Elasticsearch:Enable SAML-based single sign-on for an Elasticsearch cluster

Procedure

1. Log on to the Alibaba Cloud Elasticsearch console.

2. In the left-side navigation pane, click Elasticsearch Clusters.

3. Navigate to the desired cluster.

   1. In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.

   2. On the Elasticsearch Clusters page, find the cluster and click its ID.

4. In the navigation pane on the left of the target cluster, select Configuration and Management > Security.

5. In the Access Settings area, enable SAML Authentication.

   Note

   If you attempt to disable the HTTPS protocol for the current cluster, the dialog box displays the message SAML authentication is enabled for the cluster. You are not allowed to disable HTTPS.

6. In the Enable SAML Authentication panel, you can configure the SAML application.

   1. On the Configure SAML Application page, select Access Kibana over Internet for the Access Type.

   2. Download the IdP metadata. For more information, see Configure an IDaaS SAML application.

      Note

      You can copy the single sign-on ACS URL and the SP Entity ID from the Configure SAML Application wizard page.

   3. Click or drag to upload the IdP metadata.

   4. Click Next.

7. Associate a custom ES role.

   1. On the Associate Elasticsearch Custom Role wizard page, enter the ES access password.

      • Role Name: The default value is es_saml1_default, which cannot be modified.

      • Role Permissions: By default, all permissions are enabled for the es_saml1_default role. To configure fine-grained permissions, you can modify the role's permissions in the Kibana console. For more information, see Manage user permissions with Elasticsearch X-Pack role management.

      • Elasticsearch Cluster Password: Enter the password to verify that you have permission to create roles.

   2. Click Create and Associate Role.

      A role is created and mapped to SAML.

   3. Click Next.

8. Configure the YML parameters.

   Category	Item	Description
   SAML information	Authentication Realm	Must be consistent with the previous mapping. By default, only saml1 is supported. You cannot change this value.
   	order	The priority of the realm. A smaller value indicates a higher priority. The default value is 2. You cannot change this value.
   	idp.entity_id	The identifier used by the IdP.
   	sp.entity_id	The unique identifier of the Kibana instance. This is the same as the SP Entity ID of the SAML application. Set this value if you add Kibana as an SP for the IdP.
   	sp.acs	The Assertion Consumer Service (ACS) endpoint. It receives identity authentication information from the IdP. This is the same as the ACS URL for SSO of the SAML application.
   	attributes.principal	The assertion information, such as nameid:persistent. For more information, see Attribute mapping.
   	attributes.groups	The assertion information, such as roles. For more information, see Attribute mapping.
   Advanced Settings	Kibana Basic Login	By default, the basic logon entry point for Kibana is displayed. You can choose not to display this entry point.
   	Kibana SAML Logon Description	Enter a description for SAML logon to Kibana.

   Note

   • After you complete the configuration, the system automatically generates a standard YML file that the backend can recognize and modifies the YML configuration of the cluster.

   • Other parameters, such as `idp.metadata.path`, are XML paths required for backend management. They are automatically generated and cannot be edited.

9. Click Complete.

   The message Enabled. appears at the top of the page, indicating that the configuration is successful and the cluster is restarting.

10. After the cluster restarts, verify SSO for Kibana.

    1. In the left navigation pane, select Configuration and Management > Access over Internet.

    2. In the Kibana area, click Access over Internet.

    3. Enter your Username and Password and click Log On.

       You are then logged on to the Kibana page.

    Note

    • For more information, see Log on to the Kibana console.

    • You can view and modify the SAML identity authentication configuration on the Security page of the cluster. If the SAML configuration is correct but you still cannot log on, check whether the Kibana access whitelist or security group is configured correctly. For more information, see Configure access to Kibana over the Internet or a VPC.

Configure an IDaaS SAML application

1. Log on to the IDaaS console.

2. Click the ID of the target IDaaS instance.

3. Add an application.

   1. In the menu bar on the left, click Application Management > Applications.

   2. On the Applications page, click Add Application.

   3. Click the Standard Protocols tab.

   4. In the SAML 2.0 area, click Add Application.

   5. Enter the Application Name and click Add.

4. In the Sign-In section, on the SSO tab, you can complete the SSO for the application.

   Configure the parameters that are described in the following table. You can retain the default values for other parameters. For more information, see IDaaS-side configuration field descriptions.

   Parameter	Description
   ACS URl	The ACS URL is used to receive authentication information from the IdP. You can copy the ACS URL from the Configure SAML Application wizard page in the ES console.
   SP Entity ID	The unique identifier of the SP. In this example, the SP is Kibana. You can copy the SP Entity ID from the Configure SAML Application wizard page in the ES console.
   Authorize	Select an authorization scope. If you select Manually, you must assign permissions on the Authorize tab.
   NameIDFormat	Select 2.0 persistent.

   Configuration example:

   

5. In the Application Settings section, click Download next to IdP Metadata.

6. Click Save to save the application.

Other operations

In the Access Settings section on the Security page of your instance, you can view and modify SAML authentication configurations, or disable SAML authentication.

Step 1: Configure an IDaaS SAML application

1. Log on to the IDaaS console.

2. Click the ID of the target IDaaS instance.

3. Add an application.

   1. In the left menu bar, click Application Management > Applications.

   2. On the Applications page, click Add Application.

   3. Click the Standard Protocols tab.

   4. In the SAML 2.0 area, click Add Application.

   5. Enter an Application Name and click Add.

4. Under Sign-In, on the SSO tab, complete the SSO for the application.

5. Configure the parameters that are described in the following table. You can retain the default values for other parameters. For more information, see IDaaS configuration field descriptions.

