OneLogin

OneLogin is a cloud-based identity and access management provider that provides a unified access management platform to enterprise-level businesses and organizations. In this guide, we integrate the OneLogin SSO to authenticate users into the Wazuh platform.

Learn how to create administrator and read-only roles on OneLogin and map them with Wazuh in the sections below.

Setup OneLogin single sign-on with administrator role

Follow these steps to integrate OneLogin IdP with Wazuh for single sign-on and grant administrator role to the authenticated OneLogin users on the Wazuh platform:

  1. OneLogin Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

OneLogin Configuration

  1. Create an account in OneLogin. Request a free trial if you don't have a paid license.

  2. Add the OneLogin extension to your browser.

  3. Create a new user.

    1. Log in to OneLogin web console, and select Administration > Users > New User.

    2. Complete the mandatory fields, assign a value in the Department field and click on Save User. In our case, the department is wazuh-admins. This field will be used later in the Wazuh indexer configuration as the backend role.

    3. Select the user, navigate to More Actions and click on Change Password to assign a password to the user.

  4. Create a new app using the SAML Custom Connector (Advanced) template and configure the SAML settings.

    1. Go to Applications tab > Applications and then click on Add app.

    2. Search for SAML Custom Connector (Advanced) application. In Display Name, assign a name. In our case, we assigned the name Wazuh. Navigate to the Configuration tab and fill in the information:

      • Audience (EntityID): wazuh-saml

      • Recipient: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • ACS (Consumer) URL Validator: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • ACS (Consumer) URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • Login URL: https://<WAZUH_DASHBOARD_URL>

      • SAML initiator: Service Provider

      • SAML nameID format: Unspecified

      • SAML issuer type: Specific

      • SAML signature element: Response

      Replace the <WAZUH_DASHBOARD_URL> field with the corresponding URL of your Wazuh dashboard instance.

      The configuration must be similar to the highlighted blue rectangles:

    3. Go to the Parameters tab and click on + to add a new parameter to the app:

    4. Edit the parameter details. In our own case, we named the new parameter as Roles, then we selected the value Department and marked the Include in SAML assertion checkbox. The rest of the app configuration is left as default.

    5. Click on Save to apply the configuration.

  5. Add the created user to the new app.

    1. Go to Users and select the created user. Go to Applications and click on +, select the Allow the user to sign in checkbox, and click on Save.

  6. Get the required parameters from the application.

    1. Go to Applications > Applications then select the Wazuh app. Click on More Actions and then select SAML Metadata.

    2. Save the file as XML. This will be the idp.metadata_file in the Wazuh indexer security configuration.

    3. The Issuer URL will be the idp.entity_id in the Wazuh indexer security configuration.

    4. The Audience (EntityID) will be the sp.entity_id in the Wazuh indexer security configuration.

    5. The roles_key is the name of the parameter added in the Wazuh app. In our example, this is Roles.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.

  1. Generate a 64-character long random key using the following command.

    openssl rand -hex 32

    The output will be used as the exchange_key in the /etc/wazuh-indexer/opensearch-security/config.yml file.

  2. Place the onelogin_metadata.xml file within the /etc/wazuh-indexer/opensearch-security/ directory. Set the file ownership to wazuh-indexer using the following command:

    # chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/onelogin_metadata.xml

  3. Edit the /etc/wazuh-indexer/opensearch-security/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
...
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "intern"
      saml_auth_domain2:
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_file: '/etc/wazuh-indexer/opensearch-security/onelogin_metadata.xml'
              entity_id: 'https://app.onelogin.com/saml/metadata/xxxxxxx'
            sp:
              entity_id: wazuh-saml
            kibana_url: https://<WAZUH_DASHBOARD_URL>
            roles_key: Roles
            exchange_key: 'b1d6dd32753374557dcf92e241.......'
        authentication_backend:
          type: noop
...

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  4. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success

  5. Edit the /etc/wazuh-indexer/opensearch-security/roles_mapping.yml file and change the following values:

    To configure the roles_mapping.yml file, we map the Department field from step 3 to the all_access role on the Wazuh indexer. In this case, wazuh-admins:

    ...
all_access:
  reserved: false
  hidden: false
  backend_roles:
  - "admin"
  - "wazuh-admins"
  description: "Maps admin to all_access"
...

  6. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null
Done with success

Wazuh dashboard configuration

  1. Verify that run_as is set to true in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. This is required to create a role mapping in the Wazuh dashboard, ensuring the backend role provided by the IdP is correctly mapped to the corresponding Wazuh role.

    hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: "<WAZUH_WUI_PASSWORD>"
      run_as: true

    1. Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.

      Wazuh role mapping

    2. Click Create Role mapping and complete the empty fields with the following parameters:

      • Role mapping name: Assign a name to the role mapping.

      • Roles: Select administrator.

      • Custom rules: Click Add new rule to expand this field.

      • User field: backend_roles

      • Search operation: FIND

      • Value: Assign the value of the Department field in OneLogin configuration. In our case, this is wazuh-admins.

      • Click Save role mapping to save and map the backend role with Wazuh as administrator.

      Create Wazuh role mapping

  2. Edit the Wazuh dashboard configuration file. Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. We recommend that you back up these files before you carry out the configuration.

    opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type: ["basicauth","saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]

  3. Restart the Wazuh dashboard service using this command.

    # systemctl restart wazuh-dashboard

  4. Test the configuration. To test the configuration, go to your Wazuh dashboard URL and log in with your OneLogin account.

