Elasticsearch JWE Errors after enabling Auth Tokens - Way to suppress?

Search Guard
1

If you think it is a bug report or you have a technical issue, please answer the following questions.

Elasticsearch version: 8.16.1

Kibana version (if relevant): 8.16.1

Browser version (if relevant): FF - 135.0.01

Describe the issue: After enabling the Searchguard Auth Tokens feature, the elasticsearch node backing Kibana is routinely showing INVALID_COMPACT_JWE errors in /var/log/elasticsearch/CLUSTER.log, making it more difficult to troubleshoot authentication and permission related logs that appear in that log. Unsure if this is a bug, or possibly a node on my end configured incorrectly, but looking for a way to suppress these particular messages.

Expected behavior: Prior to enabling auth tokens, these errors were not appearing.

Provide logs:
Elasticsearch
[2025-02-24T23:55:38,930][WARN ][o.a.c.r.s.j.j.JweCompactConsumer] [KIBANA-01] 5 JWE parts are expected
[2025-02-24T23:55:38,930][ERROR][c.f.s.a.r.RestRequestAuthenticationProcessor] [KIBANA-01] ‘org.apache.cxf.rs.security.jose.jwe.JweException: INVALID_COMPACT_JWE’ extracting credentials from sg_auth_token authentication frontend
org.apache.cxf.rs.security.jose.jwe.JweException: INVALID_COMPACT_JWE
at org.apache.cxf.rs.security.jose.jwe.JweCompactConsumer.(JweCompactConsumer.java:41) ~[?:?]
at org.apache.cxf.rs.security.jose.jwe.AbstractJweDecryption.decrypt(AbstractJweDecryption.java:50) ~[?:?]
at com.floragunn.searchguard.authtoken.AuthTokenService.getVerifiedJwtToken(AuthTokenService.java:492) ~[?:?]
at com.floragunn.searchguard.authtoken.AuthTokenHttpJwtAuthenticator.extractCredentials(AuthTokenHttpJwtAuthenticator.java:58) ~[?:?]

2

Thank you for the report!

A couple of more questions:

  • Did you configure the auth token service to produce encrypted JWTs?
  • Do you also other JWT based authentication methods (like OIDC or plain JWT)?
  • Which version of Search Guard are you using?
3

sg_auth_token_service:

# sg_auth_token_service v:3.0.2 cluster:ELK etag:368.601
---
enabled: true
jwt_signing_key_hs512: "Dc64..."
jwt_encryption_key_a256kw: "MvE..."
max_validity: "1y"

I have two OIDC providers configured for sg_frontend_authc