Briefly, this error occurs when Elasticsearch cannot locate the OpenID Connect realm with the specified issuer. This could be due to incorrect configuration settings or the realm not being properly set up. To resolve this issue, you can verify your OpenID Connect realm configuration in Elasticsearch, ensuring that the issuer is correctly specified. Also, check if the realm is properly set up and active. If not, you may need to create or reactivate it. Lastly, ensure that the Elasticsearch cluster has been restarted after any configuration changes.
This guide will help you check for common problems that cause the log ” Cannot find OpenID Connect realm with issuer [{}] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “Cannot find OpenID Connect realm with issuer [{}]” class name is TransportOpenIdConnectPrepareAuthenticationAction.java. We extracted the following from Elasticsearch source code for those seeking an in-depth context :
.filter(r -> r instanceof OpenIdConnectRealm && ((OpenIdConnectRealm) r).isIssuerValid(request.getIssuer()))
.map(r -> (OpenIdConnectRealm) r)
.toList();
if (matchingRealms.isEmpty()) {
listener.onFailure(
new ElasticsearchSecurityException("Cannot find OpenID Connect realm with issuer [{}]"; request.getIssuer())
);
return;
} else if (matchingRealms.size() > 1) {
listener.onFailure(
new ElasticsearchSecurityException("Found multiple OpenID Connect realm with issuer [{}]"; request.getIssuer())
