Contact UsGet started

Configuring SAML authentication

Written by
Updated at November 18, 2024

Security Assertion Markup Language (SAML) is used for exchanging authentication and authorization data between two parties. With SAML, you can implement a single sign-on system (SSO) to switch between applications without re-authentication.

When using SAML and SSO, a Managed Service for OpenSearch cluster gets information from an identity provider (IdP). For more information about SAML and SSO, see the OASIS documentation.

Managed Service for OpenSearch works with any SAML 2.0 compatible identity provider.

To set up SAML authentication:

  1. Configure an identity provider.
  2. Set up a Managed Service for OpenSearch cluster to use this IdP for SSO.
  3. Configure cluster roles for SSO users on the IdP side.

Configure an identity provider

  1. Create an application on the IdP side.

  2. Specify the Assertion Consumer Service (ACS) URL.

    Use the URL with a special cluster FQDN:

    https://c-<OpenSearch_cluster_ID>.rw.mdb.yandexcloud.net/_opendistro/_security/saml/acs

    You can get the cluster ID with a list of clusters in the folder.

    URL example: https://c-e4ut2....rw.mdb.yandexcloud.net/_opendistro/_security/saml/acs

  3. Specify the SP Entity ID (Audience URI).

    Use the URL with a special cluster FQDN:

    https://c-<cluster_ID>rw.mdb.yandexcloud.net/

    URL example: https://c-e4ut2....rw.mdb.yandexcloud.net/

  4. Specify the Name ID Format:

  5. Get the data you need to set up SAML SSO on OpenSearch side:

    • Copy the information about the Identity Provider Issuer.
    • Save the provider's metadata file in XML format.

    You will need it to set up SSO for your cluster.

Set up SSO for the cluster

Warning

Incorrect settings may cause the cluster to fail.

  1. In the management console, go to the folder page and select Managed Service for OpenSearch.

  2. Click the cluster name and open the Authentication sources tab.

  3. Click Settings.

  4. Specify the parameters of external authentication source:

    • idp_entity_id: Information about the Identity Provider Issuer obtained when configuring the IdP.

    • idp_metadata_file: Provider's metadata file in XML format obtained when configuring the IdP.

    • sp_entity_id: Application-defined SP Entity ID (Audience URI). Make sure it is the same as the ID specified when configuring the IdP.

    • kibana_url: URL with a special cluster FQDN, same as the sp_entity_id.

    • roles_key: SAML response parameter that stores the roles. If omitted, no roles are used.

    • subject_key: SAML response parameter that stores the subject. If it is not set, the NameID parameter is used.

    • Enable: Shows whether to activate an authentication source after creating it.

  5. Click Save.

  1. Convert the metadata file received from the Identity Provider Issuer to Base64 format.

  2. To set identity provider settings on the cluster side, use the updateAuthSettings REST API method for the Cluster resource or the ClusterService/UpdateAuthSettings gRPC API call, and provide the following in the request:

    • Cluster ID in the clusterId parameter.

      You can get the cluster ID with a list of clusters in the folder.

    • true in the enabled parameter.

    • ID of the Identity Provider Issuer obtained when configuring the IdP, in the idpEntityId parameter.

    • Path to the Base64 metadata file, in the idpMetadataFile parameter.

    • URI of the SP Entity ID (Audience URI) application in the spEntityId parameter. Use the URI you specified when configuring the IdP.

    • URL of the OpenSearch host with the DASHBOARDS role, in the dashboardsUrl parameter.

    • (Optional) SAML response parameter that stores the roles, in the rolesKey parameter.

    • (Optional) SAML response parameter that stores the subject, in the subjectKey parameter.

Note

For more information about SAML attributes, see the OpenSearch documentation.

Configure roles for SSO

To access the cluster via SSO, associate the cluster roles with the SSO users on the IdP side:

  1. Map the roles of the OpenSearch users on the IdP side to the roles in the cluster. Perform this operation as an admin user in one of the following ways:
  2. On the IdP side, create a user that meets the role mappings defined in OpenSearch.
  3. Grant this user access to the previously created application.

To log in to OpenSearch using the new user's credentials, go to the OpenSearch Dashboards page.

Examples of integration with providers

Authentication in OpenSearch Dashboards using Keycloak.

Previous
Connecting to a cluster
Next
Updating cluster settings