Secure your clusters with SAML

These steps show how you can secure your Elasticsearch clusters, Kibana, and Enterprise Search instances in a deployment by using a Security Assertion Markup Language (SAML) identity provider (IdP) for cross-domain, single sign-on authentication.

The SAML credentials are valid against the deployment, not the ECE platform. You can configure role-based access control for the platform separately.

Before you begin

edit

Elastic Cloud Enterprise supports SAML with Elastic Stack version 6.4 and later.

Configure your 7.0 or above cluster to use SAML

edit

You must edit your cluster configuration, sometimes also referred to as the deployment plan, to point to the SAML IdP before you can complete the configuration in Kibana. If you are using machine learning or a deployment with hot-warm architecture, you must include this SAML IdP configuration in the user settings section for each node type.

Create or use an existing deployment that includes a Kibana instance version 6.4 or later.
Copy the Kibana endpoint URL.

Update your Elasticsearch user settings for the saml realm and specify your IdP provider configuration:

xpack:
  security:
    authc:
      realms:
        saml: 
          saml-realm-name: 
            order: 2 
            attributes.principal: "nameid:persistent" 
            attributes.groups: "groups" 
            idp.metadata.path: "<check with your identity provider>" 
            idp.entity_id: "<check with your identity provider>" 
            sp.entity_id: "KIBANA_ENDPOINT_URL/" 
            sp.acs: "KIBANA_ENDPOINT_URL/api/security/saml/callback"
            sp.logout: "KIBANA_ENDPOINT_URL/logout"

	Specifies the authentication realm service.
	Defines the SAML realm name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.
	The order of the SAML realm in your authentication chain. Allowed values are between `2` and `100`. Set to `2` unless you plan on configuring multiple SSO realms for this cluster.
	Defines the SAML attribute that is going to be mapped to the principal (username) of the authenticated user in Kibana. In this non-normative example, `nameid:persistent` maps the `NameID` with the `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` format from the Subject of the SAML Assertion. You can use any SAML attribute that carries the necessary value for your use case in this setting, such as `uid` or `mail`. Refer to the attribute mapping documentation for details and available options.
	Defines the SAML attribute used for role mapping when configured in Kibana. Common choices are `groups` or `roles`. The values for both `attributes.principal` and `attributes.groups` depend on the IdP provider, so be sure to review their documentation. Refer to the attribute mapping documentation for details and available options.
	The file path or the HTTPS URL where your IdP metadata is available, such as `https://idpurl.com/sso/saml/metadata`. If you configure a URL you need to make ensure that your Elasticsearch cluster can access it.
	The SAML EntityID of your IdP. This can be read from the configuration page of the IdP, or its SAML metadata, such as `https://idpurl.com/entity_id`.
	Replace `KIBANA_ENDPOINT_URL` with the one noted in the previous step, such as `sp.entity_id: https://eddac6b924f5450c91e6ecc6d247b514.us-east-1.aws.found.io:9243/` including the slash at the end.

By default, users authenticating through SAML have no roles assigned to them. For example, if you want all your users authenticating with SAML to get access to Kibana, issue the following request to Elasticsearch:

POST /_xpack/security/role_mapping/CLOUD_SAML_TO_KIBANA_ADMIN 
{
   "enabled": true,
    "roles": [ "kibana_admin" ], 
    "rules": { 
        "field": { "realm.name": "saml-realm-name" } 
    },
    "metadata": { "version": 1 }
}

	The mapping name.
	The Elastic Stack role to map to.
	A rule specifying the SAML role to map from.
	`realm.name` can be any string containing only alphanumeric characters, underscores, and hyphens.

Alternatively, if you want the users that belong to the group elasticadmins in your identity provider to be assigned the superuser role in your Elasticsearch cluster, issue the following request to Elasticsearch:

POST /_xpack/security/role_mapping/CLOUD_SAML_ELASTICADMIN_TO_SUPERUSER 
{
   "enabled": true,
    "roles": [ "superuser" ], 
    "rules": { "all" : [ 
        { "field": { "realm.name": "saml-realm-name" } }, 
        { "field": { "groups": "elasticadmins" } }
    ]},
    "metadata": { "version": 1 }
}

	The mapping name.
	The Elastic Stack role to map to.
	A rule specifying the SAML role to map from.
	`realm.name` can be any string containing only alphanumeric characters, underscores, and hyphens.

In order to use the field groups in the mapping rule, you need to have mapped the SAML Attribute that conveys the group membership to attributes.groups in the previous step.

Update Kibana in the user settings configuration to use SAML as the authentication provider:

If you are using a Kibana instance of version 7.7 or later:

xpack.security.authc.providers:
  saml.saml1:
    order: 0
    realm: saml-realm-name

The name of the SAML realm that you have configured earlier, for instance saml-realm-name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.

This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the basic provider like this:

xpack.security.authc.providers:
  saml.saml1:
    order: 0
    realm: saml-realm-name
    description: "Log in with my SAML" 
  basic.basic1:
    order: 1

This arbitrary string defines how SAML login is titled in the Login Selector UI that is shown when you enable multiple authentication providers in Kibana. If you have a Kibana instance of version 7.8 or later, you can also configure the optional icon and hint settings for any authentication provider.

If you are using a Kibana instance of version 7.3 - 7.6:
```
xpack.security.authc.providers: [saml]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.authc.saml.realm: saml-realm-name 
```
The name of the SAML realm that you have configured earlier, for instance saml-realm-name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.

