# Unauthorized message when using clent certification authentification

**URL:** https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809
**Category:** Security
**Tags:** configure, security-issue
**Created:** [April 10, 2024, 3:22pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809 "2024-04-10T15:22:56Z")
**Posts on this page:** 20
**Page:** 1

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 10, 2024, 3:22pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/1 "2024-04-10T15:22:56Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

> Blockquote

**Describe the issue** :

Hello, I am trying to configure opensearch in a secure way. I have set up Opensearch and an LDAP server, now all user can connect with no issue through the dashboard.  
I also use Jenkins, so I wanted to configure client certificate athentication. I use the first certificate i configure to try connecting to opensearch node but i got an error of Unauthorized as follow :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d0de3ce1cfe1c2bbfff30a640ee98d4fe3f805bb.png)

Here is the command i run :

```auto
**elasticdump --input=kibana.json --ca root-ca.pem --cert client.pem --key client-key.pem --output=https://xxxxx.xxxx.xxxx/.kibana_2**

```

I use the same certificate that the dashboard is using but i get an error.

**Configuration** :  
Here is my configuration :

```auto
plugins.security.ssl.transport.pemkey_filepath: node1-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: node1.pem
plugins.security.ssl.http.pemkey_filepath: node1-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.http.clientauth_mode: OPTIONAL
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
          - 'CN=admin,OU=XX,O=XXXXXXX,L=XXXXX,C=XX'
plugins.security.nodes_dn:
          - 'CN=node1.xxx.x-xxxxxx,OU=XX,O=XXXXXXX,L=XXXXX,C=XX'
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
opendistro_security.audit.config.disabled_transport_categories: NONE

```

Thanks,

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 10, 2024, 3:29pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/2 "2024-04-10T15:29:10Z")

</div>

> [@maestro57](#):
>
> `plugins.security.authcz.admin_dn`

Hi @maestro57,

Is your client.pem DN included in `plugins.security.authcz.admin_dn`?

Could you please share your `config.yml`?

You might be interested in:

> **[Client certificate authentication](https://opensearch.org/docs/latest/security/authentication-backends/client-auth/#assigning-roles-to-your-common-name)**
>
> Client certificate authentication

Best,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 11, 2024, 12:56pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/3 "2024-04-11T12:56:24Z")

</div>

Hello @Mantas

That for the reactivity  
here is my config.yml

```auto
    authc:
      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop
      ldap:
        description: "Authenticate via LDAP or Active Directory"
            verify_hostnames: true
            hosts:
            - xxxxxxxxxxxxxxxxxx:xxx
            bind_dn: 'cn=admin,dc=xxxxxxxx,dc=xxx,dc=xxx'
            userbase: 'ou=XXXX,dc=xxxxxxxx,dc=xxx,dc=xxx'
            usersearch: '(uid={0})'
            username_attribute: 'uid'

```

Thanks

---

<div class="post-metadata">

### Author: ![hm21](https://avatars.discourse-cdn.com/v4/letter/h/8dc957/32.png) [@hm21](https://forum.opensearch.org/u/hm21)
#### Post date: [April 12, 2024, 8:21am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/4 "2024-04-12T08:21:02Z")

</div>

I have the same issue. Did everything that was needed to do based on the documentation but it still does not work.

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 15, 2024, 2:07am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/5 "2024-04-15T02:07:07Z")

</div>

Hello,

please, can i have some help ?

Thanks again

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 15, 2024, 10:39am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/6 "2024-04-15T10:39:51Z")

</div>

> [@maestro57](#):
>
> `username_attribute: cn `

Hi @maestro57 (same to you @hm21),

How are you assigning roles to your common name (CN)?  
Would you mind sharing your roll mapping - you can run the bellow to get roll mapping:

```auto

 curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/rolesmapping?pretty

```

> **[API](https://opensearch.org/docs/latest/security/access-control/api/#role-mappings)**
>
> API

You also might be interested in:

> **[Client certificate authentication](https://opensearch.org/docs/latest/security/authentication-backends/client-auth/#assigning-roles-to-your-common-name)**
>
> Client certificate authentication

best,  
mj

---

<div class="post-metadata">

### Author: ![hm21](https://avatars.discourse-cdn.com/v4/letter/h/8dc957/32.png) [@hm21](https://forum.opensearch.org/u/hm21)
#### Post date: [April 15, 2024, 2:07pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/7 "2024-04-15T14:07:15Z")

</div>

Hello @Mantas, I now know why it didn’t work for me.  
It was because the order of the authentication methods in `config.yml` file.

