opensearch-project / security-dashboards-plugin

🔐 Manage your internal users, roles, access control, and audit logs from OpenSearch Dashboards
https://opensearch.org/docs/latest/security-plugin/index/
Apache License 2.0
70 stars 153 forks source link

Proxy-based authentication not working in kibana:1.11.0 #612

Closed WassimDhib closed 3 years ago

WassimDhib commented 3 years ago

Hi,

I use a docker image : amazon/opendistro-for-elasticsearch-kibana:1.11.0

Authentication with proxy worked fin in previous version (kibana:1.10.1)

Now, after upgrading to 1.11.0, I have this error when logging to Kibana :

{"statusCode":401,"error":"Unauthorized","message":"No Living connections"}

Elasticsearch is also in version, 1.11.0 Authentication with proxy is working fine for Elasticsearch

This is my kibana.yml :

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["https://localhost:9200"]
logging.verbose: false
elasticsearch.password: "kibanaserver"
elasticsearch.ssl.verificationMode: none
elasticsearch.username: "kibanaserver"
elasticsearch.requestHeadersWhitelist: ["securitytenant","Authorization","x-forwarded-for","x-proxy-user","x-proxy-roles"]
opendistro_security.auth.type: "proxy"
opendistro_security.multitenancy.enabled: true
opendistro_security.multitenancy.tenants.enable_global: false
opendistro_security.multitenancy.tenants.enable_private: true
opendistro_security.multitenancy.tenants.preferred: ["Private"]
opendistro_security.multitenancy.enable_filter: false
telemetry.enabled: false
opendistro_security.proxycache.user_header: "x-proxy-user"
opendistro_security.proxycache.roles_header: "x-proxy-roles"

My proxy is based on lemonldap::ng, it authenticates user against an ldap server, then addes x-forwarded-for, x-proxy-user, x-proxy-roles headers for each http request

WassimDhib commented 3 years ago

Hi,

Is there any updates ont this issue ?

I just installed the 1.12 version of odfe/odfe-kibana

Stille have this error : {"statusCode":401,"error":"Unauthorized","message":"No Living connections"}

WassimDhib commented 3 years ago

that was no an issue with Proxy-based authentication. It was related to elasticsearch.host parameter containing a "_" character