# Failed to authenticate user with OpenID Connect **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [December 20, 2019, 5:39am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600 "2019-12-20T05:39:34Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![firabby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/firabby/32/58342_2.png) [@firabby](https://discuss.elastic.co/u/firabby)\ **Post date:** [December 20, 2019, 5:39am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/1 "2019-12-20T05:39:34Z")
Continuing the discussion from [OpenID error after authenticating against AWS Cognito](https://discuss.elastic.co/t/openid-error-after-authenticating-against-aws-cognito/206018/12): I am trying to authenticate kibana users using OIDC. When the user is redirected to kibana after logging in, following error occurs. `[2019-12-20T11:36:57,355][WARN][o.e.x.s.a.AuthenticationService] [X556UQK] Authentication to realm oidc1 failed - Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to get user information from the UserInfo endpoint.]; nested: IllegalStateException[Error merging ID token and userinfo claim value for claim [email_verified]. Cannot merge [java.lang.Boolean] with [java.lang.String]];)` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 2, 2020, 2:45pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/2 "2020-01-02T14:45:57Z")
As the error indicates, AWS Cognito returns the value for the `email_verified` claim as a boolean in the ID Token and as a string in the Userinfo response. We consider the same claim with different value types to be an error as there is no way for us to know whether this is supposed to be a boolean or a string and thus we fail the login flow. I suggest you open a support ticket with AWS to report their behavior, I dont think there is a reason to not fix this on their side. In the meantime, you can probably just comment out the `op.userinfo_endpoint` in your elasticsearch configuration, assuming all the claims you want are already in the ID Token HTH ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 15, 2020, 6:01am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/3 "2020-01-15T06:01:32Z")
To be clear the correct type is the one in the ID Token, as the `email_verified` claim [is defined to be boolean in the specification](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) ---
**Author:** ![piyush\_kashyap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/piyush_kashyap/32/62160_2.png) [@piyush\_kashyap](https://discuss.elastic.co/u/piyush_kashyap)\ **Post date:** [February 6, 2020, 7:03am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/4 "2020-02-06T07:03:50Z")
I am facing the same issue so I commented out `op.userinfo_endpoint` as per your suggestion but now I am getting 403 forbidden error after authentication.. Is it because of commenting out userinfo ? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 6, 2020, 7:10am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/5 "2020-02-06T07:10:16Z")
We can't say without any additional information from you. Please open a new topic and add your logs and configuration ---
**Author:** ![piyush\_kashyap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/piyush_kashyap/32/62160_2.png) [@piyush\_kashyap](https://discuss.elastic.co/u/piyush_kashyap)\ **Post date:** [February 6, 2020, 8:39am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/6 "2020-02-06T08:39:42Z")
Please find below the logs from elasticsearch after authenticating with aws cognito OpenID Connect Provider redirected user to [/api/security/v1/oidc?code=] [2020-02-06T13:57:06,502][TRACE][o.e.x.s.a.o.OpenIdConnectAuthenticator] [node-1] Received Token Response from OP with status [200] and content [{"id\_token":"","expires\_in":3600,"token\_type":"Bearer"}] [2020-02-06T13:57:06,526][TRACE][o.e.x.s.a.o.OpenIdConnectAuthenticator] [node-1] Successfully exchanged code for ID Token: [com.nimbusds.jwt.SignedJWT@15333bdc] and Access Token [] [2020-02-06T13:57:06,560][TRACE][o.e.x.s.a.o.OpenIdConnectAuthenticator] [node-1] Received and validated the Id Token for the user: [{"at\_hash":"SOt6DfjuG3jjIBf00BSRig","sub":"","cognito:groups":["kibana-users"],"email\_verified":true,"iss":"[https://cognito-idp.us-east-1.amazonaws.com/us-east-1\_bBxqRAHER","cognito:username":"piyush.a.kashyap","nonce":"](https://cognito-idp.us-east-1.amazonaws.com/us-east-1_bBxqRAHER%22,%22cognito:username%22:%22piyush.a.kashyap%22,%22nonce%22:%22)","cognito:roles":["arn:aws:iam:::role/cognito\_authenticated"],"aud":"","token\_use":"id","auth\_time":1580977626,"exp":1580981226,"iat":1580977626,"email":"piyush.a.kashyap@organization.com"}] [2020-02-06T13:57:06,561][DEBUG][o.e.x.s.a.o.OpenIdConnectAuthenticator] [node-1] OP returned an access token but the UserInfo endpoint is not configured. I am using following rolemapping with OIDC:- curl --user elastic:123456 -X PUT "localhost:9200/\_security/role\_mapping/cloud-oidc?pretty" -H 'Content-Type: application/json' -d' { "roles": ["kibana\_dashboard\_only\_user"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "cloud-oidc" } }, { "field": { "groups": "cognito:groups" } } ] } } ' Please let me know if you find any issue in the logs or role.. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 6, 2020, 8:52am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/7 "2020-02-06T08:52:37Z")
Please open a new issue as instructed and provide all the information you were requested to. You didn't show us your realm configuration. ---
**Author:** ![piyush\_kashyap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/piyush_kashyap/32/62160_2.png) [@piyush\_kashyap](https://discuss.elastic.co/u/piyush_kashyap)\ **Post date:** [February 6, 2020, 9:05am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/8 "2020-02-06T09:05:56Z")
I have opened a new ticket:- [Getting 403 forbidden error on User authentication with OpenID connect](https://discuss.elastic.co/t/getting-403-forbidden-error-on-user-authentication-with-openid-connect/218120) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 5, 2020, 9:06am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-openid-connect/212600/9 "2020-03-05T09:06:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.