Single sign-on for managed OpenSearch

OpenSearch clusters can now delegate authentication to your identity provider over SAML or OIDC, so access follows the directory you already run. It costs nothing extra, on every tier.

Update, October 2026: a cluster can now trust several identity providers at once, configured as a single auth_sources list. The auth_type, saml_config and oidc_config examples below show the previous shape. See multiple SSO providers and the SSO overview for the current configuration.

What changes

Without SSO, an OpenSearch cluster keeps its own user list, which means a second place to add a joiner and a second place somebody forgets when a leaver goes. Pointing the cluster at your identity provider collapses that back to one. Access is granted and revoked where you already do it, and the audit trail lives with the rest of your access records.

SAML covers the established enterprise providers. OIDC covers the rest. Both are configured per cluster.

Configuring it

SAML:

resource "clusternest_opensearch" "saml" {
  name            = "saml-cluster"
  tier            = "standard"
  organization_id = 1
  auth_type       = "saml"
  saml_config = {
    idp_metadata_url = "https://auth.example.com/application/saml/open-search-saml/metadata/"
    idp_entity_id    = "open-search-saml"
    sp_entity_id     = "open-search-saml"
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

OIDC:

resource "clusternest_opensearch" "oidc" {
  name            = "oidc-cluster"
  tier            = "standard"
  organization_id = 1
  auth_type       = "oidc"
  oidc_config = {
    connect_url   = "https://auth.example.com/.well-known/openid-configuration"
    client_id     = var.oidc_client_id
    client_secret = var.oidc_client_secret
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

The full attribute list is in the Terraform documentation. OpenSearch’s own docs cover what each backend expects, for SAML and for OIDC.

What it costs

Nothing. SAML and OIDC are available on every tier at no additional charge, because charging for the ability to secure your own account is not a business we want to be in.

Questions to [email protected].