OneLogin
OneLogin is a cloud-based identity and access management provider that provides a unified access management platform to enterprise-level businesses and organizations. In this guide, we integrate the OneLogin SSO to authenticate users into the Wazuh platform.
There are three stages in the single sign-on integration.
OneLogin Configuration
Create an account in OneLogin. Request a free trial if you don't have a paid license.
Add the OneLogin extension to your browser.
Create a new user.
Log in to OneLogin web console, and select Administration > Users > New User.
Complete the mandatory fields, assign a value in the Department field and click on Save User. In our case, the department is
wazuh-readonly
. This field will be used later in the Wazuh indexer configuration as the backend role.Select the user, navigate to More Actions and click on Change Password to assign a password to the user.
Create a new app using the SAML Custom Connector (Advanced) template and configure the SAML settings.
Go to Applications tab > Applications and then click on Add app.
Search for SAML Custom Connector (Advanced) application. In Display Name, assign a name. In our case, we assigned the name
Wazuh
. Navigate to the Configuration tab and fill in the information:Audience (EntityID):
wazuh-saml
Recipient:
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs
ACS (Consumer) URL Validator:
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs
ACS (Consumer) URL:
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs
Login URL:
https://<WAZUH_DASHBOARD_URL>/app/wazuh
SAML initiator:
Service Provider
SAML nameID format:
Unspecified
SAML issuer type:
Specific
SAML signature element:
Response
Replace the
<WAZUH_DASHBOARD_URL>
field with the corresponding URL of your Wazuh dashboard instance.The configuration must be similar to the highlighted blue rectangles:
Go to the Parameters tab and click on + to add a new parameter to the app:
Edit the parameter details. In our case, we named the new parameter as Roles, then we selected the value Department and marked the Include in SAML assertion checkbox. The rest of the app configuration is left as default.
Click on Save to apply the configuration.
Add the created user to the new app.
Go to Users and select the created user. Go to Applications and click on +, select the Allow the user to sign in checkbox, and click on Save.
Get the
metadata_onelogin.xml
file andX.509 certificate
from the application.Go to Applications > Applications then select the Wazuh app. Click on More Actions and then select SAML Metadata.
Save the file as
XML
. This will be theidp.metadata_file
in the Wazuh indexer security configuration.The Issuer URL will be the
idp.entity_id
in the Wazuh indexer security configuration.The Audience (EntityID) will be the
sp.entity_id
in the Wazuh indexer security configuration.The
roles_key
is the name of the parameter added in the Wazuh app. In our example, this isRoles
.Finally, to obtain the
exchange_key
, go to the SSO tab of the Wazuh app and select View Details in X.509 Certificate. Copy the blob of the certificate excluding the-----BEGIN CERTIFICATE-----
and-----END CERTIFICATE-----
lines:
Wazuh indexer configuration
Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.
Place the
metadata_onelogin.xml
file within the/etc/wazuh-indexer/opensearch-security/
directory. Set the file ownership towazuh-indexer
using the following command:# chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/metadata_onelogin.xml
Edit the
/etc/wazuh-indexer/opensearch-security/config.yml
file and change the following values:Set the
order
inbasic_internal_auth_domain
to0
and thechallenge
flag tofalse
.Include a
saml_auth_domain
configuration under theauthc
section similar to the following:
authc: ... basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: true order: 0 http_authenticator: type: "basic" challenge: false authentication_backend: type: "intern" saml_auth_domain2: http_enabled: true transport_enabled: true order: 1 http_authenticator: type: saml challenge: true config: idp: metadata_file: '/etc/wazuh-indexer/opensearch-security/metadata_onelogin.xml' entity_id: 'https://app.onelogin.com/saml/metadata/xxxxxxx' sp: entity_id: wazuh-saml kibana_url: https://<WAZUH_DASHBOARD_URL> roles_key: Roles exchange_key: 'MIIBkjCB/AIBADBTMQswCQ......' authentication_backend: type: noop ...
Ensure to change the following parameters to their corresponding value:
idp.metadata_file
idp.entity_id
sp.entity_id
kibana_url
roles_key
exchange_key
Run the
securityadmin
script to load the configuration changes made in theconfig.yml
file.# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
The
-h
flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.The command output must be similar to the following:
Security Admin v7 Will connect to localhost:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.8.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /etc/wazuh-indexer/opensearch-security Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null Done with success
Wazuh dashboard configuration
Create a new role mapping for the backend role. Follow these steps to create a new role mapping, and grant read-only permissions to the backend role.
Log into the Wazuh dashboard as administrator.
Click the upper-left menu icon ☰ to open the options, select Security, and then Roles to open the roles page.
Click Create role, complete the empty fields with the following parameters, and then click Create to complete the task.
Name: Assign a name to the role.
Cluster permissions:
cluster_composite_ops_ro
Index:
*
Index permissions:
read
Tenant permissions: Select
global_tenant
and theRead only
option.
Select the newly created role.
Select the Mapped users tab and click Manage mapping.
Under Backend roles, add the value of the Department field in OneLogin configuration and click Map to confirm the action. In our case, the backend role is
wazuh-readonly
.
Check the value of
run_as
in the/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
configuration file. Ifrun_as
is set tofalse
, proceed to the next step.hosts: - default: url: https://localhost port: 55000 username: wazuh-wui password: "<wazuh-wui-password>" run_as: false
If
run_as
is set totrue
, you need to add a role mapping on the Wazuh dashboard. To map the backend role to Wazuh, follow these steps:Click the upper-left menu icon ☰ to open the available options.
Click Wazuh to open the Wazuh dashboard menu, select Security, and then Roles mapping to open the page.
Click Create Role mapping and complete the empty fields with the following parameters:
Role mapping name: Assign a name to the role mapping.
Roles: Select
readonly
.Custom rules: Click Add new rule to expand this field.
User field:
backend_roles
Search operation:
FIND
Value: Assign the value of the Department field in OneLogin configuration. In our case, this is
wazuh-readonly
.
Click Save role mapping to save and map the backend role with Wazuh as read-only.
Edit the Wazuh dashboard configuration file. Add these configurations to
/etc/wazuh-dashboard/opensearch_dashboards.yml
. We recommend that you back up these files before you carry out the configuration.opensearch_security.auth.type: "saml" server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"] opensearch_security.session.keepalive: false
Restart the Wazuh dashboard service.
# systemctl restart wazuh-dashboard
# service wazuh-dashboard restart
Test the configuration. Go to your Wazuh dashboard URL and log in with your OneLogin account.