Configuring Kibana

SAML authentication in Kibana requires a small number of additional settings in addition to the standard Kibana security configuration. The Kibana security documentation provides details on the available configuration options that you can apply.

In particular, since your Elasticsearch nodes have been configured to use TLS on the HTTP interface, you must configure Kibana to use a https URL to connect to Elasticsearch, and you may need to configure elasticsearch.ssl.certificateAuthorities to trust the certificates that Elasticsearch has been configured to use.

SAML authentication in Kibana is also subject to the xpack.security.sessionTimeout setting that is described in the Kibana security documentation, and you may wish to adjust this timeout to meet your local needs.

The three additional settings that are required for SAML support are shown below:

  1. xpack.security.authc.providers:
  2.   saml.saml1:
  3.     order: 0
  4.     realm: "saml1"

The configuration values used in the example above are:

xpack.security.authc.providers

Add saml provider to instruct Kibana to use SAML SSO as the authentication method.

xpack.security.authc.providers.saml.<provider-name>.realm

Set this to the name of the SAML realm that you have used in your Elasticsearch realm configuration, for instance: saml1

Supporting SAML and basic authentication in Kibana

The SAML support in Kibana is designed on the expectation that it will be the primary (or sole) authentication method for users of that Kibana instance. However, it is possible to support both SAML and Basic authentication within a single Kibana instance by setting xpack.security.authc.providers as per the example below:

  1. xpack.security.authc.providers:
  2.   saml.saml1:
  3.     order: 0
  4.     realm: "saml1"
  5.   basic.basic1:
  6.     order: 1

If Kibana is configured in this way, users are presented with a choice at the Login Selector UI. They log in with SAML or they provide a username and password and rely on one of the other security realms within Elasticsearch. Only users who have a username and password for a configured Elasticsearch authentication realm can log in via Kibana login form.

Alternatively, when the basic authentication provider is enabled, you can place a reverse proxy in front of Kibana, and configure it to send a basic authentication header (Authorization: Basic ....) for each request. If this header is present and valid, Kibana will not initiate the SAML authentication process.

Operating multiple Kibana instances

If you wish to have multiple Kibana instances that authenticate against the same Elasticsearch cluster, then each Kibana instance that is configured for SAML authentication, requires its own SAML realm.

Each SAML realm must have its own unique Entity ID (sp.entity_id), and its own Assertion Consumer Service (sp.acs). Each Kibana instance will be mapped to the correct realm by looking up the matching sp.acs value.

These realms may use the same Identity Provider, but are not required to.

The following is example of having 3 difference Kibana instances, 2 of which use the same internal IdP, and another which uses a different IdP.

  1. xpack.security.authc.realms.saml.saml_finance:
  2.   order: 2
  3.   idp.metadata.path: saml/idp-metadata.xml
  4.   idp.entity_id: "https://sso.example.com/"
  5.   sp.entity_id:  "https://kibana.finance.example.com/"
  6.   sp.acs: "https://kibana.finance.example.com/api/security/v1/saml"
  7.   sp.logout: "https://kibana.finance.example.com/logout"
  8.   attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"
  9.   attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."
  10. xpack.security.authc.realms.saml.saml_sales:
  11.   order: 3
  12.   idp.metadata.path: saml/idp-metadata.xml
  13.   idp.entity_id: "https://sso.example.com/"
  14.   sp.entity_id:  "https://kibana.sales.example.com/"
  15.   sp.acs: "https://kibana.sales.example.com/api/security/v1/saml"
  16.   sp.logout: "https://kibana.sales.example.com/logout"
  17.   attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"
  18.   attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."
  19. xpack.security.authc.realms.saml.saml_eng:
  20.   order: 4
  21.   idp.metadata.path: saml/idp-external.xml
  22.   idp.entity_id: "https://engineering.sso.example.net/"
  23.   sp.entity_id:  "https://kibana.engineering.example.com/"
  24.   sp.acs: "https://kibana.engineering.example.com/api/security/v1/saml"
  25.   sp.logout: "https://kibana.engineering.example.com/logout"
  26.   attributes.principal: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

It is possible to have one or more Kibana instances that use SAML, while other instances use basic authentication against another realm type (e.g. Native or LDAP).