Hello Team,
We are using platinum-tier-xpack-trial-license
While using oidc authentication without Kibana- following steps mentioned here:
https://www.elastic.co/guide/en/elasticsearch/reference/7.3/oidc-without-kibana.html
getting following error while hitting api
POST /_security/oidc/authenticate
we get following error while doing this as response to api
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "unable to authenticate user [<OIDC Token>] for action [cluster:admin/xpack/security/oidc/authenticate]",
"header" : {
"WWW-Authenticate" : [
"Bearer realm=\"security\"",
"ApiKey",
"Basic realm=\"security\" charset=\"UTF-8\""
]
}
}
and the following in logs
[2019-10-25T01:33:59,319][WARN ][o.e.x.s.a.AuthenticationService] [elkpoc-1]
Authentication to realm oidc2 failed - Failed to authenticate user with OpenID Connect
(Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token using the Token Endpoint.
Unable to parse Token Response]; nested: ParseException[Missing JSON object member with key "token_type"];)
-----below are detailed steps -------
We want to authenticate our api calls to elastic. For this we are using the following guide.
https://www.elastic.co/guide/en/elasticsearch/reference/7.3/oidc-without-kibana.html
The oidc provider is our enterprise oidc provider.
As required, we have done following steps:
1) Register the RP with an OpenID Connect Provider
registered both our custom web app as well as elastic api
https://:9200/api/security/v1/oidc
https:///services/platform
2) OpenID Connect Realm
Created openid connect realm
3) Service Account user for accessing the APIs
using elastic user which has the superuser access
4) Handling the authentication flow
4.1) Make an HTTP POST request to _security/oidc/prepare
We make the call and successfully get the response as
< {
"redirect" : "https://{oidc provider url }?scope=openid
&response_type=code
&redirect_uri={our custom url}/Fservices/platform
&state={state id}
&client_id={client id}}",
"state" : "{state id}}",
"nonce" : "nonce id"
} >
4.2) Handle the response to /_security/oidc/prepare
we then hit the redirect url above in browser, authenticate using our enterprise id, and get redirected back
to the url mentioned in redirect_uri above.
it is returned as following:
https://{custom url}/services/platform/client?scope=openid
&code={code id}
&state={state id}}
4.3) Handle a subsequent response from the OP.
once we are redirected back to our custom url mentioned in redirect uri
we use that url and the state and nonce parameters to hit the authenticate api
POST /_security/oidc/authenticate
{
"redirect_uri" : "https://{custom url}/services/platform/client?scope=openid",
"state" : "{state id}",
"nonce" : "{nonce id}"
}
we get following error while doing this as response to api
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "unable to authenticate user [] for action [cluster:admin/xpack/security/oidc/authenticate]",
"header" : {
"WWW-Authenticate" : [
"Bearer realm="security"",
"ApiKey",
"Basic realm="security" charset="UTF-8""
]
}
}
and the following in logs
[2019-10-25T01:33:59,319][WARN ][o.e.x.s.a.AuthenticationService] [elkpoc-1]
Authentication to realm oidc2 failed - Failed to authenticate user with OpenID Connect
(Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token using the Token Endpoint.
Unable to parse Token Response]; nested: ParseException[Missing JSON object member with key "token_type"]