Skip to content

Commit ea0d2b5

Browse files
eedugoneedugon
authored
yaml values indentation fixed and aligned with the other oidc page (#1493)
This solves a bug discovered @rgshenoy in #1416 Replaces #1416 Some indentation in the yaml configuration for Elasticsearch and Kibana was incorrect. We have fixed it and aligned the format with the other OIDC document. Note that while reviewing all other examples in other realms (LDAP, SAML, etc) there's no alignment at all in the format of the suggested yaml settings. It might be good to align them in a separate PR, although it's not really an issue or important. cc: @shainaraskas
1 parent 1251b96 commit ea0d2b5

File tree

1 file changed

+48
-63
lines changed

1 file changed

+48
-63
lines changed

‎deploy-manage/users-roles/cluster-or-deployment-auth/oidc-examples.md

Lines changed: 48 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -75,26 +75,21 @@ For more information about OpenID connect in Azure, refer to [Azure OAuth 2.0 an
7575
To configure {{es}} for OIDC, [update your {{es}} user settings](../../../deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) with the following configuration:
7676

7777
```sh
78-
xpack:
79-
security:
80-
authc:
81-
realms:
82-
oidc:
83-
oidc1:
84-
order: 2
85-
rp.client_id: "<Application (client) ID>"
86-
rp.response_type: "code"
87-
rp.requested_scopes: ["openid", "email"]
88-
rp.redirect_uri: "KIBANA_ENDPOINT_URL/api/security/oidc/callback"
89-
op.issuer: "https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0"
90-
op.authorization_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/authorize"
91-
op.token_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/token"
92-
op.userinfo_endpoint: "https://graph.microsoft.com/oidc/userinfo"
93-
op.endsession_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/logout"
94-
rp.post_logout_redirect_uri: "KIBANA_ENDPOINT_URL/logged_out"
95-
op.jwkset_path: "https://login.microsoftonline.com/<Directory (tenant) ID>/discovery/v2.0/keys"
96-
claims.principal: email
97-
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
78+
xpack.security.authc.realms.oidc.oidc1:
79+
order: 2
80+
rp.client_id: "<Application (client) ID>"
81+
rp.response_type: "code"
82+
rp.requested_scopes: ["openid", "email"]
83+
rp.redirect_uri: "KIBANA_ENDPOINT_URL/api/security/oidc/callback"
84+
op.issuer: "https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0"
85+
op.authorization_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/authorize"
86+
op.token_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/token"
87+
op.userinfo_endpoint: "https://graph.microsoft.com/oidc/userinfo"
88+
op.endsession_endpoint: "https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/logout"
89+
rp.post_logout_redirect_uri: "KIBANA_ENDPOINT_URL/logged_out"
90+
op.jwkset_path: "https://login.microsoftonline.com/<Directory (tenant) ID>/discovery/v2.0/keys"
91+
claims.principal: email
92+
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
9893
```
9994

