# ECK SSO with google cloud OpenID: Error \[security\_exception\] unable to authenticate user \[\<OIDC Token\>\]

**URL:** <https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Tags:** elastic-stack-security\
**Created:** [April 14, 2021, 10:15am UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101 "2021-04-14T10:15:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lmes3oud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmes3oud/32/85735_2.png) [@lmes3oud](https://discuss.elastic.co/u/lmes3oud)\
**Post date:** [April 14, 2021, 10:15am UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/1 "2021-04-14T10:15:43Z")

</div>

Hi all, I'm trying to enable SSO to Kibana version `7.11.0` created using ECK version `1.4.1`. I followed this [tutorial](https://www.elastic.co/blog/how-to-set-up-openid-connect-on-elastic-cloud-with-azure-google-okta) for Setup with Google Cloud OAuth Credential.

```
token.enabled: true
          realms.oidc:
            oidc1:
              order: 2
              rp.client_id: "<CLIENT_ID>"
              rp.response_type: code
              rp.requested_scopes: [openid, profile, email]
              rp.redirect_uri: "<KIBANA_ENDPOINT>/api/security/v1/oidc"
              op.issuer: "https://accounts.google.com" 
              op.authorization_endpoint: "https://accounts.google.com/o/oauth2/v2/auth" 
              op.token_endpoint: "https://oauth2.googleapis.com/token" 
              op.userinfo_endpoint: "https://openidconnect.googleapis.com/v1/userinfo" 
              op.jwkset_path: "https://www.googleapis.com/oauth2/v3/certs" 
              claims.principal: sub

```

Kibana configuration is:

```
xpack.security.authc.providers:
      oidc.oidc1:
        order: 0
        realm: oidc1
        description: "Log in with Google"
        hint: "User your company account"
        icon: "https://lh3.googleusercontent.com/M-c5Qiy3ahxn9XnUhGqzAAM8aYYZmwiY1vvdbkoQPm6QngJcUIgyBu8Wn38JebP3WZ1uDi86m14GPFK65UZugIeMzLGRO-ZNMoLS"
    
      basic.basic1:
        order: 1

```

I Enabled trace logging and having this logs in Elasticsearch:

```
{"type": "server", "timestamp": "2021-04-14T10:05:44,652Z", "level": "WARN", "component": "o.e.x.s.a.o.OpenIdConnectAuthenticator", "cluster.name": "es-main-cluster", "node.name": "es-main-cluster-es-zone-a-0", "message": "Received Token Response from OP with status [UNAUTHORIZED] and content [{\n \"error\": \"invalid_client\",\n \"error_description\": \"Unauthorized\"\n}]", "cluster.uuid": "oyHjvM3XQJOqjjG4-QUPFg", "node.id": "-TCUHxwhQnOEP2vQ0QrZFA" }
{"type": "server", "timestamp": "2021-04-14T10:05:44,653Z", "level": "DEBUG", "component": "o.e.x.s.a.o.OpenIdConnectRealm", "cluster.name": "es-main-cluster", "node.name": "es-main-cluster-es-zone-a-0", "message": "Failed to consume the OpenIdConnectToken ", "cluster.uuid": "oyHjvM3XQJOqjjG4-QUPFg", "node.id": "-TCUHxwhQnOEP2vQ0QrZFA" ,
"stacktrace": ["org.elasticsearch.ElasticsearchSecurityException: Failed to exchange code for Id Token",
"at org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectAuthenticator.handleTokenResponse(OpenIdConnectAuthenticator.java:551) [x-pack-security-7.11.0.jar:7.11.0]",
"at org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectAuthenticator.access$600(OpenIdConnectAuthenticator.java:131) [x-pack-security-7.11.0.jar:7.11.0]",
"at org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectAuthenticator$2.completed(OpenIdConnectAuthenticator.java:503) [x-pack-security-7.11.0.jar:7.11.0]",
"at org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectAuthenticator$2.completed(OpenIdConnectAuthenticator.java:500) [x-pack-security-7.11.0.jar:7.11.0]",
"at org.apache.http.concurrent.BasicFuture.completed(BasicFuture.java:122) [httpcore-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.client.DefaultClientExchangeHandlerImpl.responseCompleted(DefaultClientExchangeHandlerImpl.java:181) [httpasyncclient-4.1.4.jar:4.1.4]",
"at org.apache.http.nio.protocol.HttpAsyncRequestExecutor.processResponse(HttpAsyncRequestExecutor.java:448) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.nio.protocol.HttpAsyncRequestExecutor.inputReady(HttpAsyncRequestExecutor.java:338) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.DefaultNHttpClientConnection.consumeInput(DefaultNHttpClientConnection.java:265) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.client.InternalIODispatch.onInputReady(InternalIODispatch.java:81) [httpasyncclient-4.1.4.jar:4.1.4]",
"at org.apache.http.impl.nio.client.InternalIODispatch.onInputReady(InternalIODispatch.java:39) [httpasyncclient-4.1.4.jar:4.1.4]",
"at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:121) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104) [httpcore-nio-4.4.12.jar:4.4.12]",
"at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591) [httpcore-nio-4.4.12.jar:4.4.12]",
"at java.lang.Thread.run(Thread.java:832) [?:?]"] }
{"type": "server", "timestamp": "2021-04-14T10:05:44,656Z", "level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "es-main-cluster", "node.name": "es-main-cluster-es-zone-a-0", "message": "Authentication to realm oidc1 failed - Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token])", "cluster.uuid": "oyHjvM3XQJOqjjG4-QUPFg", "node.id": "-TCUHxwhQnOEP2vQ0QrZFA" }

