# Kibana ECK OIDC with DEX **URL:** \ **Category:** Elastic Cloud on Kubernetes (ECK)\ **Created:** [July 17, 2020, 3:39pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689 "2020-07-17T15:39:20Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 17, 2020, 3:39pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/1 "2020-07-17T15:39:20Z")
Hi, we configured Elastic Cloud on Kubernetes (version 1.1.2) on our own Bare Metal Kubernetes Stack. We set up Elasticsearch (version 7.8.0) with an OpenID Connect "oidc" realm with DEX as provider. We called the realm "dex": ```auto [...] security: authc: token.enabled: true realms: oidc: dex: order: 0 op: issuer: "https://dex.test/dex" authorization_endpoint: "https://dex.test/dex/auth" token_endpoint: "https://dex.test/dex/token" jwkset_path: "https://dex.test/dex/keys" userinfo_endpoint: "https://dex.test/dex/userinfo" rp: # The "rp.client_secret" is injected into keystore from secret. client_id: "kibana" redirect_uri: "https://ip removed:443/api/security/v1/oidc/callback" response_type: code signature_algorithm: RS256 requested_scopes: - groups - openid - profile - email - federated:id claims: principal: name groups: groups mail: email ``` To make Kibana (version 7.8.0) use this OpenId Connect realm we added to the Kibana config: ```auto xpack.security.authc.providers: oidc.oidc1: order: 0 realm: "dex" # Basic Access is required e.g. to utilize the Kibana API for automated shard allocation with elastic user. basic.basic1: order: 1 ``` We experience the following issue: - Kibana correctly shows the login selections: "Login with oidc/oidc1" and "Login with Elasticsearch" as expected - Choosing "Log in with oidc/oidc1" redirects to our oidc provider. Completing the login there results in being redirected to Kibana as expected. - But: Kibana then redirects again to the oidc provider instead of considering the succeeded auth and forward to the Kibana GUI. We received the following logs from Kibana: ```auto {"type":"log","@timestamp":"2020-07-17T15:06:28Z","tags":"debug","plugins","security","oidc","oidc1"],"pid":6,"message":"Trying to authenticate via state."} {"type":"log","@timestamp":"2020-07-17T15:06:28Z","tags":["debug","plugins","security","oidc","oidc1"],"pid":6,"message":"Elasticsearch access token is not found in state."} {"type":"log","@timestamp":"2020-07-17T15:06:28Z","tags":["debug","plugins","security","oidc","oidc1"],"pid":6,"message":"Trying to initiate OpenID Connect authentication."} {"type":"log","@timestamp":"2020-07-17T15:06:28Z","tags":["debug","plugins","security","oidc","oidc1"],"pid":6,"message":"Redirecting to OpenID Connect Provider with authentication request."} {"type":"response","@timestamp":"2020-07-17T15:06:28Z","tags":[],"pid":6,"method":"get","statusCode":302,"req":{"url":"/api/security/v1/oidc/callback? code=sdnjxcqizxl73ffik46vmsvvu&state=gtXhZLWuN1p_Dljz9VZSGVCfBiu61MzTuMYkxdSsKrQ","method":"get","headers":{"host":"ip removed","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate, br","referer":"https://dex.test/","dnt":"1","connection":"keep-alive","upgrade-insecure-requests":"1"},"remoteAddress":"ip removed","userAgent":"ip removed","referer":"https://dex.test"},"res":{"statusCode":302,"responseTime":11,"contentLength":9},"message":"GET /api/security/v1/oidc/callback?code=sdnjxcqizxl73ff3k46vmsvvu&state=gtXhZLWuN1p_Dljz9VZSGVCfBiu61MzTuMYkxdSsKrQ 302 11ms - 9.0B"} ``` In the Elasticsearch log there is literally nothing(!) regarding this oidc login. Even with enabled debug/ trace logging there is no interaction betwen Kibana and Elasticsearch while the login happens. We expect Elasticsearch to issue an Access Token or something. Any idea how to let Kibana/ Elasticsearch consider the succeeded OpenID Connect auth and stop forwarding to the oidc provider again and again? Help is really appreciated! Thanks, Tobias ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 20, 2020, 12:26pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/2 "2020-07-20T12:26:14Z")
> [@suckowbiz](#): > > `redirect_uri: "https://ip removed:443/api/security/v1/oidc/callback"` I think the `redirect_uri` is wrong, please try `"https://ip removed:443/api/security/oidc/callback"` (note it is without the `v1` part) ---
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 20, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/3 "2020-07-20T14:03:57Z")
Thanks a lot, this helped. Now we get ```auto 401 "Unauthorized" "[security_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/oidc/authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } }" ``` ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 20, 2020, 2:23pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/4 "2020-07-20T14:23:07Z")
Without logs it's hard to tell where it went wrong. Could you please turn on trace logs for oidc: ```auto PUT _cluster/settings {"transient":{"logger.org.elasticsearch.xpack.security.authc.oidc":"trace"}} ``` and share the logs for analysis? ---
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 20, 2020, 2:53pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/5 "2020-07-20T14:53:35Z")
