Configure OpenSearch SSO with Google Workspace

ClusterNest Managed OpenSearch can delegate Dashboards login to Google over OIDC or SAML. SAML is the recommended option - see the disclaimer under OIDC below for why. A cluster takes several auth sources side by side, with at most one SAML source and one OIDC source offered on Dashboards. A new cluster already has the ClusterNest sign-in, which is the one OIDC login Dashboards offers, so remove it before offering an OIDC source of your own (the auth_sources list in the Terraform tab replaces it). SAML sources sit next to it.

You’ll need your cluster’s OpenSearch Dashboards hostname before registering the app. Set dashboards_custom_hostname so you know it upfront, or create the cluster first without an auth source and note the generated opensearch_dashboards_url output before adding it.

SAML

SAML

1. In the Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app. Name it (e.g. “OpenSearch Dashboards”).
2. Google shows its IdP details on the next screen - a SSO URL, a Entity ID, and a Download Metadata link. Save the metadata file’s URL as idp_metadata_url, and the Entity ID as idp_entity_id (it looks like https://accounts.google.com/o/saml2?idpid=<idpid>).
3. On the Service provider details step, enter:
   • ACS URL: https://<dashboards-hostname>/_opendistro/_security/saml/acs
   • Entity ID: the value you’ll use as sp_entity_id below
   • Name ID format: EMAIL, Name ID: Basic Information > Primary email
4. Under Attribute mapping, map a Google directory field (e.g. a custom Groups field) to the SAML attribute name you’ll set as roles_key, if you want role mapping. This is the reason SAML is preferred here - see the OIDC tab.
5. Google apps are OFF for all users by default - turn the app ON for the relevant OUs/groups from the app’s overview page.

roles_key defaults to an ADFS-style claim URI that Google never emits - leave it unset (uses the SAML subject/NameID) unless you configured an attribute mapping in step 4, in which case set it to that attribute’s name.

Console

In the ClusterNest console, open the cluster’s create/edit form and add a SAML source under Authentication. Choose a Name (it becomes the text of the Dashboards button, “Login with” followed by this name), then fill in:

• IDP Metadata URL: the metadata file URL from step 2
• IDP Entity ID: https://accounts.google.com/o/saml2?idpid=C0123abcd
• SP Entity ID: opensearch-dashboards
• Roles Key: only if you configured an attribute mapping in step 4

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "google"
      type             = "saml"
      idp_metadata_url = "https://accounts.google.com/o/saml2/metadata?idpid=C0123abcd"
      idp_entity_id    = "https://accounts.google.com/o/saml2?idpid=C0123abcd"
      sp_entity_id     = "opensearch-dashboards"
    },
  ]

  dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

OIDC

OIDC

Prefer SAML above

Google’s standard OIDC token carries no group/role claim at all, and Workspace has no equivalent of a SAML attribute mapping for OIDC - there’s no groups-shaped claim to point roles_key at without also wiring up the Admin SDK Directory API server-side, which is outside what this integration does. If you need group-based OpenSearch role mapping, use the SAML tab instead; OIDC here only gets you authentication, not role mapping.

Google Workspace doesn’t expose generic OIDC app registration in the Admin console either - that’s done from Google Cloud Console against the Cloud project tied to your Workspace org.

1. In Google Cloud Console, open APIs & Services > OAuth consent screen. Set User type to Internal if you want to restrict login to your Workspace org.
2. Go to APIs & Services > Credentials > Create Credentials > OAuth client ID, application type Web application.
   • Authorized redirect URIs: https://<dashboards-hostname>/auth/openid/login
3. Note the generated Client ID and Client secret.

Google’s ID token has no preferred_username claim, so subject_key must be overridden to email.

Console

In the ClusterNest console, open the cluster’s create/edit form and add an OIDC source under Authentication. Choose a Name (it becomes the text of the Dashboards button, “Login with” followed by this name), tick Offer on OpenSearch Dashboards, then fill in:

• Connect URL: https://accounts.google.com/.well-known/openid-configuration
• Client ID / Client Secret: from Google Cloud Console
• Subject Key: email
• Roles Key: leave blank

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "google"
      type             = "oidc"
      connect_url      = "https://accounts.google.com/.well-known/openid-configuration"
      client_id        = var.oidc_client_id
      client_secret    = var.oidc_client_secret
      subject_key      = "email"
      dashboards_login = true
    },
  ]

  dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

See the Terraform resource reference for the full field list.