Single sign-on for managed OpenSearch

OpenSearch clusters can now delegate authentication to your identity provider over SAML or OIDC, so access follows the directory you already run. It costs nothing extra, on every tier.

What changes

Without SSO, an OpenSearch cluster keeps its own user list, which means a second place to add a joiner and a second place somebody forgets when a leaver goes. Pointing the cluster at your identity provider collapses that back to one. Access is granted and revoked where you already do it, and the audit trail lives with the rest of your access records.

SAML covers the established enterprise providers. OIDC covers the rest. Both are configured per cluster.

Configuring it

SAML:

resource "clusternest_opensearch" "saml" {
  name            = "saml-cluster"
  tier            = "standard"
  organization_id = 1
  auth_type       = "saml"
  saml_config = {
    idp_metadata_url = "https://auth.example.com/application/saml/open-search-saml/metadata/"
    idp_entity_id    = "open-search-saml"
    sp_entity_id     = "open-search-saml"
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

OIDC:

resource "clusternest_opensearch" "oidc" {
  name            = "oidc-cluster"
  tier            = "standard"
  organization_id = 1
  auth_type       = "oidc"
  oidc_config = {
    connect_url   = "https://auth.example.com/.well-known/openid-configuration"
    client_id     = var.oidc_client_id
    client_secret = var.oidc_client_secret
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

The full attribute list is in the Terraform documentation. OpenSearch’s own docs cover what each backend expects, for SAML and for OIDC.

What it costs

Nothing. SAML and OIDC are available on every tier at no additional charge, because charging for the ability to secure your own account is not a business we want to be in.

Questions to hello@clusternest.com.