Search Guard Keycloak Open ID endless loop for users with a lot of groups

[Kosmonafft]

Hi folks,

In relation to my question some months ago:

Kibana OpenID Keycloak too many redirects

Hi folks, I have some users who are not able to access kibana because their browser stops: too many redirects. The only difference between other users who do not expirience such behavior is that they are members of quite a lot of active directory groups (30+), which are returned by keycloak in the payload (groups claim). Could it be that search guard fails to handle too many values in the groups claim and some how tries to redirect to keycloak again which creates a loop and finaly breaks? Ma…

I wanted to ask if you have an estimated date for this? We are currently updating our components to 7.15.2 and as far as I am testing this has not been solved yet, right?

Thank you very much

[nils]

In order to fix this issue, we have to do some quite fundamental changes; a preview of these changes is available right now as tech preview:

Now Available: Technical preview for the next generation of Search Guard

We are glad to announce an important milestone towards the next generation of Search Guard. Today, we are releasing a Search Guard technical preview; it brings a number of important and fundamental improvements: Support for OpenSearch and OpenSearch Dashboards New session-based login for Dashboards/Kibana - fixing lots of outstanding issues with Kibana login and cookies New easy-to-use and lightweight command line administration tool for Search Guard For download links and documentation go h…

It is not suitable for production, yet, but we are very grateful for users who try it on their test systems. Any feedback will greatly help us in completing it.

A new tech preview is scheduled for beginning of 2022.

We hope to have a general availability release ready by end of Q1 2022.

[Kosmonafft]

We can try to run it for our dev cluster and report