# Issue in integration of searchguard kibana plugin with ssl-enabled keycloak **URL:** \ **Category:** Search Guard\ **Created:** [November 30, 2018, 6:23pm UTC](https://forum.search-guard.com/t/issue-in-integration-of-searchguard-kibana-plugin-with-ssl-enabled-keycloak/1230 "2018-11-30T18:23:01Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![shivani.aggarwal2195](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/shivani.aggarwal2195/32/571_2.png) [@shivani.aggarwal2195](https://forum.search-guard.com/u/shivani.aggarwal2195)\ **Post date:** [November 30, 2018, 6:23pm UTC](https://forum.search-guard.com/t/issue-in-integration-of-searchguard-kibana-plugin-with-ssl-enabled-keycloak/1230/1 "2018-11-30T18:23:01Z")
Hi, I have trouble in achieving Kibana Single Sign On with keycloak IdP. I have followed the documentation from: [https://search-guard.com/kibana-openid-keycloak/](https://search-guard.com/kibana-openid-keycloak/) My keycloak is **ssl-enabled and is accessed via https.** - Search Guard: 6.4.1 Elasticsearch version: 6.4.1 - Installed and used enterprise modules: openid-based authentication - JVM version: openjdk 1.8-191 operating system version: RHEL 7.5 - Search Guard configuration files : Attached kibana.yml & sg\_config.yml - Elasticsearch log messages on debug level: No related logs These are my configuration files. **kibana.yml** : (attached full file) # SSL for outgoing requests from the Kibana Server to the browser (PEM formatted) server.ssl.cert: /etc/kibana/admin.crt.pem server.ssl.key: /etc/kibana/admin.key.pem server.ssl.supportedProtocols: [“TLSv1.2”] searchguard.cookie.secure: true searchguard.auth.type: “openid” searchguard.openid.connect\_url: “[https://x.x.x.x:8666/auth/realms/elk/.well-known/openid-configuration](https://x.x.x.x:8666/auth/realms/elk/.well-known/openid-configuration)” searchguard.openid.client\_id: “elk-kibana-sso” searchguard.openid.client\_secret: “a70c7db0-939e-444b-bc91-b652d10bc60c” searchguard.openid.header: “Authorization” # The Elasticsearch instance to use for all your queries. elasticsearch.url: “[https://x.x.x.x:9200](https://x.x.x.x:9200)” `` **sg\_config.yml** (attached full file ) authc: openid\_auth\_domain: http\_enabled: true enabled: true transport\_enabled: true order: 1 http\_authenticator: type: openid challenge: false config: subject\_key: preferred\_username roles\_key: roles openid\_connect\_url: [https://x.x.x.x:8666/auth/realms/belk/.well-known/openid-configuration](https://x.x.x.x:8666/auth/realms/belk/.well-known/openid-configuration) verify\_hostnames: false authentication\_backend: type: noop basic\_internal\_auth\_domain: http\_enabled: true enabled: true transport\_enabled: true order: 0 http\_authenticator: type: basic challenge: false authentication\_backend: type: internal `` **Keycloak client settings** look like this: ![kibana-sso-client.PNG](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/5a51ee60b65c30bab15e862781e103f94943e0fc.png) Note: Kibana and keycloak server are running on the same machine. Keycloak is accessible via [https://x.x.x.x:8666/auth](https://x.x.x.x:8666/auth) With the above configurations, when I enter kibana url in the browser i.e. **[https://x.x.x.x:5601](https://x.x.x.x:5601)** : - it redirects to keycloak’s UI i.e. [https://x.x.x.x:8666/auth/realms/elk/protocol/openid-connect/auth?client\_id=elk-kibana-sso&response\_type=code&redirect\_uri=https%3A%2F%2Fx.x.x.x%3A5601%2Fauth%2Fopenid%2Flogin&state=6dlsAjt7Xd4Kw6OwkgLc7i&scope=openid%20profile%20email%20address%20phone](https://x.x.x.x:8666/auth/realms/elk/protocol/openid-connect/auth?client_id=elk-kibana-sso&response_type=code&redirect_uri=https%3A%2F%2Fx.x.x.x%3A5601%2Fauth%2Fopenid%2Flogin&state=6dlsAjt7Xd4Kw6OwkgLc7i&scope=openid%20profile%20email%20address%20phone) `` - on the keycloak UI, I enter the user’s credentials and submit - it redirects to [https://x.x.x.x:5601/auth/openid/login?state=jbLzzzkoOCp..&session\_state=32af94e9-9](https://x.x.x.x:5601/auth/openid/login?state=jbLzzzkoOCp..&session_state=32af94e9-9)… with this following error messsage on the screen. ```auto kibana.yml (3.64 KB) sg_config.yml (8.25 KB)
··· ** {"statusCode":502,"error":"Bad Gateway","message":"self signed certificate"}** I could not find any log messages related to this in kibana or elasticsearch. With the same setup, when I use ssl-disabled keycloak (i.e keycloak on http), I am able to successfully login to kibana. Can you tell me if I have missed any configurations on keycloak or kibana's side to achieve this functionality? Thanks, Shivani
``` ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [December 3, 2018, 11:04am UTC](https://forum.search-guard.com/t/issue-in-integration-of-searchguard-kibana-plugin-with-ssl-enabled-keycloak/1230/2 "2018-12-03T11:04:37Z")
We need to look into this, I will keep you updated! > **···** > > On Friday, November 30, 2018 at 7:23:01 PM UTC+1, [shivani.aggarwal2195@gmail.com](mailto:shivani.aggarwal2195@gmail.com) wrote: > > > > > > Hi, > > > > > > I have trouble in achieving Kibana Single Sign On with keycloak IdP. > > > I have followed the documentation from: [https://search-guard.com/kibana-openid-keycloak/](https://search-guard.com/kibana-openid-keycloak/) > > > My keycloak is **ssl-enabled and is accessed via https.** > > > > > > - Search Guard: 6.4.1 > > > Elasticsearch version: 6.4.1 > > > - Installed and used enterprise modules: openid-based authentication > > > - JVM version: openjdk 1.8-191 > > > operating system version: RHEL 7.5 > > > - Search Guard configuration files : Attached kibana.yml & sg\_config.yml > > > - Elasticsearch log messages on debug level: No related logs > > > > > > > > > These are my configuration files. > > > > > > **kibana.yml** : (attached full file) > > > # SSL for outgoing requests from the Kibana Server to the browser (PEM formatted) > > > > server.ssl.cert: /etc/kibana/admin.crt.pem > > server.ssl.key: /etc/kibana/admin.key.pem > > server.ssl.supportedProtocols: [“TLSv1.2”] > > searchguard.cookie.secure: true > > > > searchguard.auth.type: “openid” > > searchguard.openid.connect\_url: “[https://x.x.x.x:8666/auth/realms/elk/.well-known/openid-configuration](https://x.x.x.x:8666/auth/realms/elk/.well-known/openid-configuration)” > > searchguard.openid.client\_id: “elk-kibana-sso” > > searchguard.openid.client\_secret: “a70c7db0-939e-444b-bc91-b652d10bc60c” > > searchguard.openid.header: “Authorization” > > > > # The Elasticsearch instance to use for all your queries. > > > > elasticsearch.url: “[https://x.x.x.x:9200](https://x.x.x.x:9200)” > > > `` > > > > > > > > > **sg\_config.yml** (attached full file ) > > authc: > > openid\_auth\_domain: > > http\_enabled: true > > enabled: true > > transport\_enabled: true > > order: 1 > > http\_authenticator: > > type: openid > > challenge: false > > config: > > subject\_key: preferred\_username > > roles\_key: roles > > openid\_connect\_url: [https://x.x.x.x:8666/auth/realms/belk/.well-known/openid-configuration](https://x.x.x.x:8666/auth/realms/belk/.well-known/openid-configuration) > > verify\_hostnames: false > > authentication\_backend: > > type: noop > > basic\_internal\_auth\_domain: > > http\_enabled: true > > enabled: true > > transport\_enabled: true > > order: 0 > > http\_authenticator: > > type: basic > > challenge: false > > authentication\_backend: > > type: internal > > > `` > > > > > > > > > **Keycloak client settings** look like this: > > > > > > ![kibana-sso-client.PNG](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/b/b9f0dd109351c9b1adb13bd5c0ad7acec8a8a738.png) > > > > > > > > > > > > > > > > > > Note: Kibana and keycloak server are running on the same machine. > > > Keycloak is accessible via [https://x.x.x.x:8666/auth](https://x.x.x.x:8666/auth) > > > > > > > > > With the above configurations, when I enter kibana url in the browser i.e. **[https://x.x.x.x:5601](https://x.x.x.x:5601)** : > > > > > > - it redirects to keycloak’s UI i.e. > > > [https://x.x.x.x:8666/auth/realms/elk/protocol/openid-connect/auth?client\_id=elk-kibana-sso&response\_type=code&redirect\_uri=https%3A%2F%2Fx.x.x.x%3A5601%2Fauth%2Fopenid%2Flogin&state=6dlsAjt7Xd4Kw6OwkgLc7i&scope=openid%20profile%20email%20address%20phone](https://x.x.x.x:8666/auth/realms/elk/protocol/openid-connect/auth?client_id=elk-kibana-sso&response_type=code&redirect_uri=https%3A%2F%2Fx.x.x.x%3A5601%2Fauth%2Fopenid%2Flogin&state=6dlsAjt7Xd4Kw6OwkgLc7i&scope=openid%20profile%20email%20address%20phone) > > > `` > > > > > > - on the keycloak UI, I enter the user’s credentials and submit > > > > > > - it redirects to [https://x.x.x.x:5601/auth/openid/login?state=jbLzzzkoOCp…&session\_state=32af94e9-9…](https://x.x.x.x:5601/auth/openid/login?state=jbLzzzkoOCp..&session_state=32af94e9-9..)… > > > with this following error messsage on the screen. > > > ```auto > > ** > > {"statusCode":502,"error":"Bad Gateway","message":"self signed certificate"}** > > > > ``` > > > > > > I could not find any log messages related to this in kibana or elasticsearch. > > > With the same setup, when I use ssl-disabled keycloak (i.e keycloak on http), I am able to successfully login to kibana. > > > > > > Can you tell me if I have missed any configurations on keycloak or kibana’s side to achieve this functionality? > > > > > > > > > Thanks, > > > Shivani > > > > > >