Supporting additional SAML assertion attributes

nickytd · May 18, 2020, 9:16am

Hi,

in the role definition we can refer to the current authenticated user with

“${user_name}”

Can we access/quote other SAML assertion attributes?

The place where jwt claims are generated by the saml response is:

opendistro-for-elasticsearch/security/blob/dcca8ec4abea9a2cd524a0683c8aa92f9a390a48/src/main/java/com/amazon/dlic/auth/http/saml/AuthTokenProcessorHandler.java#L296


      
              }
          }
          
          
private String createJwt(SamlResponse samlResponse) throws Exception {
              JwtClaims jwtClaims = new JwtClaims();
              JwtToken jwt = new JwtToken(jwtClaims);
          
          
    jwtClaims.setNotBefore(System.currentTimeMillis() / 1000);
              jwtClaims.setExpiryTime(getJwtExpiration(samlResponse));
          
          
    jwtClaims.setProperty(this.jwtSubjectKey, this.extractSubject(samlResponse));
          
          
    if (this.samlSubjectKey != null) {
                  jwtClaims.setProperty("saml_ni", samlResponse.getNameId());
              }
          
          
    if (samlResponse.getNameIdFormat() != null) {
                  jwtClaims.setProperty("saml_nif", SamlNameIdFormat.getByUri(samlResponse.getNameIdFormat()).getShortName());
              }
          
          
    String sessionIndex = samlResponse.getSessionIndex();

and it seems that other assertions are ignored.
Can someone confirm that observation?
And one additional question can we add one more jwt claim assertion mapping?

The use case is when multiple users per tenant are carrying the same assertion attribute and we want to map it to a tenant in kibana/opendistro.

Thanks
Niki

Topic		Replies	Views
Kibana samlAuthError Open Source Elasticsearch and Kibana	1	379	February 7, 2023
Issue when re-login with saml authentication Security	3	755	May 6, 2021
SAML Authentication Not Working Security	8	2591	November 25, 2019
Setting up SAML with an admin group Security	1	348	April 10, 2021
SAML (Azure AD) working but getting Basic Authorization WARNs when clicking around Kibana Security	1	744	May 24, 2021

Supporting additional SAML assertion attributes

Related Topics