# SSLconfigException Error

**URL:** <https://forum.opensearch.org/t/sslconfigexception-error/15770>\
**Category:** OpenSearch\
**Tags:** troubleshoot\
**Created:** [September 5, 2023, 12:07pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770 "2023-09-05T12:07:41Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 5, 2023, 12:07pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/1 "2023-09-05T12:07:41Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

**Describe the issue** :

Hi Team,  
Am integrating opensearch and keycloak with openid.

Opensearch throws an error like unable to load the pemtrustedcas\_filepath: /usr/share/opensearch/config/data/openid-certs.

**Configuration** :

authc:  
basic\_internal\_auth\_domain:  
http\_enabled: true  
transport\_enabled: true  
order: 0  
http\_authenticator:  
type: basic  
challenge: false  
authentication\_backend:  
type: internal  
openid\_auth\_domain:  
http\_enabled: true  
transport\_enabled: true  
order: 1  
http\_authenticator:  
type: openid  
challenge: false  
config:  
enable\_ssl: true  
verify\_hostnames: false  
enable\_ssl\_client\_auth: true  
pemtrustedcas\_filepath: /usr/share/opensearch/config/certs/openid-certs  
openid\_connect\_url: https://\<[https://195.xxx.xxx.xxx.sslip.io/auth/realms/realm/.well-known/openid-configuration](https://195.xxx.xxx.xxx.sslip.io/auth/realms/realm/.well-known/openid-configuration)  
subject\_key: preferred\_username  
roles\_key: roles  
authentication\_backend:  
type: noop  
**Relevant Logs or Screenshots** :  
at java.lang.Thread.run(Thread.java:833) [?:?]  
Caused by: java.security.cert.CertificateException: No certificate data found  
at sun.security.provider.X509Factory.parseX509orPKCS7Cert(X509Factory.java:456) ~[?:?]  
at sun.security.provider.X509Factory.engineGenerateCertificates(X509Factory.java:356) ~[?:?]  
at java.security.cert.CertificateFactory.generateCertificates(CertificateFactory.java:480) ~[?:?]  
at org.opensearch.security.support.PemKeyReader.loadCertificatesFromFile(PemKeyReader.java:279) ~[opensearch-security-2.8.0.0.jar:2.8.0.0]  
at com.amazon.dlic.util.SettingsBasedSSLConfigurator.initFromPem(SettingsBasedSSLConfigurator.java:236) ~[opensearch-security-2.8.0.0.jar:2.8.0.0]  
… 22 more  
[2023-09-05T09:25:56,139][WARN][o.o.s.s.ReflectionHelper] [my-cluster1-masters-0] Unable to enable ‘com.amazon.dlic.auth.http.jwt.keybyoidc.HTTPJwtKeyByOpenIdConnectAuthenticator’ due to java.lang.reflect.InvocationTargetException  
[2023-09-05T09:25:56,147][ERROR][o.o.s.s.DynamicConfigModelV7] [my-cluster1-masters-0] Unable to initialize auth domain openid\_auth\_domain=AuthcDomain [http\_enabled=true, transport\_enabled=true, order=1, http\_authenticator=HttpAuthenticator [challenge=false, type=openid, config={openid\_connect\_idp={enable\_ssl=true, verify\_hostnames=false, pemtrustedcas\_filepath=/usr/share/opensearch/config/certs/openid-certs}, subject\_key=preferred\_username, roles\_key=roles, openid\_connect\_url=[https://xxx.xxx.xxx.xxx.sslip.io/auth/realms/nha/.well-known/openid-configuration}]](https://xxx.xxx.xxx.xxx.sslip.io/auth/realms/nha/.well-known/openid-configuration%7D%5D), authentication\_backend=AuthcBackend [type=noop, config={}], description=null] due to OpenSearchException[java.lang.reflect.InvocationTargetException]; nested: InvocationTargetException; nested: RuntimeException[com.amazon.dlic.util.SettingsBasedSSLConfigurator$SSLConfigException: Error loading PEM from /usr/share/opensearch/config/certs/openid-certs (openid\_connect\_idp.pemtrustedcas\_filepath) for openid\_connect\_idp.]; nested: SSLConfigException[Error loading PEM from /usr/share/opensearch/config/certs/openid-certs (openid\_connect\_idp.pemtrustedcas\_filepath) for openid\_connect\_idp.]; nested: CertificateException[No certificate data found];  
org.opensearch.OpenSearchException: java.lang.reflect.InvocationTargetException  
at org.opensearch.security.support.ReflectionHelper.instantiateAAA(ReflectionHelper.java:73) ~[opensearch-security-2.8.0.0.jar:2.8.0.0]

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 5, 2023, 10:21pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/2 "2023-09-05T22:21:23Z")

</div>

> [@Tamilkumar](#):
>
> RuntimeException[com.amazon.dlic.util.SettingsBasedSSLConfigurator$SSLConfigException: Error loading PEM from /usr/share/opensearch/config/certs/openid-certs

You must provide a file name and not a folder name. If you have more than one CA then you must concatenate them in one single file.

> **[Configuring TLS certificates](https://opensearch.org/docs/latest/security/configuration/tls/#rest-layer-tls)**
>
> Configuring TLS certificates

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 6, 2023, 6:09am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/3 "2023-09-06T06:09:27Z")

</div>

> [@pablo](#):
>
> You must provide a file name and not a folder name. If you have more than one CA then you must concatenate them in one single file.
> 
> [Configuring TLS certificates | OpenSearch Documentation](https://opensearch.org/docs/latest/security/configuration/tls/#rest-layer-tls)

Hi @pablo

The file path ending with openid-certs is a file which has PEM, Certificate and keys which is concatenated into one file. Still the issue persists.

Note: Am using opensearch operator in the k8s environment.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 6, 2023, 8:24am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/4 "2023-09-06T08:24:45Z")

</div>

@Tamilkumar How did you mount that certificate?

---

<div class="post-metadata">

**Author:** ![jaboo](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jaboo](https://forum.opensearch.org/u/jaboo)\
**Post date:** [September 6, 2023, 9:03am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/5 "2023-09-06T09:03:25Z")

</div>

My understanding is that ‘pemtrustedcas\_filepath’ only needs to contain your trusted CA cert (or concatenate more than one if you have many), but you don’t need to concatenate any other certs or keys into it.

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 6, 2023, 10:14am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/6 "2023-09-06T10:14:44Z")

</div>

Hi @pablo

Openid-certs mentioned in the file path has been fetched from the keycloak .(wget [https://xxx.xxx.xxx.xxx.sslip.io/auth/realms/](https://xxx.xxx.xxx.xxx.sslip.io/auth/realms/)/protocol/openid-connect/certs) Since its a n operator i have created a configmap and appended as additional volume sections in opensearch.yaml file.

