Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OS: 2.14.0
I can’t seem to manage to tie correctly OpenSearch - SAML - Keycloak.
I’m currently getting a few 401 responses when trying to use the button to login with SAML.
My OpenSearch service is active through a virtual machine set up for me, and Keycloak runs locally on port 8080.
Configuration:
authc:
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: intern
saml_auth_domain:
http_enabled: true
transport_enabled: false
order: 0
http_authenticator:
type: saml
challenge: true
config:
idp:
metadata_url: 'http://localhost:8080/realms/os/protocol/saml'
sp:
entity_id: opensearch.devenv.dev
kibana_url: '//my-domain/app/dashboards'
roles_key: Role
authentication_backend:
type: noop
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.enable_global: true
opensearch_security.multitenancy.tenants.enable_private: false
opensearch_security.multitenancy.tenants.preferred: [Global, Private]
opensearch_security.readonly_mode.roles: [kibana_read_only]
# Use this setting if you are running opensearch-dashboards without https
opensearch_security.cookie.secure: false
#Enable SAML login
opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type: ["basicauth", "saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_plugins/_security/saml/acs/idpinitiated", "/_plugins/_security/saml/acs", "/_plugins/_security/saml/logout"]
I created a client in Keycloak with SAML protocol.
Client ID: ‘opensearch.devenv.dev’
Root url: ‘//my-domain’
Valid redirect URIs: ‘//my-domain/*’
IDP-Initiated SSO URL name: ‘//my-domain/_opendistro/_security/saml/acs/idpinitiated’
Master SAML Processing URL: ‘//my-domain/_opendistro/_security/saml/acs’
Force POST binding: On
Include AuthnStatement: On
Sign documents: On
I created a mapper in Client scopes → opensearch.devenv.dev-dedicated. The name is Role, category: Role Mapper, type: Role list
Relevant Logs or Screenshots:
These are my 401 responses:
"res":{"statusCode":401,"responseTime":3,"contentLength":9},"message":"GET /api/v1/auth/type?dataSourceId= 401 3ms - 9.0B"}
"res":{"statusCode":401,"responseTime":3,"contentLength":9},"message":"GET /api/v1/multitenancy/tenant 401 3ms - 9.0B"}
"res":{"statusCode":401,"responseTime":2,"contentLength":9},"message":"GET /api/v1/configuration/account 401 2ms - 9.0B"}
"res":{"statusCode":401,"responseTime":2,"contentLength":9},"message":"GET /api/v1/configuration/account?dataSourceId= 401 2ms - 9.0B"}
I’m obviously changing ‘my-domain’ with the correct value.
I am running Keycloak in Debug and i see nothing happening when i try to login in OpenSearch.
I had to cancel some ‘https’ because it’s my first post.
Any help would be great.