Building SAML federation for Amazon OpenSearch Service with Okta
AWS Architecture BlogBuilding SAML federation for Amazon OpenSearch Service with Oktaby Raghavarao Sodabathina, Jana Gnanachandran, and Rudy Collado | on21 APR 2022| inAmazon OpenSearch Service,Architecture|Permalink|ShareAmazon OpenSearch Serviceis a fully managed open search and analytics service powered by the Apache Lucene search library. Security Assertion Markup Language (SAML)-based federation for OpenSearch Dashboards lets you use your existing identity provider (IdP) like Okta to provide single sign-on (SSO) for OpenSearch Dashboards on OpenSearch Service domains.This post shows step-by-step guidance to enable SP-initiated single sign-on (SSO) into OpenSearch Dashboards using Okta.To use this feature, you must enable fine-grained access control. Rather than authenticating throughAmazon Cognitoor the internal user database, SAML authentication for OpenSearch Dashboards lets you use third-party identity providers to log in to OpenSearch Dashboards. SAML authentication for OpenSearch Dashboards is only for accessing OpenSearch Dashboards through a web browser.Overview of Okta SAML authenticated solutionFigure 1 depicts a sample architecture of a generic, integrated solution between Okta and OpenSearch Dashboards over SAML authentication.Figure 1. SAML transactions between Amazon OpenSearch Service and OktaThe initial sign-in flow is as follows:User opens browser window and navigates to OpenSearch DashboardsOpenSearch Service generates SAML authentication requestOpenSearch Service redirects request back to browserBrowser redirects to Okta URLOkta parses SAML request, authenticates user, and generates SAML responseOkta returns encoded SAML response to browserBrowser sends SAML response back to OpenSearch Service Assertion Consumer Services (ACS) URLACS verifies SAML responseUser logs into OpenSearch Service domainPrerequisitesFor this walkthrough, you should have the following prerequisites:AnAWS accountAvirtual private cloud (VPC)-based OpenSearch Service domain with fine-grained access control enabledOkta account with user and a groupA browser with network connectivity to Okta, OpenSearch Service domain, and OpenSearch Dashboards.The steps in this post are structured into the following sections:Identity provider (Okta) setupPrepare OpenSearch Service for SAML configurationIdentity provider (Okta) SAML configurationFinish OpenSearch Service for SAML configurationValidationCleanupIdentity provider (Okta) setupStep 1: Sign up for an Okta accountSign up for anOkta account, then click on theSign upbutton to complete your account setup.If you already have an account with Okta,loginto your Okta account.Step 2: Create Groups in OktaChooseDirectoryin the left menu and clickGroupsto proceed.Click onAdd Groupand enter name asopensearch. Then click on theSavebutton, see Figure 2.Figure 2. Creating a group in OktaStep 3: Create users in OktaChoosePeoplein left menu under Directory section and click the+AddPerson button.ProvideFirst name, Last name, username(email ID), and primary email. Then selectset by adminfrom thePassworddropdown, and choose first time password. Click on theSavebutton to create your user.Add more users as needed.Step 4: Assign Groups to usersChooseGroupsfrom the left menu, then click on theopensearchgroup created in Step 2. Click on theAssign Peoplebutton to addusersto theopensearchgroup. Next, either click on individual user underPerson & Username, or use theAdd Allbutton to add all existing users to theopensearchgroup. Click on theSavebutton to complete adding users to your group.Prepare OpenSearch Service for SAML configurationOnce OpenSearch Service domain is up and running, we can proceed with configuration.Navigate to theOpenSearch ServiceconsoleUnder Actions, chooseEdit security configurationas shown in Figure 3Figure 3. Enabling Amazon OpenSearch Service security configuration for SAMLUnder SAML authentication for OpenSearch Dashboards/Kibana, select theEnable SAML authenticationcheck box, see Figure 4. When we enable SAML, it will create different URLs required for configuring SAML with your identity provider.Figure 4. Amazon OpenSearch Service URLs for SAML configurationWe will be using theService Provider entity IDandSP-initiated SSO URL(highlighted in Figure 4) for Okta SAML configuration. The OpenSearch Dashboards login flow can take one of two forms:Service provider (SP) initiated: You navigate to your OpenSearch Dashboard (for example, https://my-domain.us-east-1.es.amazonaws.com/_dashboards), which redirects you to the login screen. After you log in, the identity provider redirects you to OpenSearch Dashboards.Identity provider (IdP) initiated: You navigate to your identity provider, log in, and choose OpenSearch Dashboards from an application directory.We will complete the rest of the OpenSearch Service SAML configuration after the Okta SAML configuration.Okta SAML configurationGo back to Okta.com, and chooseApplicationsfrom the left menu. Click onApplications,then click onCreate App Integrationand chooseSAML 2.0. Click on theNextbutton to proceed, as shown in Figure 5.For this example, we are creating an application called “OpenSearch Dashboard”.SelectPlatformasWeb, and selectSign on methodasSAML 2.0.Click on theCreatebutton to proceed.Figure 5. Creating a SAML app integration in OktaEnter theApp nameasOpenSearch, use default options, and click on theNextbutton to proceed.Enter the following under theSAML Settingssection, as shown in Figure 6. Click on theNextbutton to proceed.Single Sign on URL= https://vpc-XXXXX-XXXXX.us-west-2.es.amazonaws.com/_dashboards/_opendistro/_security/saml/acs(SP-initiated SSO URL)Audience URI(SP Entity ID)= https://vpc-XXXXX-XXXXX.us-west-2.es.amazonaws.com(Service Provider entity ID)Default RelayState =leave it blankName ID format= SelectEmailAddressfrom drop downApplication username= SelectOkta usernamefrom dropdownUpdate application username on= leave it set to defaultEnter the following underAttribute Statements (optional)section.Name= http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressName format= SelectURI Referencefrom dropdownValue=user.emailEnter the following under theGroup Attribute Statements (optional)section.Name= http://schemas.xmlsoap.org/claims/GroupName format= SelectURI Referencefrom dropdownFilter= SelectMatches regexfrom dropdown and enter value as.