Keycloak

Keycloak is an open source identity and access management tool. It provides user federation, strong authentication, user management, and fine-grained authorization for modern applications and services. In this guide, we integrate the Keycloak IdP to authenticate users into the Wazuh platform.

Learn how to create administrator and read-only roles on Keycloak and map them with Wazuh in the sections below.

Setup Keycloak single sign-on with administrator role

Follow these steps to integrate Keycloak IdP with Wazuh for single sign-on and grant administrator role to the authenticated Keycloak users on the Wazuh platform:

  1. Keycloak Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

Keycloak Configuration

  1. Create a new realm. Log in to the Keycloak admin console, click on Manage realms > Create realm. Input a name in the Realm name field; in our case, this is named Wazuh. Click on Create to apply this configuration.

    Keycloak admin console, Create realm form with the Wazuh realm name

  2. Create a new client. In the newly created realm, navigate to Clients > Create client and modify the following parameters:

    • Client type: select SAML from the drop-down menu.

    • Client ID: input wazuh-saml. This is the SP Entity ID value which will be used later in the Wazuh indexer configuration.

    You can leave the rest of the values as default. Click Next and Save to apply the configuration.

    Keycloak admin console, Create client form with SAML client type and the wazuh-saml client ID

  3. Configure client settings.

    1. Navigate to Clients > Settings and ensure the Enabled button is turned on. Complete the section with these parameters:

      • Client ID: wazuh-saml

      • Name: Wazuh SSO

      • Valid redirect URIs: https://<WAZUH_DASHBOARD_URL>/*

      • IDP-Initiated SSO URL name: wazuh-dashboard

      • Name ID format: username

      • Force POST binding: ON

      • Include AuthnStatement: ON

      • Sign documents: ON

      • Sign assertions: ON

      • Signature algorithm: RSA_SHA256

      • SAML signature key name: KEY_ID

      • Canonicalization method: EXCLUSIVE

      • Front channel logout: ON

      Replace the <WAZUH_DASHBOARD_URL> field with the corresponding URL of your Wazuh dashboard instance.

      The configuration must be similar to the highlighted blue rectangles:

      Keycloak client Settings tab with the general and access settings for wazuh-saml
      Keycloak client Settings tab with the SAML capabilities options
      Keycloak client Settings tab with Canonicalization method EXCLUSIVE and Front channel logout turned on

      You can leave the rest of the values as default. Click Save to apply the configuration.

    2. Navigate to Clients > Keys and complete the section with these parameters:

      • Client signature required: Off

      Keycloak client Keys tab with Client signature required turned off

    3. Navigate to Clients > Advanced > Fine Grain SAML Endpoint Configuration and complete the section with these parameters:

      • Assertion Consumer Service POST Binding URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs/idpinitiated

      • Logout Service Redirect Binding URL: https://<WAZUH_DASHBOARD_URL>

      Keycloak client Advanced tab, Fine Grain SAML Endpoint Configuration with the service URLs

      You can leave the rest of the values as default. Click Save to apply the configuration.

  4. Create a new role. Navigate to Realm roles > Create role and complete the section with these parameters:

    • Role name: Input wazuh-admins. This will be our backend role in the Wazuh indexer configuration.

      Keycloak Create role form with the wazuh-admins role name

    Click on Save to apply the configuration.

  5. Create a new user.

    1. Navigate to Users > Add user and fill in the required information.

      Keycloak Create user form with the user details

      Click on Create to apply the configuration.

    2. Navigate to Users > Credentials > Set password and input a password for the newly created user. You will use these credentials to log in to the Wazuh dashboard.

      Keycloak user Credentials tab with the Set password dialog

      Click on Save to apply the configuration.

  6. Create a new group and assign the user.

    1. Go to Groups > Create group and assign a name to the group. In our case, this is Wazuh-admins.

      Keycloak Groups page with the Create group button and the Wazuh-admins group listed

    2. Click on the newly created group, navigate to Members > Add member and select the user created in the previous step. Click on Add to add it to the group.

      Keycloak Add member dialog for the Wazuh-admins group with a user selected and the Add button

    3. In the newly created group details, go to Role Mapping > Assign role > Realm roles and select the wazuh-admins role created in step 4. Click on Assign to apply the configuration.

      Keycloak Assign Realm roles dialog for Wazuh-admins with the wazuh-admins role selected

  7. Configure protocol mapper.

    1. Navigate to Client scopes > role_list > Mappers. Click the ⋮ icon on the role list row and select Delete. Keycloak sends the roles through only one Role list mapper per client, so the built-in mapper can replace the one you add next.

