# Partial `authc` section for /etc/wazuh-indexer/opensearch-security/config.yml
# SAML single sign-on, with the internal password login left working behind it.
#
# Source: the 5.0-beta Microsoft Entra ID and Okta single sign-on guides,
# https://documentation.wazuh.com/5.0-beta/user-manual/user-administration/single-sign-on/index.html
#
# This is a FRAGMENT. Merge it into the existing authc section; do not replace
# the file.
#
# Before editing, back the directory up:
#   /usr/share/wazuh-indexer/bin/indexer-security-init.sh \
#     --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"
#
# Generate exchange_key (must be at least 64 characters):
#   openssl rand -hex 32

authc:
  # BREAK GLASS. Keep this domain, at order 0, with challenge: false.
  # It is what leaves a working password login behind the SSO button when the
  # identity provider is unreachable. Every SAML guide instructs this.
  basic_internal_auth_domain:
    description: "Authenticate via HTTP Basic against internal users database"
    http_enabled: true
    transport_enabled: true
    order: 0
    http_authenticator:
      type: "basic"
      challenge: false
    authentication_backend:
      type: "intern"

  saml_auth_domain:
    http_enabled: true
    transport_enabled: false
    order: 1
    http_authenticator:
      type: saml
      challenge: true
      config:
        idp:
          # Entra ID: the App Federation Metadata Url (SAML Certificate, option 3).
          # Okta:     the IdP metadata URL from the active signing certificate.
          metadata_url: https://login.microsoftonline.com/...
          # Entra ID: the Microsoft Entra ID Identifier (option 4).
          # Okta:     the Identity Provider Issuer URL.
          entity_id: https://sts.windows.net/...
        sp:
          # Must equal the Identifier / Audience URI set on the IdP application.
          entity_id: wazuh-saml
        kibana_url: https://<WAZUH_DASHBOARD_URL>
        # The assertion attribute carrying group or role names.
        # Entra ID: a claim named Roles sourced from user.assignedroles.
        # Okta:     the Group Attribute Statement named Roles, filter regex .*
        roles_key: Roles
        exchange_key: 'REPLACE_WITH_OUTPUT_OF_openssl_rand_hex_32'
    authentication_backend:
      type: noop

# Load it:
#   export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && \
#   bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
#     -f /etc/wazuh-indexer/opensearch-security/config.yml \
#     -icl \
#     -key /etc/wazuh-indexer/certs/admin-key.pem \
#     -cert /etc/wazuh-indexer/certs/admin.pem \
#     -cacert /etc/wazuh-indexer/certs/root-ca.pem \
#     -h localhost -nhnv
#
# Then, on the dashboard node, in /etc/wazuh-dashboard/opensearch_dashboards.yml:
#   opensearch_security.auth.multiple_auth_enabled: true
#   opensearch_security.auth.type: ["basicauth","saml"]
#   server.xsrf.allowlist: ["/_opendistro/_security/saml/acs",
#                           "/_opendistro/_security/saml/logout",
#                           "/_opendistro/_security/saml/acs/idpinitiated"]
# and confirm run_as: true under wazuh_core.hosts.
# Restart wazuh-dashboard and clear browser cache and cookies.