# Failed to authenticate user with OpenID Connect in trial version of elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [April 9, 2020, 2:45pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348 "2020-04-09T14:45:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![viveknagar](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@viveknagar](https://discuss.elastic.co/u/viveknagar)\ **Post date:** [April 9, 2020, 2:45pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/1 "2020-04-09T14:45:07Z")
Hello All, I am using elasticsearch 7.5.2 and kbana 7.5.2 with this i am using keyclock as OP . I have enabled trial version for 30 to run single-sign-on on elasticsearch . But I am getting below error in elasticsearch. ```auto Authentication to realm oidc1 failed - Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token using the Token Endpoint.]; nested: SSLHandshakeException[General SSLEngine problem]; nested: SSLHandshakeException[General SSLEngine problem]; nested: ValidatorException[PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]; nested: SunCertPathBuilderException[unable to find valid certification path to requested target] ; ) ``` Can anyone suggest me where I am making mistake. Below is my elasticsearch.yml and kibana.yml Elasticsearch.yml : ##======================== Elasticsearch Configuration ========================= xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: /home/ist/elasticsearch-7.5.2/config/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /home/ist/elasticsearch-7.5.2/config/elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /home/ist/elasticsearch-7.5.2/config/elastic-stack-ca.p12 xpack.security.http.ssl.truststore.path: /home/ist/elasticsearch-7.5.2/config/elastic-stack-ca.p12 xpack.http.ssl.truststore.password: elastic xpack.security.authc.token.enabled: true xpack.security.authc.realms.oidc.oidc1: order: 2 rp.client\_id: "kibana-sso" rp.response\_type: code rp.redirect\_uri: "[http://localhost:5601/api/security/v1/oidc](http://localhost:5601/api/security/v1/oidc)" op.issuer: "[https://127.0.0.1:8443/auth/realms/oidc1](https://127.0.0.1:8443/auth/realms/oidc1)" op.authorization\_endpoint: "[https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/auth](https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/auth)" op.token\_endpoint: "[https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/token](https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/token)" op.jwkset\_path: "/home/ist/elasticsearch-7.5.2/config/key.json" op.endsession\_endpoint: "[https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/logout](https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/logout)" rp.post\_logout\_redirect\_uri: "[https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/logout](https://127.0.0.1:8443/auth/realms/oidc1/protocol/openid-connect/logout)" claims.principal: preferred\_username claims.groups: "[https://127.0.0.1:8443/auth/realms/oidc1/.well-known/openid-configuration](https://127.0.0.1:8443/auth/realms/oidc1/.well-known/openid-configuration)" kibana.yml elasticsearch.hosts: ["[https://localhost:9200](https://localhost:9200)"] elasticsearch.username: "elastic" elasticsearch.password: "elastic" elasticsearch.ssl.verificationMode: none xpack.security.enabled: true xpack.security.authc.providers: [oidc] xpack.security.authc.oidc.realm: "oidc1" server.xsrf.whitelist: [/api/security/v1/oidc] Please suggest me where am i making mistakes. Thanks in advance ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 9, 2020, 3:07pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/2 "2020-04-09T15:07:20Z")
Please don't post unformatted code, logs, or configuration as it's very hard to read. Instead, paste the text and format it with \ icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. It would be great if you could update your post to solve this. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 9, 2020, 3:11pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/3 "2020-04-09T15:11:54Z")
The error is printed in the logs, albeit not very user friendly ( Java SSL exception messages leave a lot to be desired 😕 ) . ```auto Failed to exchange code for Id Token using the Token Endpoint.]; nested: SSLHandshakeException[General SSLEngine problem]; nested: SSLHandshakeException[General SSLEngine problem]; nested: ValidatorException[PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]; nested: SunCertPathBuilderException[unable to find valid certification path to requested target] ; ) ``` Elasticsearch tries to communicate with your Keycloack instance and it fails because it doesn't trust the certificate that keycloack is using . We cover this case and the configuration you need to set in [our docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/oidc-guide-authentication.html#oidc-ssl-config) ---
**Author:** ![viveknagar](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@viveknagar](https://discuss.elastic.co/u/viveknagar)\ **Post date:** [April 10, 2020, 6:39am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/4 "2020-04-10T06:39:07Z")
I have also tried that config you suggested but the problem is still same ```auto ssl.certificate_authorities: "/home/ist/elasticsearch-7.5.2/config/root.crt" ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 10, 2020, 7:15am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/5 "2020-04-10T07:15:21Z")
Where did you add this and what is the `root.crt` certificate ? The more information you add in your responses, the easier will be for folks to assist you ! Can you share the whole realm configuration ? Did you restart elasticsearch after adding this ? Is the error _exactly_ the same again ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 8, 2020, 7:15am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect-in-trial-version-of-elasticsearch/227348/6 "2020-05-08T07:15:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.