      Keycloak admin console, role_list client scope Mappers tab with the Delete option for the built-in role list mapper

    2. Navigate to Client scopes > role_list > Mappers > Configure a new mapper.

      Keycloak role_list client scope, Mappers tab with no mappers and the Configure a new mapper button

    3. Select Role list from the list as seen below:

      Keycloak mapper type list with Role list selected

    4. Complete the Add mapper section with these parameters:

      • Mapper type: Role list

      • Name: wazuhRoleKey. You can use any name here.

      • Role attribute name: Roles. This will be the roles_key on the Wazuh indexer configuration.

      • SAML Attribute NameFormat: Basic

      • Single Role Attribute: On

      Keycloak Add mapper form for the Role list mapper with the Roles attribute name

    Click on Save to apply the configuration.

  8. Note the necessary parameters from the SAML settings of Keycloak.

    1. The parameters already obtained during the integration are:

      • sp.entity_id: wazuh-saml

      • roles_key: Roles

      • kibana_url: https://<WAZUH_DASHBOARD_URL>

      • backend_roles: wazuh-admins

    2. To obtain the remaining parameters:

      1. Navigate to Clients and select the name of your client. In our case, this is wazuh-saml.

      2. Navigate to Action > Download adaptor config, and ensure the Format option is mod-auth-mellon.

      3. Click on Download to download the remaining files.

      Keycloak Download adaptor configs dialog with the mod-auth-mellon format option and Download button

    3. The downloaded files contain the idp-metadata.xml file and the sp-metadata.xml file.

      • The idp.entityID parameter is in the idp-metadata.xml file.

      SAML identity provider metadata XML with the entityID attribute highlighted

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.

  1. Backup the existing Wazuh indexer security configuration files:

    # /usr/share/wazuh-indexer/bin/indexer-security-init.sh --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"

  2. Generate a 64-character long random key using the following command.

    openssl rand -hex 32

    The output will be used as the exchange_key in the /etc/wazuh-indexer/opensearch-security/config.yml file.

  3. Place the idp-metadata.xml and sp-metadata.xml files within the /etc/wazuh-indexer/opensearch-security/ directory. Set the file ownership to wazuh-indexer using the following command:

    # chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/idp-metadata.xml
# chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/sp-metadata.xml

  4. Edit the /etc/wazuh-indexer/opensearch-security/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0, and set the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
...
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "intern"
      saml_auth_domain:
        http_enabled: true
        transport_enabled: false
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_file: '/etc/wazuh-indexer/opensearch-security/idp-metadata.xml'
              entity_id: 'http://<KEYCLOAK_URL>:<KEYCLOAK_PORT>/realms/Wazuh'
            sp:
              entity_id: wazuh-saml
              metadata_file: '/etc/wazuh-indexer/opensearch-security/sp-metadata.xml'
            kibana_url: https://<WAZUH_DASHBOARD_URL>
            roles_key: Roles
            exchange_key: 'b1d6dd32753374557dcf92e241.......'
        authentication_backend:
          type: noop

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • sp.metadata_file

    • kibana_url

    • roles_key

    • exchange_key

  5. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success

  6. Edit the /etc/wazuh-indexer/opensearch-security/roles_mapping.yml file and change the following values:

    Configure the roles_mapping.yml file to map the realm role in Keycloak to the appropriate Wazuh indexer role. In our case, we map this to the all_access role:

    all_access:
  reserved: false
  hidden: false
  backend_roles:
  - "wazuh-admins"

  7. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null
Done with success

Wazuh dashboard configuration

  1. Verify that run_as is set to true in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. This is required to create a role mapping in the Wazuh dashboard, ensuring the backend role provided by the IdP is correctly mapped to the corresponding Wazuh role.

    hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: "<WAZUH_WUI_PASSWORD>"
      run_as: true

    1. Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.

      Wazuh role mapping

    2. Click Create Role mapping and complete the empty fields with the following parameters:

      • Role mapping name: Assign a name to the role mapping.

      • Roles: Select administrator.

      • Custom rules: Click Add new rule to expand this field.

      • User field: backend_roles

      • Search operation: FIND

      • Value: Assign the value of the realm role in Keycloak configuration. In our case, this is wazuh-admins.

      • Click Save role mapping to save and map the backend role with Wazuh as administrator.

      Create Wazuh role mapping

  2. Edit the Wazuh dashboard configuration file. Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. We recommend that you back up these files before you carry out the configuration.

    opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type: ["basicauth","saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]

  3. Restart the Wazuh dashboard service using this command.

    # systemctl restart wazuh-dashboard

  4. Test the configuration. To test the configuration, go to your Wazuh dashboard URL and log in with your Keycloak account.

