Hello, I have 6 node Elasticsearch cluster in acceptance enviroment.
I have 2 master, 2 hot and 2 warm nodes.
I want to implement authentication via Keycloak.
In elasticsearch.yml I configured.
xpack.security.authc.token.enabled: true
xpack.security.authc.realms:
oidc:
oidc1:
order: 2
rp.client_id: "elasticsearch"
rp.response_type: "code"
rp.redirect_uri: "https://apkibana.-***/api/security/oidc/callback"
rp.post_logout_redirect_uri: "https://apkibana.-***/logged_out"
op.issuer: "https://keycloak.-***/realms/vnttest"
op.authorization_endpoint: "https://keycloak.-***/realms/vnttest/protocol/openid-connect/auth"
op.token_endpoint: "https://keycloak.-***/realms/vnttest/protocol/openid-connect/token"
op.jwkset_path: "https://keycloak.-***/realms/vnttest/protocol/openid-connect/certs"
op.userinfo_endpoint: "https://keycloak.-***/realms/vnttest/protocol/openid-connect/userinfo"
op.endsession_endpoint: "https://keycloak.-***/realms/vnttest/protocol/openid-connect/logout"
#claims.principal: "preferred_username"
claims.principal: "sub"
claims.groups: "roles"
in kibana.yml I configured
xpack.security.authc.providers:
oidc.oidc1:
order: 0
realm: oidc1
description: "Keycloak"
basic.basic:
order: 1
Redirect from Kibana to Keycloak is working, then I should get token and access Kibana but I always fail to permissions. I have no permission to access.
When I try to debug with curl:
curl --location --request POST 'https://keycloak.-***/realms/vnttest/protocol/openid-connect/token' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'grant_type=password' --data-urlencode 'client_id=elasticsearch' --data-urlencode 'client_secret=****' --data-urlencode 'username=****' --data-urlencode 'password=***
I get token:
{"access_token":"*******************","expires_in":300,"refresh_expires_in":1800,"refresh_token":"*************","token_type":"Bearer","not-before-policy":0,"session_state":"cce2******3370","scope":"email profile groups"}
But when I try to authenticate:
curl -X GET "https://es-node1***:9200/_xpack/security/_authenticate" -H "Authorization: Bearer "Token"
I got:
{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate with provided credentials and anonymous access is not allowed for this request","additional_unsuccessful_credentials":"oauth2 token: invalid token","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate with provided credentials and anonymous access is not allowed for this request","additional_unsuccessful_credentials":"oauth2 token: invalid token","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
Any advice?
There is nothing in logs.
ES log is clear and kibana logs:
"Logging in with provider \"oidc1\" (oidc)","log":{"level":"INFO","logger":"plugins.security.routes"},"process":{"pid":605362,"uptime":66536.670301688},"trace":{"id":"42cc8bfc351db5f7b37d71a848d16869"},"transaction":{"id":"e87196424eba00cd"}}
When should I debug?
Why I cant auth via command line?
from JWT token I can see that I got:
"exp": 1718625334,
"iat": 1718625034,
"jti": "b936c1****9064cb37",
"iss": "https://keycloak-*****realms/vnttest",
"aud": [
"realm-management",
"broker",
"account"
],
"sub": "ffd8e08*****1051c205e",
"typ": "Bearer",
"azp": "elasticsearch",
"session_state": "d29261****ebb04f7a375",
"acr": "1",
"allowed-origins": [
"*",
"https://apkibana-****"
],
"realm_access": {
"roles": [
"elasticsearch",
"offline_access",
"uma_authorization",
"vntadmin",
"default-roles-vnttest"
]
},
"resource_access": {
"realm-management": {
"roles": [
"view-realm",
"view-identity-providers",
"manage-identity-providers",
"impersonation",
"realm-admin",
"create-client",
"manage-users",
"query-realms",
"view-authorization",
"query-clients",
"query-users",
"manage-events",
"manage-realm",
"view-events",
"view-users",
"view-clients",
"manage-authorization",
"manage-clients",
"query-groups"
]
},
"elasticsearch": {
"roles": [
"vntadmin"
]
},
"broker": {
"roles": [
"read-token"
]
},
"account": {
"roles": [
"manage-account",
"view-applications",
"view-consent",
"view-groups",
"manage-account-links",
"manage-consent",
"delete-account",
"view-profile"
]
}
},
"scope": "email profile groups",
"sid": "d292*****7a375",
"email_verified": false,
"roles": [
"vntadmin"
],
"name": "*****",
"preferred_username": "vnttest",
"given_name": "****",
"family_name": "****",
"email": "****"
}
In Kibana I set role_mapping:
PUT /_security/role_mapping/keycloak_role_mapping
{
"roles": ["superuser"],
"enabled": true,
"rules": {
"all": [
{
"field": { "realm_access.roles": "vntadmin" }
},
{
"field": { "resource_access.elasticsearch.roles": "vntadmin" }
}
]
}
}
