Basic auth on OpenSearch with SAML enabled

Question

Hi all, I'm trying to configure basic auth and SAML in my OpenSearch cluster. I'm following https://docs.aws.amazon.com/opensearch-service/latest/developerguide/saml.html and https://docs.opensearch.org/latest/security/configuration/configuration/ (among other docs).

I've enbaled Fine-grained access control with M a s t e r user type of type interanl user database and created a loca user that has been mapped to "all_access" role. SAML is enabled (and working) and the accees policy is as open as possible:

   "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:ESHttp*",
      "Resource": "arn:aws:es:eu-west-1:123:domain/opensearch-XYZ/*"
    }

As said, SAML is working nicely in when accessing the dashboard in the broswer. From the OpenSearch dev tools console I get the security config (GET /_plugins/_security/api/securityconfig) and it looks like (output cut to what I think it's relevant to my question):

     "authc": {
        "basic_internal_auth_domain": {
          "http_enabled": true,
          "order": 4,
          "http_authenticator": {
            "challenge": false,
            "type": "basic",
            "config": {}
          },
          "authentication_backend": {
            "type": "intern",
            "config": {}
          },
          "description": "Authenticate via HTTP Basic against internal users database"
        },
        "saml_auth_domain": {
          "http_enabled": true,
          "order": 5,
          "http_authenticator": {
            "challenge": true,
            "type": "saml",

so, my understanding is that both basic auth and saml are enabled. According to opensearch docs the security plugin should offer both authz methods when contacting the API being requests, but when doing curl from the cli with user + password it only offers SAML auth and request fails:

$ curl -v  -GET -ku 'user:passwd' https://opensearch.endpoint/_cluster/health
[...]
> GET /_cluster/health HTTP/2
> Host: opensearch.endpoint
> authorization: Basic ABCSD
> user-agent: curl/7.76.1
> accept: */*
>
* TLSv1.2 (IN), TLS header, Unknown (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* TLSv1.2 (OUT), TLS header, Unknown (23):
* TLSv1.2 (IN), TLS header, Unknown (23):
* TLSv1.2 (IN), TLS header, Unknown (23):
< HTTP/2 401
< date: Mon, 01 Dec 2025 15:27:39 GMT
< content-type: text/plain; charset=UTF-8
< content-length: 0
< access-control-allow-origin: *
< www-authenticate: X-Security-IdP realm="OpenSearch Security" location="https://login.microsoftonline.com/[....]

what am I missing in order to make both auth methods work ? The only thing I can think of is having to explicity enable dual sign in the the dashbors (https://docs.opensearch.org/latest/security/configuration/multi-auth/) , btu it not clear to me how to enable it.

Thanks in advance

Arnau · Accepted Answer

The conf I posted is correct and works as expected. The problem was the user/passwors combination used.

re:Post Agent · Answer

Based on your configuration, both SAML and basic authentication are enabled in your OpenSearch cluster, but there appears to be an issue with the authentication order or challenge settings.

In your security configuration, I notice that the SAML authentication domain has `"challenge": true` while the basic authentication domain has `"challenge": false`. This means that when authentication fails, the system is defaulting to challenging with SAML authentication rather than basic authentication.

To fix this issue, you have a few options:

1. Modify the order of authentication domains - The authentication domain with the lower "order" value is tried first. Currently, your basic_internal_auth_domain has order 4 and saml_auth_domain has order 5, which is correct, but other settings might be overriding this.

2. Set "challenge": true for the basic authentication domain - This would make the system challenge with basic auth when authentication fails.

3. Use explicit authentication headers - When making API calls with curl, try adding a specific header to indicate you want to use basic authentication.

For Amazon OpenSearch Service domains with fine-grained access control enabled, you can use both SAML for browser-based access to OpenSearch Dashboards and HTTP basic authentication for API calls. The internal user database allows you to create users that can authenticate with username and password credentials.

Make sure your internal user (the one you're using with curl) has been properly created in the internal user database and mapped to the appropriate roles. You mentioned mapping a local user to the "all_access" role, but verify this user is the same one you're using in your curl command.

If you're still having issues, you might need to check if there are any additional security settings or policies that could be affecting the authentication flow.  
**Sources**  
[Tutorial: Configure a domain with the internal user database and HTTP basic authentication - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac-http-auth.html)  
[Tutorial: Configure a domain with an IAM master user and Amazon Cognito authentication - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac-iam.html)  
[Single sign-on SSO for Amazon OpenSearch Service using SAML and Keycloak | AWS Big Data Blog](https://aws.amazon.com/blogs/big-data/single-sign-on-sso-for-amazon-opensearch-service-using-saml-and-keycloak/)

Taz · Answer

Hey,

Hope you're keeping well.

When SAML is enabled in Amazon OpenSearch Service, it typically becomes the primary challenge mechanism if its `order` is higher than Basic auth, especially when `challenge` is set to `true`. In your config, Basic auth has `order: 4` and SAML has `order: 5` with `challenge: true`, so browser-based access will always be redirected to the SAML IdP instead of prompting for Basic credentials. To use Basic auth alongside SAML, set the Basic auth domain to a lower order and ensure SAML’s `challenge` flag is `false` so it doesn’t override other methods.

Thanks and regards,  
Taz

Basic auth on OpenSearch with SAML enabled

Add your answer

Relevant content