As many times before, I keep writing cheat sheets after the tasks which made me search a lot and glue things together before I found a solution. Long story short, this time I was asked to set up Google SSO for Kibana without switching from a basic license to a paid one. Kibana, by the moment, already had authentication set up and the customer wanted to log in there with the use of Google Workspace user accounts. Along with that, the customer wanted to keep user account which was already there, in Kibana. There was no need for role mapping or other advanced features, just plain SSO and that's all. As you probably know Elastic provides SSO feature only on paid license, so I have had no other way to get it working except for using 3rd party software. But first things first, let's list the steps we should go over: Create credentials for the application in GCP Console Install and set up oauth2-proxy Set up Nginx Now let's dig into the details. Kibana's url: https://kibana.example.com Username for logging into Kibana: kibana Password for user kibana: $3cuRep@sSW0rd Nginx is set up and used for reverse-proxying Kibana Navigate to https://console.cloud.google.com/apis/credentials You can refer to the documentation on the topic https://cloud.google.com/resource-manager/docs/creating-managing-projects Don't forget to add authorized email domains which users will be allowed to log into Kibana.   On the next page select Application type as Web application, Name could be any of your preferences, then put URLs of your Kibana as follows: Base URL of your Kibana for Authorized JavaScript origins: https://kibana.example.com Route to Kibana's oauth2 callbacks for Authorized redirect URIs: https://kibana.example.com/oauth2/callback Click Create and take a note on the contents of the pop-up window after. Copy and save Client ID and Client secret as we will need them a bit later. Since ELK is running in Docker containers on the customer's side, I decided to use oauth2-proxy in the container too. But before we run oauth2-proxy we need to generate value for OAUTH2_PROXY_COOKIE_SECRET parameter. Execute the command: Save the resulting value, for example we will take this one HUK59dRK_CDMJkYFdmQUlTllqr_j4UTq__2F-v3WWws= Now we are good to go. There are a number of ways to configure oauth2-proxy and I choose to do that over environmental variables. Run the container and pass variables and its values with use of -e parameter: Don't forget to put actual values for secrets and Client ID you got yourself on previous steps instead of the ones I used for writing the examples! Check if container's status is Up by executing the command: If you prefer docker compose you can use the following yaml: As for me, all the parameters are self-explanatory but you can refer to the official docs at any time: https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview/ Check if newly created container is up and oauth2-proxy is running and returns html on requests: If you get something like that then we are good to go to the next step: You can navigate to http://localhost:1080 in a browser of your choice as well and check if loaded page looks like that: As we assumed before, we use Nginx as a reverse-proxy for Kibana. It means that a minimal configuration of / location is set up and now it's time to add a couple of new lines there, which will provide necessary conduct for a new authentication process.  Before we continue we need to get base64-encoded credentials for the user kibana with password $3cuRep@sSW0rd which will be used after successful SSO login.  Execute the command: Resulting string: a2liYW5hOiQzY3VSZXBAc1NXMHJk Now we are ready to bake the config. Modify config for location / as follows: We need configuration for /oauth2 endpoint as well:  Save the changes and exit the text editor. Check new config for validity: You should get something like: Now you're ready to restart Nginx: Now you can navigate to your Kibana URL and check if everything work as expected.  DevOps-engineer