Elasticsearch log: ```auto {"type":"log","@timestamp":"2020-07-20T14:11:27Z","tags":["debug","plugins","security","oidc","dex"],"pid":6,"message":"Trying to perform a login."} {"type":"log","@timestamp":"2020-07-20T14:11:27Z","tags":["debug","plugins","security","oidc","dex"],"pid":6,"message":"OpenID Connect Authorization Code Authentication flow is used."} {"type":"log","@timestamp":"2020-07-20T14:11:27Z","tags":["debug","plugins","security","oidc","dex"],"pid":6,"message":"Failed to authenticate request via OpenID Connect: [security_exception] unable to a uthenticate user [] for action [cluster:admin/xpack/security/oidc/authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"se curity\\\" charset=\\\"UTF-8\\\"\" } } }"} ``` We realize the error message but the client\_secret in the vault equals the one that is expected. We inject the password for the OIDC client with Ansible via K8s secret as required by ECK like this: ```auto --- apiVersion: v1 kind: Secret metadata: name: es-oicd-client-secret namespace: elastic-system type: Opaque data: xpack.security.authc.realms.oidc.dex.rp.client_secret: "{{ vault.es.oidc.client_secret }}" ``` Verifying the password is injected correctly into elasticsearch: ```auto [root@dwp-test-es-default-0 bin]# ./elasticsearch-keystore list keystore.seed xpack.security.authc.realms.oidc.dex.rp.client_secret ``` Is this password key correct? ---
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 20, 2020, 3:33pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/6 "2020-07-20T15:33:03Z")
The key was correct but the base 64 endoding was missing. The correct string is: ```auto xpack.security.authc.realms.oidc.dex.rp.client_secret: "{{ vault.es.oidc.client_secret | string | b64encode }}" ``` ---
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 20, 2020, 3:47pm UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/7 "2020-07-20T15:47:38Z")
The login succeeded but we need to extract the DN from "federated\_claim" field "user\_id". ```auto { "type": "server", "timestamp": "2020-07-20T15:35:38,047Z", "level": "TRACE", "component": "o.e.x.s.a.o.OpenIdConnectAuthenticator", "cluster.name": "test", "node.name": "test-es-default-0", "message": "Successfully retrieved user information: [{\"at_hash\":\"removed\",\"federated_claims\":{\"user_id\":\"cn=achim.admin,ou=People,dc=removed,dc=de\",\"connector_id\":\"dwp_ldap_openldap\"},\"sub\":\"removed\",\"aud\":\"kibana\",\"email_verified\":true,\"iss\":\"https:\\/\\/dex.test.fi-ts.io\\/dex\",\"name\":\"test000\",\"groups\":[\"testsecu\",\"dwpstwpdir\",\"k8s_kaas-admin\",\"test_kaas-all-all-admin\",\"test_prmt-all-all-admin\",\"test_k8s-test-all-clusteradmin\",\"test_k8s-qa$poc-all-clusteradmin\",\"test_k8s-dwp$poc-all-clusteradmin\",\"test_k8s-prod$poc-all-clusteradmin\"],\"exp\":1595302537,\"iat\":1595259337,\"nonce\":\"removed\",\"email\":\"achim.admin@removed\"}]", } ``` What would be the correct syntax to read input federated\_claims-\>user\_id into `claims.dn`? ```auto claims: principal: name groups: groups mail: email dn: federated_claims.user_id # What is the syntax required here? ``` P.S. The encoded JWT token structure: ```auto # { # "iss": "https://dex.test", # "sub": "test", # "aud": "auth-go-cli", # "exp": 1594428593, # "iat": 1594385393, # "at_hash": "test", # "email": "achim.admin@test.de", # "email_verified": true, # "groups": [ # "k8s_kaas-admin", # ], # "name": "test000", # "federated_claims": { # "connector_id": "test_ldap_openldap", # "user_id": "cn=achim.admin,ou=People,dc=test,dc=de" # } # } ``` ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 21, 2020, 2:29am UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/8 "2020-07-21T02:29:21Z")
> What would be the correct syntax to read input federated\_claims-\>user\_id into `claims.dn` ? It is currently impossible to map nested fields to claims. I think it is a reasonable thing to ask. I'll check with the team and get back to you. ---
**Author:** ![suckowbiz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suckowbiz/32/20790_2.png) [@suckowbiz](https://discuss.elastic.co/u/suckowbiz)\ **Post date:** [July 22, 2020, 7:16am UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/9 "2020-07-22T07:16:23Z")
Hi @Yang_Wang, do you have already any kind of feedback? Thanks! ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 23, 2020, 4:31am UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/10 "2020-07-23T04:31:53Z")
Hi Tobias, Sorry for the delay. I have talked to the team and it turns out we don't currently support mapping claims that is type of JSON object. The currently supported ones are String, Number, Boolean or arrays of them. I have opened [an issue](https://github.com/elastic/elasticsearch/issues/60102) for this. But I don't have any timeline on when this can be resolved. In the meantime, the alternatives would be asking if your OP can return the claims in a slightly different format, e.g. elevate `user_id` to a top level field, or mapping user roles based on a different attribute. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 20, 2020, 4:31am UTC](https://discuss.elastic.co/t/kibana-eck-oidc-with-dex/241689/11 "2020-08-20T04:31:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.