10095
Where:
@@ -144,11 +139,11 @@ For more information about OpenID connect in Azure, refer to [Azure OAuth 2.0 an
144139
145140
```sh
146141
xpack.security.authc.providers:
147-
oidc.oidc1:
142+
oidc.oidc1:
148143
order: 0
149144
realm: oidc1
150145
description: "Log in with Azure"
151-
basic.basic1:
146+
basic.basic1:
152147
order: 1
153148
```
154149
@@ -192,24 +187,19 @@ For more information about OpenID connect in Google, refer to [Google OpenID Con
192187
To configure {{es}} for OIDC, [update your {{es}} user settings](../../../deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) with the following configuration:
193188
194189
```sh
195-
xpack:
196-
security:
197-
authc:
198-
realms:
199-
oidc:
200-
oidc1:
201-
order: 2
202-
rp.client_id: "YOUR_CLIENT_ID"
203-
rp.response_type: "code"
204-
rp.requested_scopes: ["openid", "email"]
205-
rp.redirect_uri: "<KIBANA_ENDPOINT_URL>/api/security/oidc/callback"
206-
op.issuer: "https://accounts.google.com"
207-
op.authorization_endpoint: "https://accounts.google.com/o/oauth2/v2/auth"
208-
op.token_endpoint: "https://oauth2.googleapis.com/token"
209-
op.userinfo_endpoint: "https://openidconnect.googleapis.com/v1/userinfo"
210-
op.jwkset_path: "https://www.googleapis.com/oauth2/v3/certs"
211-
claims.principal: email
212-
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
190+
xpack.security.authc.realms.oidc.oidc1:
191+
order: 2
192+
rp.client_id: "YOUR_CLIENT_ID"
193+
rp.response_type: "code"
194+
rp.requested_scopes: ["openid", "email"]
195+
rp.redirect_uri: "<KIBANA_ENDPOINT_URL>/api/security/oidc/callback"
196+
op.issuer: "https://accounts.google.com"
197+
op.authorization_endpoint: "https://accounts.google.com/o/oauth2/v2/auth"
198+
op.token_endpoint: "https://oauth2.googleapis.com/token"
199+
op.userinfo_endpoint: "https://openidconnect.googleapis.com/v1/userinfo"
200+
op.jwkset_path: "https://www.googleapis.com/oauth2/v3/certs"
201+
claims.principal: email
202+
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
213203
```
214204
215205
Where:
@@ -262,11 +252,11 @@ For more information about OpenID connect in Google, refer to [Google OpenID Con
262252
263253
```sh
264254
xpack.security.authc.providers:
265-
oidc.oidc1:
255+
oidc.oidc1:
266256
order: 0
267257
realm: oidc1
268258
description: "Log in with Google"
269-
basic.basic1:
259+
basic.basic1:
270260
order: 1
271261
```
272262
@@ -308,25 +298,20 @@ For more information about OpenID connect in Okta, refer to [Okta OAuth 2.0 docu
308298
To configure {{es}} for OIDC, [update your {{es}} user settings](../../../deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) with the following configuration:
309299
310300
```sh
311-
xpack:
312-
security:
313-
authc:
314-
realms:
315-
oidc:
316-
oidc1:
317-
order: 2
318-
rp.client_id: "YOUR_CLIENT_ID"
319-
rp.response_type: "code"
320-
rp.requested_scopes: ["openid", "email"]
321-
rp.redirect_uri: "KIBANA_ENDPOINT_URL/api/security/oidc/callback"
322-
op.issuer: "https://YOUR_OKTA_DOMAIN"
323-
op.authorization_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/authorize"
324-
op.token_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/token"
325-
op.userinfo_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/userinfo"
326-
op.endsession_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/logout"
327-
op.jwkset_path: "https://YOUR_OKTA_DOMAIN/oauth2/v1/keys"
328-
claims.principal: email
329-
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
301+
xpack.security.authc.realms.oidc.oidc1:
302+
order: 2
303+
rp.client_id: "YOUR_CLIENT_ID"
304+
rp.response_type: "code"
305+
rp.requested_scopes: ["openid", "email"]
306+
rp.redirect_uri: "KIBANA_ENDPOINT_URL/api/security/oidc/callback"
307+
op.issuer: "https://YOUR_OKTA_DOMAIN"
308+
op.authorization_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/authorize"
309+
op.token_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/token"
310+
op.userinfo_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/userinfo"
311+
op.endsession_endpoint: "https://YOUR_OKTA_DOMAIN/oauth2/v1/logout"
312+
op.jwkset_path: "https://YOUR_OKTA_DOMAIN/oauth2/v1/keys"
313+
claims.principal: email
314+
claim_patterns.principal: "^([^@]+)@YOUR_DOMAIN\\.TLD$"
330315
```
331316
332317
Where:
@@ -376,10 +361,10 @@ Remember to add this configuration for each node type in the [User settings](../
376361
377362
```sh
378363
xpack.security.authc.providers:
379-
oidc.oidc1:
364+
oidc.oidc1:
380365
order: 0
381366
realm: oidc1
382367
description: "Log in with Okta"
383-
basic.basic1:
368+
basic.basic1:
384369
order: 1
385370
```

0 commit comments

Comments
 (0)