This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the basic provider by setting xpack.security.authc.providers: [saml, basic] in the configuration of Kibana.
If you are using a Kibana instance of version 7.2 or earlier:
```
xpack.security.authProviders: [saml]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.public:
  protocol: https
  hostname: d1a45bf330b74c248d7cc2e0ead8e159.192.168.44.10.ip.es.io 
  port: 9243
```
The hostname from your Kibana endpoint URL.

This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the basic authProvider by setting xpack.security.authProviders: [saml, basic] in the configuration of Kibana.

Recommended: If you are using Enterprise Search, we recommend you set up SAML 2.0 single sign-on (SSO) for the solution. This allows you to manage access to App Search and Workplace Search for your existing SAML users.

Configure your Enterprise Search user settings with the following parameters:

If you are using an Enterprise Search deployment of version 7.14.0 or later:

Check Set up Enterprise Search with SAML 2.0 single sign-on (SSO) in the Enterprise Search documentation. This document covers the Elastic Cloud user settings for Elasticsearch, Kibana, and Enterprise Search. It also explains how to manage access to App Search and Workplace Search for your existing SAML users.

If you are using an Enterprise Search deployment of version 7.9.2 or later:

ent_search.auth.saml1.source: elasticsearch-saml 
ent_search.auth.saml1.order: 1 
ent_search.auth.saml1.description: "SAML login" 
ent_search.auth.saml1.icon: "https://my-company.org/company-logo.png"

	The name of the SAML realm that you have configured earlier, for instance `saml-realm-name`. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference an `ent_search.auth.<auth_name>.source`, you must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for Enterprise Search. To learn more, check Elasticsearch SAML in the App Search documentation.
	The order in which to display this provider on the login screen.
	The name to be displayed on the login screen associated with this provider.
	The URL to an icon to be displayed on the login screen associated with this provider.

If you are using an Enterprise Search deployment of version 7.9.1 or earlier:

ent_search.auth.source: elasticsearch-saml
ent_search.auth.name: saml-realm-name

The name of the SAML realm that you have configured earlier, for instance saml-realm-name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference an ent_search.auth.name, you generally must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for Enterprise Search. To learn more, check Elasticsearch SAML in the App Search documentation.

Optional: If you have an App Search deployment (App Search 7.6 and earlier), you can set it to also use SAML single sign-on authentication. Configure your App Search user settings with the following parameters:

app_search.auth.source: elasticsearch-saml
app_search.auth.name: saml-realm-name

The name of the SAML realm that you have configured earlier, for instance saml-realm-name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference an app_search.auth.name, you generally must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for App Search. To learn more, check Elasticsearch SAML in the App Search documentation.

Optional: Generate SAML metadata for the Service Provider.

This endpoint is only available for deployments on version 7.11 or later.

The SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file. If your SAML Identity Provider requires or allows you to configure it to trust the Elastic Stack Service Provider through the use of a metadata file, you can generate the SAML metadata by issuing the following request to Elasticsearch:
```
GET /_security/saml/metadata/realm_name 
```
The name of the SAML realm in Elasticsearch.

You can generate the SAML metadata by issuing the API request to Elasticsearch and storing metadata as an XML file using tools like jq.

The following command, for example, generates the metadata for the SAML realm saml1 and saves it to metadata.xml file:
```
curl -X GET -H "Content-Type: application/json" -u user_name:password https://<elasticsearch_endpoint>:9243/_security/saml/metadata/saml1 
|jq -r '.[]' > metadata.xml
```
The elasticsearch endpoint for the given deployment where the saml1 realm is configured.
Optional: If your Identity Provider doesn’t publish its SAML metadata at an HTTP URL, or if your Elasticsearch cluster cannot reach that URL, you can upload the SAML metadata as a file.
1. Prepare a ZIP file with a custom bundle that contains your Identity Provider’s metadata (metadata.xml) inside of a saml folder.
  
  This bundle allows all Elasticsearch containers to access the metadata file.
2. Update your Elasticsearch cluster configuration using the advanced configuration editor to use the bundle you prepared in the previous step. You need to modify the user_bundles JSON attribute similar to the following example snippet:
```
{
  "cluster_name": "REPLACE_WITH_YOUR_CLUSTER_NAME",
  "plan": {

    ...

    "elasticsearch": {
      "version": "6.4.1",
      "user_bundles": [
        {
          "name": "saml-metadata",
          "url": "https://www.MYURL.com/saml-metadata.zip",
          "elasticsearch_version": "6.4.1"
        }
      ]
    }
  }
```
  The URLs that point to the ZIP file containing the bundle must be accessible to the deployment. Custom bundles are unzipped under the path /app/config/BUNDLE_DIRECTORY_STRUCTURE, where BUNDLE_DIRECTORY_STRUCTURE is the directory structure in the ZIP file. Make sure to save the file location where custom bundles get unzipped, as you will need it in the next step.
  
  In our example, the SAML metadata file will be located in the path /app/config/saml/metadata.xml:
```
$ tree .
.
└── saml
      └── metadata.xml
```
3. Adjust your saml realm configuration accordingly:
```
    idp.metadata.path: /app/config/saml/metadata.xml 
```
  The path to the SAML metadata file that was uploaded.
Use the Kibana endpoint URL to log in.

Configure your 6.x cluster to use SAML

edit

For 6.x deployments the configuration is slightly different. For step 3, you must specify the realm name, then define the realm type using the following example:

xpack:
  security:
    authc:
      realms:
        cloud-saml: 
          type: saml
            order: 2

	For 6.x clusters you must use `cloud-saml` as realm name.
	For 6.x clusters, you must set the `order` to `2`.

All of the other steps are the same.

« Secure your 5.x and 6.x clusters with Active Directory Sign Outgoing SAML Message »