SAML Authentication in Search with OpenSearch

• Console
• CLI
• API

• You can only enable SAML for an existing cluster in the Console.

  1. Open the navigation menu and click Databases. Under OpenSearch, click Clusters.

  2. In the Clusters list, click the name of the cluster you want to enable SAML for.

  3. On the cluster details page, click More actions, and then select Add SAML authentication.

  4. In the Metadata content field, paste the contents of the SAML metadata file for the identity provider.

     The SAML metadata file describes the identity provider's capabilities and configuration. This includes the identity provider's certificate.

  5. Specify the identity provider's name in Identity ID.

  6. You can optionally specify the following configuration details:

     • Dashboard URL: The cluster's OpenSearch.Dashboard URL.
     • Admin backend role: The backend role in the identity provider for users who have administrator privileges for the OpenSearch cluster.
     • Roles key: Specifies the attribute in the SAML response that contains the user roles.
     • Subject key: Specifies the attribute in the SAML response that contains the users.
  7. Click Save changes.
• For information about using the CLI, see Command Line Interface (CLI). For a complete list of flags and options available for CLI commands, see the CLI Command Reference.

  Enabling SAML When Creating a Cluster

  You can enable SAML authentication when you use the create command for the cluster object in the CLI to create a cluster. In addition to the required parameters for the create command, you also need to include the following parameters:

  • The role-based access control parameters, including security-mode, security-master-user-name, and security-master-user-password-hash. The security-mode parameter must be set to ENFORCING.

  • The securitySamlConfig parameter that contains the SAML configuration. The following shows a JSON example with SAML configuration for this parameter:

    Copy

    {
        "isEnabled": true,
        "idpEntityId": "<identity_provider_name>",
        "idpMetadataContent": "xml content"
        "opendashboardUrl": "https://localhost:5601",
        "adminBackendRole": "<admin_role_name>",
        "subjectKey": "<NameID>",
        "rolesKey": "<group_name>"
        }

    While the preceding sample includes all the available SAML configuration fields, only the isEnabled, idpEntityId, and idpMetadataContent fields are required.

  Sample create command:

  Copy

  oci opensearch cluster create --compartment-id <compartment_ocid> --securitySamlConfig <SAML_Config_JSON> --security-mode ENFORCING --security-master-user-name <username> --security-master-user-password-hash <password> ...remaining required fields

  Enabling SAML When Updating a Cluster

  You can enable SAML authentication for an existing cluster when you use the update command for the cluster object in the CLI to update a cluster. You need to include the securitySamlConfig parameter in the update command. See the SAML configuration JSON in the preceding section for an example of what to specify for this parameter.

  Sample update command:

  Copy

  oci opensearch cluster update --display-name<cluster_name> --opensearch-cluster-id <cluster_ocid --securitySamlConfig <SAML_Config_JSON>

  If role-based access control is not enabled for the cluster, you need to enable it by also including the security-mode, security-master-user-name, and security-master-user-password-hash parameters. The security-mode parameter must be set to ENFORCING.

• For information about using the API and signing requests, see REST APIs and Security Credentials. For information about SDKs, see Software Development Kits and Command Line Interface.

  Enabling SAML When Creating a Cluster

  You can enable SAML authentication when you use the CreateOpensearchCluster operation to create a cluster. Pass the SAML configuration details in the CreateOpensearchClusterDetails, using the new securitySamlConfig attribute, as shown in the following example:

  Copy

  POST https://opensearch.us-ashburn-1.oci.oraclecloud.com/20180828/opensearchClusters/
  {
    ...
    "securitySamlConfig": {
      "isEnabled": true,
      "idpEntityId": "<identity_provider_name>",
      "idpMetadataContent": "xml content"
      "opendashboardUrl": "https://localhost:5601",
      "adminBackendRole": "<admin_role_name>",
      "subjectKey": "<NameID>",
      "rolesKey": "<group_name>"
    },
    ...
  }

  Enabling SAML When Updating a Cluster

  You can enable SAML authentication for an existing cluster when you use the UpdateOpensearchCluster operation to update a cluster. Pass the SAML configuration details in the UpdateOpensearchClusterDetails, using the new securitySamlConfig attribute, as shown in the following example:

  Copy

  PUT https://opensearch.us-ashburn-1.oci.oraclecloud.com/20180828/opensearchClusters/ocid1.opensearchcluster.oc1.<unique_ID>
  {
    ...
    "securitySamlConfig": {
      "isEnabled": true,
      "idpEntityId": "<identity_provider_name>",
      "idpMetadataContent": "xml content"
      "opendashboardUrl": "https://localhost:5601",
      "adminBackendRole": "<admin_role_name>",
      "subjectKey": "<NameID>",
      "rolesKey": "<group_name>"
    },
    ...
  }