How to Integrate AWS SSO with AWS Managed Elasticsearch Kibana Instance
By: Nuwan Premaratne
Tags: AWS, Aws Elasticsearch, Monitoring, Single Sign On, Observability

How to Integrate AWS SSO with AWS Managed Elasticsearch Kibana Instance

Here we talk about how to integrate Amazon Web Services (AWS) Managed Elasticsearch (ES) Cluster with AWS Single Sign-On (SSO) service for user authentication.

Let’s talk a little about “What is Elasticsearch?”. Elasticsearch is a powerful search engine and a Log Analytics tool. Depending on your use case/requirement we can use Elasticsearch in either of the above-mentioned ways. For example, UK Government uses Elasticsearch’s search engine capability for searching through their archived documents.

You can read more about above-mentioned example using the following link below;

How AWS Managed ES helped various Customers ….

In this article, I won’t go be explaining ES as you might already know about it when you searched for this article and not to make this article a long lengthy one. But if you are not familiar, there are a lot of online resources that you can use to get to know about Elasticsearch.

So, lets’ get started….

I assume that you have already configured the sync between your AD service and the AWS SSO at this moment or you are using AWS SSO as a sole IdP.

This article will explain how to integrate the AWS SSO and Kibana. I will show you how to authenticate using individual user mappings and how to use groups to authenticate yourself to Kibana.

AWS managed ES Kibana Interface

From the AWS SSO end you will have to create a Custom SAML 2.0 Application. In order to create this, you need the two URLs that the ES Cluster provides. So, let’s first note them down.

Navigate to your AWS ES Console. Select the ES Cluster that you need to enable the SSO with SAML authentication. You will be able to see a button named “Actions" as shown in the diagram below. Click on it and select “Modify Authentication” option.

Changing Authentication Method to SAML

Scroll a bit down the page and you will be able to see the section that provides you to enable SAML authentication to Kibana. Check the box with “Enable SAML Authentication”. This will make visible another section that carries the required details that need to configure SSO for Kibana.

There are two methods that the SSO Authentication can be initiated.

IdP initiated SSO URL: - SSO login initiated from the AWS SSO user portal in this situation since AWS SSO is our IDP. If you are using Azure AD or similar AD directly that will be from that end. SP initiated SSO URL: - SSO login is initiated when you navigate to the Kibana Console URL.

Depending on your situation select one of the given URLs (IdP initiated/ SP initiated) along with SP entity ID URL.

Identity URLs needed for Configuring SSO

For this example, I will be using IdP initiated method. Copy the IdP Initiated SSO URl and the SP entity ID values. Open a new web browser tab and navigate to the AWS SSO Page. Navigate to Applications from the menu on the left corner and select “Add a new application”.

Create a New SSO Custom Application

From the next window select the “Add a Custom SAML 2.0 Application” option. Provide a proper name for the Application and a description. For the example I will provide the name as “Kibana”.

Configuring SAML Custom Application

Download the “AWS SSO SAML metadata file”. We need this to be provided to the AWS Elasticsearch domain in order to complete the SSO setup. Scroll down the page and you will be able to find a section as “Application Metadata”. Since we do not get an Application Metadata file; select on option to provide metadata values manually. Provide the IdP Initialed SSO URL to the “Application ACS URL” field and SP entity ID to the “Application SAML audience” field.

Application Metadata Values

Once done save the changes so that AWS SSO will begin creating the Custom Application.

The window will change into your configured Custom Application. Now we need to configure the attributes (User/Group attributes) to be sent in order to be authenticated with the Kibana Application.