Jumpcloud

Jumpcloud, is a Unified Device and Identity Access Management platform that provides services such as Multi-Factor Authentication (MFA), Single Sign-On, password management, and cloud directory. In this guide, we integrate the Jumpcloud SSO to authenticate users into the Wazuh platform.

The single sign-on integration process is divided into three stages.

  1. Jumpcloud Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

Jumpcloud Configuration

  1. Create an account in Jumpcloud. Request a free trial if you don't have a paid license.

  2. Create a new user. This step can be skipped if you are just testing, you can use your Jumpcloud admin user for example.

    1. Go to User Management, click on Users > (+) > Manual user entry. Fill in the user information, activate the user and click on save user.

  3. Create a new group and assign the user.

    1. Go to User Management > User Groups > (+) and give a name to the group. In our case, this is Wazuh admins.

      The name you give to your group will be used in the configuration. It will be our backend_roles in roles_mapping.yml.

    2. In the selected User Groups, go to the Users tab, select the newly created user and Save the changes.

  4. Create a new app. Configure the SAML settings while you create the app.

    1. Under the User Authentication section, go to SSO, select (+), click on Custom SAML App and add a Display Label.

    2. Complete the SSO tab with the appropriate information.

      • IdP Entity ID: wazuh (this will be the idp.entity_id in our Wazuh indexer configuration).

      • SP Entity ID: wazuh-saml (this will be the sp.entity_id in our Wazuh indexer configuration).

      • ACS URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • Check Sign Assertion.

      • Check Declare Redirect Endpoint.

      • Check include group attribute and add Roles as the attribute. This will be used later in the config.yml configuration file.

      The rest of the options can be left as their default values.

    3. On the User Groups tab, select the Group created previously and click save.

  5. Note the necessary parameters from the SAML settings of the new app.

    1. Open the recently created application, go to the SSO tab and select Export Metadata. This will be our metadata_file. Place the metadata file in the configuration directory of the Wazuh indexer. The path to the directory is /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/.

    2. Extract the exchange_key from the metadata_file under the ds:X509Certificate tag.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. It is recommended to back up these files before the configuration is carried out.

  1. Edit the /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
    ...
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: "basic"
              challenge: false
            authentication_backend:
              type: "intern"
          saml_auth_domain:
            http_enabled: true
            transport_enabled: true
            order: 1
            http_authenticator:
              type: saml
              challenge: true
              config:
                idp:
                  metadata_file: “/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/metadata_jumpcloud.xml”
                  entity_id: wazuh
                sp:
                  entity_id: wazuh-saml
                  forceAuthn: true
                kibana_url: https://<WAZUH_DASHBOARD_ADDRESS>
                roles_key: Roles
                exchange_key: '...'
            authentication_backend:
              type: noop
    

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  2. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/config' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml
       SUCC: Configuration for 'config' created or updated
    Done with success
    
  3. Edit /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml file and change the following values:

    Configure the roles_mapping.yml file to map the Jumpcloud user group to the appropriate Wazuh indexer role. In our case, we map the Wazuh admins group to the all_access role:

    all_access:
      reserved: false
      hidden: false
      backend_roles:
      - "admin"
      - "Wazuh admins"
      description: "Maps admin to all_access"
    
  4. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/rolesmapping' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml
       SUCC: Configuration for 'rolesmapping' created or updated
    Done with success
    

Wazuh dashboard configuration

  1. Edit the Wazuh dashboard configuration file.

    Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. It is recommended to back up this file before the configuration is changed.

    opensearch_security.auth.type: "saml"
    server.xsrf.whitelist: ["/_plugins/_security/saml/acs", "/_plugins/_security/saml/logout", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
    

    Note

    For versions 4.3.9 and earlier, also replace path: `/auth/logout` with path: `/logout` in /usr/share/wazuh-dashboard/plugins/securityDashboards/server/auth/types/saml/routes.js.

    ...
       this.router.get({
          path: `/logout`,
          validate: false
    ...
    
  2. Restart the Wazuh dashboard service.

    # systemctl restart wazuh-dashboard
    
    # service wazuh-dashboard restart
    
  3. Test the configuration.

    To test the configuration, go to your Wazuh dashboard URL and log in with your Jumpcloud account.