Azure Active Directory

Azure Active Directory (Azure AD) is a cloud-based identity and access management service by Microsoft. It provides single sign-on, multifactor authentication, and access to internal and cloud developed applications. In this guide, we integrate the Azure Active Directory IdP to authenticate users into the Wazuh platform. The single sign-on integration process is divided into three stages.

  1. Azure Active Directory Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

Note

You may have to request a free trial at least to complete the configuration.

Azure Active Directory Configuration

  1. Create a Microsoft account or use your own if you already have one.

  2. Go to Azure Active Directory and sign in with your Microsoft account.

  3. Create an app in Azure Active Directory.

    1. Go to Azure Active Directory > Enterprise applications > New application and Create your own application.

    2. Select Integrate any other application you don't find in the gallery. Give a name to your application and click Add. In our case, we name this application wazuh-sso.

  4. Create a role for your application.

    1. Go back to Azure Active Directory and click on App registrations.

    2. Select your new app under All applications and click Manifest.

    3. Add a new role to your application's Manifest:

      {
         "allowedMemberTypes": [
            "User"
         ],
         "description": "Wazuh role",
         "displayName": "Wazuh_role",
         "id": "<application_id>",
         "isEnabled": true,
         "lang": null,
         "origin": "Application",
         "value": "Wazuh_role"
      },
      
      • description: can be any value that you want.

      • id: should be the ID of your application. You can find it in the application's overview menu or at the top of the Manifest in the field appId.

      • value: defines the name of the role. In this case, Wazuh_role, which will be the value for the role to be mapped on the roles_mapping.yml file.

      • displayName: can be the same as value.

    4. Save the changes and proceed to the next step.

  5. Assign a user to the app.

    1. In Azure Active Directory, go to Enterprise applications, select your application and then click on Assign users and groups (or Users and Groups in the panel to the left).

    2. Click on Add user/group, assign a user and select the role we created in Manifest.

  6. Configure Single sign-on.

    1. Go to Enterprise applications, select your application and then click on Set up single sign-on > SAML.

    2. In option 1, under Basic SAML Configuration, click edit and set wazuh-saml as Identifier (Entity ID) and https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs as Reply URL (Assertion Consumer Service URL). Replace <WAZUH_DASHBOARD_URL> with the corresponding value. Save and proceed to the next step.

    3. In option 2 under User Attributes & Claims, click edit and select Add new claim. Select Roles as the name and user.assignedroles as Source attribute. This claim will be mapped with roles_key on the Wazuh indexer configuration.

  7. Note the necessary parameters.

    In the Enterprise applications menu, select your application and then click on Single sign-on. Note some parameters that will be used in the Wazuh indexer configuration.

    • In option 3 SAML Certificate, the App Federation Metadata Url will be the idp.metadata_url in the Wazuh indexer configuration file.

    • Go to the metadata URL using your web browser and note the X509Certificate. It will be our exchange_key:

    • In option 4 Set up <YOUR APPLICATION>, the Azure AD Identifier will be our idp.entity_id.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. It is recommended to back up these files before the configuration is carried out.

  1. Edit the /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
    ...
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: "basic"
              challenge: false
            authentication_backend:
              type: "intern"
          saml_auth_domain:
            http_enabled: true
            transport_enabled: false
            order: 1
            http_authenticator:
              type: saml
              challenge: true
              config:
                idp:
                  metadata_url: https://login.microsoftonline.com/...
                  entity_id: https://sts.windows.net/...
                sp:
                  entity_id: wazuh-saml
                kibana_url: https://<WAZUH_DASHBOARD_ADDRESS>
                roles_key: Roles
                exchange_key: '...'
            authentication_backend:
              type: noop
    
    • The roles_key must be the same value that we used in the Azure AD configuration.

  2. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/config' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml
       SUCC: Configuration for 'config' created or updated
    Done with success
    
  3. Edit the /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml file and change the following values:

    Configure the roles_mapping.yml file to map the role we have in Azure AD to the appropriate Wazuh indexer role. In this case, we map the Wazuh_role in Azure AD to the all_access role in Wazuh indexer:

    all_access:
      reserved: false
      hidden: false
      backend_roles:
      - "admin"
      - "Wazuh_role"
      description: "Maps admin to all_access"
    
  4. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/rolesmapping' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml
       SUCC: Configuration for 'rolesmapping' created or updated
    Done with success
    

Wazuh dashboard configuration

  1. Edit the Wazuh dashboard configuration file.

    Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. It is recommended to back up this file before the configuration is changed.

    opensearch_security.auth.type: "saml"
    server.xsrf.whitelist: ["/_plugins/_security/saml/acs", "/_plugins/_security/saml/logout", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
    

    Note

    For versions 4.3.9 and earlier, also replace path: `/auth/logout` with path: `/logout` in /usr/share/wazuh-dashboard/plugins/securityDashboards/server/auth/types/saml/routes.js.

    ...
       this.router.get({
          path: `/logout`,
          validate: false
    ...
    
  2. Restart the Wazuh dashboard service.

    # systemctl restart wazuh-dashboard
    
    # service wazuh-dashboard restart
    
  3. Test the configuration.

    To test the configuration, go to your Wazuh dashboard URL and log in with your Microsoft account.