Configure OpenSearch SSO with Okta

ClusterNest Managed OpenSearch can delegate Dashboards login to Okta over OIDC or SAML. A cluster takes several auth sources side by side, with at most one SAML source and one OIDC source offered on Dashboards. A new cluster already has the ClusterNest sign-in, which is the one OIDC login Dashboards offers, so remove it before offering an OIDC source of your own (the auth_sources list in the Terraform tab replaces it). SAML sources sit next to it.

You’ll need your cluster’s OpenSearch Dashboards hostname before registering the app. Set dashboards_custom_hostname so you know it upfront, or create the cluster first without an auth source and note the generated opensearch_dashboards_url output before adding it.

OIDC

OIDC

connect_url is your Okta domain’s discovery endpoint (or a custom authorization server’s, if you used one instead of default).

Console

1. In the Okta admin console, go to Applications > Create App Integration, choose OIDC - Web Application.
   • Sign-in redirect URIs: https://<dashboards-hostname>/auth/openid/login
   • Assign the app to the users or groups who should have access.
2. On the app’s General tab, note the Client ID and Client secret.
3. To get a groups claim into the ID token, go to Security > API > Authorization Servers, pick the server you’re using (default for the org authorization server), open the Claims tab, and add a claim named groups (Include in: ID Token, Value type: Groups, Filter: matches a regex, e.g. .*).

In the ClusterNest console, open the cluster’s create/edit form and add an OIDC source under Authentication. Choose a Name (it becomes the text of the Dashboards button, “Login with” followed by this name), tick Offer on OpenSearch Dashboards, then fill in:

• Connect URL: https://example.okta.com/.well-known/openid-configuration
• Client ID / Client Secret: from the app’s General tab
• Roles Key: groups (leave blank if you skipped step 3)

Terraform

Okta’s official provider (okta/okta) creates the app and the groups claim in the same config as the ClusterNest cluster:

terraform {
  required_providers {
    okta = {
      source  = "okta/okta"
      version = "~> 5.0"
    }
    clusternest = {
      source  = "tf.clusternest.com/clusternest/clusternest"
      version = ">= 1.11.1"
    }
  }
}

provider "okta" {
  org_name  = "example"
  base_url  = "okta.com"
  api_token = var.okta_api_token
}

provider "clusternest" {
  email    = "[email protected]"
  password = var.clusternest_app_password
}

locals {
  dashboards_hostname = "opensearch-dashboards.example.com"
}

resource "okta_app_oauth" "opensearch" {
  label          = "OpenSearch Dashboards"
  type           = "web"
  grant_types    = ["authorization_code"]
  response_types = ["code"]
  redirect_uris  = ["https://${local.dashboards_hostname}/auth/openid/login"]
}

resource "okta_auth_server_claim" "groups" {
  auth_server_id = "default"
  name           = "groups"
  value_type     = "GROUPS"
  claim_type     = "IDENTITY"
  value          = ".*"
}

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "okta"
      type             = "oidc"
      connect_url      = "https://example.okta.com/.well-known/openid-configuration"
      client_id        = okta_app_oauth.opensearch.client_id
      client_secret    = okta_app_oauth.opensearch.client_secret
      roles_key        = "groups"
      dashboards_login = true
    },
  ]

  dashboards_custom_hostname = local.dashboards_hostname
}

okta_app_oauth.opensearch.client_secret is computed once the app is created - it lands in plain text in the state file, same as any Terraform-managed secret. Drop the okta_auth_server_claim resource and roles_key if you don’t need role mapping, and assign the app to users/groups separately with okta_app_group_assignment or okta_app_user.

SAML

SAML

idp_metadata_url and idp_entity_id come straight from Okta’s own setup instructions. Drop roles_key if you don’t need role mapping (it defaults to an ADFS-style claim URI Okta never emits).

Console

1. In the Okta admin console, go to Applications > Create App Integration, choose SAML 2.0.
2. On the Configure SAML step:
   • Single sign-on URL: https://<dashboards-hostname>/_opendistro/_security/saml/acs (leave “Use this for Recipient URL and Destination URL” checked)
   • Audience URI (SP Entity ID): the value you’ll use as sp_entity_id below
   • Name ID format: EmailAddress
   • Under Attribute Statements or Group Attribute Statements, add an attribute (e.g. groups, matching a regex) if you want role mapping.
3. Assign the app to the relevant users/groups, then open its Sign On tab and click View SAML setup instructions - it lists the Identity Provider metadata URL and the Identity Provider Issuer.

In the ClusterNest console, open the cluster’s create/edit form and add a SAML source under Authentication. Choose a Name (it becomes the text of the Dashboards button, “Login with” followed by this name), then fill in:

• IDP Metadata URL: https://example.okta.com/app/exkabc123/sso/saml/metadata
• IDP Entity ID: http://www.okta.com/exkabc123
• SP Entity ID: opensearch-dashboards
• Roles Key: groups (leave blank if you skipped the attribute statement)

Terraform

okta_app_saml exposes the resulting metadata URL and entity ID as computed attributes, so they can be wired directly into the clusternest_opensearch resource:

terraform {
  required_providers {
    okta = {
      source  = "okta/okta"
      version = "~> 5.0"
    }
    clusternest = {
      source  = "tf.clusternest.com/clusternest/clusternest"
      version = ">= 1.11.1"
    }
  }
}

provider "okta" {
  org_name  = "example"
  base_url  = "okta.com"
  api_token = var.okta_api_token
}

provider "clusternest" {
  email    = "[email protected]"
  password = var.clusternest_app_password
}

locals {
  dashboards_hostname = "opensearch-dashboards.example.com"
}

resource "okta_app_saml" "opensearch" {
  label                    = "OpenSearch Dashboards"
  sso_url                  = "https://${local.dashboards_hostname}/_opendistro/_security/saml/acs"
  recipient                = "https://${local.dashboards_hostname}/_opendistro/_security/saml/acs"
  destination              = "https://${local.dashboards_hostname}/_opendistro/_security/saml/acs"
  audience                 = "opensearch-dashboards"
  subject_name_id_template = "$${user.email}"
  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

  attribute_statements {
    type         = "GROUP"
    name         = "groups"
    filter_type  = "REGEX"
    filter_value = ".*"
  }
}

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "okta"
      type             = "saml"
      idp_metadata_url = okta_app_saml.opensearch.metadata_url
      idp_entity_id    = okta_app_saml.opensearch.entity_url
      sp_entity_id     = "opensearch-dashboards"
      roles_key        = "groups"
    },
  ]

  dashboards_custom_hostname = local.dashboards_hostname
}

Drop the attribute_statements block and roles_key if you don’t need role mapping.

See the Terraform resource reference for the full field list.