401 errors after integrating Kibana/Elastic Search with Istio user auth

[juan-garcia-db]

Hi team!

We're integrating Kibana/elastic search running on Google's Kubernetes Engine with our organizations IDaaS, and are getting 401 errors when we log in. After configuring our OIDC client, Istio user-auth, and the ElasticSearch backend itself, our login screen comes up, our credentials are accepted, the Kibana loading page shows up, but then we get

"Authentication failed, please contact your system administrator"

After checking istio-ingress-gateway, asm-user-auth, and kibana and elastic search logs in GKE logs we don't see any meaningful error messages. The only hint is the one we get from the dev tools, where we see the callback returning 401 Unauthorized, along with a referrer policy strict-origin-when-cross-origin OR no-referrer-when-downgrade.

So we suspect we might be missing some configuration on the Istio side of things. Are there any logs we could enable to help us troubleshoot?

Thanks in advance.