Tenant setting after timeout

OpenSearch Dashboards
1

Versions (relevant - OpenSearch Dashboards v2.11.1 on Ubuntu 22.04 using Firefox 123.0.1 on MacOS 14.3.1):

I log in to Opensearch and choose a dashboard to view. If I do not interact with Opensearch for some time than my login seems to be timed out … the dashboard is not responsive and so I have to login again. When I log in after a timeout, my dashboard is no longer selected or available, apparently because the tenant has changed. If I use ‘Switch Tenant’ and choose the ‘Global’ tenant I can see and use the dashboards.

Note that we are not using multi-tenancy … everything is in the Global tenant, but it seems that after a timeout I get switched to the Private tenant, which has no content.

Is this expected behavior? Is there a way to configure the Opensearch Dashboards so that Global tenant is the default even after a timeout?

Any information or troubleshooting advice appreciated.

2

Hi @dxturner,

Could you share your ../config/opensearch.yml, ../config/opensearch-security/config.yml and your ..config/opensearch_dashboards.yml?

You can disable multi-tenancy in your ..config/opensearch_dashboards.yml with opensearch_security.multitenancy.enabled: false if you don’t use it or set opensearch_security.multitenancy.tenants.preferred: ["Global"] as your default tenancy.

Please see more here: Multi-tenancy configuration - OpenSearch Documentation

Best,
mj

3

server.port: 5601
server.host: “0.0.0.0”
server.maxPayloadBytes: 8388608
server.name: “*****-****”
opensearch.hosts: [“https://127.0.0.1:9200”]
opensearch.username: ***********
opensearch.password: ***********
server.ssl.enabled: true
server.ssl.certificate: /etc/opensearch-dashboards/osdnode.pem
server.ssl.key: /etc/opensearch-dashboards/osdnode-key.pem
server.ssl.certificateAuthorities: /etc/opensearch-dashboards/root-ca.pem
opensearch.ssl.verificationMode: none
opensearch.requestTimeout: 132000
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
opensearch.shardTimeout: 120000
logging.quiet: true
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: false

As you can see the ‘preferred’ lists both Private and Global … will setting it to only Global prevent from reverting to private? Or should we configure it as [Global, Private] so that Global is first in the list?

I do appreciate the reply and help.

4

Hi @dxturner,

If I understand it correctly you want your users to be defaulted to Global tenant, in this case, set opensearch_security.multitenancy.tenants.preferred: [Global], users will be able to change the tenancy if needed, and if permission allows once logged in to the UI.

best,
mj

5

Review the session timeout setting in openssh to ensure ensure they are configured properly. If the timeout is slow, it may cause the session expire permanently.

6

Besides updating opensearch_dashboards.yml file , you can turn on/off multi-tenancy dynamic with visit http://localhost:5601/app/security-dashboards-plugin#/tenants (replace host with your own host)

image
image1350×1524 195 KB