Google

Google Workspace, developed and marketed by Google, is a collection of cloud computing, productivity, and collaboration tools. In this guide, we integrate Google IdP to authenticate users into the ThreatLockDown platform.

There are three stages in the single sign-on integration.

  1. Google Configuration

  2. ThreatLockDown indexer configuration

  3. ThreatLockDown dashboard configuration

Google Configuration

  1. Create an account in Google Workspace. A Google Workspace account is required for this configuration. Request a free trial if you don't have a paid license.

  2. Go to https://admin.google.com/ac/apps/unified and sign in with your Google Admin account.

  3. Create an app with Add custom SAML app.

    1. Go to Apps > Web and mobile apps > Add App, then Add custom SAML app. Enter an App name and click CONTINUE.

    2. Take note of the following parameters, as they will be used during the ThreatLockDown indexer configuration:

      • Entity ID: This will be used later as the idp.entity_id

      • Select DOWNLOAD METADATA and place the metadata file in the configuration directory of the ThreatLockDown indexer. The path to the directory is /etc/wazuh-indexer/opensearch-security/.

      • Certificate: Copy the blob of the certificate excluding the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. This will be our exchange_key in the ThreatLockDown indexer configuration file.

    3. Select CONTINUE and configure the following:

      • ACS URL: https://<WAZUH_DASHBOARD_URL>/_opendistro/_security/saml/acs. Replace the ThreatLockDown dashboard URL field with the appropriate URL or IP address.

      • Entity ID: Use any name here. This will be the sp.entity_id in the ThreatLockDown indexer configuration file. In our case, the value is wazuh-saml.

    4. Leave the remaining parameters with their default values, then select CONTINUE.

    5. Click on ADD MAPPING. Under Employee details, choose Department and under App attributes, type Roles. Click FINISH.

      Google doesn't support sending the Group membership attribute as part of the SAML Assertion (as the other Identity Providers do). So in this example, we are going to use Department as the attribute whose value will be used as our roles_key in the ThreatLockDown indexer configuration. In this case, the value for the Department attribute will be stored as Roles.

  4. Turn ON access for everyone.

    1. Select the recently created app and click on User access.

    2. Select ON for everyone and click SAVE.

  5. Define the attribute for users.

    1. Go to Directory then Users.

    2. Select a user, go to User information, then edit Employee information.

    3. Add a value to the Department field, in this example, we add Wazuh_access, click on SAVE. This value will be used in the role_mapping file configuration.

ThreatLockDown indexer configuration

Edit the ThreatLockDown indexer security configuration files. We recommend that you back up these files before you carry out the configuration.

  1. Place the Google_Metadata.xml file within the /etc/wazuh-indexer/opensearch-security/ directory. Set the file ownership to wazuh-indexer using the following command:

    # chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/Google_Metadata.xml

  2. Edit the /etc/wazuh-indexer/opensearch-security/config.yml file and change the following values:

    • Set the order in basic_internal_auth_domain to 0 and the challenge flag to false.

    • Include a saml_auth_domain configuration under the authc section similar to the following:

        authc:
...
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "intern"
      saml_auth_domain:
        http_enabled: true
        transport_enabled: false
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_file: '/etc/wazuh-indexer/opensearch-security/Google_Metadata.xml'
              entity_id: 'https://accounts.google.com/o/saml2?idpid=C02…'
            sp:
              entity_id: wazuh-saml
            kibana_url: https://<WAZUH_DASHBOARD_URL>
            roles_key: Roles
            exchange_key: 'MIICajCCAdOgAwIBAgIBAD.........'
        authentication_backend:
          type: noop

    Ensure to change the following parameters to their corresponding value:

    • idp.metadata_file

    • idp.entity_id

    • sp.entity_id

    • kibana_url

    • roles_key

    • exchange_key

  3. Run the securityadmin script to load the configuration changes made in the config.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the ThreatLockDown indexer node. Note that this command uses localhost, set your ThreatLockDown indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-indexer/opensearch-security
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success

  4. Edit the /etc/wazuh-indexer/opensearch-security/roles_mapping.yml file and change the following values:

    Map the Department field value that was obtained in Google IdP to the all_access role in the ThreatLockDown indexer:

    all_access:
  reserved: false
  hidden: false
  backend_roles:
  - "admin"
  - "Wazuh_access"
  description: "Maps admin and Wazuh_access to all_access"

  5. Run the securityadmin script to load the configuration changes made in the roles_mapping.yml file.

    # export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

    The -h flag specifies the hostname or the IP address of the ThreatLockDown indexer node. Note that this command uses localhost, set your ThreatLockDown indexer address if necessary.

    The command output must be similar to the following:

    Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-indexer/opensearch-security
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null
Done with success

ThreatLockDown dashboard configuration

  1. Check the value of run_as in the /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml configuration file. If run_as is set to false, proceed to the next step.

    hosts:
  - default:
      url: https://localhost
      port: 55000
      username: wazuh-wui
      password: "<wazuh-wui-password>"
      run_as: false

    If run_as is set to true, you need to add a role mapping on the ThreatLockDown dashboard. To map the backend role to Wazuh, follow these steps:

    1. Click ☰ to open the menu on the ThreatLockDown dashboard, go to Server management > Security, and then Roles mapping to open the page.

      ThreatLockDown role mapping

    2. Click Create Role mapping and complete the empty fields with the following parameters:

      • Role mapping name: Assign a name to the role mapping.

      • Roles: Select administrator.

      • Custom rules: Click Add new rule to expand this field.

      • User field: backend_roles

      • Search operation: FIND

      • Value: Assign the Department field value that was obtained in Google IdP, in our case, this is Wazuh_access.

      Create ThreatLockDown role mapping

    3. Click Save role mapping to save and map the backend role with ThreatLockDown as administrator.

  2. Edit the ThreatLockDown dashboard configuration file. Add these configurations to /etc/wazuh-dashboard/opensearch_dashboards.yml. We recommend that you back up these files before you carry out the configuration.

    opensearch_security.auth.type: "saml"
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
opensearch_security.session.keepalive: false

  3. Restart the ThreatLockDown dashboard service using this command:

    # systemctl restart wazuh-dashboard

  4. Test the configuration. Go to your ThreatLockDown dashboard URL and log in with your Google Workspace account.