Google

Google Workspace, developed and marketed by Google, is a collection of cloud computing, productivity, and collaboration tools. In this guide, we integrate Google IdP to authenticate users into the Wazuh platform.

The single sign-on integration process is divided into three stages.

  1. Google Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

Google Configuration

  1. Create an account in Google Workspace.

    A Google Workspace account is required for this configuration. Request a free trial if you don't have a paid license.

  2. Go to https://admin.google.com/ac/apps/unified and sign in with your Google Admin account.

  3. Create an app with Add custom SAML app.

    1. Go to Apps > Website and mobile apps > Add App, then Add custom SAML app. Enter an App name and click CONTINUE.

    2. Take note of the following parameters, as they will be used during the Wazuh indexer configuration:

      • Entity ID: This will be used later as the idp.entity_id

      • Select DOWNLOAD METADATA and place the metadata file in the configuration directory of the Wazuh indexer. The path to the directory is /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/.

    3. Select CONTINUE and configure the following:

      • ACS URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs. Replace the Wazuh dashboard URL field with the appropriate URL or IP address.

      • Entity ID: Use any name here. This will be the sp.entity_id in the Wazuh indexer configuration file. In our case, the value is wazuh-saml.

      • Certificate: Copy the blob of the certificate excluding the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. This will be our exchange_key in the Wazuh indexer configuration file.

    4. Leave the remaining parameters with their default values, then select CONTINUE.

    5. Click on ADD MAPPING, under Employee details, choose Department, under App attributes, type Roles, and select FINISH.

      Google doesn't support sending the Group membership attribute as part of the SAML Assertion (as the other Identity Providers do). So in this example, we are going to use Department as the attribute whose value will be used as our roles_key in the Wazuh indexer configuration. In this case, the value for the Department attribute will be stored as Roles.

  4. Turn ON access for everyone.

    1. Select the recently created app and click on User access.

    2. Select ON for everyone and click SAVE.

  5. Define the attribute for users.

    1. Go to Directory then Users.

    2. Select a user, go to User information, then edit Employee information.

    3. Add a value to the Department field, in this example, we add Wazuh_access, click on SAVE. This value will be used in the role_mapping file configuration.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. It is recommended to back up these files before the configuration is carried out.

  1. Edit the /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
    ...
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: "basic"
              challenge: false
            authentication_backend:
              type: "intern"
          saml_auth_domain:
            http_enabled: true
            transport_enabled: false
            order: 1
            http_authenticator:
              type: saml
              challenge: true
              config:
                idp:
                  metadata_file: “/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/Google_Metadata.xml”
                  entity_id: “https://accounts.google.com/o/saml2?idpid=C02…”
                sp:
                  entity_id: wazuh-saml
                kibana_url: https://<WAZUH_DASHBOARD_ADDRESS>
                roles_key: Roles
                exchange_key: 'X509Certificate'
            authentication_backend:
              type: noop
    

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  2. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/config' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml
       SUCC: Configuration for 'config' created or updated
    Done with success
    
  3. Edit /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml file and change the following values:

    Map the Department field value that was obtained in Google IdP to the all_access role in the Wazuh indexer:

    all_access:
      reserved: false
      hidden: false
      backend_roles:
      - "admin"
      - "Wazuh_access"
      description: "Maps admin and Wazuh_access to all_access"
    
  4. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/rolesmapping' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml
       SUCC: Configuration for 'rolesmapping' created or updated
    Done with success
    

Wazuh dashboard configuration

  1. Edit the Wazuh dashboard configuration file.

    Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. It is recommended to back up this file before the configuration is changed.

    opensearch_security.auth.type: "saml"
    server.xsrf.whitelist: ["/_plugins/_security/saml/acs", "/_plugins/_security/saml/logout", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
    

    Note

    For versions 4.3.9 and earlier, also replace path: `/auth/logout` with path: `/logout` in /usr/share/wazuh-dashboard/plugins/securityDashboards/server/auth/types/saml/routes.js.

    ...
       this.router.get({
          path: `/logout`,
          validate: false
    ...
    
  2. Restart the Wazuh dashboard service.

    # systemctl restart wazuh-dashboard
    
    # service wazuh-dashboard restart
    
  3. Test the configuration.

    To test the configuration, go to your Wazuh dashboard URL and log in with your Google Workspace account.