Hello OpenSearch Community,
I am currently working with an AWS-managed OpenSearch domain and have SAML authentication enabled for users. However, I am looking to enable dual authentication (SAML and basic auth) to facilitate admin testing using internal user accounts alongside SAML Single Sign-On (SSO).
Additionally, I need to be able to access OpenSearch Dashboards in a browser’s incognito mode or through another mechanism to bypass SAML and log in directly using admin credentials for troubleshooting and testing purposes—without disabling SAML in the security configuration.
I understand that enabling dual authentication typically involves updating the configuration with a payload like the one below:
{
"authc": {
"basic_internal_auth_domain": {
"http_enabled": true,
"order": 0,
"transport_enabled": true,
"authentication_backend": {
"type": "intern"
}
},
"saml_auth_domain": {
"http_enabled": true,
"order": 1,
"transport_enabled": true,
"authentication_backend": {
"type": "noop"
}
}
}
}
However, when I try to make the required changes via the _plugins/_security/api/securityconfig
endpoint using the Dev Tools console, I receive the following error message:
Your request /_plugins/_security/api/securityconfig is not allowed.
I am logged in with an SSO account that has security_manager
and all_access
roles, which should grant high-level permissions. On inspecting the security_manager
role, I noticed it has no explicit cluster_permissions
defined.
This raises a few questions:
- Is the
/securityconfig
API restricted in AWS OpenSearch, even for users with admin roles? - If restricted, is there any supported way to enable dual authentication in AWS OpenSearch managed service?
- Are there any recommended workarounds for temporarily bypassing SAML (e.g., using incognito mode) to log in as an admin for testing and troubleshooting purposes—without disabling SAML in the security configuration?
I would appreciate any guidance or best practices on addressing this issue, particularly for environments using AWS’s managed service.
Thank you in advance for your help!