# How to set initial login using OpenID Connect

**URL:** <https://discuss.elastic.co/t/how-to-set-initial-login-using-openid-connect/220291>\
**Category:** Kibana\
**Created:** [February 21, 2020, 4:41am UTC](https://discuss.elastic.co/t/how-to-set-initial-login-using-openid-connect/220291 "2020-02-21T04:41:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [February 21, 2020, 4:41am UTC](https://discuss.elastic.co/t/how-to-set-initial-login-using-openid-connect/220291/1 "2020-02-21T04:41:49Z")

</div>

i want to set SSO using OpenID Connect(google).  
So I added the setting to elasticsearch and added the relevant setting to Kibana.

my kibana.yml  
xpack.security.authc.providers: [oidc, basic]  
xpack.security.authc.oidc.realm: oidc1  
server.xsrf.whitelist: [/api/security/oidc/initiate\_login]

and keystore add  
elasticsearch.username: elastic  
elasticsearch.password: mypassword  
(The ID:elastic was added with the command 'bin/elasticsearch-setup-passwords interactive'.)

After this setting, the following error occurs when starting the kibana.

```
log [01:38:59.926] [warning][licensing][plugins] 
  License information could not be obtained from Elasticsearch for the [data] cluster. 
  [security_exception] unable to authenticate user [elastic] for REST request [/_xpack], 
  with { header={ WWW-Authenticate={ 0="Bearer realm=\"security\"" & 1="Basic realm=\"security\" charset=\"UTF-8\"" } } } :: 
  {"path":"/_xpack","statusCode":401,"response":"{\"error\":{\"root_cause\": [{\"type\":\"security_exception\",
  \"reason\":\"unable to authenticate user [elastic] for REST request [/_xpack]\",
  \"header\":{\"WWW-Authenticate\":[\"Bearer realm=\\\"security\\\"\",
  \"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"]}}],
  \"type\":\"security_exception\",\"reason\":\"unable to authenticate user [elastic] for REST request [/_xpack]\",
  \"header\":{\"WWW-Authenticate\":[\"Bearer realm=\\\"security\\\"\",\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"]}},
  \"status\":401}","wwwAuthenticateDirective":"Bearer realm=\"security\", Basic realm=\"security\" charset=\"UTF-8\""}

```

what i have to add setting?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [March 13, 2020, 1:58am UTC](https://discuss.elastic.co/t/how-to-set-initial-login-using-openid-connect/220291/2 "2020-03-13T01:58:23Z")

</div>

> [@Yungyoung\_Ok](#):
>
> unable to authenticate user [elastic] for REST request [/\_xpack],

A number of things can be happening to get to that authentication exception you see thrown by ES.

- Your password is wrong or misstyped. You can use the [change password API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-change-password.html) authenticating as the `elastic` user to change the password of your akhil user just to be sure.
- You have defined an extra authentication realm in your `elasticsearch.yml` . Doing so, stops the native realm from being implicitly enabled, so you need to explicitly enable it yourself. See [https://www.elastic.co/guide/en/elasticsearch/reference/7.3/configuring-native-realm.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/configuring-native-realm.html)

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2020, 1:58am UTC](https://discuss.elastic.co/t/how-to-set-initial-login-using-openid-connect/220291/3 "2020-04-10T01:58:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.