119 lines
3.1 KiB
Markdown
119 lines
3.1 KiB
Markdown
---
|
|
layout: default
|
|
title: Troubleshoot OpenID Connect
|
|
parent: Troubleshoot
|
|
nav_order: 3
|
|
---
|
|
|
|
# OpenID Connect troubleshooting
|
|
|
|
This page includes troubleshooting steps for using OpenID Connect with the security plugin.
|
|
|
|
|
|
---
|
|
|
|
#### Table of contents
|
|
- TOC
|
|
{:toc}
|
|
|
|
|
|
---
|
|
|
|
## Set log level to debug
|
|
|
|
To help troubleshoot OpenID Connect, set the log level to `debug` on OpenSearch. Add the following lines in `config/log4j2.properties` and restart the node:
|
|
|
|
```
|
|
logger.opensearch_security.name = com.amazon.dlic.auth.http.jwt
|
|
logger.opensearch_security.level = trace
|
|
```
|
|
|
|
This setting prints a lot of helpful information to your log file. If this information isn't sufficient, you can also set the log level to `trace`.
|
|
|
|
|
|
## "Failed when trying to obtain the endpoints from your IdP"
|
|
|
|
This error indicates that the security plugin can't reach the metadata endpoint of your IdP. In `opensearch_dashboards.yml`, check the following setting:
|
|
|
|
```
|
|
opensearch_security.openid.connect_url: "http://keycloak.example.com:8080/auth/realms/master/.well-known/openid-configuration"
|
|
```
|
|
|
|
If this error occurs on OpenSearch, check the following setting in `config.yml`:
|
|
|
|
```yml
|
|
openid_auth_domain:
|
|
enabled: true
|
|
order: 1
|
|
http_authenticator:
|
|
type: "openid"
|
|
...
|
|
config:
|
|
openid_connect_url: http://keycloak.examplesss.com:8080/auth/realms/master/.well-known/openid-configuration
|
|
...
|
|
```
|
|
|
|
## "ValidationError: child 'opensearch_security' fails"
|
|
|
|
This indicates that one or more of the OpenSearch Dashboards configuration settings are missing.
|
|
|
|
Check `opensearch_dashboards.yml` and make sure you have set the following minimal configuration:
|
|
|
|
```yml
|
|
opensearch_security.openid.connect_url: "..."
|
|
opensearch_security.openid.client_id: "..."
|
|
opensearch_security.openid.client_secret: "..."
|
|
```
|
|
|
|
|
|
## "Authentication failed. Please provide a new token."
|
|
|
|
This error has several potential root causes.
|
|
|
|
|
|
### Leftover cookies or cached credentials
|
|
|
|
Please delete all cached browser data, or try again in a private browser window.
|
|
|
|
|
|
### Wrong client secret
|
|
|
|
To trade the access token for an identity token, most IdPs require you to provide a client secret. Check if the client secret in `opensearch_dashboards.yml` matches the client secret of your IdP configuration:
|
|
|
|
```
|
|
opensearch_security.openid.client_secret: "..."
|
|
```
|
|
|
|
|
|
### "Failed to get subject from JWT claims"
|
|
|
|
This error is logged on OpenSearch and means that the username could not be extracted from the ID token. Make sure the following setting matches the claims in the JWT your IdP issues:
|
|
|
|
```
|
|
openid_auth_domain:
|
|
enabled: true
|
|
order: 1
|
|
http_authenticator:
|
|
type: "openid"
|
|
...
|
|
config:
|
|
subject_key: <subject key>
|
|
...
|
|
```
|
|
|
|
### "Failed to get roles from JWT claims with roles_key"
|
|
|
|
This error indicates that the roles key you configured in `config.yml` does not exist in the JWT issued by your IdP. Make sure the following setting matches the claims in the JWT your IdP issues:
|
|
|
|
```
|
|
openid_auth_domain:
|
|
enabled: true
|
|
order: 1
|
|
http_authenticator:
|
|
type: "openid"
|
|
...
|
|
config:
|
|
roles_key: <roles key>
|
|
...
|
|
```
|