Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Opensearch JDBC access using internal account when SAML is activated

0

Hello, We have deploy a Opensearch cluster using AWS Opensearch Service. We have set the SAML authentication pointing to our Azure AD but let internal authentication too. We have no problem to connect to it using Rest API our ODBC connecter. But when we try to connect to our Opensearch cluster from jdbc client (Squirrel), we always receive unauthorize answer.

I tried to connect building a small test java application and with debug enable I see that Opensearch always try to connect thru our SAML authentication and not relay to basic authentication.

Could you help us on this point ?

Topics
AnalyticsSecurity, Identity, & ComplianceJava Development
Tags
AWS Identity and Access ManagementAmazon OpenSearch ServiceJava Development
Language
English

asked a year ago195 views

2 Answers
0

When you have SAML authentication enabled for your Amazon OpenSearch Service domain, it can indeed cause complications for JDBC access using internal accounts. This is because SAML authentication is primarily designed for web browser-based access, such as through OpenSearch Dashboards.

For JDBC connections, which typically use basic authentication, you may need to take additional steps:

  1. Ensure that fine-grained access control is properly configured on your OpenSearch domain. This allows you to use both SAML for web-based access and internal users for API access.

  2. Create an internal master user within OpenSearch's internal user database. This is separate from SAML and allows you to have a username and password combination specifically for OpenSearch.

  3. In your JDBC connection string or configuration, make sure you're using the internal master user credentials, not attempting SAML authentication.

  4. If you're using security groups or network ACLs, ensure that the necessary ports are open for JDBC connections from your client's IP address.

  5. Double-check that the IAM permissions associated with your OpenSearch domain allow for the type of access you're attempting with JDBC.

If you've confirmed all of these and are still having issues, you may need to contact AWS support for further assistance. They can help diagnose any specific configuration issues with your OpenSearch domain that might be preventing JDBC access when SAML is enabled.

Remember, SAML authentication is primarily for OpenSearch Dashboards access through a web browser. For programmatic access like JDBC, you typically need to use IAM authentication or internal user authentication.
Sources
Can i use identity center user or permission sets as master user in amazon opensearch? | AWS re:Post
Build SAML identity federation for Amazon OpenSearch Service domains within a VPC | AWS Big Data Blog

answered a year ago

0

In fact, we can connect using internal account thru Rest API so I think that our Opensearch is well configurated.

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content