Connect OpenSearch with JWT Bearer Token – StackOne Hub

Sample block using an HMAC shared secret. For RSA or ECDSA, set signing_key to the (non-Base64-encoded) public key wrapped in -----BEGIN PUBLIC KEY----- / -----END PUBLIC KEY----- — the plugin auto-detects the algorithm. For a rotating IdP, use jwks_uri in place of signing_key.

• “yaml jwt_auth_domain: http_enabled: true transport_enabled: true order: 0 http_authenticator: type: jwt challenge: false config: signing_key: "<base64-encoded HMAC secret>" jwt_header: "Authorization" jwt_url_parameter: null subject_key: null roles_key: null required_audience: null required_issuer: null jwt_clock_skew_tolerance_seconds: 20 authentication_backend: type: noop “
• Apply the config with plugins/opensearch-security/tools/securityadmin.sh and reload.
• Because JWTs are self-contained, authentication_backend is set to noop.
• Full reference: JSON Web Token authentication.

Once JWT auth accepts the token, the user still needs mapped OpenSearch roles.

• The subject claim (sub by default) becomes the OpenSearch username. Override with subject_key if your IdP puts the username elsewhere.
• The roles_key config value points at the claim carrying the user’s role list. Set it (e.g. roles_key: "roles") if you want the JWT to carry OpenSearch role membership.
• Alternatively, map the subject or a backend role via Dashboards: Security > Roles > select role > Mapped users > Manage mapping > Map.

The cluster validates these claims automatically:

• Include a sub claim (or the subject_key claim your admin configured) whose value the cluster’s role-mapping recognises.
• Include an exp (expiration) claim reasonable for the workload. Long-lived tokens are simpler; short-lived tokens are safer — the cluster tolerates up to jwt_clock_skew_tolerance_seconds (default 30 seconds) of clock drift.
• If required_audience or required_issuer are set on the cluster, the token must include matching aud / iss claims — otherwise the request is rejected as unauthorised.
• Supported algorithms: HS256/384/512 (HMAC), RS256/384/512 (RSA), PS256/384/512 (RSA-PSS), ES256/384/512 (ECDSA).
• Short-lived tokens must be refreshed externally before expiry — the connector does not refresh them automatically. When your token nears exp, generate a new one and update the connection.

The URL depends on your deployment.

• For self-hosted clusters, an HTTPS URL to the cluster’s REST port (default 9200).
• For hosted providers with JWT support, the endpoint URL is shown in the provider’s console.
• The URL must use HTTPS — the Security Plugin requires TLS.
• No trailing slash.

From a shell that can reach the cluster, send GET /_cluster/health with the Authorization: Bearer <jwt> header and inspect the response:

• 200 OK with a JSON status — the token is accepted.
• 401 Unauthorized — the JWT signature or claims don’t validate. Check that the signing_key on the cluster matches the IdP’s signing key, that required_audience / required_issuer (if set) match the token, and that exp has not passed.
• 403 Forbidden — the JWT authenticates but the subject / roles claim is not mapped to a role with the required permissions. Update role mapping in Dashboards or the roles_key claim in the token.

Copy each value from the JWT and the cluster endpoint.

• OpenSearch Endpoint URL — the HTTPS endpoint from step 3.
• JWT Bearer Token — paste the JWT exactly as issued (three base64url segments separated by dots). Do not add the Bearer prefix — StackOne adds it automatically.
• OpenSearch Dashboards URL — optional. Required only for dashboards_* actions. Leave blank for core datasync workflows.