config.yaml  
apiVersion: v1  
data:  
openid-certs: '{“keys”:[{“kid”:“1qGlXsK7PC-H6-EFQ8fP69uJMpfXh\_EP1TTP4xtuIrw”, “kty”: “RSA”, “alg”: “RSA-OAEP”, “use”: “enc”, “n”: “rykU\_GBbcZ7P JM5hHviq3Modu-7iuRImn2aubVp\_l2shMBLWC6E91DVVLSTD73V37FCHVxPEn980cUmHME-CK80JXrYHK4dPQ1Ho0e9WFgQL5GUKTfIqZabP1rnFvncYHvnHJGh6Jyts 98PNP4tBU pJEHbuE7Z5f2tBLrF6dkx5ivp7NEXps9JsD6VTwiTm2A\_cfEWPEZBGgtUpcAeNIAZNqrixq4NiGPtX1j ink ims QCS BQmvhLtHaOPL jonkkPAXWD3Vtq-wdf-JRkoP1mBZS 34EU31T s1tDFKAETX6pK-lqbPSib-bvTmGSqRnjHttEUAoAtaJUU0ac6e2nxQ4w”, “e”: “AQAB”, “x5c”: [“MIICLTCCAX0CBgGItGYiljANBgkqhkiG9w0BAQS FADAOMQWWCgYDVQQDDANu aGEwHhcNMjMwNjEzMTA1NDMyWhcNMzMwNjEzMTA1NjEyWjAOMQwwCgYDVQQDDANuaGEwggE iMA0GCSqGSIb3DQEBAQUAA4IBDWAwggEKAoIBAQCVKRT8YFtxns 8kzmEe+Krcyh277  
UK5EiafZq5tWn+XZKEWE VALOT3UNW8tJMPvdXfsUIe/E85f3w5XSYcwT4IrzQnGtgcrh09DUejR71YWBAVkZQpN8 iplps/WucW+dxge+cckaHonK2z3w80/10FSkkQdu4Ttnl/a0E us Xp2THmK+ns@Remz @mwPpVPCJ0bYD9X8RY8RkEaC1slwB40gBk2quLGrg21Y+1fWOKeSKaxAKWFCa+Eu0do48uM6e5Q8DFYPdW2r7B1/41GSg/WYFmzfgRTEVOZWOMUOARNfqkr6 Wps9KJv5u90YZKpGeMe20RQCgC10LRTRpzp7afFDjAgMBAAEWDQYJKoZIhvcNAQEL BQADggEBAEo+t06vbFXR98f0xj FZRD6RLQFpup imKzGlSGOKjjcPgTzNTADOwm1PZ9lb/BXC  
wS4JJHJHhjsdjIgQIrnS3Y7tYbIgD68/8cFcbHSCqYo8gSooGp5cGgJdpSS/bbsb700edTGZFQTlLKHBUjseRbZ9orjMlIMalaTN2dSbFcr53H5b1NngxE3ZTJ2YgRBL5wbme3kVT Rww/2v/gCJ5HRytefLE4YY6Uz2LBd+4Q+uUoIzuzIz6hbJ+IeIxYFd3pF6x7ln0wIjxgiv+UDjsxqdamdmHRDeZcrFzKn2MZXSwxaJXiYe0Df+o/kxxkbQxdj CymPKOUJF762mQm+ F1hKA=”],“x5t”:“35laLNBNqn-cHwv3fxiLCKW-zj0”, “x5t#S256”: “R9zN7Uz7tCkCHtX470jnyiopcf8K fnBY1wKwDBCP5nk”}, { “kid”:“UAGGhgB005pY649QTr-0J8XVqn 1YKBONE 31bsP8dVhc”, “kty”: “RSA”, “alg”: “RS256”, “use”: “sig”, “n”: “rgMc Vs XunPi2fKiwetaAKbvslTg6zhyiINleMOzYni82ows OfrcIGLIMhdH2qFib2dvNg81aJwT CPXK8WdUS6362q2hj HuYihBvwZ4PAJDIFXQG-DOO\_KVtnGhA2qbaN3nkLtPOCdjuQWuh8eEus-Dp422HLxrP70UW2PSBguVjr5zjS4IQR7ipLpUpxdzoulik JQZYGXQh9NPutQZ\_6 3qaZF\_3di\_W6UFmlTEzCjg0G\_uANy7qIdDxAPFj-\_tiMs 9ozT-ODIAIg\_Q5ekDevTv59RFkIqh27ofWpKH1g8f0KhEKbгL3JDpa1roLBQnWoodwelv1HXGcVJLEU7Ziv9w”, “e”:" AQAB",“x5”:[“MIICLTCCAX0CBgGItGYhIzANBgkqhkiG9w0BAQS FADAOMQwwCgYDVQQDDANuaGEwHhcNMjMwNjEzMTA1NDMyWhcNMzMwNjEzMTA1NjEyWjAOMQwwCgYDVQQDDAN  
uaGEwggE iMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCuAxxWxe6c+LZ8qJZ610Apu9KVODгOHKIg2V4w7Nielzahaw5+twgaIgyFofaoWJvZ282Dz  
VonBMI/ErXZ1RLrfrar  
aGMe5 LKEG/Bng8AkMh9dAb4M7T+RW2caEDapto3eeQu084J205Ba6Hx4S6z40njbYcvGs/vRRbY9IGC5W0vnONLghBHukkulSnF1k5SWKQlDNgbFCH00+61Bn/reppkX/d2L9bpQw aVMTMK0DQb+4A3Luoh@PEA8WP7+21yz2jNP7QMgAiD9Dl6QN690/n1EWQiqHbuh9ak ofWDx84qEQpus vck0lrwugs FCdag51bSW/UfEZXUks57tmk/3AgMBAAEWDQYJKoZIhvcNAQ ELBQADggEBAAVCYoHPcSb6J1T7mZqw+x7xbcA6HLYOj Ad1wQgpts SkAf0+n+ovp/T58tpAfaV5YipoZFto5fyXzKf6kMmQj vknVrr Fh+F6UTImTKiRflrQ6K6cHkghSyZ9lENOq5j 31mUyD7yqAANvaIQPCNZVpW0Xb2fqz7tdXSaanTkJ1i/Tuk0Y14mJqjYXRZYVKA 1Toz dUaBcDyt23ELHixBs 28Wl1CnQVHLoJj0jYrqt0wbYpeAXdI ic5c+0dVt1C+kM28rwmTOwu m7sgNUseW53cSZJnbVCLHPPCydJ+iLTdUnNevBfLEBg0nshGj7iwJipUaUp9mF7Wegk6wtVoIE3fT74=”],“x5t”: “u7seUrRxe6txc5gkMZiyas qviCI”, “x5t#S256”:“NaOiGy  
XXynLZbNz7ieb\_FKrnregWujbdhvgo561SbTU”}]}  
kind: ConfigMap  
metadata:  
name: openid-certs

