# SearchGuard and OIDC **URL:** \ **Category:** Search Guard\ **Created:** [September 16, 2026, 12:35pm UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049 "2026-09-16T12:35:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 16, 2026, 12:35pm UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/1 "2026-09-16T12:35:20Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. **Elasticsearch version:** ```auto 8.19.19 ``` **Kibana version (if relevant):** ```auto 8.19.19 ``` **Describe the issue:** I’m currently trying to configure OIDC in Kibana. Kibana is behind a Apache reverse proxy. I have problems with the settings and the documentation. The configuration file is ```auto --- _sg_meta: type: "frontend_authc" config_version: 2 default: debug: true auth_domains: - type: basic label: "Login" - type: oidc oidc: client_id: "kibanadev" client_secret: "XXXX" get_user_info: true use_dynamic_frontend_url: true idp: openid_configuration_url: "https://XXXXX/oidc/.well-known/openid-configuration" user_mapping: roles: from_comma_separated_string: "oidc_id_token.roles" ``` First point the \_sg\_meta is not provided in the documentation [Kibana OIDC Quick Start | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/kibana-authentication-openid). I’m not sure if it’s mandatory or not. The documentation talks about use\_pkce, but when I add it in the file, I got ```auto $ sudo java -Xmx1G -jar sgctl update-config --sgctl-config-dir=.../sgconf --debug /tmp/dev/sg_frontend_authc.yml Selected cluster: development ------------------------------------------------ HTTP/1.1 200 OK Content-Type: application/json {"user":"User O=XXXX","user_name":"XXXX","user_requested_tenant":null,"remote_address":null,"backend_roles":[],"attribute_names":[],"sg_roles":[],"sg_ten... ------------------------------------------------ Successfully connected to cluster development (esdev02.XXXX) as user XXXX Uploading config files: sg_frontend_authc.yml ------------------------------------------------ HTTP/1.1 400 Bad Request Content-Type: application/json {"status":400,"error":{"message":"'frontend_authc.default.auth_domains.1.oidc.use_pkce': Unsupported attribute","details":{"frontend_authc.default.auth_domains.1.oidc.use_pkce":[{"error":"Unsupported attribute","value":"true"}]}}} ------------------------------------------------ Invalid config files: /tmp/dev/sg_frontend_authc.yml: default.auth_domains.1.oidc.use_pkce: Unsupported attribute ``` `use_pkce` is described the Elastic plugin source code. But it’s seems to be missing in the Kibana plugin. I also a problem in the callback URL. As it’s behind a reverse proxy, it’s resolved as [http://localhost:5602/auth/openid/login](http://localhost:5602/auth/openid/login) that will obviously fails. The document says to configure `use_dynamic_frontend_url` to control the usage of `frontend_base_url`. I tried to then set default.auth\_domains.1.oidc.idp.frontend\_base\_url to “[https://XXXX/auth/openid/login](https://XXXX/auth/openid/login)” and efault.auth\_domains.1.oidc.use\_dynamic\_frontend\_url to false, but now the callback URL is the quite strange [https://XXXX:5601/auth/openid/login](https://XXXX:5601/auth/openid/login) instead of localhost. I don’t know how I can handle that. ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 16, 2026, 3:47pm UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/2 "2026-09-16T15:47:41Z")
I solved my callback URL problem. I set use\_dynamic\_frontend\_url to false and fixed a bug in kibana.yml, the plugin uses the value of server.publicBaseUrl that was incorrectly set in my case. I now have another problem. I added a custom profiles groups with the claim memberOf that return the attribute memberOf as extracted from ActiveDirectory. But it’s parsed with the value user\_mapping.roles.from\_comma\_separated\_string. That does not fit a list of DN where the real separator is `, `. ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [September 17, 2026, 7:11pm UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/3 "2026-09-17T19:11:49Z")
Hello @fbacchella Are these roles included in the token in DN format, or is the CN extracted for each role? Regarding `use_pkce` option, the documentation is incorrect. The correct setting is `oidc.pkce` . ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 18, 2026, 9:36am UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/4 "2026-09-18T09:36:11Z")
It was only a documentation problem. OIDC can provide the group list as an array of group, so the best solution is not to use `from_comma_separated_string` but directly `from` the userinfo endpoint. To sum up, I see 3 possible improvement to do in the documentation — correct the `use_pcke` — In the Dynamic Frontend URL section, explain more clearly that the used settings is `server.publicBaseUrl`, and `use_dynamic_frontend_url` should be set to false. I don’t even understand the purpose of this in Advanced settings, it generated confusion with the settings in Kibana setup section that is correct. — The `from_comma_separated_string` is a fails back settings, and it’s only used if the groups list provided is not correctly generated from the idp. ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 18, 2026, 9:51am UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/5 "2026-09-18T09:51:13Z")
Another small improvement that can be done. In my OIDC server, I see in the logs [2026-09-18 11:23:41] 10.xx.xx9.xx “XXXX” “GET /oidc/.well-known/openid-configuration HTTP/1.1” 5420 200 + 4540 “-” “Apache-HttpClient/4.5.14 (Java/25.0.4.1)” Providing an helpfull User-Agent string like “SearchGuard/XX ElasticSearch/XXX” would be nice to identify logs. ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [October 9, 2026, 9:52am UTC](https://forum.search-guard.com/t/searchguard-and-oidc/5049/6 "2026-10-09T09:52:02Z")
Closed on October 9, 2026, 9:52am UTC This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.