   Parameter	Description
   ACS URl	This ACS endpoint accepts identity verification information from the IDP and supports only SAML HTTP-POST binding. It is typically configured as: ${kibana-url}:5601/api/security/v1/saml.
   SP Entity ID	The URL of the Service Provider (SP). In this topic, the service provider is Kibana. Set this value to ${kibana-url}:5601.
   Authorize	Select the authorization scope. If you select manual authorization, you need to assign permissions on the Authorize tab.
   NameIDFormat	Select 2.0 persistent.

   Note

   • ${kibana-url} is the public address of Kibana.

   • You can find the public URL and public port of Kibana on the Kibana Configuration page in the Elasticsearch console. For more information, see Configure access to Kibana over the Internet or a VPC.

   Configuration example:

   

6. In the Application Settings section, click Download for IdP Metadata.

   The downloaded file is the IDaaS SAML metadata configuration file. Save this file for later use.

7. To save the application, click Save.

Step 2: Create a custom role and configure elastic SAML

1. Log on to the Kibana console of the target instance. For more information, see log on to the Kibana console.

2. Create a role.

3. Map the role to SAML.

   PUT /_security/role_mapping/idaas-test
   {
     "roles": "<admin_role>" ,
     "enabled": true,
     "rules": {
       "field": { "realm.name": "saml1" }
     }
   }

   • Replace idaas-test with the name of the IDaaS service account created in Step 1.

   • Replace <admin_role> with the name of the role that you created in the previous step.

4. Create the YAML configuration files for Elasticsearch and Kibana and add the SAML information.

   Note

   The YML parameter information must be consistent with the SAML information that you configured in Configure an IDaaS SAML application.

   • Content of the elasticsearch.yml configuration file

     #elasticsearch.yml configuration
     
     xpack.security.authc.token.enabled: 'true'
     xpack.security.authc.realms.saml.saml1:
       order: 2
       idp.metadata.path: saml/metadata.xml
       idp.entity_id: "https://es-cn-n6xxxxxx1d.elasticsearch.aliyuncs.com/"
       sp.entity_id: "https://es-cn-n6xxxxxx1d.kibana.elasticsearch.aliyuncs.com:5601/"
       sp.acs: "https://es-cn-n6xxxxxx1d.kibana.elasticsearch.aliyuncs.com:5601/api/security/v1/saml"
       attributes.principal: "nameid:persistent"
       attributes.groups: "roles"

     Parameter	Description
     xpack.security.authc.token.enabled	Specifies whether to enable the Token service. This parameter must be set to true to configure SAML single sign-on. For more information, see saml-enable-token.
     xpack.security.authc.realms.saml.saml1	The identity authentication realm. In this example, saml1 is used. For more information about realms, see Realms.
     order	The priority of the realm. A smaller value indicates a higher priority. Note V8.x requires a unique value for order. We recommend using 2.
     idp.metadata.path	The path to the IdP metadata file.
     idp.entity_id	The identifier used by the IdP. It must match the EntityID in the metadata file.
     sp.entity_id	The unique identifier of the Kibana instance. This is the same as the SP Entity ID of the SAML application. Set this value if you add Kibana as an SP for the IdP. We recommend setting this to the Kibana URL. Important Ensure that the parameter value is consistent with your business environment. If you use a reverse proxy to access Kibana instead of accessing Kibana directly using a URL, set this parameter to the address and port of the reverse proxy.
     sp.acs	The Assertion Consumer Service (ACS) endpoint. The value must be the same as the ACS URL of the single sign-on address for the SAML application. This endpoint receives identity verification information from the IdP, supports only SAML HTTP-POST binding, and is typically configured as ${kibana-url}:5601/api/security/v1/saml. Note ${kibana-url} is the Internet address of Kibana.
     attributes.principal	Assertion information. For more information, see Attribute mapping.
     attributes.groups	Assertion information. For more information, see Attribute mapping.

   • Content of the kibana.yml configuration file

     Important

     This configuration applies only to version 7.10 instances. The Kibana configuration may vary significantly between different versions. You can adjust the configuration as needed. For more information, see Configuring Kibana.

     # kibana configuration
     
     xpack.security.authc.providers:
       saml.saml1:
         order: 0
         realm: "saml1"
       basic.basic1:
         order: 1
         icon: "logoElasticsearch"
         hint: "Typically for administrators"

     Parameter	Description
     xpack.security.authc.providers	Add a SAML provider to set Kibana to use SAML SSO as the authentication method.
     xpack.security.authc.providers.saml.<provider-name>.realm	Set the SAML realm name. Replace <provider-name> with the realm name configured in elasticsearch.yml. In this example, it is saml1.
     xpack.security.authc.providers.basic.basic1	After you configure SAML for Kibana, only users who pass SAML authentication can log on to Kibana. To enable basic authentication on the Kibana logon page, you can specify the basic.basic1 configuration. This is especially useful in test environments where you may need to use the elastic username and password to log on to the cluster to create roles and role mappings. After you specify this configuration, an entry point for basic authentication is added to the Kibana logon page. For more information, see Authentication in kibana. Note If users do not need to use basic authentication to log on to the Kibana console, you do not need to set up basic authentication in kibana.yml.

Step 3: Submit the files

Submit the following files to Alibaba Cloud Elasticsearch technical support:

• A technical support engineer uploads the IDaaS SAML metadata configuration file to the config/saml path in Elasticsearch.

• The elasticsearch.yml configuration file. Technical support will update your cluster's YML file based on the content that you submit.

• The kibana.yml configuration file. Technical support will update your cluster's YML file based on the content that you submit.

Step 4: Verify SSO to Kibana

After technical support completes the configuration, verify SSO for Kibana.

1. Go to the Kibana console logon page. Click Log in with saml/saml1.

   For more information, see Log on to the Kibana console.

2. Enter your IDaaS account and click Submit.

   You are then logged on to the Kibana page.