Setup Keycloak single sign-on with read-only role

Follow these steps to integrate Keycloak IdP with Wazuh for single sign-on and grant read-only role to the authenticated Keycloak users on the Wazuh platform:

  1. Keycloak Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

Keycloak Configuration

  1. Create a new realm. Log in to the Keycloak admin console, click on Manage realms > Create realm. Input a name in the Realm name field; in our case, this is named Wazuh. Click on Create to apply this configuration.

    Keycloak admin console, Create realm form with the Wazuh realm name

  2. Create a new client. In the newly created realm, navigate to Clients > Create client and modify the following parameters:

    • Client type: select SAML from the drop-down menu.

    • Client ID: input wazuh-saml. This is the SP Entity ID value which will be used later in the Wazuh indexer configuration.

    You can leave the rest of the values as default. Click Next and Save to apply the configuration.

    Keycloak admin console, Create client form with SAML client type and the wazuh-saml client ID

  3. Configure client settings.

    1. Navigate to Clients > Settings and ensure the Enabled button is turned on. Complete the section with these parameters:

      • Client ID: wazuh-saml

      • Name: Wazuh SSO

      • Valid redirect URIs: https://<WAZUH_DASHBOARD_URL>/*

      • IDP-Initiated SSO URL name: wazuh-dashboard

      • Name ID format: username

      • Force POST binding: ON

      • Include AuthnStatement: ON

      • Sign documents: ON

      • Sign assertions: ON

      • Signature algorithm: RSA_SHA256

      • SAML signature key name: KEY_ID

      • Canonicalization method: EXCLUSIVE

      • Front channel logout: ON

      Replace the <WAZUH_DASHBOARD_URL> field with the corresponding URL of your Wazuh dashboard instance.

      The configuration must be similar to the highlighted blue rectangles:

      Keycloak client Settings tab with the general and access settings for wazuh-saml
      Keycloak client Settings tab with the SAML capabilities options
      Keycloak client Settings tab with Canonicalization method EXCLUSIVE and Front channel logout turned on

      You can leave the rest of the values as default. Click Save to apply the configuration.

    2. Navigate to Clients > Keys and complete the section with these parameters:

      • Client signature required: Off

      Keycloak client Keys tab with Client signature required turned off

    3. Navigate to Clients > Advanced > Fine Grain SAML Endpoint Configuration and complete the section with these parameters:

      • Assertion Consumer Service POST Binding URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs/idpinitiated

      • Logout Service Redirect Binding URL: https://<WAZUH_DASHBOARD_URL>

      Keycloak client Advanced tab, Fine Grain SAML Endpoint Configuration with the service URLs

      You can leave the rest of the values as default. Click Save to apply the configuration.

  4. Create a new role. Navigate to Realm roles > Create role and complete the section with these parameters:

    • Role name: Input wazuh-readonly. This will be our backend role in the Wazuh indexer configuration.

      Keycloak Create role form with the wazuh-readonly role name

    Click on Save to apply the configuration.

  5. Create a new user.

    1. Navigate to Users > Add user and fill in the required information.

      Keycloak Create user form with the user details

      Click on Create to apply the configuration.

    2. Navigate to Users > Credentials > Set password and input a password for the newly created user. You will use these credentials to log in to the Wazuh dashboard.

      Keycloak user Credentials tab with the Set password dialog

      Click on Save to apply the configuration.

  6. Create a new group and assign the user.

    1. Go to Groups > Create group and assign a name to the group. In our case, this is Wazuh read only.

      Keycloak Groups page with the Create group button and the Wazuh read only group highlighted

    2. Click on the newly created group, navigate to Members > Add member and select the user created in the previous step. Click on Add to add it to the group.

      Keycloak Add member dialog for the Wazuh read only group with a user selected and the Add button

    3. In the newly created group details, go to Role Mapping > Assign role > Realm roles and select the wazuh-readonly role created in step 4. Click on Assign to apply the configuration.

      Keycloak Assign Realm roles dialog for Wazuh read only with the wazuh-readonly role selected

  7. Configure protocol mapper.

    1. Navigate to Client scopes > role_list > Mappers. Click the ⋮ icon on the role list row and select Delete. Keycloak sends the roles through only one Role list mapper per client, so the built-in mapper can replace the one you add next.

      Keycloak admin console, role_list client scope Mappers tab with the Delete option for the built-in role list mapper

    2. Navigate to Client scopes > role_list > Mappers > Configure a new mapper.

      Keycloak role_list client scope, Mappers tab with no mappers and the Configure a new mapper button

    3. Select Role list from the list as seen below:

      Keycloak mapper type list with Role list selected

    4. Complete the Add mapper section with these parameters:

      • Mapper type: Role list

      • Name: wazuhRoleKey. You can use any name here.

