配置Elastic/Kibana与WSO2的OpenID SSO时遇认证失败问题求助

环境 #

• WSO2 Identity Server 7.0.0
• Elasticsearch/Kibana 8.18.1（已激活30天试用许可）

已完成配置步骤 #

1. 在WSO2控制台创建名为kibana的传统Web应用服务提供商，选择OpenID Connect协议，配置授权重定向URL为http://192.168.18.90:5601/api/security/oidc/callback和http://192.168.18.90:5601/security/logged_out，并允许共享email和groups属性；
2. 配置elasticsearch.yml，设置OIDC realm参数：

node.name: es01
cluster.name: my-cluster
discovery.type: single-node

network.host: 0.0.0.0
http.host: 0.0.0.0

bootstrap.memory_lock: true

xpack.security.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: certs/es01/es01.key
xpack.security.http.ssl.certificate: certs/es01/es01.crt
xpack.security.http.ssl.certificate_authorities: certs/ca/ca.crt

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.key: certs/es01/es01.key
xpack.security.transport.ssl.certificate: certs/es01/es01.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca/ca.crt
xpack.security.transport.ssl.verification_mode: certificate

xpack.security.authc.token.enabled: true
xpack.security.authc.realms.oidc.oidc1:
  order: 1
  rp.client_id: "Z1qRhSHIvtaSmJ39ypwcsSyeZ4Aa"
  rp.response_type: code
  rp.redirect_uri: "http://192.168.18.90:5601/api/security/oidc/callback"
  op.issuer: "https://192.168.18.90:9443/oauth2/token"
  op.authorization_endpoint: "https://192.168.18.90:9443/oauth2/authorize"
  op.token_endpoint: "https://192.168.18.90:9443/oauth2/token"
  op.jwkset_path: "https://192.168.18.90:9443/oauth2/jwks"
  op.endsession_endpoint: "https://192.168.18.90:9443/oidc/logout"
  op.userinfo_endpoint: "https://192.168.18.90:9443/oauth2/userinfo"
  rp.post_logout_redirect_uri: "http://192.168.18.90:5601/security/logged_out"
  claims.principal: sub
  ssl.verification_mode: none
  claims.groups: groups
  claims.name: name
  claims.mail: email

执行命令添加客户端密钥：

echo -n 'A6jb4fu7YPr6qAyEOBwNuPAI4bWoM0lZWecXGIu0zYga' | bin/elasticsearch-keystore add --stdin --force xpack.security.authc.realms.oidc.oidc1.rp.client_secret

3. 在WSO2中创建AnalyticsViewer角色及关联该角色的用户；
4. 在Kibana中配置角色映射，将WSO2的AnalyticsViewer角色关联到对应Kibana角色；
5. 配置kibana.yml启用OIDC认证提供者：

server.name: kibana
server.host: 0.0.0.0
server.port: 5601
#server.ssl.enabled: true
#server.ssl.certificate: /usr/share/kibana/config/certs/kibana/kibana.crt
#server.ssl.key: /usr/share/kibana/config/certs/kibana/kibana.key

elasticsearch.hosts: ["https://192.168.18.90:9200"]
elasticsearch.username: kibana_system
elasticsearch.password: test
elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/certs/ca/ca.crt"]

telemetry.enabled: false

xpack.security.authc.providers:
  oidc.oidc1:
    order: 0
    realm: "oidc1"
    description: "Log in with WSO2 Identity Server (OAuth2/OIDC)"
  basic.basic1:
    order: 1

错误现象 #

使用WSO2 SSO登录时出现401认证失败，Kibana日志如下：

[2025-06-07T18:45:23.608+00:00][INFO ][plugins.security.authentication] Performing login attempt with "oidc1" provider.
[2025-06-07T18:45:23.634+00:00][INFO ][plugins.security.authentication] Login attempt with "oidc1" provider succeeded (requires redirect: true).
[2025-06-07T18:45:55.889+00:00][INFO ][plugins.security.authentication] Performing login attempt with "oidc" provider.
[2025-06-07T18:45:55.979+00:00][WARN ][plugins.security.authenticator] Authentication attempt failed, existing session will be invalidated.
[2025-06-07T18:45:55.987+00:00][ERROR][plugins.security.authentication] Login attempt with "oidc" provider failed: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [<OIDC Token>] for action [cluster:admin/xpack/security/oidc/authenticate]","header":{"WWW-Authenticate":["Basic realm="security", charset="UTF-8"","Bearer realm="security"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [<OIDC Token>] for action [cluster:admin/xpack/security/oidc/authenticate]","header":{"WWW-Authenticate":["Basic realm="security", charset="UTF-8"","Bearer realm="security"","ApiKey"]}},"status":401}
[2025-06-07T18:45:55.991+00:00][WARN ][plugins.security.authentication] Could not authenticate user with the existing session. Forcing logout.

