Okta
Okta Inc. is an identity and access management company that provides technologies that enable secure user authentication into applications. In this guide, we integrate the Okta IdP to authenticate users into the Wazuh platform.
There are three stages in the single sign-on integration.
Okta Configuration
Create an account on Okta. Request a free trial if you don't have a paid license.
Create a new user.
From your okta admin console page, navigate to Directory > People.
From the People section, select Add Person, fill in the details of the new user, and click Save as seen in the following screenshots.
Create a new group. Navigate to Directory > Groups and add a group.
Create a new group using any name. In our case, we name it
wazuh-admins
. This name will be used as ourbackend_roles
inroles_mapping.yml
.Add the new user to the new group. Navigate to Directory > Groups and select your group. Click on Assign People and add the user to the group created.
Create a new app. Configure the SAML settings while you create the app.
Navigate to the Applications section in Okta. Select Create App Integration.
In the Create a new application integration window, select SAML 2.0 and click Next.
Assign a name to the application and click on Next. In our case, we assign the name
wazuh-sso-app
.In the Configure SAML menu, you’ll find the SAML Settings section, modify the following parameters:
Single sign on URL: input
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs
and replace the<WAZUH_DASHBOARD_URL>
field with the corresponding URL.Audience URI (SP Entity ID): input
wazuh-saml
. This is theSP Entity ID
value which will be used later in theconfig.yml
on the Wazuh indexer instance.Other Requestable SSO URLs: click on Show Advanced Settings to access this option. Input
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs/idpinitiated
and replace the<WAZUH_DASHBOARD_URL>
field with the corresponding URL.
You can leave the rest of the values as default.
In the Group Attribute Statements section put
Roles
as the name. The value forRoles
will be used as theroles_key
parameter in the Wazuh indexer configuration. For the filter field, select Matches regex and type.*
.Proceed by clicking next and on the feedback page, select the options seen in the screenshot below. Click on Finish and proceed to the next step.
Add the new app to the new group. Navigate to Directory > Groups and select your group. Click on Applications and select Assign Applications. From here, assign the app created in step 5 and click on Done to save the changes.
Note the necessary parameters from the SAML settings of the new app. The parameters already obtained during the integration are:
sp.entity_id
:wazuh-saml
roles_key
:Roles
kibana_url
:https://<WAZUH_DASHBOARD_URL>
To obtain the remaining parameters, navigate to Applications > Applications, select your app and click Sign On.
Under SAML Signing Certificates, select View IdP metadata of the active certificate. This will open in a new tab. Copy the URL as this will be the
idp.metadata_url
.Now, on the same page, click on View SAML setup instructions. Copy the Identity Provider Issuer URL, it will be the
idp.entity_id
.This information can also be found in the metadata XML file.
Wazuh indexer configuration
Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.
Generate a 64-character long random key using the following command.
openssl rand -hex 32
The output will be used as the
exchange_key
in the/etc/wazuh-indexer/opensearch-security/config.yml
file.Edit the
/etc/wazuh-indexer/opensearch-security/config.yml
file and change the following values:Set the
order
inbasic_internal_auth_domain
to0
and thechallenge
flag tofalse
.Include a
saml_auth_domain
configuration under theauthc
section similar to the following:
authc: ... basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: true order: 0 http_authenticator: type: "basic" challenge: false authentication_backend: type: "intern" saml_auth_domain: http_enabled: true transport_enabled: false order: 1 http_authenticator: type: saml challenge: true config: idp: metadata_url: 'https://....okta.com/app/..../sso/saml/metadata' entity_id: 'http://www.okta.com/....' sp: entity_id: wazuh-saml kibana_url: https://<WAZUH_DASHBOARD_URL> roles_key: Roles exchange_key: 'b1d6dd32753374557dcf92e241.........' authentication_backend: type: noop
Ensure to change the following parameters to their corresponding value:
idp.metadata_url
idp.entity_id
sp.entity_id
kibana_url
roles_key
exchange_key
Run the
securityadmin
script to load the configuration changes made in theconfig.yml
file.# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
The
-h
flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses 127.0.0.1, set your Wazuh indexer address if necessary.The command output must be similar to the following:
Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.10.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /etc/wazuh-indexer/opensearch-security Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null Done with success
Edit the
/etc/wazuh-indexer/opensearch-security/roles_mapping.yml
file and change the following values:Configure the
roles_mapping.yml
file to map the Okta group to the appropriate Wazuh indexer role. In our case, we map it to theall_access
role:all_access: reserved: false hidden: false backend_roles: - "admin" - "<GROUP_NAME>"
Replace
<GROUP_NAME>
with the name you gave to your group in Step 3. In our case, this iswazuh-admins
.Run the
securityadmin
script to load the configuration changes made in theroles_mapping.yml
file.# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
The
-h
flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses 127.0.0.1, set your Wazuh indexer address if necessary.The command output must be similar to the following:
Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.10.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /etc/wazuh-indexer/opensearch-security Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml SUCC: Configuration for 'rolesmapping' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null Done with success
Wazuh dashboard configuration
Check the value of
run_as
in the/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
configuration file. Ifrun_as
is set tofalse
, proceed to the next step.hosts: - default: url: https://127.0.0.1 port: 55000 username: wazuh-wui password: "<wazuh-wui-password>" run_as: false
If
run_as
is set totrue
, you need to add a role mapping on the Wazuh dashboard. To map the backend role to Wazuh, follow these steps:Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.
Click Create Role mapping and complete the empty fields with the following parameters:
Role mapping name: Assign a name to the role mapping.
Roles: Select
administrator
.Custom rules: Click Add new rule to expand this field.
User field:
backend_roles
Search operation:
FIND
Value: Assign the name you gave to your group in Step 3 of Okta configuration, in our case, this is
wazuh-admins
.
Click Save role mapping to save and map the backend role with Wazuh as administrator.
Edit the Wazuh dashboard configuration file. Add these configurations to
/etc/wazuh-dashboard/opensearch_dashboards.yml
. We recommend that you back up these files before you carry out the configuration.opensearch_security.auth.type: "saml" server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"] opensearch_security.session.keepalive: false
Restart the Wazuh dashboard service.
# systemctl restart wazuh-dashboard
# service wazuh-dashboard restart
Test the configuration. Go to your Wazuh dashboard URL and log in with your Okta account.