      • Role attribute name: Roles. This will be the roles_key on the Wazuh indexer configuration.

      • SAML Attribute NameFormat: Basic

      • Single Role Attribute: On

      Keycloak Add mapper form for the Role list mapper with the Roles attribute name

    Click on Save to apply the configuration.

  8. Note the necessary parameters from the SAML settings of Keycloak.

    1. The parameters already obtained during the integration are:

      • sp.entity_id: wazuh-saml

      • roles_key: Roles

      • kibana_url: https://<WAZUH_DASHBOARD_URL>

      • backend_roles: wazuh-readonly

    2. To obtain the remaining parameters.

      1. Navigate to Clients and select the name of your client. In our case, this is wazuh-saml.

      2. Navigate to Action > Download adaptor config, and ensure the Format option is mod-auth-mellon.

      3. Click on Download to download the remaining files.

      Keycloak Download adaptor configs dialog with the mod-auth-mellon format option and Download button

    3. The downloaded files contain the idp-metadata.xml file and the sp-metadata.xml file.

      • The idp.entityID parameter is in the idp-metadata.xml file.

      SAML identity provider metadata XML with the entityID attribute highlighted

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.

  1. Backup the existing Wazuh indexer security configuration files:

    # /usr/share/wazuh-indexer/bin/indexer-security-init.sh --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"

  2. Generate a 64-character long random key using the following command.

    openssl rand -hex 32

    The output will be used as the exchange_key in the /etc/wazuh-indexer/opensearch-security/config.yml file.

  3. Place the idp-metadata.xml and sp-metadata.xml files within the /etc/wazuh-indexer/opensearch-security/ directory. Set the file ownership to wazuh-indexer using the following command:

    # chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/idp-metadata.xml
# chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/sp-metadata.xml

  4. Edit the /etc/wazuh-indexer/opensearch-security/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0, and set the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
...
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "intern"
      saml_auth_domain:
        http_enabled: true
        transport_enabled: false
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_file: '/etc/wazuh-indexer/opensearch-security/idp-metadata.xml'
              entity_id: 'http://<KEYCLOAK_URL>:<KEYCLOAK_PORT>/realms/Wazuh'
            sp:
              entity_id: wazuh-saml
              metadata_file: '/etc/wazuh-indexer/opensearch-security/sp-metadata.xml'
            kibana_url: https://<WAZUH_DASHBOARD_URL>
            roles_key: Roles
            exchange_key: 'b1d6dd32753374557dcf92e241.......'
        authentication_backend:
          type: noop

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • sp.metadata_file

    • kibana_url

    • roles_key

    • exchange_key

  5. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.19.4
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /home/wazuh-user
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success

Wazuh dashboard configuration

  1. Create a new role mapping for the backend role. Follow these steps to create a new role mapping, and grant read-only permissions to the backend role.

    1. Log into the Wazuh dashboard as administrator.

    2. Click the upper-left menu icon ☰ to open the options, go to Indexer management > Security, and then Roles to open the roles page.

    3. Click Create role, complete the empty fields with the following parameters, and then click Create to complete the task.

      • Name: Assign a name to the role.

      • Cluster permissions: cluster_composite_ops_ro

      • Index: *

      • Index permissions: read

      • Tenant permissions: global_tenant and select the Read only option.

    4. Select the newly created role.

    5. Select the Mapped users tab and click Manage mapping.

    6. Under Backend roles, add the value of the Role name attribute in Keycloak configuration and click Map to confirm the action. In our case, the backend role is wazuh-readonly.

  2. Verify that run_as is set to true in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. This is required to create a role mapping in the Wazuh dashboard, ensuring the backend role provided by the IdP is correctly mapped to the corresponding Wazuh role.

    hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: "<WAZUH_WUI_PASSWORD>"
      run_as: true

    1. Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.

      Wazuh role mapping

    2. Click Create Role mapping and complete the empty fields with the following parameters:

      • Role mapping name: Assign a name to the role mapping.

      • Roles: Select readonly.

      • Custom rules: Click Add new rule to expand this field.

      • User field: backend_roles

      • Search operation: FIND

      • Value: Assign the value of the Role name field in Keycloak configuration. In our case, the backend role is wazuh-readonly.

      • Click Save role mapping to save and map the backend role with Wazuh as read-only.

      Create Wazuh role mapping

  3. Edit the Wazuh dashboard configuration file. Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. We recommend that you back up these files before you carry out the configuration.

    opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.auth.type: ["basicauth","saml"]
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]

  4. Restart the Wazuh dashboard service using this command.

    # systemctl restart wazuh-dashboard

  5. Test the configuration. To test the configuration, go to your Wazuh dashboard URL and log in with your Keycloak account.