# Kibana - Use Laravel Passport as OpenID Connect Provider to SSO with Elastic and Kibana

**URL:** <https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [September 27, 2021, 9:41pm UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283 "2021-09-27T21:41:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![medina](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@medina](https://discuss.elastic.co/u/medina)\
**Post date:** [September 27, 2021, 9:41pm UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283/1 "2021-09-27T21:41:32Z")

</div>

Hello, I'm trying to use my Laravel app that uses Passport for authentication, to create an OpenID Connect Provider to single sign on with Elastic and Kibana. But I get the following error:

```json
{
"statusCode":401,
"error":"Unauthorized",
"message":"Unauthorized"
}

```

In the **[http://localhost:5601/api/licensing/info](http://localhost:5601/api/licensing/info)** endpoint.  
And in the Elastic terminal I get:

```bash
[Failed to exchange code for Id Token]

```

My configs for elastic are:

```auto
xpack.security.authc.realms.oidc.oidc2:
  order: 1
  rp.client_id: "947fe15a-8f74-473e-b794-138fd79d7c79"
  rp.response_type: code
  rp.redirect_uri: "http://localhost:5601/api/security/oidc/callback"
  op.issuer: "http://localhost:8082"
  op.authorization_endpoint: "http://localhost:8082/oauth/authorize/"
  op.token_endpoint: "http://localhost:8082/oauth/token/"
  op.jwkset_path: oidc/jwkset.json
  op.userinfo_endpoint: "http://localhost:8082/oauth/userinfo/"
  op.endsession_endpoint: "http://localhost:8082/oauth/logout/"
  rp.post_logout_redirect_uri: "http://localhost:5601/security/logged_out"
  claims.principal: sub
  claims.mail: email
  claims.name: name

```

And the only endpoint that I manually added in laravel is:

```php
Route::middleware(['auth:api', 'scope:openid', 'claim:sub,email,name'])->get('/oauth/userinfo', function (Request $request) {
    return $request->user();
});

```

I'm using the [laravel-passport-claims](https://github.com/corbosman/laravel-passport-claims) package to add the required claims.

Is someone able to spot a possible cause for the error with these informations?

Obs.: I installed Elastic and Kibana on Windows 10 and I'm using the free trial to use the OpenID features.

---

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [October 18, 2021, 10:18am UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283/2 "2021-10-18T10:18:03Z")

</div>

> [@medina](#):
>
> `[Failed to exchange code for Id Token]`

Are there any other logs available for Elasticsearch? Trace logs would also help:

```auto
PUT /_cluster/settings
{
  "transient": {
    "logger.org.elasticsearch.xpack.security.authc.oidc": "trace"
  }
}

```

Is `http://localhost:8082/oauth/token/` endpoint available?

Best,  
Oleg

---

<div class="post-metadata">

**Author:** ![medina](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@medina](https://discuss.elastic.co/u/medina)\
**Post date:** [October 19, 2021, 9:10pm UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283/3 "2021-10-19T21:10:21Z")

</div>

About this issue now 😅. This was my previous attempt on SSO with Elastic/Kibana RP.

However my freel trial is about to end, and my machine is not able to run kibana from the source code 😒. So since the SSO worked using SAML, I don't believe I'll be trying anything else here, even though I'd like to.  
Should I close the question or something like that?

---

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [October 20, 2021, 6:37am UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283/4 "2021-10-20T06:37:51Z")

</div>

> [@medina](#):
>
> Should I close the question or something like that?

No solution is also a solution 🙂 If it's fine for you I'd keep your question here just in case someone else will be trying a similar thing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2021, 6:38am UTC](https://discuss.elastic.co/t/kibana-use-laravel-passport-as-openid-connect-provider-to-sso-with-elastic-and-kibana/285283/5 "2021-11-17T06:38:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.