# Auth error while using keycloak

**URL:** <https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586>\
**Category:** Search Guard\
**Created:** [July 8, 2019, 4:43pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586 "2019-07-08T16:43:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![njtk](https://avatars.discourse-cdn.com/v4/letter/n/da6949/32.png) [@njtk](https://forum.search-guard.com/u/njtk)\
**Post date:** [July 8, 2019, 4:43pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/1 "2019-07-08T16:43:16Z")

</div>

I am using the demo search guard scripts to initialize search guard.  
Below are the relevant configuration snippets.

I always get the auth error please provide a new token error in the browser.

I checked the elastic search logs it doesn’t have any of the errors listed here -

> **[OpenID Troubleshooting](https://docs.search-guard.com/latest/troubleshooting-openid)**
>
> Step-by-step instructions on how to troubleshoot OpenID Connect issues in Elasticsearch and Kibana.

I tried removing the roles\_key from the configuration but still get the same error.

Note: I do not have role mappings.

I am running kibana and elasticsearch as rpms on centos 7

- Your Search Guard configuration files  
http:  
anonymous\_auth\_enabled: true  
xff:  
enabled: false  
internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern  
authc:  
basic\_internal\_auth\_domain:  
description: “Authenticate via HTTP Basic against internal users database”  
http\_enabled: true  
transport\_enabled: true  
order: 0  
http\_authenticator:  
type: basic  
challenge: false  
authentication\_backend:  
type: internal  
openid\_auth\_domain:  
http\_enabled: true  
order: 1  
http\_authenticator:  
type: openid  
challenge: false  
config:  
openid\_connect\_url: [https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration](https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration)  
subject\_key: preferred\_username  
roles\_key: roles  
enable\_ssl: false  
verify\_hosts: false  
authentication\_backend:  
type: noop

- Your elasticsearch.yml configuration file

searchguard.ssl.transport.pemcert\_filepath: esnode.pem  
searchguard.ssl.transport.pemkey\_filepath: esnode-key.pem  
searchguard.ssl.transport.pemtrustedcas\_filepath: root-ca.pem  
searchguard.ssl.transport.enforce\_hostname\_verification: false  
searchguard.ssl.http.enabled: true  
searchguard.ssl.http.pemcert\_filepath: esnode.pem  
searchguard.ssl.http.pemkey\_filepath: esnode-key.pem  
searchguard.ssl.http.pemtrustedcas\_filepath: root-ca.pem  
searchguard.allow\_unsafe\_democertificates: true  
searchguard.allow\_default\_init\_sgindex: true  
searchguard.authcz.admin\_dn:

- CN=kirk,OU=client,O=client,L=test, C=desearchguard.audit.type: internal\_elasticsearch  
searchguard.enable\_snapshot\_restore\_privilege: true  
searchguard.check\_snapshot\_restore\_write\_privileges: true  
searchguard.restapi.roles\_enabled: [“SGS\_ALL\_ACCESS”]  
cluster.routing.allocation.disk.threshold\_enabled: false  
cluster.name: searchguard\_demo  
node.max\_local\_storage\_nodes: 3  
xpack.security.enabled: false  
######## End Search Guard Demo Configuration ########If you are using Kibana, please also add:

- Your kibana.yml configuration file

xpack.security.enabled: falsesearchguard.cookie.password : “--------------------------------------”  
searchguard.auth.type: “openid”  
searchguard.openid.connect\_url: “[https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration”](https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration%E2%80%9D)  
searchguard.openid.client\_id: “kibana”  
searchguard.openid.client\_secret: “xxxxxxx”  
searchguard.cookie.secure: true

---

<div class="post-metadata">

**Author:** ![hsaly](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/hsaly/32/21_2.png) [@hsaly](https://forum.search-guard.com/u/hsaly)\
**Post date:** [July 9, 2019, 10:49am UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/2 "2019-07-09T10:49:59Z")

</div>



---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [July 9, 2019, 6:10pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/3 "2019-07-09T18:10:00Z")

</div>

I would have expected to see some log statements in either the Kibana or Elasticsearch logs. Usually, when you get this error it means the JWT is not valid or there are some problems talking to the IdP / Keycloak.

I see that you are using https for connecting to Keycloak. What kind of certificate are you using, is it self-signed?

Is so you might need to configure the root CA used for signing the certficate in Kibana and Elasticsearch.

For the ES OpenID module please see here:

> **[OpenID Connect](https://docs.search-guard.com/latest/openid-json-web-keys#tls-settings)**
>
> How to connect Search Guard with an OpenID provider like Keycloak and how to use JSON web keys to automatially fetch encryption keys

And make sure the `pemtrustedcas_filepath` or `pemtrustedcas_content` is set.

For Kibana, please make sure you configure the root CA in kibana.yml via:

`searchguard.openid.root_ca: <path to root CA>`

---

<div class="post-metadata">

**Author:** ![njtk](https://avatars.discourse-cdn.com/v4/letter/n/da6949/32.png) [@njtk](https://forum.search-guard.com/u/njtk)\
**Post date:** [July 10, 2019, 11:45pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/4 "2019-07-10T23:45:12Z")

</div>

The Idp login works as expected. When browse to Kibana url I get redirected to keycloak idp url, I login correctly but then get redirected to the auth error page.

I have custom certs. I have set them correctly i.e. `pemtrustedcas_filepath` or `pemtrustedcas_content`  
and searchguard.openid.root\_ca:

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [July 14, 2019, 7:21pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/5 "2019-07-14T19:21:57Z")

</div>

Your last post seems to be cut off somehow … can you attach your configuration files here please?

For example, in the sg\_config you posted I don’t see any configuration for the root CA and ssl is set to false:

```
config:
  openid_connect_url: https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration
  subject_key: preferred_username
  roles_key: roles
  enable_ssl: false
  verify_hosts: false

```

Also, in kibana.yml you posted initially I don’t see the searchguard.openid.root\_ca setting:

```
xpack.security.enabled: false
searchguard.cookie.password : “--------------------------------------”
searchguard.auth.type: “openid”
searchguard.openid.connect_url: “https://keycloak-host:31809/auth/realms/ABC/.well-known/openid-configuration”
searchguard.openid.client_id: “kibana”
searchguard.openid.client_secret: “xxxxxxx”
searchguard.cookie.secure: true

```

Can you please add the configuration files directly?

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [August 4, 2019, 7:29pm UTC](https://forum.search-guard.com/t/auth-error-while-using-keycloak/1586/6 "2019-08-04T19:29:39Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.