PingOne for Enterprise is an identity-as-a-service (IDaaS) and single sign-on (SSO) platform. It allows enterprises to give their users federated access to applications. In this guide, we integrate the PingOne IdP to authenticate users into the Wazuh platform.
There are three stages in the single sign-on integration.
- Create an account in Ping Identity. Request a free trial if you don't have a paid license.
- Go to PingOne and sign in with your Ping Identity account.
- Create an application in Connections.
- Navigate to Connections > Applications > Add Application and give it a name. In our case, the name is
wazuh-sso
. Proceed to the Choose Application Type section, and select SAML Application > Configure.
/images/single-sign-on/pingone/01-proceed-to-the-choose-application-type-section.png
Select Manually Enter on the Provide App Metadata section and add the following configuration, replacing
<WAZUH_DASHBOARD_URL>
with the corresponding value:- ACS URLs:
https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs
- Entity ID:
wazuh-saml
/images/single-sign-on/pingone/02-select-manually-enter-on-the-provide-app-metadata.png
- ACS URLs:
On the Configuration tab, click on the edit icon and add the following information:
- SLO ENDPOINT:
https://<WAZUH_DASHBOARD_URL>/
- SLO BINDING:
HTTP Redirect
- ASSERTION VALIDITY DURATION:
3600
(for one hour token validity) - VERIFICATION CERTIFICATE (OPTIONAL): Load a PUBLIC CERTIFICATE that corresponds to the PRIVATE KEY that is going to be used on the
sp.signature_private_key_filepath
of theconfig.yml
configuration file on the Wazuh indexer instance. This is necessary as all the logout requests must be signed.
/images/single-sign-on/pingone/03-on-the-configuration-tab.png
- SLO ENDPOINT:
Click on the Attribute Mappings tab, select the edit icon, click on Add and insert the following configuration:
Roles
=Group Names
/images/single-sign-on/pingone/04-click-on-the-attribute-mappings-tab.png
The
Roles
attribute will be used later as thesp.entity_id
in the Wazuh indexer configuration file.- Click on the Required checkbox, and click on Save.
- Navigate to Connections > Applications > Add Application and give it a name. In our case, the name is
- Create a group and assign users.
Navigate to Identities > Groups, and click on the + sign. Select the name of the Group, in this case,
Role
./images/single-sign-on/pingone/05-navigate-to-identities-groups.png
To assign users, open the created Group, go to the Users tab and select Add Individually. Add all the members that must log in to the Wazuh dashboard, and click on Save when done.
/images/single-sign-on/pingone/06-assign-users.png
/images/single-sign-on/pingone/07-assign-users.png
- Activate the application and note the necessary parameters.
Navigate to Connections, select Applications, and enable the application.
/images/single-sign-on/pingone/08-navigate-to-connections.png
Take note of the following parameters from the configuration page of the application. This information will be used in the next step.
- ISSUER ID: It'll be in the form https://auth.pingone.com/...
- IDP METADATA URL: It’ll be in the form https://auth.pingone.com/...
exchange_key
: If you open the IDP METADATA URL you'll find the X509 Certificate section, this will be used as theexchange_key
.
/images/single-sign-on/pingone/09-take-note-of-parameters.png
Edit the Wazuh indexer security configuration files. We recommend that you back up these files before you carry out the configuration.
Place the private key file within the
/etc/wazuh-indexer/opensearch-security/
directory. Set the file ownership towazuh-indexer
using the following command:# chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/securityconfig/PRIVATE_KEY
Edit the
/etc/wazuh-indexer/opensearch-security/config.yml
file and change the following values:- Set the
order
inbasic_internal_auth_domain
to0
and thechallenge
flag tofalse
. - Include a
saml_auth_domain
configuration under theauthc
section similar to the following:
authc:
... basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: true order: 0 http_authenticator: type: "basic" challenge: false authentication_backend: type: "intern" saml_auth_domain: http_enabled: true transport_enabled: false order: 1 http_authenticator: type: saml challenge: true config: idp: metadata_url: IDP METADATA URL entity_id: ISSUER ID sp: entity_id: wazuh-saml signature_private_key_filepath: /etc/wazuh-indexer/opensearch-security/PRIVATE_KEY forceAuthn: true kibana_url: https://<WAZUH_DASHBOARD_URL> roles_key: Roles exchange_key: 'MIIJ6DLSAAbAmAJHSgIWYia.........' authentication_backend: type: noop
Ensure to change the following parameters to their corresponding value:
idp.metadata_file
idp.entity_id
sp.entity_id
sp.signature_private_key_filepath
kibana_url
roles_key
exchange_key
- Set the
Run the
securityadmin
script to load the configuration changes made in theconfig.yml
file.# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
The
-h
flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.The command output must be similar to the following:
Security Admin v7 Will connect to localhost:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.10.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /etc/wazuh-indexer/opensearch-security Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null Done with success
Edit the
/etc/wazuh-indexer/opensearch-security/roles_mapping.yml
file and change the following values:Map the Group (Role) that is in PingOne to the
all_access
role in Wazuh indexer:all_access: reserved: false hidden: false backend_roles: - "admin" - "Role" description: "Maps admin to all_access"
Run the
securityadmin
script to load the configuration changes made in theroles_mapping.yml
file.# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv
The
-h
flag specifies the hostname or the IP address of the Wazuh indexer node. Note that this command uses localhost, set your Wazuh indexer address if necessary.The command output must be similar to the following:
Security Admin v7 Will connect to localhost:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.10.0 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /etc/wazuh-indexer/opensearch-security Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml SUCC: Configuration for 'rolesmapping' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null Done with success
- Check the value of Run as in the API host entry configuration on Dashboard management > Server APIs. If Run as is set to
false
, proceed to the next step. If Run as is set totrue
, you need to add a role mapping on the Wazuh dashboard. To map the backend role to Wazuh, follow these steps:Click ☰ to open the menu on the Wazuh dashboard, go to Server management > Security, and then Roles mapping to open the page.
/images/single-sign-on/Wazuh-role-mapping.gif
Click Create Role mapping and complete the empty fields with the following parameters:
- Role mapping name: Assign a name to the role mapping.
- Roles: Select
administrator
. - Custom rules: Click Add new rule to expand this field.
- User field:
backend_roles
- Search operation:
FIND
- Value: Assign the name you gave to your group in PingOne configuration, in our case, this is
Role
.
/images/single-sign-on/pingone/Wazuh-role-mapping.png
- Click Save role mapping to save and map the backend role with Wazuh as administrator.
Edit the Wazuh dashboard configuration file. Add these configurations to
/etc/wazuh-dashboard/opensearch_dashboards.yml
. We recommend that you back up these files before you carry out the configuration.opensearch_security.auth.type: "saml" server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"] opensearch_security.session.keepalive: false
- Restart the Wazuh dashboard service.
- Test the configuration. Go to your Wazuh dashboard URL and log in with your Ping One account.