# Elasticsearch service wont stop when OIDC is enabled

**URL:** <https://discuss.elastic.co/t/elasticsearch-service-wont-stop-when-oidc-is-enabled/265864>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, windows\
**Created:** [March 1, 2021, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-stop-when-oidc-is-enabled/265864 "2021-03-01T20:23:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![froxxen](https://avatars.discourse-cdn.com/v4/letter/f/df788c/32.png) [@froxxen](https://discuss.elastic.co/u/froxxen)\
**Post date:** [March 1, 2021, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-stop-when-oidc-is-enabled/265864/1 "2021-03-01T20:23:25Z")

</div>

I'm running the entire stack on Windows and will integrate SSO into the environment.  
It works as expected except one thing, when the Elasticsearch service needs to be stopped it hangs for some reason.

If I remove below lines and the part from the keystore, the service behaves as expected (_reproduced in two different environments and tried in Elasticsearch 7.9.1 as well as 7.10.2_).

**Elasticsearch.yml:**

```auto
oidc.oidc-adfs:
  order: 2
  client_id: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  response_type: code
  requested_scopes: ["openid",'allatclaims']
  rp.redirect_uri: 'https://kibana.domain.local/api/security/oidc/callback'
  op.issuer: 'https://adfs.domain.local/adfs'
  op.authorization_endpoint: 'https://adfs.domain.local/adfs/oauth2/authorize/'
  op.token_endpoint: 'https://adfs.domain.local/adfs/oauth2/token/'
  op.endsession_endpoint: 'https://adfs.domain.local/adfs/oauth2/logout'
  rp.post_logout_redirect_uri: 'https://kibana.domain.local/security/logged_out'
  op.jwkset_path: 'https://adfs.domain.local/adfs/discovery/keys'
  claims.principal: sub
  claims.groups: group
  claims.name: commonname
  ssl.certificate_authorities: D:\Elasticsearch\config\chain.crt

```

This is also included in the keystore:

```auto
xpack.security.authc.realms.oidc.oidc-adfs.rp.client_secret

```

**Elasticcluster.log (when stopping service):**

```auto
[INFO][o.e.n.Node] [es1.domain.local] stopping ...
[INFO][o.e.x.w.WatcherService] [es1.domain.local] stopping watch service, reason [shutdown initiated]
[INFO][o.e.x.w.WatcherLifeCycleService] [es1.domain.local] watcher has stopped and shutdown
[INFO][o.e.x.m.p.l.CppLogMessageHandler] [es1.domain.local] [controller/8132] [Main.cc@154] ML controller exiting
[INFO][o.e.x.m.p.NativeController] [es1.domain.local] Native controller process has stopped - no new native processes can be started
[INFO][o.e.n.Node] [es1.domain.local] stopped
[INFO][o.e.n.Node] [es1.domain.local] closing ...
[INFO][o.e.n.Node] [es1.domain.local] closed

```

... **but** the process and service is still running and trying to stop and only way to shut it down is to kill the process...

The service is installed with the provided _elasticsearch-service.bat_

This can't be an expected behavior, what am I missing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2021, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-stop-when-oidc-is-enabled/265864/2 "2021-03-29T20:23:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.