Hi! I’m using the trial for ROR Enterprise and I’m working on setting up SAML with keycloak on my local ELK running in Kubernetes. I followed the instructions from the documentation to setup both Keycloak side and ELK side. But I am not able to login with Keycloak because I get redirected to the login screen again. I’ll leave here the config that I’m using and the output from the logs.
Elasticsearch version: 8.10.4
Kibana version 8.10.4
ROR-ES version: 1.53.0_es8.10.4
ROR-Kibana version: 1.53.0_es8.10.4
My configs:
readonlyrest.yml:
readonlyrest:
audit_collector: true
audit_index_template: "'readonlyrest_audit'-yyyy"
prompt_for_basic_auth: false
response_if_req_forbidden: Access forbidden
access_control_rules:
- name: "Allow requests for cluster health"
hosts:
- elasticsearch-all-master-hl.elk.svc.cluster.local,
- name: "::KIBANA-SRV::"
auth_key: kibana:kibana
verbosity: error
- name: "ReadonlyREST Enterprise instance #1"
kibana:
access: admin
index: "*"
ror_kbn_auth:
name: "keycloak"
ror_kbn:
- name: keycloak
signature_key: <some_key>
kibana.yml
pid.file: /opt/bitnami/kibana/tmp/kibana.pid
server.host: "::"
server.port: 5601
elasticsearch.hosts: [http://elasticsearch-all-master-hl.elk.svc.cluster.local:9200]
server.rewriteBasePath: false
elasticsearch.password: kibana
elasticsearch.requestHeadersWhitelist:
- authorization
- x-forwarded-user
- x-access-group
elasticsearch.username: kibana
readonlyrest_kbn.auth:
saml_serv1:
buttonName: Keycloak
cert: <cert_from_keycloak>
enabled: true
entryPoint: https://vkeycloak.obs/realms/vkibana/protocol/saml
groupsParameter: memberOf
issuer: http://kibana.local/
kibanaExternalHost: kibana.local
logoutUrl: https://vkeycloak.obs/realms/vkibana/protocol/saml/resolve
protocol: http
type: saml
usernameParameter: nameID
signature_key: <some_key>
readonlyrest_kbn.license.activationKeyFilePath: /etc/kibana/ROR_ACTIVATION_KEY.txt
readonlyrest_kbn.license.activationKeyRetrievalModes:
- file
readonlyrest_kbn.logLevel: debug
readonlyrest_kbn.login_subtitle: Blah
readonlyrest_kbn.login_title: Welcome to Kibana
readonlyrest_kbn.multiTenancyEnabled: false
readonlyrest_kbn.session_timeout_minutes: 720
readonlyrest_kbn.store_sessions_in_index: true
server.publicBaseUrl: http://vkibana.local
xpack.apm.enabled: false
xpack.apm.ui.enabled: false
xpack.canvas.enabled: false
xpack.infra.enabled: false
xpack.reporting.roles.enabled: false
xpack.security.enabled: false
Output from Kibana:
[warning][plugins][ReadonlyREST][samlController] JWT token size is approaching the limit (size: 7444 of 8185 Bytes)! Please set "readonlyrest_kbn.logLevel: debug", look for "Created JWT for ROR with claims" in Kibana logs, and inspect for any data duplication in the JSON Object. If no data is being duplicated, this user has too many groups, or the individual group strings length are too long.
...
Created JWT for ROR with claims: {"user":"natalia.mellino@avature.net","groups":[....],,"assertion":{"issuer":"https://vkeycloak.obs/realms/vkibana","inResponseTo":"_c1e6609e5960c84ab711","sessionIndex":"f6e22e53-c24e-4e3f-934d-a112fd6ede0f::fcebcc76-f673-4ea7-a4d8151742a85b14","nameID":"user@email","nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","Role":"default-roles-vkibana"},"x-ror-origin":"saml_serv1"}, (size: 7444 of 8185 Bytes))
...