```

I can't complete the login:

> | statusCode | 401 |
> | --- | --- |
> | error | Unauthorized |
> | message | [security\_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/oidc/authenticate], with { header={ WWW-Authenticate={ 0=\Basic realm=\\security\\ charset=\\UTF-8\\ & 1=\Bearer realm=\\security\\ & 2=\ApiKey\ } } } |

Can you please help. Thank you in advance.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 14, 2021, 1:45pm UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/2 "2021-04-14T13:45:32Z")

</div>

The main problem is this

```auto
{"type": "server", "timestamp": "2021-04-14T10:05:44,652Z", "level": "WARN", "component": "o.e.x.s.a.o.OpenIdConnectAuthenticator", "cluster.name": "es-main-cluster", "node.name": "es-main-cluster-es-zone-a-0", "message": "Received Token Response from OP with status [UNAUTHORIZED] and content [{\n \"error\": \"invalid_client\",\n \"error_description\": \"Unauthorized\"\n}]", "cluster.uuid": "oyHjvM3XQJOqjjG4-QUPFg", "node.id": "-TCUHxwhQnOEP2vQ0QrZFA" }

```

when we hit the Token Endpoint, your OP is saying that the client ( i.e. the RP in OIDC == Elasticsearch ) is not authorized. That usually means that either your `rp.client_id` or your `rp.client_secret` are wrong. I'm assuming you have changed `"<CLIENT_ID>"` above and set this to your actual client id. Have you also set the rp.client\_secret?

By they way, the reason that the final error is not clear enough is that your OP responds to our request to the Token Endpoint with a `200` HTTP status code even if it failed. It _should not_ do that, but instead return a `400`.

---

<div class="post-metadata">

**Author:** ![lmes3oud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmes3oud/32/85735_2.png) [@lmes3oud](https://discuss.elastic.co/u/lmes3oud)\
**Post date:** [April 14, 2021, 2:06pm UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/3 "2021-04-14T14:06:35Z")

</div>

Hi @ikakavas. Thank you for quick reply.  
Yes. For the `<CLIENT_ID>` I'm using my actual Client ID generated By google when creating the credential.

For the `rp.client_secret`, I generated a K8s secret from the Client Secret generated by google using this code.

```
apiVersion: v1
kind: Secret
metadata:
  name: client_secret
  namespace: <same_as_es_cluster_namespace>
type: Opaque
data:
  xpack.security.authc.realms.oidc.oidc1.rp.client_secret: <base64 of the secret>

```

Please notice that the secret is within the same namespace as the Elasticsearch cluster, and It is added to the nodes config.

I also tried to remove the secret manually from inside the keystore and add it again with its actuall value directly from within the container, but still no success.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 14, 2021, 2:53pm UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/4 "2021-04-14T14:53:03Z")

</div>

> [@lmes3oud](#):
>
> ` xpack.security.authc.realms.oidc.oidc1.rp.client_secret: <base64 of the secret>`

You should not base64 encode the client secret but add it as is.

---

<div class="post-metadata">

**Author:** ![lmes3oud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmes3oud/32/85735_2.png) [@lmes3oud](https://discuss.elastic.co/u/lmes3oud)\
**Post date:** [April 14, 2021, 3:39pm UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/5 "2021-04-14T15:39:44Z")

</div>

Thank you @ikakavas. It is working now.

---

<div class="post-metadata">

**Author:** ![lmes3oud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lmes3oud/32/85735_2.png) [@lmes3oud](https://discuss.elastic.co/u/lmes3oud)\
**Post date:** [April 15, 2021, 10:17am UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/6 "2021-04-15T10:17:56Z")

</div>

Just something that should be also considered in the Secret Yaml file, is the use of `stringData` instead of `data`, since the client secret might include `illegal base64 data`. This was my original problem, when I had this error, I converted the secret to `base64`, instead of changing the type to `stringData`. The code will be as below.

```
apiVersion: v1
kind: Secret
metadata:
    name: <name_of_the_secret>
    namespace: <same_as_es_cluster_namespace>
type: Opaque
stringData:
   xpack.security.authc.realms.oidc.oidc1.rp.client_secret: <actual_client_secret>
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2021, 10:18am UTC](https://discuss.elastic.co/t/eck-sso-with-google-cloud-openid-error-security-exception-unable-to-authenticate-user-oidc-token/270101/7 "2021-05-13T10:18:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.