Building SAML federation for Amazon OpenSearch Service with Ping Identity
AWS Architecture BlogBuilding SAML federation for Amazon OpenSearch Service with Ping Identityby Raghavarao Sodabathina and Jana Gnanachandran | on19 APR 2022| inAmazon OpenSearch Service,Architecture|Permalink|ShareAmazon OpenSearch Serviceis an open search and log analytics service, powered by the Apache Lucene search library.In this blog post, we provide step-by-step guidance for SP-initiated SSO by showing how to set up a trial Ping Identity account. We’ll show how to build users and groups within your organization’s directory and enable SSO in OpenSearch Dashboards.To use this feature, you must enable fine-grained access control. Rather than authenticating throughAmazon Cognitoor the internal user database, SAML authentication for OpenSearch Dashboards lets you use third-party identity providers to log in.Ping Identityis anAWS Competency Partner, and the provider of the PingOne Cloud Platform is a multi-tenant Identity-as-a-Service (IDaaS) platform. Ping Identity supports both service provider (SP)-initiated and identity provider (IdP)-initiated SSO.Overview of Ping Identity SAML authenticated solutionFigure 1 shows a sample architecture of a generic integrated solution between Ping Identity and OpenSearch Dashboards over SAML authentication.Figure 1. SAML transactions between Amazon OpenSearch Service and Ping IdentityThe sign-in flow is as follows:User opens browser window and navigates to OpenSearch DashboardsOpenSearch Service generates SAML authentication requestOpenSearch Service redirects request back to browserBrowser redirects to Ping Identity URLPing Identity parses SAML request, authenticates user, and generates SAML responsePing Identity returns encoded SAML response to browserBrowser sends SAML response back to OpenSearch Service Assertion Consumer Service (ACS) URLACS verifies SAML responseUser logs into OpenSearch Service domainPrerequisitesFor this walkthrough, you should have the following prerequisites:AnAWS accountAvirtual private cloud (VPC)-based OpenSearch Service domain with fine-grained access control enabledPing Identity account with user and a groupA browser with network connectivity to Ping Identity, OpenSearch Service domain, and OpenSearch Dashboards.The steps in this post are structured into the following sections:Identity provider (Ping Identity) setupPrepare OpenSearch Service for SAML configurationIdentity provider (Ping Identity) SAML configurationFinish OpenSearch Service for SAML configurationValidationCleanupIdentity provider (Ping Identity) setupStep 1: Sign up for a Ping Identity accountSign up for aPing Identity account, then click on theSign upbutton to complete your account setup.If you already have an account with Ping Identity,loginto your Ping Identity account.Step 2: CreatePopulationin Ping IdentityChooseIdentitiesin the left menu and clickPopulationsto proceed.Click on the blue+button next toPopulations, enter theNameasIT, chooseStandard (default)from thePassword Policydropdown, then click on theSavebutton (see Figure 2).Figure 2. Creating population in Ping IdentityStep 3: Create a group in Ping IdentityChoose Groups from the left menu and click on the blue+button next toGroups. For this example, we will create a group calledopensearchfor OpenSearch Dashboards access.EnterGroup Name= opensearch, then chooseITfromPopulationdropdown (created in previous step).Click on theSavebutton to complete the group creation.Step 4: Create users in Ping IdentityChooseUsersin left menu, then click the+ Add Userbutton.ProvideGIVEN NAME, FAMILY NAME, EMAIL ADDRESS, and choose Population asIT, (created in Step 1). Choose your ownUSERNAME. Click on theSAVEbutton to create your user.Add more users as needed.Step 5: Assign role and group to usersClick onIdentities/usersin the left menu, and click onUsers. Then click on the edit button for a particular user. You can also set up a one time password for a user by using Reset Password as shown in Figure 3.Figure 3. Assigning roles and groups to users in Ping IdentityClick on theEditbutton, click on+ Add Rolebutton, and click on the edit button to assign a role to the user.For this example, choose Environment Admin, as shown in Figure 4. You can choose different roles depending on your use case.Figure 4. Assigning roles to users in Ping IdentityFor this example, assign administrator responsibilities for our users. Click onShow Environments, and drag Administrators into the ADDED RESPONSIBILITES section. Then click on theAdd Rolebutton.Add Group to users. Go to theGroupstab, search for theopensearchgroup created in Step 3. Click on the + button next toopensearchto add into group memberships.Prepare OpenSearch Service for SAML configurationOnce the OpenSearch Service domain is up and running, we can proceed with configuration.Under Actions, chooseEdit security configuration, as shown in Figure 5.Figure 5. Enabling Amazon OpenSearch Service security configuration for SAMLUnder SAML authentication for OpenSearch Dashboards/Kibana, selectEnable SAML authenticationcheck box (Figure 6). When we enable SAML, it will create different URLs required for configuring SAML with your identity provider.Figure 6. Amazon OpenSearch Service URLs for SAML configurationWe will be using theService Provider entity IDandSP-initiated SSO URLas highlighted in Figure 6 for Ping Identity SAML configuration. We will complete the rest of the OpenSearch Service SAML configuration after the Ping Identity SAML configuration.Ping Identity SAML configurationGo back to PingIdentity.com, and navigate toConnectionson the left menu. Then selectApplications, and click onApplication +.For this example, we are creating an application called“opensearch”SelectWEB APPasAPPLICATION TYPEandCHOOSE CONNECTION TYPEas SAML, and click onConfigurebutton to proceed as shown in Figure 7.Figure 