[15:24:52:231] [error][plugins][ReadonlyREST][esClient] ES Authorization error: 403 Error: ES Authorization error: 403
at l.e (/opt/bitnami/kibana/plugins/readonlyrestkbn/proxy/core/esClient.js:1:17932)
at l.e (/opt/bitnami/kibana/plugins/readonlyrestkbn/proxy/core/esClient.js:1:5483)
at tryCatch (/opt/bitnami/kibana/plugins/readonlyrestkbn/node_modules/regenerator-runtime/runtime.js:45:40)
at Generator.invoke [as _invoke (/opt/bitnami/kibana/plugins/readonlyrestkbn/node_modules/regenerator-runtime/runtime.js:274:22)
at Generator.prototype.<computed> [as next] (/opt/bitnami/kibana/plugins/readonlyrestkbn/node_modules/regenerator-runtime/runtime.js:97:21)
at asyncGeneratorStep (/opt/bitnami/kibana/plugins/readonlyrestkbn/node_modules/@babel/runtime/helpers/asyncToGenerator.js:3:24)
at _next (/opt/bitnami/kibana/plugins/readonlyrestkbn/node_modules/@babel/runtime/helpers/asyncToGenerator.js:25:9)
at processTicksAndRejections (node:internal/process/task_queues:95:5)
[15:24:52:231] [debug][plugins][ReadonlyREST][authController] login request rejected: username: user@email
[15:24:52:231] [info][plugins][ReadonlyREST][authController] Could not login in: WRONG_CREDENTIALS
[15:24:52:232] [debug][plugins][ReadonlyREST][authorizationHeadersValidation] There is no identity session. Token revalidation aborted
Output from ES:
FORBIDDEN by default req={ ID:1302400855-1579723820#7672, TYP:RRUserMetadataRequest
, CGR:<N/A>, USR:[no info about user], BRS:true, KDX:null, ACT:cluster:internal_ror/user_metadata/ge
t, OA:10.42.2.185/32, XFF:null, DA:10.42.2.187/32, IDX:<N/A>, MET:GET, PTH:/_readonlyrest/metadata/c
urrent_user, CNT:<N/A>, HDR:Accept-Encoding=gzip,deflate, Accept=*/*, Authorization=<OMITTED>, Conne
ction=close, Host=elasticsearch-all-master-hl.elk.svc.cluster.local:9200, User-Agent=node-fetch/1.0
(+https://github.com/bitinn/node-fetch), content-length=0, cookie=x-csrf-token-e4dbaf9d-cf83-4b04-84
9c-b7c2dcbf1ea2=db98b0855dc77aa82550b6b0ed2826dc3be1f4233c17a7b2cf7fb1fc87c923c7; x-csrf-token-3bc0d
56a-79f6-4130-ad92-e22db46786aa=68210960520eeb131adb624a5c05da862f6aee2116d325ae1f02fc6912b18b70; x-
csrf-token-fac7fd9d-31b9-492a-b02a-4e04ab1c0210=ec233016b9cdeee750e2b628f9769b374d69661c5fe90322cdf3
c4083905bf9e; x-csrf-token-305fcb86-d097-4029-93ce-c0174c5d92cc=a65ec15ebe34a5731f014565965d49baca22
3e6fb9a056a5ac1141abfb28d268; rorCookie_saml_serv1=s%3A79U7QZvIqOufONWwDebIyrzWIHmxTt3w.87Ol7zTjoH%2
F%2FHjB3dEuGY5Ezq%2BFCmuHU9nmUD6JBPoU, elastic-apm-traceparent=00-0b6e3b4ff53c79217176d95e9ee87090-e
ef4e51fd8970620-00, traceparent=00-0b6e3b4ff53c79217176d95e9ee87090-eef4e51fd8970620-00, tracestate=
es=s:0, x-ror-origin=saml_serv1, HIS:[Allow requests for cluster health-> RULES:[hosts->false]], [::
KIBANA-SRV::-> RULES:[auth_key->false]], [ReadonlyREST Enterprise instance #1-> RULES:[ror_kbn_auth-
>false]], }
It is not a problem with my credentials since I’ve already checked that they are correct, and I see in Keycloak that I’m getting authenticated, but ES is throwing me a ‘forbidden’. Another thing that caught my attention is that in the ES logs I see USR:[no info about user] instead of my username I don’t know if that’s the expected behavior or not but I point it out just in case.
Any help with this will be appreciated, thanks in advance!