Previous config.yml file which had the wrong order of authentication methods:

```auto
---
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    do_not_fail_on_forbidden: true
    do_not_fail_on_forbidden_empty: true
    http:
      anonymous_auth_enabled: false
    authc:
      internal_auth:
        order: 0
        description: "HTTP basic authentication using the internal user database"
        http_enabled: true
        transport_enabled: true
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: internal
      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop

```

The fix was to change the order, so it looks like the following:

```auto
---
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    do_not_fail_on_forbidden: true
    do_not_fail_on_forbidden_empty: true
    http:
      anonymous_auth_enabled: false
    authc:
      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop
      internal_auth:
        order: 1
        description: "HTTP basic authentication using the internal user database"
        http_enabled: true
        transport_enabled: true
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: internal

```

the client cert authentication needs to be the authentication method with order 0 for it to work.  
If it has the order of 1 after and internal\_auth has the order of 0 then the client certificate authentication works along the basic authentication, providing two layers of security.

@Mantas is this the right approach I’m having now or does the order not matter?

Because in the documentation example ([Client certificate authentication - OpenSearch Documentation](https://opensearch.org/docs/latest/security/authentication-backends/client-auth/#assigning-roles-to-your-common-name)) the order is set to “1” for the clientcert\_auth\_domain

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 15, 2024, 2:55pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/8 "2024-04-15T14:55:23Z")

</div>

> [@hm21](#):
>
> @Mantas is this the right approach I’m having now or does the order not matter?

Yes, you are correct the order is of great importance and in your particular case the order of the `clientcert_auth_domain:` should be lower than `internal_auth:`- as it sets the authentication order.

> [@hm21](#):
>
> ` challenge: false`

`clientcert_auth_domain.http_authenticator.challenge: false ` should be disabled too in this particular case, for both authentication methods to work, as it is correctly done in your example.

Thanks for sharing @hm21.

Best,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 16, 2024, 1:10pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/9 "2024-04-16T13:10:32Z")

</div>

Hello @Mantas

Here is my rolemapping

```auto
{
  "manage_snapshots" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "snapshotrestore"
    ],
    "and_backend_roles" : []
  },
  "logstash" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "logstash"
    ],
    "and_backend_roles" : []
  },
  "kibana_user" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "kibanauser"
    ],
    "and_backend_roles" : []
  },
  "kibana_read_only" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "kibanareadonly"
    ],
    "and_backend_roles" : []
  },
  "all_access" : {
    "hosts" : [],
    "users" : [
      "*",
      "client.dns.a-record"
    ],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [],
    "and_backend_roles" : []
  },
  "readall" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "readall"
    ],
    "and_backend_roles" : []
  }
}

```

Thanks

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 16, 2024, 2:07pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/10 "2024-04-16T14:07:15Z")

</div>

> [@maestro57](#):
>
> ` username_attribute: cn`

Hi @maestro57,

What is the `CN` in the cert used for authentication?

> [@maestro57](#):
>
> ```auto
> clientcert_auth_domain:
> description: "Authenticate via SSL client certificates"
> http_enabled: true
> transport_enabled: true
> order: 1
> 
> ```

Can you confirm orders of all your authentication methods or share a full config.yml file?

Thanks,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 16, 2024, 8:34pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/11 "2024-04-16T20:34:11Z")

</div>

Hello @Mantas

Here is my CN :

```auto
CN = client.dns.a-record

```

And for the authentification order, the first one is client certificate and the second one is ldap.

Thanks a lot,

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 17, 2024, 9:35am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/12 "2024-04-17T09:35:47Z")

</div>

Hi @maestro57,

Could you run the below and share the output:

`curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/securityconfig?pretty`

Thanks,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 17, 2024, 12:12pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/13 "2024-04-17T12:12:29Z")

