# Logs cannot be written and doesn't work basic auth after setting OIDC

**URL:** <https://discuss.elastic.co/t/logs-cannot-be-written-and-doesnt-work-basic-auth-after-setting-oidc/360190>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 24, 2024, 3:50pm UTC](https://discuss.elastic.co/t/logs-cannot-be-written-and-doesnt-work-basic-auth-after-setting-oidc/360190 "2024-05-24T15:50:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cass1ope1a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cass1ope1a/32/137266_2.png) [@cass1ope1a](https://discuss.elastic.co/u/cass1ope1a)\
**Post date:** [May 24, 2024, 3:50pm UTC](https://discuss.elastic.co/t/logs-cannot-be-written-and-doesnt-work-basic-auth-after-setting-oidc/360190/1 "2024-05-24T15:50:30Z")

</div>

I need to switch Kibana to OIDC auth through keycloak  
I have default user `dev` with basic auth and logs writing by vector (with username logstash) to elasticsearch

When i switch on OIDC, i cannot auth with that `dev` user and my logs stop writing, because user logstash unable to auth (401)

How can I fix that?

There is a part of my `elasticsearch.yml` config:

```auto
...

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/elastic.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/elastic.p12
xpack.security.transport.ssl.keystore.password: ""
xpack.security.transport.ssl.truststore.password: ""

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/someserver.some.domain.p12

xpack:
  security:
    authc:
      realms:
        oidc.oidc1:
          order: 2
          rp.client_id: my_user
          rp.response_type: code 
          rp.redirect_uri: http://somebalancer/kibana/api/security/oidc/callback
          op.issuer: https://some.keycloak.server/auth/realms/somerealm
          op.authorization_endpoint: https://some.keycloak.server/auth/realms/somerealm/protocol/openid-connect/auth
          op.token_endpoint: https://some.keycloak.server/auth/realms/somerealm/protocol/openid-connect/token
          op.jwkset_path: https://some.keycloak.server/auth/realms/somerealm/protocol/openid-connect/certs
          op.userinfo_endpoint: https://some.keycloak.server/auth/realms/somerealm/protocol/openid-connect/userinfo
          op.endsession_endpoint: https://some.keycloak.server/auth/realms/somerealm/protocol/openid-connect/logout
          rp.post_logout_redirect_uri: http://somebalancer/kibana/security/logged_out
          claims.principal: sub
          ssl.certificate_authorities: /usr/share/elasticsearch/config/keycloak.cer
          ssl.verification_mode: none
          claims.groups: groups

...

```

Part of kibana.yml:

```auto
xpack.security.enabled: true

xpack.security.authc.providers:
  oidc.oidc1:
    order: 0
    realm: oidc1
    description: "Log in with my OpenID Connect" 
  basic.basic1:
    order: 1

...

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 24, 2024, 6:26pm UTC](https://discuss.elastic.co/t/logs-cannot-be-written-and-doesnt-work-basic-auth-after-setting-oidc/360190/2 "2024-05-24T18:26:40Z")

</div>

Do you have a license? What do you have in the Kibana and Elasticsearch logs?