PingOne

PingOne for Enterprise is an identity-as-a-service (IDaaS) and single sign-on (SSO) platform. It allows enterprises to give their users federated access to applications. In this guide, we integrate the PingOne IdP to authenticate users into the Wazuh platform.

The single sign-on integration process is divided into three stages.

  1. PingOne Configuration

  2. Wazuh indexer configuration

  3. Wazuh dashboard configuration

PingOne Configuration

  1. Create an account in Ping Identity. Request a free trial if you don't have a paid license.

  2. Go to PingOne and sign in with your Ping Identity account.

  3. Create an application in Connections.

    1. Navigate to Connections > Applications > Add Application and give it a name. In our case, the name is wazuh-sso.

    2. Proceed to the Choose Application Type section, and select SAML Application > Configure.

    3. Select Manually Enter on the Provide App Metadata page and add the following configuration, replacing <WAZUH_DASHBOARD_URL> with the corresponding value:

      • ACS URLs: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs

      • ENTITY ID: wazuh-saml

    4. On the Configuration tab, click on the edit icon and add the following information:

      • SLO ENDPOINT: https://<WAZUH_DASHBOARD_URL>/

      • SLO BINDING: HTTP Redirect

      • ASSERTION VALIDITY DURATION: 3600 (for one hour token validity)

      • VERIFICATION CERTIFICATE (OPTIONAL): Load a PUBLIC CERTIFICATE that corresponds to the PRIVATE KEY that is going to be used on the sp.signature_private_key_filepath of the config.yml configuration file on the Wazuh indexer instance. This is necessary as all the logout requests must be signed.

    5. Click on the Attribute Mappings tab, select the edit icon, click on Add and insert the following configuration:

      Roles = Group Names

      The Roles attribute will be used later as the sp.entity_id in the Wazuh indexer configuration file.

    6. Click on the Required checkbox, and click on Save.

  4. Create a group and assign users.

    1. Navigate to Identities > Groups, and click on the + sign. Select the name of the Group, in this case, Role.

    2. To assign users, open the created Group, go to the Users tab and select Add Users Individually. Add all the members that must log in to the Wazuh dashboard, and click on Save when done.

  5. Activate the application and note the necessary parameters.

    1. Navigate to Connections, select Applications, and enable the application.

    2. Take note of the following parameters from the configuration page of the application. This information will be used in the next step.

      • ISSUER ID: It'll be in the form “https://auth.pingone.com/....”

      • IDP METADATA URL: It’ll be in the form “https://auth.pingone.com/....”

      • exchange_key: If you open IDP IDP METADATA URL you'll find the X509 Certificate section, this will be used as the exchange_key.

Wazuh indexer configuration

Edit the Wazuh indexer security configuration files. It is recommended to back up these files before the configuration is carried out.

  1. Edit the /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
    ...
          basic_internal_auth_domain:
            description: "Authenticate via HTTP Basic against internal users database"
            http_enabled: true
            transport_enabled: true
            order: 0
            http_authenticator:
              type: "basic"
              challenge: false
            authentication_backend:
              type: "intern"
          saml_auth_domain:
            http_enabled: true
            transport_enabled: false
            order: 1
            http_authenticator:
              type: saml
              challenge: true
              config:
                idp:
                  metadata_file: “/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/Google_Metadata.xml”
                  entity_id: “https://accounts.google.com/o/saml2?idpid=C02…”
                sp:
                  entity_id: wazuh-saml
                kibana_url: https://<WAZUH_DASHBOARD_ADDRESS>
                roles_key: Roles
                exchange_key: 'X509Certificate'
            authentication_backend:
              type: noop
    

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  2. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/config' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml
       SUCC: Configuration for 'config' created or updated
    Done with success
    
  3. Edit /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml file and change the following values:

    Map the Group (Role) that is in PingOne to the all_access role in Wazuh indexer:

    all_access:
      reserved: false
      hidden: false
      backend_roles:
      - "admin"
      - "Role"
      description: "Maps admin to all_access"
    
  4. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
    

    The -h flag is used to specify the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
    Will connect to localhost:9300 ... done
    Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
    OpenSearch Version: 1.2.4
    OpenSearch Security Version: 1.2.4.0
    Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
    Clustername: wazuh-cluster
    Clusterstate: GREEN
    Number of nodes: 1
    Number of data nodes: 1
    .opendistro_security index already exists, so we do not need to create one.
    Populate config from /home/wazuh
    Will update '_doc/rolesmapping' with /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml
       SUCC: Configuration for 'rolesmapping' created or updated
    Done with success
    

Wazuh dashboard configuration

  1. Edit the Wazuh dashboard configuration file.

    Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. It is recommended to back up this file before the configuration is changed.

    opensearch_security.auth.type: "saml"
    server.xsrf.whitelist: ["/_plugins/_security/saml/acs", "/_plugins/_security/saml/logout", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
    

    Note

    For versions 4.3.9 and earlier, also replace path: `/auth/logout` with path: `/logout` in /usr/share/wazuh-dashboard/plugins/securityDashboards/server/auth/types/saml/routes.js.

    ...
       this.router.get({
          path: `/logout`,
          validate: false
    ...
    
  2. Restart the Wazuh dashboard service.

    # systemctl restart wazuh-dashboard
    
    # service wazuh-dashboard restart
    
  3. Test the configuration.

    To test the configuration, go to your Wazuh dashboard URL and log in with your Ping One account.