opensearch.yaml

kind: OpenSearchCluster  
metadata:  
name: my-cluster1  
namespace: opensearch  
spec:  
security:  
config:  
adminCredentialsSecret:  
name: a-admin-credentials-secret  
securityConfigSecret:  
tls:  
name: a-securityconfig-secret  
transport:  
generate: true  
http:  
generate: true  
general:  
serviceName: my-cluster1 version: 2.8.0  
pluginsList: [“repository-s3”] drainDataNodes: true  
setVMMaxMapCount: true  
additional volumes:

- name: openid-certs  
path: /usr/share/opensearch/config/certs/ configMap:  
name: openid-certs  
restartPods: true

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 6, 2023, 10:34pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/7 "2023-09-06T22:34:06Z")

</div>

@Tamilkumar The mapping in the OpenSearch cluster object looks correct.  
However, your configmap is not.

I’ve tested Opster deployment with configmap containing the keycloak certificate and all worked.

Your configmap should look similar to the below one.

```auto
kubectl get configmap keycloak-cert -o yaml
apiVersion: v1
data:
  keycloak.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDoTCCAomgAwIBAgIEOa2AUjANBgkqhkiG9w0BAQsFADBtMQswCQYDVQQGEwJJ
    RTENMAsGA1UECBMEQ29yazENMAsGA1UEBxMEQ29yazENMAsGA1UEChMEQ29yazER
    ...
    U/JlUrz+Ht8MOSsJtIeo/bntvoHqSYJvV5GNSzRZs19VMeIgip3+qLM6sH9i70lU
    EW0ylLohWz3rwwF0U5D5wEBfqZnv
    -----END CERTIFICATE-----
kind: ConfigMap
metadata:
  creationTimestamp: "2023-09-06T22:01:42Z"
  name: keycloak-cert
  namespace: default
  resourceVersion: "125660"
  uid: 1f06d842-9ede-4f01-bd7b-a631b95f046a

```

I’ve created my configmap with the following command.

```auto
kubectl create configmap keycloak-cert --from-file ./keycloak.crt

```

This is my OpenSearch cluster yaml.

```auto
apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: my-cluster1
  namespace: default
spec:
  security:
    config:
      adminCredentialsSecret:
        name: a-admin-credentials-secret
      securityConfigSecret:
        name: a-securityconfig-secret
    tls:
      transport:
        generate: true
      http:
        generate: true
  general:
    serviceName: my-cluster1
    version: 2.9.0
    pluginsList: ["repository-s3"]
    drainDataNodes: true
    setVMMaxMapCount: true
    additionalVolumes:
    - name: keycloak-cert-os-secret
      path: /usr/share/opensearch/config/certs/
      configMap:
         name: keycloak-cert

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 6, 2023, 10:55pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/8 "2023-09-06T22:55:50Z")

</div>

@Tamilkumar pemtrustedcas\_filepath in openid configuration in config.yml must contain either signing certificate of the IDP (keycloak) or IDP certificate.

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 19, 2023, 11:14am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/9 "2023-09-19T11:14:08Z")

</div>

@pablo

Even my folder structure certs worked out the thing i missed is the mapper section. which sorted out the issue.

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 19, 2023, 11:26am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/10 "2023-09-19T11:26:34Z")

</div>

@pablo ,

I wanted my opensearch dashboard to configure in ssl mode authentication . To achieve this i’ve add the tls configs in the dashboard.yml but its not working as expected.

opensearch-keycloak authentication works out but from keycloak to opensearch dashboard its not working out. pls help what am i missing?

I’ve mentioned th e yaml file below:

dashboards:  
additionalConfig:  
logging.verbose: “true”  
opensearch\_security.auth.type: ‘[“basicauth”, “openid”]’  
opensearch\_security.auth.multiple\_auth\_enabled: “True”  
opensearch\_security.openid.connect\_url: [https://xx.xxx.xxx.xx.sslip.io/auth/realms/xxx/.well-known/openid-configuration](https://xx.xxx.xxx.xx.sslip.io/auth/realms/xxx/.well-known/openid-configuration) opensearch\_security.openid.base\_redirect\_url:[https://xxx.dev26.xxx.com/](https://xxx.dev26.xxx.com/)  
opensearch\_security.openid.client\_id: grafana  
opensearch\_security.openid.scope: openid profile email  
opensearch\_security.openid.client\_secret:  
opensearch\_security.openid.header: Authorization  
opensearch\_security.openid.trust\_dynamic\_headers: “true”  
opensearch.optimizedHealthcheckId: “my-cluster1”  
opensearch\_security.openid.verify\_hostnames : “false”  
opensearch.ssl.verificationMode: none  
opensearch\_security.cookie.secure: “false”  
opensearch.requestHeaders Whitelist: |  
[“securitytenant”, “Authorization”, “security\_tenant”]  
opensearch\_security.readonly\_mode.roles: [“kibana\_user”, “readall”]’  
opensearchCredentialsSecret:  
name: a-admin-credentials-secret  
enable: true  
tls:  
enable: true  
generate: true  
version: 2.8.0  
replicas: 1

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [September 27, 2023, 9:40am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/11 "2023-09-27T09:40:17Z")

</div>

Hi @pablo

Your suggestion will help me to move fwd.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 6, 2023, 1:49am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/12 "2023-10-06T01:49:52Z")

</div>

@Tamilkumar What exactly do you see? Are you getting redirected to the Keycloak’s login page?

You need to point OpenSearch Dashboards to Keycloak’s self-signed certificate in opensearch\_dashboards.yml

