# Keycloak Elasticsearch/Kibana Configuration **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 14, 2022, 1:29pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624 "2022-03-14T13:29:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\ **Post date:** [March 14, 2022, 1:29pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/1 "2022-03-14T13:29:07Z")
Hi, I'm having trouble configuring Kibana and Keycloak to use SSO. I am getting an error like the one below: ```auto Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token using the Token Endpoint. ``` ---
**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\ **Post date:** [March 14, 2022, 1:31pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/2 "2022-03-14T13:31:35Z")
My 'Elasticsearch.yml' configuration is: ```auto xpack.security.authc.realms.oidc.oidc1: order: 1 rp.client_id: "kibana" rp.response_type: code rp.redirect_uri: "http://kibana-url:5601/api/security/oidc/callback" op.issuer: "https://keycloak-url:8443/auth/realms/kibana" op.authorization_endpoint: "https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/auth" op.token_endpoint: "https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/token" op.jwkset_path: "https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/certs" op.userinfo_endpoint: "https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/userinfo" op.endsession_endpoint: "https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/logout" rp.post_logout_redirect_uri: "http://kibana-url:5601/logged_out" claims.principal: preferred_username ssl.verification_mode: none ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 14, 2022, 1:36pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/3 "2022-03-14T13:36:28Z")
> [@pkward](#): > > I'm having trouble configuring Kibana and Keycloak to use SSO. I am getting an error like the one below: Can you share the relevant part of the logs from `elasticsearch.log` too ? There will be much more information there around _why_ this fails ---
**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\ **Post date:** [March 14, 2022, 1:39pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/4 "2022-03-14T13:39:28Z")
Yes, here it is. ```auto [2022-03-14T13:25:59,692][WARN][o.e.x.s.a.RealmsAuthenticator] [master] Authentication to realm oidc1 failed - Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException[Failed to exchange code for Id Token using the Token Endpoint.]; nested: ConnectException[Timeout connecting to [/keycloak-url:8443]];) ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 14, 2022, 1:41pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/5 "2022-03-14T13:41:27Z")
Elasticsearch tries to communicate with `https://keycloak-url:8443/auth/realms/kibana/protocol/openid-connect/token` and it times out. Are you sure that keycloak is running and functional and accessible in the URL that you configure there ? ( I assume that `keycloack-url` is an obfuscation of the actual URL ) ---
**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\ **Post date:** [March 14, 2022, 1:44pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/6 "2022-03-14T13:44:37Z")
Yes, Keycloak is running but when I try to connect to the token URI from my web browser I get an internal server error. Correct, the IP is obfuscated. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 14, 2022, 3:41pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/7 "2022-03-14T15:41:51Z")
> [@pkward](#): > > but when I try to connect to the token URI from my web browser I get an internal server error Then it seems to be a problem with keycloak and not the Elastic Stack. Maybe there is a relevant forum or support portal where you can get better assistance with fixing keycloak ? Not sure if we can offer much assistance here unfortunately ---
**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\ **Post date:** [March 14, 2022, 3:44pm UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/8 "2022-03-14T15:44:40Z")
Does Kibana have to be encrypted at the application layer https? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/9 "2022-03-16T07:42:27Z")
No, this is not necessary, but this is not what the problem you are facing at the moment as far as I can tell. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2022, 7:42am UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624/10 "2022-04-13T07:42:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.