Skip to content

OIDC clarifications and tip for Azure added #3498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+9 −2
Open

OIDC clarifications and tip for Azure added #3498

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8309ea1
suggestions and tip added
eedugon Oct 16, 2025
289cca0
Apply suggestions from code review
eedugon Oct 16, 2025
a3e4b89
Merge branch 'main' into oidc_enhancement
eedugon Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions deploy-manage/users-roles/cluster-or-deployment-auth/oidc-examples.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,13 @@ For more information about OpenID connect in Azure, refer to [Azure OAuth 2.0 an
* `KIBANA_ENDPOINT_URL` is your {{kib}} endpoint.
* `YOUR_DOMAIN` and `TLD` in the `claim_patterns.principal` regular expression are your organization email domain and top level domain.

::::{tip} for organizations with many group memberships
If you use [`claims.groups`](/deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md#oidc-user-properties) to map the list of Azure AD groups included in the ID token, users with a large number of group memberships might exceed the token size limit.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if there's a different way to phrase the first part of this - all claims.groups does is tells Elasticsearch which JWT field contains the list of groups (in this case, it's just groups)

We may want to clarify that "exceed the token size limit" means "the groups claim will be omitted"


To avoid this, enable the **Groups assigned to the application** option in Azure Entra (**App registrations > Token configuration > Edit groups claim**). This limits the groups included in the ID token to those assigned to the application.

For more details, refer to [Configure group claims and app roles in tokens](https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles) in the Microsoft Security documentation.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could link directly to the relevant subsection https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles#group-overages

::::

If you're using {{ece}} or {{ech}}, and you're using machine learning or a deployment with hot-warm architecture, you must include this configuration in the user settings section for each node type.

Expand Down
4 changes: 2 additions & 2 deletions deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,10 +254,10 @@ groups
: *(Recommended)* If you want to use your OP’s concept of groups or roles as the basis for a user’s {{es}} privileges, you should map them with this property. The `groups` are passed directly to your [role mapping rules](/deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md#oidc-role-mappings).

name
: *(Optional)* The user’s full name.
: *(Optional)* The user’s full name. It will be used in {{kib}}'s profile page to display user details. Use the payload key of your ID token that fits best here.

mail
: *(Optional)* The user’s email address.
: *(Optional)* The user’s email address. It will be used in {{kib}}'s profile page to display user details. Use the payload key of your ID token that fits best here.

dn
: *(Optional)* The user’s X.500 Distinguished Name.
Expand Down