```auto
opensearch_security.openid.root_ca: "/usr/share/opensearch-dashboards/config/keycloak.crt"

```

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [December 14, 2023, 4:39am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/13 "2023-12-14T04:39:29Z")

</div>

HI @pablo ,

Would like to thank you for the solutions and discussions provided to me during my deployments.

Am trying to setup key Cloak saml federation with OpenID authorization in the OpenSearch level but am facing an issue at the opensearch dashboard end like

Error Failed to obtain the endpoints from IDP.

Set up details  
Key Cloak federation setup:  
I’ve two key Cloak set it up locally named as central-key Cloak and local-key Cloak.

central-key Cloak is the one which needs to authorize the user when an user access from local-Key Cloak

The parameters required to achieve the setup is IDP at key Cloak-local end and Client id at key Cloak-central end. with saml authentication.

The parameters needed for the above task is IDP URL, ClientID and OpenSearch dashboard url for redirection.

dashboard config:  
dashboards:  
additionalConfig:  
logging.verbose: “true”  
opensearch\_security.auth.type: ‘[“basicauth”, “openid”]’  
opensearch\_security.auth.multiple\_auth\_enabled: “True”  
opensearch\_security.openid.connect\_url: [https://xx.xxx.xxx.xx.sslip.io/auth/realms/xxx/.well-known/openid-configuration](https://xx.xxx.xxx.xx.sslip.io/auth/realms/xxx/.well-known/openid-configuration) opensearch\_security.openid.base\_redirect\_url:[https://xxx.dev26.xxx.com/](https://xxx.dev26.xxx.com/)  
opensearch\_security.openid.client\_id: grafana  
opensearch\_security.openid.scope: openid profile email  
opensearch\_security.openid.client\_secret:  
opensearch\_security.openid.header: Authorization  
opensearch\_security.openid.trust\_dynamic\_headers: “true”  
opensearch.optimizedHealthcheckId: “my-cluster1”  
opensearch\_security.openid.verify\_hostnames : “false”  
opensearch.ssl.verificationMode: none  
opensearch\_security.cookie.secure: “false”  
opensearch.requestHeaders Whitelist: |  
[“securitytenant”, “Authorization”, “security\_tenant”]  
opensearch\_security.readonly\_mode.roles: [“kibana\_user”, “readall”]’  
opensearchCredentialsSecret:  
name: a-admin-credentials-secret  
enable: true  
tls:  
enable: true  
generate: true  
version: 2.8.0  
replicas: 1

Please share me the documents or configs or suggestions from ur end on how to achieve this or solve the dasjboard error(unable to find endpoint from idp)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [December 14, 2023, 10:14am UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/14 "2023-12-14T10:14:43Z")

</div>

@Tamilkumar Just to clarify.  
You’d like to authenticate with SAML and authorize with OpenID using the OpenSearch security plugin, is that correct?

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [December 14, 2023, 2:51pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/15 "2023-12-14T14:51:41Z")

</div>

HI @pablo ,

Exactly the same.

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [December 14, 2023, 2:55pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/16 "2023-12-14T14:55:07Z")

</div>

@pablo

say for example in my scenario when i access the OpenSearch dashboard it should redirect to key Cloak-local first(idp)for authentication and then it should redirect to key Cloak-central (Client-id)for authorization.

Meaning two single sign on redirections has to happen

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [December 14, 2023, 3:17pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/17 "2023-12-14T15:17:32Z")

</div>

@Tamilkumar Unfortunately OpenSearch and OpenSearch Dashboards don’t have such functionality.  
You can configure multiple authentication types with OpenSearch and OpenSearch Dashboards but this only allows you to use one authentication type at a time.

> **[Configuring sign-in options](https://opensearch.org/docs/latest/security/configuration/multi-auth/)**
>
> Configuring Dashboards sign-in for multiple authentication options

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [December 14, 2023, 4:04pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/18 "2023-12-14T16:04:07Z")

</div>

@pablo ,

I tried configuring multiple sign on with the order 0 order 1 and so on but its not meeting my requirements.

Thats bad luck for me that OpenSearch doesn’t have this functionality.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [December 14, 2023, 6:34pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/19 "2023-12-14T18:34:13Z")

</div>

@Tamilkumar I can only suggest opening a feature request in the [OpenSearch security GitHub](https://github.com/opensearch-project/security/issues).

---

<div class="post-metadata">

**Author:** ![Tamilkumar](https://avatars.discourse-cdn.com/v4/letter/t/eb9ed0/32.png) [@Tamilkumar](https://forum.opensearch.org/u/Tamilkumar)\
**Post date:** [December 15, 2023, 4:56pm UTC](https://forum.opensearch.org/t/sslconfigexception-error/15770/20 "2023-12-15T16:56:58Z")

</div>

@pablo  
Thanks for your suggestion and Support.

[Next page](https://forum.opensearch.org/t/sslconfigexception-error/15770.md?page=2)