Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ERROR An error ocurred in the delayed request: "DELETE /security/user/authenticate" #1032

Open
Nestor42 opened this issue Sep 8, 2023 · 0 comments

Comments

@Nestor42
Copy link

Nestor42 commented Sep 8, 2023

Hello. I'm trying to enable authentication and authorization in my Wazuh via an AD domain. I rewrote the configuration according to opensearch and wazuh documentation.
I also want to say that in our environment there is an Opensearch cluster, and it works fine with the same configuration.
But when I try to login I get this error

image

my /etc/wazuh-indexer/opensearch-security/config.yml

config:
  dynamic:
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
    authc:
      kerberos_auth_domain:
        http_enabled: false
        transport_enabled: false
        order: 6
        http_authenticator:
          type: kerberos
          challenge: true
          config:
            krb_debug: false
            strip_realm_from_principal: true
        authentication_backend:
          type: noop
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 4
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: intern
      proxy_auth_domain:
        description: "Authenticate via proxy"
        http_enabled: false
        transport_enabled: false
        order: 3
        http_authenticator:
          type: proxy
          challenge: false
          config:
            user_header: "x-proxy-user"
            roles_header: "x-proxy-roles"
        authentication_backend:
          type: noop
      jwt_auth_domain:
        description: "Authenticate via Json Web Token"
        http_enabled: false
        transport_enabled: false
        order: 0
        http_authenticator:
          type: jwt
          challenge: false
          config:
            signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
            jwt_header: "Authorization"
            jwt_url_parameter: null
            roles_key: null
            subject_key: null
        authentication_backend:
          type: noop
      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: false
        transport_enabled: false
        order: 2
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop
      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        order: 5
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: ldap
          config:
            trust_all: true
            enable_ssl: true
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            pemtrustedcas_filepath: "/etc/wazuh-indexer/jeep-ca.crt"
            hosts:
              - my.lan:636
            bind_dn: "cn=wazuh,cn=Users,dc=my,dc=lan"
            password: "********"
            userbase: 'dc=my,dc=lan'
            usersearch: '(sAMAccountName={0})'
            username_attribute: null
    authz:
      roles_from_myldap:
        description: "Authorize via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          type: ldap
          config:
            trust_all: true
            enable_ssl: true
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            pemtrustedcas_filepath: "/etc/wazuh-indexer/jeep-ca.crt"
            hosts:
              - my.lan:636
            bind_dn: "cn=wazuh,cn=Users,dc=my,dc=lan"
            password: "********"
            rolebase: "ou=Kubernetes,dc=my,dc=lan"
            rolesearch: '(member={0})'
            userroleattribute: null
            userrolename: disabled
            rolename: 'dn'
            resolve_nested_roles: true
            userbase: 'dc=my,dc=lan
            usersearch: '(uniqueMember={0})'
            skip_users:
              - admin
              - kibanaserver
      roles_from_another_ldap:
        description: "Authorize via another Active Directory"
        http_enabled: false
        transport_enabled: false
        authorization_backend:
          type: ldap

my /etc/wazuh-indexer/opensearch-security/roles_mapping.yml

all_access:
  reserved: false
  backend_roles:
  - "admin"
  - "CN=cn1,OU=Kubernetes,DC=my,DC=lan"
  description: "Maps admin to all_access"

own_index:
  reserved: false
  users:
  - "*"
  description: "Allow full access to an index named like the username"

logstash:
  reserved: false
  backend_roles:
  - "logstash"

readall:
  reserved: false
  backend_roles:
  - "readall"

manage_snapshots:
  reserved: false
  hidden: false
  backend_roles:
  - "snapshotrestore"

kibana_server:
  reserved: true
  users:
  - "kibanaserver"

kibana_user:
  reserved: false
  backend_roles:
  - "kibanauser"
  
manage_wazuh_index:
  reserved: false
  users:
  - "kibanaserver"
  backend_roles:
  - "CN=cn1,OU=Kubernetes,DC=my,DC=lan"

my /etc/wazuh-indexer/opensearch.yml

network.host: 0.0.0.0
node.name: wazuh-indexer01.my.lan
cluster.initial_master_nodes:
  - 10.10.10.11
  - 10.10.10.12
  - 10.10.10.13

discovery.seed_hosts:
  - 10.10.10.14
  - 10.10.10.15
  - 10.10.10.16

cluster.name: my

http.port: 9200-9299
transport.tcp.port: 9300-9399
node.max_local_storage_nodes: "3"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer

plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/wazuh-indexer01.my.lan.pem
plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/wazuh-indexer01.my.lan-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/wazuh-indexer01.my.lan.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/wazuh-indexer01.my.lan-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false

plugins.security.authcz.admin_dn:
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.nodes_dn:
- "CN=wazuh-indexer01.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
- "CN=wazuh-indexer02.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
- "CN=wazuh-indexer03.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
- "CN=wazuh-manager01.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
- "CN=wazuh-manager02.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
- "CN=wazuh-dashboard.my.lan,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"

plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]

#Option to allow Filebeat-oss 7.10.2 to work ###
compatibility.override_main_response_version: true

please, help

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant