# SearchGuard Authorization Via CURL **URL:** \ **Category:** Search Guard\ **Created:** [June 27, 2019, 6:55pm UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547 "2019-06-27T18:55:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mni](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/mni/32/580_2.png) [@mni](https://forum.search-guard.com/u/mni)\ **Post date:** [June 27, 2019, 6:55pm UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/1 "2019-06-27T18:55:30Z")
An external UI app is able to login the user with Keycloak and grab an access token from Keycloak. The next step for that UI is to use that access token to make a request to elasticsearch. We have tried a few ways we thought _should_ work and we have not been successful so far. Also, there is no mention in searchguard docs about how we can use CURL and pass an access token to make a request to ES. A solution using CURL would be appreciated because that would serve as a POC and then developers would be able to test/implement the authentication with SG depending on the language/framework they are using on the app side. ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [June 27, 2019, 7:33pm UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/2 "2019-06-27T19:33:44Z")
Hi, probably the easiest way to integrate Keycloak with Search Guard is to use the OpenID specification. We have OpenID support already built-in in the Kibana plugin. Depending on the type of application you are building, you may want to consider following that path. If I understood your use case correctly, I think the main problem is that you are trying to use the _access token_ that you retrieved from Keycloak for authentication. However, you need an _identity token_, which is the “real” JSON web token carrying the user identity. Once your application has obtained the identity token, you would then use the OpenID Connect authentication module with Search Guard: > **[OpenID Connect](https://docs.search-guard.com/latest/openid-json-web-keys)** > > How to connect Search Guard with an OpenID provider like Keycloak and how to use JSON web keys to automatially fetch encryption keys When using curl or any other HTTP client library, you can either append the identity token as an URL parameter or as an HTTP header. Search Guard supports both. In the configuration of the OpenID connect module, you can specify the name of the HTTP header by using the `jwt_header` parameter, or the `jwt_url_parameter` configuration setting in case you are using an URL parameter. ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [June 27, 2019, 7:33pm UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/3 "2019-06-27T19:33:51Z")
---
**Author:** ![mni](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/mni/32/580_2.png) [@mni](https://forum.search-guard.com/u/mni)\ **Post date:** [July 1, 2019, 3:04pm UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/4 "2019-07-01T15:04:43Z")
The ES and SearchGuard side is already secured using the openID specifications and works exactly how SearchGuard mentions it in the docs. The question however is sending a request using CURL and getting authenticated. Should the jwt\_header parameter still be used when using openid on the SearchGuard side? ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [July 2, 2019, 8:22am UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/5 "2019-07-02T08:22:52Z")
Ah, ok, now I understand. Yes, if you use curl to access the cluster the request should contain the JWT in the same HTTP header field as the OpenID module on Kibana uses. For example, if your SG configuration looks like: ``` openid_auth_domain: http_enabled: true ... http_authenticator: type: openid ... config: jwt_header: "Authorization" ... authentication_backend: type: noop ``` Then a curl call would look like: `curl -k -H "Authorization: Bearer " -XGET "https://:/_searchguard/authinfo?pretty"` Where _JWT_ is the _identitiy token_ from Keycloak (not the _access token_) ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [July 23, 2019, 8:22am UTC](https://forum.search-guard.com/t/searchguard-authorization-via-curl/1547/6 "2019-07-23T08:22:52Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.