Setup OneLogin single sign-on with read-only role

Follow these steps to integrate OneLogin IdP with Wazuh for single sign-on and grant read-only role to the authenticated OneLogin users on the Wazuh platform:

  1. OneLogin configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

OneLogin configuration

  1. Create an account in OneLogin. Request a free trial if you don't have a paid license.

  2. Add the OneLogin extension to your browser.

  3. Create a new user.

    1. Log in to OneLogin web console, and select Administration > Users > New User.

    2. Complete the mandatory fields, assign a value in the Department field and click on Save User. In our case, the department is wazuh-readonly. This field will be used later in the Wazuh indexer configuration as the backend role.

    3. Select the user, navigate to More Actions and click on Change Password to assign a password to the user.

  4. Create a new app using the SAML Custom Connector (Advanced) template and configure the SAML settings.

    1. Go to Applications tab > Applications and then click on Add app.

    2. Search for SAML Custom Connector (Advanced) application. In Display Name, assign a name. In our case, we assigned the name Wazuh. Navigate to the Configuration tab and fill in the information:

      • Audience (EntityID): wazuh-saml

      • Recipient: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • ACS (Consumer) URL Validator: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • ACS (Consumer) URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • Login URL: https://<WAZUH_DASHBOARD_URL>

      • SAML initiator: Service Provider

      • SAML nameID format: Unspecified

      • SAML issuer type: Specific

      • SAML signature element: Response

      Replace the <WAZUH_DASHBOARD_URL> field with the corresponding URL of your Wazuh dashboard instance.

      The configuration must be similar to the highlighted blue rectangles:

    3. Go to the Parameters tab and click on + to add a new parameter to the app:

    4. Edit the parameter details. In our own case, we named the new parameter as Roles, then we selected the value Department and marked the Include in SAML assertion checkbox. The rest of the app configuration is left as default.

    5. Click on Save to apply the configuration.

  5. Add the created user to the new app.

    1. Go to Users and select the created user. Go to Applications and click on +, select the Allow the user to sign in checkbox, and click on Save.

  6. Get the required parameters from the application.

    1. Go to Applications > Applications then select the Wazuh app. Click on More Actions and then select SAML Metadata.

    2. Save the file as XML. This will be the idp.metadata_file in the Wazuh indexer security configuration.

    3. The Issuer URL will be the idp.entity_id in the Wazuh indexer security configuration.

    4. The Audience (EntityID) will be the sp.entity_id in the Wazuh indexer security configuration.

    5. The roles_key is the name of the parameter added in the Wazuh app. In our example, this is Roles.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.

  1. Generate a 64-character long random key using the following command.

    openssl rand -hex 32

    The output will be used as the exchange_key in the /etc/wazuh-indexer/opensearch-security/config.yml file.

  2. Place the onelogin_metadata.xml file within the /etc/wazuh-indexer/opensearch-security/ directory. Set the file ownership to wazuh-indexer using the following command:

    # chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/onelogin_metadata.xml

  3. Edit the /etc/wazuh-indexer/opensearch-security/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
...
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "intern"
      saml_auth_domain2:
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_file: '/etc/wazuh-indexer/opensearch-security/onelogin_metadata.xml'
              entity_id: 'https://app.onelogin.com/saml/metadata/xxxxxxx'
            sp:
              entity_id: wazuh-saml
            kibana_url: https://<WAZUH_DASHBOARD_URL>
            roles_key: Roles
            exchange_key: 'b1d6dd32753374557dcf92e241......'
        authentication_backend:
          type: noop
...

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  4. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success

Wazuh dashboard configuration

  1. Create a new role mapping for the backend role. Follow these steps to create a new role mapping, and grant read-only permissions to the backend role.

    1. Log into the Wazuh dashboard as administrator.

    2. Click the upper-left menu icon ☰ to open the options, go to Indexer management > Security, and then Roles to open the roles page.

    3. Click Create role, complete the empty fields with the following parameters, and then click Create to complete the task.

      • Name: Assign a name to the role.

      • Cluster permissions: cluster_composite_ops_ro

      • Index: *

      • Index permissions: read

      • Tenant permissions: global_tenant and select the Read only option.

    4. Select the newly created role.

    5. Select the Mapped users tab and click Manage mapping.

    6. Under Backend roles, add the value of the Department field in OneLogin configuration and click Map to confirm the action. In our case, the backend role is wazuh-readonly.

  2. Verify that run_as is set to true in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. This is required to create a role mapping in the Wazuh dashboard, ensuring the backend role provided by the IdP is correctly mapped to the corresponding Wazuh role.

    hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: "<WAZUH_WUI_PASSWORD>"
      run_as: true

    1. Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.

      Wazuh role mapping

    2. Click Create Role mapping and complete the empty fields with the following parameters:

      • Role mapping name: Assign a name to the role mapping.

      • Roles: Select readonly.

      • Custom rules: Click Add new rule to expand this field.

      • User field: backend_roles

      • Search operation: FIND

      • Value: Assign the value of the Department field in OneLogin configuration. In our case, this is wazuh-readonly.

      • Click Save role mapping to save and map the backend role with Wazuh as read-only.

      Create Wazuh role mapping

  3. Edit the Wazuh dashboard configuration file. Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. We recommend that you back up these files before you carry out the configuration.

    opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type: ["basicauth","saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]

  4. Restart the Wazuh dashboard service using this command.

    # systemctl restart wazuh-dashboard

  5. Test the configuration. Go to your Wazuh dashboard URL and log in with your OneLogin account.