</div>

Bonjour @Mantas

Ici le resultat de la commande :

```auto
{
  "config" : {
    "dynamic" : {
      "filtered_alias_mode" : "warn",
      "disable_rest_auth" : false,
      "disable_intertransport_auth" : false,
      "respect_request_indices_options" : false,
      "kibana" : {
        "multitenancy_enabled" : false,
        "server_username" : "kibanaserver",
        "index" : ".kibana"
      },
      "http" : {
        "anonymous_auth_enabled" : false,
        "xff" : {
          "enabled" : false,
          "internalProxies" : "192\\.168\\.0\\.10|192\\.168\\.0\\.11",
          "remoteIpHeader" : "X-Forwarded-For"
        }
      },
      "authc" : {
        "ldap" : {
          "http_enabled" : true,
          "transport_enabled" : true,
          "order" : 2,
          "http_authenticator" : {
            "challenge" : true,
            "type" : "basic",
            "config" : { }
          },
          "authentication_backend" : {
            "type" : "ldap",
            "config" : {
              "enable_ssl" : false,
              "enable_start_tls" : false,
              "enable_ssl_client_auth" : false,
              "verify_hostnames" : false,
              "hosts" : [
                "xxxxxxxx:389"
              ],
              "bind_dn" : "cn=XXXX,dc=XXXXXXXX,dc=XXX,dc=XX",
              "password" : "XXXXXXXXXXXX",
              "userbase" : "ou=Users,dc=XXXXXXXXX,dc=XXX,dc=XXX",
              "usersearch" : "(uid={0})",
              "username_attribute" : "uid"
            }
          },
          "description" : "Authenticate via LDAP or Active Directory"
        },
        "clientcert_auth_domain" : {
          "http_enabled" : true,
          "transport_enabled" : true,
          "order" : 1,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "clientcert",
            "config" : {
              "username_attribute" : "cn"
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via SSL client certificates"
        }
      },
      "authz" : { },
      "auth_failure_listeners" : { },
      "do_not_fail_on_forbidden" : false,
      "multi_rolespan_enabled" : true,
      "hosts_resolver_mode" : "ip-only",
      "do_not_fail_on_forbidden_empty" : false
    }
  }
}

```

Merci d’avance,

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 17, 2024, 1:02pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/14 "2024-04-17T13:02:19Z")

</div>

all looks in order.

Could you also run the below:

`curl --insecure --cacert root-ca.pem --cert client.pem --key client-key.pem -H "Content-Type:application/json" -XGET https://localhost:9200/_plugins/_security/authinfo?pretty`

One more thing, can you try with ` --cacert` instead of ` --ca`

> [@maestro57](#):
>
> ` **elasticdump --input=kibana.json --ca root-ca.pem --cert client.pem --key client-key.pem --output=https://xxxxx.xxxx.xxxx/.kibana_2** `

Best,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 17, 2024, 2:14pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/15 "2024-04-17T14:14:57Z")

</div>

i try the following command :

```auto
curl --insecure --cacert root-ca.pem --cert client.pem --key client-key.pem -H "Content-Type:application/json" -XGET https://xxxxxxxx:9200/_plugins/_security/authinfo?pretty

```

but got an **Unauthorized**.

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 17, 2024, 2:54pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/16 "2024-04-17T14:54:49Z")

</div>

Could you share the output of:

```auto

openssl x509 -noout -subject -in client.pem

```

Best,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 17, 2024, 6:48pm UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/17 "2024-04-17T18:48:42Z")

</div>

Here is the output :

```auto
subject=C = FR, L = PARIS, O = XXXXXXX, OU = IT, CN = client.dns.a-record

```

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 18, 2024, 9:50am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/18 "2024-04-18T09:50:28Z")

</div>

> [@maestro57](#):
>
> `subject=C = FR, L = PARIS, O = XXXXXXX, OU = IT, CN = client.dns.a-record`

Could you please add the subject to your `plugins.security.authcz.admin_dn:` to test your cert:

```auto
plugins.security.authcz.admin_dn:
          - 'CN=admin,OU=XX,O=XXXXXXX,L=XXXXX,C=XX'
          - 'CN=client.dns.a-record,OU=IT,O=XXXXXXX,L=PARIS,C=FR'

```

best,  
mj

---

<div class="post-metadata">

### Author: ![maestro57](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@maestro57](https://forum.opensearch.org/u/maestro57)
#### Post date: [April 18, 2024, 10:18am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/19 "2024-04-18T10:18:21Z")

</div>

I did as you told me, but i still get the same error :

```auto
Thu, 18 Apr 2024 10:18:00 GMT | starting dump
Thu, 18 Apr 2024 10:18:00 GMT | got 89 objects from source file (offset: 0)
Thu, 18 Apr 2024 10:18:00 GMT | Error Emitted => Unauthorized
Thu, 18 Apr 2024 10:18:00 GMT | Error Emitted => Unauthorized
Thu, 18 Apr 2024 10:18:00 GMT | Total Writes: 0
Thu, 18 Apr 2024 10:18:00 GMT | dump ended with error (get phase) => UNAUTHORIZED: Unauthorized

```

Thanks,

---

<div class="post-metadata">

### Author: ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)
#### Post date: [April 18, 2024, 10:24am UTC](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809/20 "2024-04-18T10:24:46Z")

</div>

Did you reboot your cluster after updating the config file (opensearch.yml)?

How did you generate your certificates?

Please try the below:

> **[Generating self-signed certificates](https://opensearch.org/docs/latest/security/configuration/generate-certificates/#generate-an-admin-certificate)**
>
> Generating self-signed certificates

best,  
mj

[Next page](https://forum.opensearch.org/t/unauthorized-message-when-using-clent-certification-authentification/18809.md?page=2)