# Auth0とのOpen ID Connectの設定

**URL:** <https://discuss.elastic.co/t/auth0-open-id-connect/221835>\
**Category:** 日本語による質問・議論はこちら\
**Tags:** elastic-stack-security\
**Created:** [March 3, 2020, 8:48am UTC](https://discuss.elastic.co/t/auth0-open-id-connect/221835 "2020-03-03T08:48:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nidcode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nidcode/32/28552_2.png) [@nidcode](https://discuss.elastic.co/u/nidcode)\
**Post date:** [March 3, 2020, 8:48am UTC](https://discuss.elastic.co/t/auth0-open-id-connect/221835/1 "2020-03-03T08:48:14Z")

</div>

Elastic Cloud (Ver7.5) にてAuth0をOPにしてOIDCの設定をしています。

[https://www.elastic.co/guide/en/cloud/current/ec-secure-clusters-oidc.html](https://www.elastic.co/guide/en/cloud/current/ec-secure-clusters-oidc.html)  
上記URLを参考にしながら設定したのですが、IDトークンの検証で以下のエラーが出てしまいます。  
`Authentication to realm oidc1 failed - Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to parse or validate the ID Token]; nested: BadJWTException[Unexpected JWT issuer: https://xxxxx.auth0.com/];)`

elasticsearch.yml

```auto
xpack.security.authc.realms.oidc.oidc1:
    order: 2
    op.issuer: https://xxxxx.auth0.com
    op.authorization_endpoint: https://xxxxx.auth0.com/authorize
    op.token_endpoint: https://xxxxx.auth0.com/oauth/token
    op.jwkset_path: https://xxxxx.auth0.com/.well-known/jwks.json
    op.userinfo_endpoint: https://xxxxx.auth0.com/userinfo
    rp.client_id: <clientid>
    rp.response_type: code
    rp.redirect_uri: https://xxxxx.ap-northeast-1.aws.found.io:9243/api/security/v1/oidc
    rp.post_logout_redirect_uri: https://xxxxx.ap-northeast-1.aws.found.io:9243/logged_out
    rp.signature_algorithm: RS256
    claims.principal: sub

```

xpack.security.authc.realms.oidc.oidc1.rp.client\_secretにclient secretを登録済み

kibana.yml

```auto
xpack.security.authProviders: [oidc, basic]
xpack.security.authc.oidc.realm: "oidc1" 
server.xsrf.whitelist: [/api/security/v1/oidc]

```

何か設定が足りないところがあるのでしょうか？  
問題解決のために他に必要な情報があれば教えてください。

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 3, 2020, 9:16am UTC](https://discuss.elastic.co/t/auth0-open-id-connect/221835/2 "2020-03-03T09:16:23Z")

</div>

Hi @nidcode,

I hope it's fine to answer in English, the solution should be easy enough to spot even without the translation 🙂  
The error is stated in the exception: `[Unexpected JWT issuer: https://xxxxx.auth0.com/]`

You have configured Elasticsearch to think that the Issuer is `https://xxxxx.auth0.com` but the issuer is _actually_ `https://xxxxx.auth0.com/` (mind the trailing `/`) . These might look like URLs but are treated and compared as strings so `https://xxxxx.auth0.com` is not the same as `https://xxxxx.auth0.com/`

In summary:

Change

```auto
op.issuer: https://xxxxx.auth0.com

```

to

```auto
op.issuer: https://xxxxx.auth0.com/

```

and it will work just fine.

---

<div class="post-metadata">

**Author:** ![nidcode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nidcode/32/28552_2.png) [@nidcode](https://discuss.elastic.co/u/nidcode)\
**Post date:** [March 3, 2020, 10:42am UTC](https://discuss.elastic.co/t/auth0-open-id-connect/221835/3 "2020-03-03T10:42:32Z")

</div>

Hi @ikakavas

Thank you very much! !  
It was easy to understand.

It worked fine.

Akifumi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2020, 10:42am UTC](https://discuss.elastic.co/t/auth0-open-id-connect/221835/4 "2020-03-31T10:42:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.