# Configuring different urls for searchguard.openid.connect\_url for internal & external access

**URL:** <https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869>\
**Category:** Search Guard\
**Created:** [June 23, 2020, 5:42pm UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869 "2020-06-23T17:42:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivani.aggarwal2195](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/shivani.aggarwal2195/32/571_2.png) [@shivani.aggarwal2195](https://forum.search-guard.com/u/shivani.aggarwal2195)\
**Post date:** [June 23, 2020, 5:42pm UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869/1 "2020-06-23T17:42:42Z")

</div>

Hello,  
I have enabled searchguard openid authentication (using keycloak) to secure ELK running in kubernetes cluster.  
Kibana interacts with keycloak at 2 points:

1. On kibana server startup, it connects to the openid metadata url configured (searchguard.openid.connect\_url in kibana.yml).
2. When user accesses kibana UI on the browser, it redirects to keycloak for authentication.

For both these interactions, the same keycloak connect url is getting used by the kibana-searchguard openid module.  
**Is it possible to configure different urls for these two backend & frontend interactions?**

In my case, keycloak server is accessible via **https** to the external world (i.e. to the browser) via a loadbalancer,  
while internally to the kubernetes cluster, it is accessible on http (with the kubernetes service name and port).  
**I do not have one keycloak url that is reachable by both kibana pod as well as the browser.**  
Any suggestions on how we could proceed with openid authentication?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [June 24, 2020, 7:46am UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869/2 "2020-06-24T07:46:42Z")

</div>

I’m not sure I understand the question.

You want to have a HTTP URL in Kibana.  
**kibana.yml**

```auto
searchguard.openid.connect_url: "http://keycloak.example.com:8080/auth/realms/master/.well-known/openid-configuration"

```

And HTTPS URL in Search Guard Elasticsearch plugin.  
**sg\_config.yml**

```auto
openid_auth_domain:
  enabled: true
  order: 1
  http_authenticator:
    config:
      openid_connect_url: https://keycloak.example.com:8080/auth/realms/master/.well-known/openid-configuration

```

Am I right? Did you try it? If tried, did you see errors?

> **[Quick Start](https://docs.search-guard.com/latest/kibana-authentication-openid)**
>
> How to use OpenID Connect and your favorite identity provider to implement Kibana Single Sign-On.

---

<div class="post-metadata">

**Author:** ![shivani.aggarwal2195](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/shivani.aggarwal2195/32/571_2.png) [@shivani.aggarwal2195](https://forum.search-guard.com/u/shivani.aggarwal2195)\
**Post date:** [June 24, 2020, 6:44pm UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869/3 "2020-06-24T18:44:18Z")

</div>

Ok thanks, but my question is about the kibana searchguard plugin alone. Let me explain my use-case a bit to clarify the query 🙂

- Keycloak, elasticsearch & kibana run as pods in kubernetes cluster. There are k8s services for each of these pods.

Within the k8s cluster, keycloak server is accessible at  
[http://keycloak.default.svc.cluster.local:8080](http://keycloak.default.svc.cluster.local:8080) (‘keycloak’ is the k8s service name in default namespace).  
That means - all pods in the cluster can reach the address

```auto
http://keycloak.default.svc.cluster.local:8080/auth/realms/master/.well-known/openid-configuration

```

- Keycloak is a UI application, so users need to access it from their browsers (which would be external to the k8s cluster). For this external access, a load-balancer(nginx ingress) is used and access is provided on https. That means, a user can access keycloak admin console on their browser by accessing [https://abc-xyz/auth](https://abc-xyz/auth).

- Now, to enable openid-auth in elasticsearch & kibana, following configurations are made:  
**sg\_config.yml (searchguard-elasticsearch)**

```auto
openid_auth_domain:
  enabled: true
  order: 1
  http_authenticator:
    config:
      openid_connect_url: http://keycloak.default.svc.cluster.local:8080/auth/realms/master/.well-known/openid-configuration

```

**kibana.yml (searchguard-kibana)**

```auto
searchguard.openid.connect_url: "http://keycloak.default.svc.cluster.local:8080/auth/realms/master/.well-known/openid-configuration"

```

* * *

**Issue** -

1. Now, kibana server (pod) starts successfully. User tries to open kibana UI on the browser on [https://abc-xyz/kibana](https://abc-xyz/kibana). As this is the first attempt to login and user is not authenticated yet, Kibana would redirect to keycloak UI (using the keycloak address configured in kibana.yml) on the browser to open the authentication page. After entering the user creds, keycloak would authenticate the user and load kibana home pg.

But now, since my browser does not identify the internal k8s svc address **keycloak.default.svc.cluster.local** , the redirection to keycloak fails.

1. If I want the browser redirection from kibana to keycloak (explained in prev point) to succeed, Kibana’s searchguard.openid.connect\_url should be configured with a url that the browser can resolve and reach. That means, in this case, [https://abc-xyz/auth](https://abc-xyz/auth).  
With this new configuration, when kibana server (pod) starts, it tries to contact the keycloak openid metadata url on service startup itself. Since the address in searchguard.openid.connect\_url ( [https://abc-xyz/auth](https://abc-xyz/auth)) is not reachable from a pod inside the k8s cluster, kibana server fails with the error -  
`Failed when trying to obtain the endpoints from your IdP`  
( Ref - [OpenID Troubleshooting | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/troubleshooting-openid))

So coming back to my query, **kibana** has two types of interations with keycloak server when openid is enabled:  
i. Kibana server to keycloak openid metadata url on kibana server startup  
ii. Kibana UI redirection to keycloak UI on browser when user attempts to access

For both these interactions, the same searchguard.openid.connect\_url is used by searchguard-kibana plugin.  
In my case as explained above, I do not have a single keycloak server url that is reachable for both these interactions.

How can I proceed? Is there a way to configure separate urls?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [June 26, 2020, 8:07am UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869/4 "2020-06-26T08:07:52Z")

</div>

Ok, now I understand. There is only one `searchguard.openid.connect_url` option, only for one URL.

> Since the address in searchguard.openid.connect\_url ( [https://abc-xyz/auth](https://abc-xyz/auth)) is not reachable from a pod inside the k8s cluster, kibana server fails with the error -  
> `Failed when trying to obtain the endpoints from your IdP`

Why can’t you make the URL reachable from the pod?

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [July 17, 2020, 8:07am UTC](https://forum.search-guard.com/t/configuring-different-urls-for-searchguard-openid-connect-url-for-internal-external-access/1869/5 "2020-07-17T08:07:57Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.