"statusCode":401 while redirecting back to opensearch-dashboard using OIDC

Security
,
1

**On behalf of a user of Slack **

"
I have configured OIDC, which gets past the sign-in part but on the redirect back to opensearch-dashboard i get this {"statusCode":401,"error":"Unauthorized","message":"Unauthorized"}
current configs:

      opensearch.ssl.verificationMode: none
      opensearch.requestHeadersWhitelist: '["Authorization", "securitytenant"]'
      opensearch_security.multitenancy.enabled: "true"
      opensearch_security.multitenancy.tenants.preferred: '["Private", "Global"]'
      opensearch_security.auth.multiple_auth_enabled: "true"
      opensearch_security.auth.type: '["openid","basicauth"]'
      opensearch_security.openid.connect_url: "https://login.microsoftonline.com/REDACTED/v2.0/.well-known/openid-configuration"
      opensearch_security.openid.client_id: "REDACTED"
      opensearch_security.openid.client_secret: "${OPENID_CLIENT_SECRET}"
      opensearch_security.openid.scope: "openid profile email"
      opensearch_security.openid.base_redirect_url: https://opensearch.example.com/

config.yml


    _meta:
      type: "config"
      config_version: "2"
    config:
      dynamic:
        http:
          anonymous_auth_enabled: false
        authc:
          basic_internal_auth_domain:
            http_enabled: true
            transport_enabled: true
            order: "4"
            http_authenticator:
              type: basic
              challenge: true
            authentication_backend:
              type: intern
          openid_auth_domain:
            order: 6
            http_enabled: true
            transport_enabled: true
            http_authenticator:
              type: openid
              challenge: false
              config:
                enable_ssl: true
                verify_hostnames: true
                subject_key: preferred_username
                roles_key: groups
                openid_connect_url: https://login.microsoftonline.com/REDACTED/v2.0/.well-known/openid-configuration
            authentication_backend:
              type: noop

"

2

@Mantas

What is he using for OIDC? I am familar with Keycloak.

  • Okta
  • Keycloak
  • Auth0
  • Connect2ID
  • Salesforce
  • IBM OpenID Connect
3

We are using Azure AD App.

4

@ctenberge Have you set app roles in App registrations and assigned them to the user in Enterprise applications?

Also, when you use app roles, your roles_key must be set to roles instead of groups.

5

@ctenberge Were you able to resolve the issue ?

6

Yes, I believe @pablo 's suggestion resolved my issue.