Elasticsearch:Configure SAML Single Sign-On (SSO) for Kibana

Step 1: Configure an IDaaS SAML application

1. Log on to the IDaaS console.

2. Click the ID of the target IDaaS instance.

3. Add an application.

   1. In the left menu bar, choose Application Management > Applications.

   2. On the Applications page, click Add Application.

   3. Click the Standard Protocols tab.

   4. In the SAML 2.0 area, click Add Application.

   5. Configure Application Name and click Add.

4. On the Sign-In tab and the SSO sub-tab, configure the following parameters. Retain default values for others. For more details, see IDaaS parameters.

   • ACS URl: This is the Assertion Consumer Service (ACS) endpoint of Kibana, where the IdP sends authentication information. Copy the ACS URI from the Configure SAML Application step of the Enable SAML Authentication wizard.

   • SP Entity ID: The unique identifier of the SP. In this example, the SP is Kibana. Copy the SP Entity ID from the Configure SAML Application step of Enable SAML Authentication wizard.

   • Authorize: Select an authorization scope. If you select Manually, you must assign permissions on the Authorize tab.

   • NameIDFormat: Select 2.0 persistent.

   Example:

   

5. In the Application Settings section, click Download next to IdP Metadata.

   Save this XML file; you will upload it to your Elasticsearch cluster.

6. Click Save.

Step 2: Enable SAML authentication in the console

1. Log on to the Alibaba Cloud Elasticsearch console.

2. In the left navigation menu, choose Elasticsearch Clusters.

3. Navigate to the target cluster.

   1. In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.

   2. On the Elasticsearch Clusters page, find the cluster and click its ID.

4. In the left navigation pane of the target cluster, select Configuration and Management > Security.

5. In the Access Settings area, switch on SAML Authentication.

   Note

   If you haven't enabled the HTTPS protocol for the current cluster, you'll be prompted to enable HTTPS first.

6. In the Enable SAML Authentication wizard (Configure SAML Application step):

   1. For Access Type, select Access Kibana over Internet.

   2. Copy the displayed ACS URL and SP Entity ID to configure your IDaaS SAML application.

   3. Upload the IdP metadata XML file you downloaded in Step 1.

   4. Click Next.

Step 3: Associate a Elasticsearch custom role

This step creates and maps a default Elasticsearch role (es_saml1_default) for SAML users.

1. In the Associate Elasticsearch Custom Role step:

   • Role Name: Defaults to es_saml1_default (cannot be modified).

   • Role Permissions: By default, es_saml1_default has all permissions enabled. For fine-grained control, you can modify these permissions later in Kibana. See Use the RBAC mechanism provided by Elasticsearch X-Pack to implement access control.

   • Elasticsearch Cluster Password: Enter the password to verify your permission to create roles.

2. Click Create and Associate Role.

3. Click Next.

Step 4: Configure YML

1. In the Configure YML File step, configure the YML parameters.

   This allows you to review and optionally customize SAML-related YML parameters. The system automatically generates a standard YML file.

   SAML information:

   • Authentication Realm: saml1 (fixed).

   • order: 2 (priority, fixed).

   • idp.entity_id: The identifier used by the IdP (from IDaaS metadata).

   • sp.entity_id: The unique identifier for this Kibana instance (should match IDaaS config).

   • sp.acs: The ACS endpoint (should match IDaaS config).

   • attributes.principal/attributes.groups: These map SAML assertion attributes (e.g., nameid:persistent, roles) to Elasticsearch principal/group fields. For more information, see Attribute mapping and Configuration of SAML 2.0-based SSO.

   Advanced settings

   • Log on to Kibana as Basic User

   • Description for SAML-based Kibana Logon

   Note

   Other parameters like idp.metadata.path are automatically generated and managed by the backend; they are not editable.

2. Click Complete.

   A message indicating successful configuration will appear.

Step 1: Configure an IDaaS SAML application

1. Log on to the IDaaS console.

2. Click the ID of the target IDaaS instance.

3. Add an application.

   1. In the left menu bar, choose Application Management > Applications.

   2. On the Applications page, click Add Application.

   3. Click the Standard Protocols tab.

   4. In the SAML 2.0 area, click Add Application.

   5. Configure Application Name and click Add.

4. On the Sign-In tab and the SSO sub-tab, configure the following parameters. Retain default values for others. For more details, see IDaaS parameters.

   • ACS URl: This is the ACS endpoint of Kibana, where the IdP sends authentication information. Use: ${kibana-url}:5601/api/security/v1/saml (where ${kibana-url} is the public address of Kibana).

   • SP Entity ID: The unique identifier of the SP. Use: ${kibana-url}:5601.

   • Authorize: Select an authorization scope. If you select Manually, you must assign permissions on the Authorize tab.

   • NameIDFormat: Select 2.0 persistent.

   Note

   You can find Kibana's public URL and port on the Kibana Configuration page in the Elasticsearch console. See Connect to a cluster using Kibana.

   Example:

   

5. In the Application Settings section, click Download next to IdP Metadata.

   Save this XML file; you will upload it to your Elasticsearch cluster.

6. Click Save.

Step 2: Create a custom role and configure SAML

This step ensures that SAML users are assigned appropriate roles in Elasticsearch. This is done via Kibana Dev Tools.

1. Log on to the Kibana console of your cluster using basic authentication (e.g., with the elastic account).

2. Create a role.

3. Map the role to SAML using the _security/role_mapping API.

   PUT /_security/role_mapping/idaas-test
   {
     "roles": "<admin_role>" ,
     "enabled": true,
     "rules": {
       "field": { "realm.name": "saml1" }
     }
   }

   Replace idaas-test with your desired mapping name and <admin_role> with the role created in the previous step.

Step 3: Prepare Elasticsearch and Kibana YML configuration files

Create separate YML configuration files for Elasticsearch and Kibana, containing your SAML settings. Ensure consistency with your IDaaS SAML application configuration.

#elasticsearch.yml configuration

xpack.security.authc.token.enabled: 'true'
xpack.security.authc.realms.saml.saml1:
  order: 2
  idp.metadata.path: saml/metadata.xml
  idp.entity_id: "https://es-cn-n6xxxxxx1d.elasticsearch.aliyuncs.com/"
  sp.entity_id: "https://es-cn-n6xxxxxx1d.kibana.elasticsearch.aliyuncs.com:5601/"
  sp.acs: "https://es-cn-n6xxxxxx1d.kibana.elasticsearch.aliyuncs.com:5601/api/security/v1/saml"
  attributes.principal: "nameid:persistent"
  attributes.groups: "roles"

# kibana configuration

xpack.security.authc.providers:
  saml.saml1:
    order: 0
    realm: "saml1"
  basic.basic1:
    order: 1
    icon: "logoElasticsearch"
    hint: "Typically for administrators"

Step 4: Submit files to technical support

After preparing the above files, contact Alibaba Cloud technical support with the following:

1. The downloaded IDaaS SAML metadata XML configuration file. Technical support will upload this to the config/saml path on your Elasticsearch cluster.

2. Your prepared elasticsearch.yml configuration content. Technical support will update your cluster's YML file based on this.

3. Your prepared kibana.yml configuration content. Technical support will update your Kibana instance's YML file based on this.