有时会显示“you don't have permission to access this page”，对应日志：

[2025-06-08T07:50:35.319+00:00][INFO ][plugins.security.authentication] Performing login attempt with "oidc" provider.
[2025-06-08T07:50:35.502+00:00][WARN ][plugins.security.authenticator] Authentication attempt failed, existing session will be invalidated.
[2025-06-08T07:50:35.507+00:00][ERROR][plugins.security.authentication] Login attempt with "oidc" provider failed: {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [<OIDC Token>] for action [cluster:admin/xpack/security/oidc/authenticate]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [<OIDC Token>] for action [cluster:admin/xpack/security/oidc/authenticate]","header":{"WWW-Authenticate":["Basic realm=\"security\", charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
[2025-06-08T07:50:35.509+00:00][WARN ][plugins.security.authentication] Could not authenticate user with the existing session. Forcing logout.

启动命令 #

Elasticsearch Docker启动命令：

docker run -it -d \
  --name es01 \
  -p 9200:9200 \
  -e ELASTIC_PASSWORD=test \
  --ulimit memlock=-1:-1 \
  -v /root/elastic-config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
  -v $PWD/certs:/usr/share/elasticsearch/config/certs \
  docker.elastic.co/elasticsearch/elasticsearch:8.18.1

Kibana Docker启动命令：

docker run -it -d \
  --name kibana \
  -p 5601:5601 \
  -v /root/elastic-config/kibana.yml:/usr/share/kibana/config/kibana.yml \
  docker.elastic.co/kibana/kibana:8.18.1

排查与解决步骤 #

1. 修正OIDC Issuer地址错误 #

elasticsearch.yml中op.issuer配置为https://192.168.18.90:9443/oauth2/token是错误的。OIDC的Issuer必须与WSO2 IS的OIDC发现端点（https://192.168.18.90:9443/oauth2/.well-known/openid-configuration）返回的issuer字段完全一致，正确值应为：

op.issuer: "https://192.168.18.90:9443/oauth2"

2. 确保客户端密钥正确加载 #

当前Docker启动命令未挂载Elasticsearch keystore文件，导致容器内无法读取客户端密钥。解决方式二选一：

• 挂载宿主机keystore到容器：修改Elasticsearch启动命令，添加-v /root/elastic-config/elasticsearch.keystore:/usr/share/elasticsearch/config/elasticsearch.keystore；
• 在容器内重新添加密钥：

docker exec -it es01 bash
echo -n 'A6jb4fu7YPr6qAyEOBwNuPAI4bWoM0lZWecXGIu0zYga' | bin/elasticsearch-keystore add --stdin --force xpack.security.authc.realms.oidc.oidc1.rp.client_secret
exit
docker restart es01

3. 验证WSO2 IS的ID Token签名算法 #

确保WSO2 IS使用RS256算法签名ID Token：

• 登录WSO2 IS控制台，进入kibana服务提供商配置页面；
• 在OAuth2/OpenID Connect Configuration中设置ID Token Signing Algorithm为RS256；
• 保存配置并重启WSO2 IS。

4. 检查ID Token包含必要Claims #

使用JWT解码工具解析WSO2返回的ID Token，确认包含sub（用户标识）、groups（含AnalyticsViewer角色）。若groups缺失：

• 在WSO2服务提供商的Requested Claims中添加groups并设为必填；
• 检查WSO2的Claim Configuration，确认groups映射到http://wso2.org/claims/role。

5. 重启服务测试 #

修改配置后，依次重启Elasticsearch、Kibana、WSO2 IS，重新尝试SSO登录。

内容的提问来源于stack exchange，提问作者I'm sK