# 使用IAM Identity Center 登录OpenSearch Cluster

Amazon OpenSearch支持使用 SAML 2.0 标准的IdP实现单点登录，比如 AWS IAM Identity Center(AWS SSO), Auth0, Okta, Keycloak, Active Directory Federation Services (AD FS), and Ping Identity (PingID)。

在本篇文章中，我将介绍如何将 AWS IAM Identity Center 与 Opensearch 集成。

## **Amazon OpenSearch Service**

打开创建好的Amazon OpenSearch Service>Domains，选择需要单点登录的domain。打开Security configuration页签，点击【Edit】。启用SAML authentication。

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2F6OT8O7sbaCx2QUGKCWcZ%2Fimage.png?alt=media&#x26;token=cb264406-034e-45ba-81f0-24446f5fd703" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FpmcZ4k7IQqVjqg0DrBdL%2Fimage.png?alt=media&#x26;token=7d3da2dc-c85a-4b29-926a-f5d2dc9f7ba9" alt=""><figcaption></figcaption></figure>

留在这个页面，一会还需要用到。

## AWS **IAM Identity Center**

打开AWS IAM Identity Center的控制台界面。选择Application， 然后选择Add Application：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2F3FAM8pIljmwtnzWDz5Og%2Fimage.png?alt=media&#x26;token=a8214db3-a49f-4832-8744-7fedc14843ef" alt=""><figcaption></figcaption></figure>

选择**Add custom SAML 2.0 application，**&#x7136;后点击下一步：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FbGmncG9G3cvGWbyklfFy%2Fimage.png?alt=media&#x26;token=b31b56af-b5c4-40ce-89fb-8fb10d653e0a" alt=""><figcaption></figcaption></figure>

显示名称可以填写：**OpenSearch**；

**下载**IAM Identity Center SAML metadata file；

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FKWj2aoT5rC5as9sssCTA%2Fimage.png?alt=media&#x26;token=7f93fe92-629c-440b-bbde-d2684799d070" alt=""><figcaption></figcaption></figure>

在 **Application metadata**, 选择 **Manually type your metadata values**. 然后从Amazon OpenSearch Service复制 **Application ACS URL** 和 **Application SAML audience** 的值提交后完成。

***Application ACS URL → IdP-initiated SSO URL***

***Application SAML audience → Service provider entity ID***

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FlZyf7BuUThXOr9i9pt81%2Fimage.png?alt=media&#x26;token=30eddb26-bbf7-4f42-9611-9d535a7dd6aa" alt=""><figcaption></figcaption></figure>

添加后点击**Edit attribute mappings：**

Subject -> ${user:email} -> emailAddress

Role -> ${user:groups} -> unspecified<br>

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FtFg8JhwSLtCERPc2QcxW%2Fimage.png?alt=media&#x26;token=08127d06-eea8-4a2d-b613-62b128d9603a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FbnG686kowxV4FbA3qBhC%2Fimage.png?alt=media&#x26;token=9675f1f4-7a86-407a-b70c-dc58e008dc80" alt=""><figcaption></figcaption></figure>

点击**Assign Users，**&#x9009;择您希望为仪表板提供访问权限的任何组。如果没有任何组，请创建一个新组。

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FB5T3pkrNW6LHbu5NDKp7%2Fimage.png?alt=media&#x26;token=e9640f89-51d2-4337-bbd5-46fa88f7f5e8" alt=""><figcaption></figcaption></figure>

打开刚才创建好的组，复制其Group ID：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FOJdKLFLgY3A6QpTpPKvp%2Fimage.png?alt=media&#x26;token=2f5fd544-051e-4764-99d1-6b628166015d" alt=""><figcaption></figcaption></figure>

## **Amazon OpenSearch Service**

回到Amazon OpenSearch Service的控制台页面，

1. 上传/粘贴从 AWS IAM 下载的 IDP 元数据。它将自动填充 IdP 实体 ID（不要更改任何内容）。&#x20;
2. 将刚才拷贝的Group ID 复制到 SAML 主后台角色，这将确保为该组的所有成员分配一个管理员到 Openseach/Dashboard。&#x20;
3. 在Roles key下填写Role，以便从 AWS SSO 中提取组，然后点击保存更改。

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FQce1AVgYMgIBqSEynChE%2Fimage.png?alt=media&#x26;token=d467f780-e99e-4bcc-9f7e-509aa2d2bb58" alt=""><figcaption></figcaption></figure>

参考资料

<https://medium.com/@smadan2703/integrate-aws-iam-identity-center-sso-saml-with-for-amazon-opensearch-dashboard-b4651c8aaf2f>

<https://docs.aws.amazon.com/opensearch-service/latest/developerguide/saml.html>

[OpenSearch Saml SP-initiated login through IAM Identity Center SSO](https://repost.aws/questions/QUeVpG4hmaTqSotTr9Gxp3MA/opensearch-saml-sp-initiated-login-through-iam-identity-center-sso)
