Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch: 2.11.0
Dashboards: 2.11.0
Server OS: linux Debian 12.2
Describe the issue:
I can’t manage to use SAML authentication with Google Workspace.
/auth/saml/login?nextUrl=%2F&redirectHash=false replies 500
/_opendistro/_security/saml/acs/idpinitiated via Google Workspace connexion test replies 500 too.
Configuration:
config.yaml :
config.dynamic.authc.saml_auth_domain:
http_enabled: true
transport_enabled: false
order: 1
http_authenticator:
type: saml
challenge: true
config:
idp:
metadata_file: GoogleIDPMetadata.xml
entity_id: https://accounts.google.com/o/saml2?idpid=*********
sp:
entity_id: https://REDACTED.local #same in Google Workspace config
kibana_url: https://REDACTED.local
subject_key: NameID
roles_key: Role
exchange_key: ***********************************
authentication_backend:
type: noop
opensearch-dashboards.yml :
[...]
opensearch_security.auth.type: ["basicauth", "saml"]
opensearch_security.auth.multiple_auth_enabled: true
server.xsrf.allowlist:
- /_plugins/_security/saml/acs
- /_opendistro/_security/saml/acs
- /_plugins/_security/saml/acs/idpinitiated
- /_opendistro/_security/saml/acs/idpinitiated
- /_plugins/_security/saml/logout
- /_opendistro/_security/saml/logout
[...]
Relevant Logs or Screenshots:
opensearch log shows at startup :
[2024-09-27T15:50:51,873][INFO ][o.o.c.c.InitializationService] [logconsult03] Initializing OpenSAML using the Java Services API
[2024-09-27T15:50:52,675][INFO ][o.o.s.m.r.i.AbstractReloadingMetadataResolver] [logconsult03] Metadata Resolver SamlFilesystemMetadataResolver com.amazon.dlic.auth.http.saml.HTTPSamlAuthenticator_1: New metadata successfully loaded for '/etc/opensearch/rt/GoogleIDPMetadata.xml'
[2024-09-27T15:50:52,676][INFO ][o.o.s.m.r.i.AbstractReloadingMetadataResolver] [logconsult03] Metadata Resolver SamlFilesystemMetadataResolver com.amazon.dlic.auth.http.saml.HTTPSamlAuthenticator_1: Next refresh cycle for metadata provider '/etc/opensearch/rt/GoogleIDPMetadata.xml' will occur on '2024-09-27T16:50:52.654Z' ('2024-09-27T18:50:52.654+02:00' local time)
[2024-09-27T15:50:52,679][WARN ][c.a.d.a.h.s.Saml2SettingsProvider] [hostname01] The IdP does not provide a Single Logout Service. In order to ensure that users have to re-enter their password after logging out, OpenSearch Security will issue all SAML authentication requests with a mandatory password input (ForceAuthn=true)
Opensearch Dashboard shows on request https://.../auth/saml/login?nextUrl=%2F&redirectHash=false:
{"type":"log","@timestamp":"2024-09-27T13:23:04Z","tags":["error","plugins","securityDashboards"],"pid":1767240,"message":"Failed to get saml header: Error: Error: failed parsing SAML config"}
{"type":"error","@timestamp":"2024-09-27T13:23:04Z","tags":[],"pid":1767240,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Error: Internal Server Error\n at HapiResponseAdapter.toError (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/src/core/server/http/router/response_adapter.js:143:19)\n at HapiResponseAdapter.toHapiResponse (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/src/core/server/http/router/response_adapter.js:97:19)\n at HapiResponseAdapter.handle (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/src/core/server/http/router/response_adapter.js:92:17)\n at Router.handle (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/src/core/server/http/router/router.js:164:34)\n at processTicksAndRejections (node:internal/process/task_queues:95:5)\n at handler (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/src/core/server/http/router/router.js:124:50)\n at exports.Manager.execute (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/node_modules/@hapi/hapi/lib/toolkit.js:60:28)\n at Object.internals.handler (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/node_modules/@hapi/hapi/lib/handler.js:46:20)\n at exports.execute (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/node_modules/@hapi/hapi/lib/handler.js:31:20)\n at Request._lifecycle (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/node_modules/@hapi/hapi/lib/request.js:371:32)\n at Request._execute (/opt/opensearch-dashboards/opensearch-dashboards-2.11.0/node_modules/@hapi/hapi/lib/request.js:281:9)"},"url":"https://REDACTED.local/auth/saml/login?nextUrl=%2F&redirectHash=false","message":"Internal Server Error"}
when adding in log4j2.properties for opensearch node
logger.token.name = com.amazon.dlic.auth.http.saml.Token
logger.token.level = debug
nothing shows.
using ngrep on node with plugins.security.ssl.http.enabled: false, I can see a request :
T ::1:54766 -> ::1:9203 [AP] #21
GET /_plugins/_security/authinfo HTTP/1.1..x-opensearch-product-origin: opensearch-dashboards..x-opaque-id: 46018254-d34e-42e3-980d-41e01eb
8bdd9..Host: localhost:9203..Content-Length: 0..Connection: keep-alive....
node replies :
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: Basic realm="OpenSearch Security"
< content-type: text/plain; charset=UTF-8
< content-length: 0
<
* Connection #0 to host localhost left intact