oauth4os — OAuth 2.0 Proxy for OpenSearch

The Gap oauth4os Fills

OpenSearch has strong auth primitives — but lacks the developer experience layer for machine-to-machine access.

Capability	Grafana	Datadog	Elastic	OpenSearch	+ oauth4os
OIDC / SSO	✅	✅	✅	✅	✅
API Keys	✅	✅	✅	🔄 3.7	✅
OAuth Apps / Scoped Tokens	✅	✅	✅	❌	✅
Token Governance UI	✅	✅	✅	❌	✅
Cedar Fine-Grained Policies	❌	❌	❌	❌	✅
PKCE (Browser Clients)	✅	❌	✅	❌	✅
Multi-Tenancy	✅	✅	✅	⚠️	✅
SDKs (Go/Python/Java/Rust/Node)	⚠️	✅	✅	❌	✅

Interactive Demo

Click each step to see the request and response. Copy commands with one click.

1. Start

2. Get Token

3. Query

4. Revoke

docker compose up

✅ Expected output:

oauth4os-proxy     | listening on :8443
oauth4os-opensearch | OpenSearch Security initialized
oauth4os-keycloak  | Keycloak started in 4.2s

curl -s -X POST http://localhost:8443/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=my-agent" \
  -d "client_secret=secret" \
  -d "scope=read:logs-*"

✅ Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read:logs-*"
}

curl -s -H "Authorization: Bearer $TOKEN" \
  http://localhost:8443/logs-*/_search \
  -d '{"query":{"match":{"level":"error"}}}'

✅ Response (proxied to OpenSearch):

{
  "hits": {
    "total": { "value": 42 },
    "hits": [
      { "_source": { "level": "error", "message": "connection timeout", "service": "payment" } }
    ]
  }
}

curl -s -X POST http://localhost:8443/oauth/revoke \
  -d "token=$TOKEN"

✅ Response:

{ "revoked": true }

Features

🔑

JWT Validation

JWKS auto-discovery, RS256/ES256, audience validation, clock skew tolerance.

🎯

Scope → Role Mapping

read:logs-* → OpenSearch logs_reader. Per-provider multi-tenant mappings.

🌲

Cedar Policies

Fine-grained access control. Index-level deny rules. Try the playground →

⚡

Rate Limiting

Per-client token bucket. Configurable RPM per scope. 429 + Retry-After.

📋

Token Lifecycle

Issue, refresh, revoke, introspect (RFC 7662). Rotation with reuse detection.

🔄

PKCE Flow

Secure browser auth (RFC 7636). Token exchange (RFC 8693).

👥

Multi-Tenancy

Per-OIDC-provider isolation. Separate scope mappings and Cedar policies.

📊

OSD Plugin

Token management UI in OpenSearch Dashboards. List, create, revoke.

🤖

MCP Server

AI agent integration. 7 tools: search, aggregate, create index, mappings.

⌨️

CLI + SDKs

CLI with auto-refresh. SDKs for Go, Python, Java, Rust, Node.js.

📈

Observability

Prometheus metrics, Grafana dashboard, structured JSON logging, OTel tracing.

🛡️

Enterprise

mTLS, IP allowlist, session management, key rotation, backup/restore, webhooks.

Ecosystem

Tools and integrations for every workflow.

🔧

GitHub Action

Get scoped tokens in CI/CD. Auto-masked in logs.

💻

VS Code Extension

Token management, query OpenSearch, inspect scopes from IDE.

🌲

Cedar Playground

Interactive policy tester with presets and evaluation trace.

📊

Analytics Dashboard

Live token analytics — usage charts, top clients, scope distribution.

🏗️

Terraform Provider

Manage clients, scopes, policies as Terraform resources.

📦

5 SDKs

Go, Python, Java, Rust, Node.js. Token auto-refresh built in.

☸️

Helm Chart

One-command Kubernetes deployment with configurable values.

🐳

Docker Compose

Dev, demo, and monitoring stacks. Prometheus + Grafana included.

OAuth 2.0 Proxy for OpenSearch