*open.*to match the group created in previous steps for OpenSearch Dashboards access.Figure 6. SAML configuration in OktaSelectI’m a software vendor. I’d like to integrate my app with Oktaunder theHelp Okta Support understand how you configured this applicationsection.Click on theFinishbutton to complete the Okta SAML application configuration.ChooseSign onmenu. Right click on the Identity Provider metadata hyperlink to download the Okta identity provider metadata as okta.xml. You will use this for the SAML configuration in OpenSearch Service, see Figure 7.Figure 7. Downloading Okta identity provider metadata for SAML configurationChoose theAssignmentsmenu and click on Assign-> Assign to GroupsSelect theopensearchgroup, click onAssign, and click on theDonebutton to complete the Group assignment, as shown in Figure 8.Figure 8. Assigning groups to the app in OktaSwitch back to the OpenSearch Service domainUnder theImport IdP metadatasection:Metadata from IdP:Import the Okta identity provider metadata from the downloaded XML fileSAML master backend role:opensearch(Okta group). Provide the SAML backend role/group SAML assertion key for group SSO into OpenSearch Dashboard.UnderOptional SAML settings:LeaveSubject KeyblankRole keyshould behttp://schemas.xmlsoap.org/claims/Group.You can view a sample assertion during the configuration process with tools likeSAML-tracer. This can help you examine and troubleshoot the contents of real assertions.Session time to live (mins):60Click on theSave changesbutton (Figure 9) to complete OpenSearch Service SAML configuration for OpenSearch Dashboards. We have successfully completed SAML configuration, and now we are ready for testing.Figure 9. Configuring Amazon OpenSearch Service SAML parametersValidating access with Okta usersAccess the OpenSearch Dashboards endpoint from the previously created OpenSearch Service cluster. The OpenSearch Dashboards URL can be found in General information within “My Domains” of the OpenSearch Service console, as shown in Figure 10. The first access to OpenSearch Dashboards URL redirects you to the Okta login screen.Figure 10. Validating Okta user access with Amazon OpenSearch ServiceNow copy and paste the OpenSearch Dashboards URL in your browser, and enter the user credentials.If your OpenSearch Service domain is hosted within a private VPC, you will not be able to access your OpenSearch Dashboard over public internet. But you can still use SAML as long as your browser can communicate with both your OpenSearch Service cluster and your identity provider.You can create a Mac or Windows EC2 instance within the same VPC so that you can access Amazon OpenSearch Dashboard from EC2 instance’s web browser to validate your SAML configuration. Or you can access your OpenSearch Dashboard through Site-to-Site VPN from your on-premises environment.After successful login, you will be redirected into the OpenSearch Dashboards home page. Here, you can explore our sample data and visualizations in OpenSearch Dashboards (Figure 11).Figure 11. SAML authenticated OpenSearch DashboardsNow, you have successfully federated OpenSearch Dashboards with Okta as an identity provider. You can connect OpenSearch Dashboards by using your Okta credentials.Cleaning upAfter you test out this solution, remember to delete all the resources you created, to avoid incurring future charges. Refer to these links:Deleting your OpenSearch Service domainDeleting your Okta account(if needed)ConclusionIn this blog post, we have demonstrated how to set up Okta as an identity provider over SAML authentication for OpenSearch Dashboards access. Get started by checking theAmazon OpenSearch Service Developer Guide, which provides guidance on how to build applications using OpenSearch Service.Raghavarao SodabathinaRaghavarao Sodabathina is a Principal Solutions Architect at AWS, focusing on Data Analytics, AI/ML, and Serverless Platform. He engages with customers to create innovative solutions that address customer business problems and to accelerate the adoption of AWS services. In his spare time, Raghavarao enjoys spending time with his family, reading books, and watching movies.Jana GnanachandranJana Gnanachandran is an Enterprise Solutions Architect at AWS, focusing on Data Analytics, AI/ML, and Serverless platforms. He helps AWS customers across numerous industries to design and build highly scalable, data-driven, analytical solutions to accelerate their cloud adoption. In his spare time, he enjoys playing tennis, 3D printing, and photography.Rudy ColladoRudy is a Solutions Architect with Amazon Web Services based in the New York City area. He has more than 20 years of experience in the IT industry, specializing in network architecture for financial services. He enjoys using his experience to help customers build innovative, resilient, and secure AWS Cloud solutions. Outside of work, he enjoys spending time with his family and flying different types of airplanes as a private pilot.
Amazon OpenSearch Service is a fully managed open search and analytics service powered by the Apache Lucene search library. Security Assertion Markup Language (SAML)-based federation for OpenSearch Dashboards lets you use your existing identity provider (IdP) like Okta to provide single sign-on (SSO) for OpenSearch Dashboards on OpenSearch Service domains. This post shows step-by-step guidance […]
Raghavarao Sodabathina
Amazon OpenSearch Service Architecture