7. Configuring a new SAML application in Ping IdentityEnter the following under theConfigure SAML ConnectionsectionChoose the “Manually Enter” option forProvide Application MetadataACS URLshttps://vpc-XXXXX-XXXXX-west-2.es.amazonaws.com/_dashboards/_opendistro/_security/saml/acs(SP-initiated SSO URL)ENTITY ID: https://vpc-XXXXX-XXXXX.us-west-2.es.amazonaws.com(Service provider entity ID)Then click on theSavebutton as shown in Figure 8Figure 8. Configuring SAML connection in Ping IdentitySelect theAttribute Mappingstab and enter the following by clicking on the edit icon on the right, followed by the+Addbutton. Then click on Save button.saml_subject=user ID(default option)saml_group= selectGroup Namesfrom the dropdownsaml_username= selectUsernamefrom the drop downSelect thePoliciestab and click on edit icon on the right and then, click on+Add policiesbuttonSelectSingle_Factorpolicy to the application, then click on theAddbutton, followed bySavebutton.Select theAccesstab and click on edit icon on the rightadd theopensearchgroup to the application by clicking on+, then click onSaveto complete SAML configuration.Finally, go to theConfigurationtab, click on theDownload Metadatabutton to download the Ping Identity metadata for the Amazon OpenSearch SAML configuration. EnableopensearchSAML application (Figure 9).Figure 9. Downloading metadata in Ping IdentityOpenSearch Service SAML configurationSwitch back to OpenSearch Service domain:Navigate to theOpenSearch Serviceconsole.Click onActions, then click onModify Security configuration.Select the Enable SAML authentication check box.UnderImport IdP metadatasection:Metadata from IdP: Import the Ping Identity identity provider metadata from the downloaded XML file, shown in Figure 10.SAML master backend role: opensearch(Ping Identity group). Provide SAML backend role/group SAML assertion key for group SSO into Kibana.Figure 10. Configuring Amazon OpenSearch Service SAML parametersUnderOptional SAML settings:Leave theSubject Keyassaml_subjectfrom Ping Identity SAML application attribute name.Role keyshould besaml_group. You can view a sample assertion during the configuration process by tools likeSAML-tracer. This can help you examine and troubleshoot the contents of real assertions.Session time to live (mins): 60Click on the Submit button to complete OpenSearch Service SAML configuration for Kibana. We have successfully completed SAML configuration and are now ready for testing.Validating Access with Ping Identity UsersThe OpenSearch Dashboards URL can be found in the Overview tab within “General Information” in the OpenSearch Service console (Figure 11). The first access to the OpenSearch Dashboards URL redirects you to the Ping Identity login screen.Figure 11. Validating Ping Identity users access with Amazon OpenSearch ServiceIf your OpenSearch Service domain is hosted within a private VPC, you will not be able to access OpenSearch Dashboards over public internet. But you can still use SAML as long as your browser can communicate with both your OpenSearch Service cluster and your identity provider.You can create a Mac or Windows EC2 instance within the same VPC and access OpenSearch Dashboards from an EC2 instance’s web browser to validate your SAML configuration. Or you can access your OpenSearch Dashboards through Site-to-Site VPN if you are trying to access it from your on-premises environment.Now copy and paste the OpenSearch Dashboards URL in your browser, and enter user credentials.After successful login, you will be redirected into the OpenSearch Dashboards home page. Explore our sample data and visualizations in OpenSearch Dashboards, as shown in Figure 12.Figure 12. SAML authenticated OpenSearch DashboardsYou have successfully federated OpenSearch Dashboards with Ping Identity as an identity provider. You can connect OpenSearch Dashboards by using your Ping Identity credentials.Cleaning upAfter you test out this solution, remember to delete all the resources you created to avoid incurring future charges. Refer to these links:Deleting your OpenSearch Service domainReach out to Ping Identity to delete your account (If needed)ConclusionIn this blog post, we have demonstrated how to set up Ping Identity as an identity provider over SAML authentication for OpenSearch Dashboards access. With this solution, you now have an OpenSearch Dashboard that uses Ping Identity as the custom identity provider for your users. This reduces the customer login process to one set of credentials and improves employee productivity.Get started by checking theAmazon OpenSearch Service Developer Guide, which provides guidance on how to build applications using OpenSearch Service for your operational analytics.Raghavarao SodabathinaRaghavarao Sodabathina is a Principal Solutions Architect at AWS, focusing on Data Analytics, AI/ML, and Serverless Platform. He engages with customers to create innovative solutions that address customer business problems and to accelerate the adoption of AWS services. In his spare time, Raghavarao enjoys spending time with his family, reading books, and watching movies.Jana GnanachandranJana Gnanachandran is an Enterprise Solutions Architect at AWS, focusing on Data Analytics, AI/ML, and Serverless platforms. He helps AWS customers across numerous industries to design and build highly scalable, data-driven, analytical solutions to accelerate their cloud adoption. In his spare time, he enjoys playing tennis, 3D printing, and photography.
Amazon OpenSearch Service is an open search and log analytics service, powered by the Apache Lucene search library. In this blog post, we provide step-by-step guidance for SP-initiated SSO by showing how to set up a trial Ping Identity account. We’ll show how to build users and groups within your organization’s directory and enable SSO […]
Raghavarao Sodabathina
Amazon OpenSearch Service Architecture