# Unauthorized error 401 while accessing app using sso oidc

**URL:** <https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703>\
**Category:** OpenSearch\
**Tags:** security-issue\
**Created:** [December 5, 2024, 5:45pm UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703 "2024-12-05T17:45:17Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 5, 2024, 5:45pm UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/1 "2024-12-05T17:45:17Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Hey , can someone provide me config of oidc through opensearch I am just setting values in config and dashboard not certificate nothing but getting unauthorised error  
Can someone give me conf of

1. Dashboard
2. Opensearch
3. Role and role map
4. Claims I have roles which i changed to access and admin still not luck
5. 
6. 

**Describe the issue** :

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [December 5, 2024, 5:48pm UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/2 "2024-12-05T17:48:15Z")

</div>

Have you checked here:

> **[GitHub - opensearch-project/helm-charts: :wheel\_of\_dharma: A community repository for Helm...](https://github.com/opensearch-project/helm-charts)**
>
> :wheel\_of\_dharma: A community repository for Helm Charts of OpenSearch Project.

Best,  
mj

---

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 6, 2024, 4:15am UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/3 "2024-12-06T04:15:43Z")

</div>

Thanks @Mantas

I have this conf for opensearch\_dashboard

```auto
config: 
  # Default OpenSearch Dashboards configuration from docker image of Dashboards
  opensearch_dashboards.yml: |
    opensearch_security.auth.type: ["openid","basicauth"]
    opensearch.username: "kibanaserver"
    opensearch.password: "kibanaserver"
    opensearch_security.auth.multiple_auth_enabled: true
    # Disable SSL verification when using self-signed demo certificates
    # allowlist basic headers and multi-tenancy header
    opensearch.requestHeadersAllowlist: ["Authorization", "securitytenant"]
    opensearch.ssl.verificationMode: none
    opensearch_security.openid.base_redirect_url: https://test.opensearch.com
    opensearch_security.openid.client_id: secrettt_id
    opensearch_security.openid.client_secret: secrettt
    opensearch_security.openid.scope: "openid email roles"
    opensearch_security.openid.connect_url: myidp/.well-known/openid-configuration

```

for opensearch i have this

```auto

dataComplete: false
    data: 
      config: |-
        _meta:
          type: "config"
          config_version: 2
        config:
          dynamic:
            http:
              anonymous_auth_enabled: false
            authc:
              basic_internal_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 0
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  type: internal
              openid_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 1
                http_authenticator:
                  type: openid
                  challenge: false
                  config:
                    subject_key: email
                    roles_key: roles
                    openid_connect_url: myidp/.well-known/openid-configuration
                authentication_backend:
                  type: noop
    
      # config.yml: |-
      # internal_users.yml: |-
      #roles.yml:

      roles_mapping.yml: |-
        custom_role:
          reserved: false
          users:
          - "*"

```

but i am getting unauthorized while trying to access app via sso

even i requesting for roles claim checked  
jwt looks like below

id{  
“[email":"test@example.com](mailto:email%22:%22test@example.com)”,  
“roles”:“admin”  
}  
tried with other roles “custome\_role” as this key in role mapping

i am running opensearch behind the nginx reverse proxy  
nginx is passing traffic to svc of dashboard

---

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 6, 2024, 5:19am UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/4 "2024-12-06T05:19:02Z")

</div>

I tried with below conf as well

```auto
_meta:
  type: "roles"
  config_version: 2

admin:
  reserved: false
  hidden: false
  cluster_permissions:
    - "cluster_all"
  index_permissions:
    - index_patterns:
        - "*"
      allowed_actions:
        - "index_all"

user:
  reserved: false
  hidden: false
  cluster_permissions:
    - "cluster_composite_ops_ro"
  index_permissions:
    - index_patterns:
        - "*"
      allowed_actions:
        - "read"
        - "search"

```

```auto
_meta:
  type: "rolesmapping"
  config_version: 2

admin:
  reserved: false
  hidden: false
  backend_roles:
    - "admin"
  hosts: []
  users:
    - "admin"

```

but no luck

---

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 7, 2024, 5:28am UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/5 "2024-12-07T05:28:29Z")

</div>

Hey @Mantas or @pablo can you please give some clue ?

---

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 7, 2024, 6:03pm UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/6 "2024-12-07T18:03:21Z")

</div>

Hey @Mantas @pablo , can you please help me for debugging this issue ?

---

<div class="post-metadata">

**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\
**Post date:** [December 7, 2024, 6:30pm UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/7 "2024-12-07T18:30:32Z")

</div>

this is my token id

{  
“email\_verified”: true,  
“iat”: 1733596079,  
“iss”: “testidp”,  
“aud”: “ad8fbebedd8400c6188eadde1db9a18b”,  
“acr”: “1”,  
“sid”: “\_da\_0fvqNh3AE8sXaQnrDLFx4e09cBAWp\_TX13pu7DDhIc1eyUeyFnlTx0MxBkRDdizcCbrfvYLvDP8a4AhardBwT-lPu-fdfdsfdsfdsfs-AzCV4FsooHzWu9s”,  
“at\_hash”: “NDhH77aEmN\_JBIs4W580SQ”,  
“exp”: 1733596389,  
“sub”: “29c9058f31c8bd06d6dcd497c7454545454563bb3ac77e9762e49a89f57a85”,  
“email”: “[onk@test.com](mailto:onk@test.com)”,  
“roles”: “admin”  
}

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [December 10, 2024, 10:48am UTC](https://forum.opensearch.org/t/unauthorized-error-401-while-accessing-app-using-sso-oidc/22703/8 "2024-12-10T10:48:52Z")

</div>

@ochavan, to confirm are you using charts or the operator?

Could you execute the below and share the output:

```auto

curl --insecure --cert <path/to/admin/cert.pem> --key <path/to/admin_key.pem> -XGET https://<OS_node>:9200/_plugins/_security/api/securityconfig?pretty

```

admin cert as per `plugins.security.authcz.admin_dn:`

Best,  
mj