Release 4.9.1 - RC 1 - E2E UX tests - SAML SSO #25829
Assignees
Labels
Comments
Environment detailsServer installation 🟢
[root@localhost Desktop]# cat /etc/os-release
NAME="CentOS Stream"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Stream 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"
[root@localhost Desktop]# curl -sO https://packages-dev.wazuh.com/4.9/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
23/09/2024 18:01:38 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.1
23/09/2024 18:01:38 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/09/2024 18:01:39 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/09/2024 18:01:39 INFO: Wazuh web interface port will be 443.
23/09/2024 18:01:41 INFO: Wazuh development repository added.
23/09/2024 18:01:41 INFO: --- Configuration files ---
23/09/2024 18:01:41 INFO: Generating configuration files.
23/09/2024 18:01:42 INFO: Generating the root certificate.
23/09/2024 18:01:42 INFO: Generating Admin certificates.
23/09/2024 18:01:42 INFO: Generating Wazuh indexer certificates.
23/09/2024 18:01:43 INFO: Generating Filebeat certificates.
23/09/2024 18:01:43 INFO: Generating Wazuh dashboard certificates.
23/09/2024 18:01:44 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
23/09/2024 18:01:44 INFO: --- Wazuh indexer ---
23/09/2024 18:01:44 INFO: Starting Wazuh indexer installation.
23/09/2024 18:02:44 INFO: Wazuh indexer installation finished.
23/09/2024 18:02:44 INFO: Wazuh indexer post-install configuration finished.
23/09/2024 18:02:44 INFO: Starting service wazuh-indexer.
23/09/2024 18:03:08 INFO: wazuh-indexer service started.
23/09/2024 18:03:08 INFO: Initializing Wazuh indexer cluster security settings.
23/09/2024 18:03:16 INFO: Wazuh indexer cluster security configuration initialized.
23/09/2024 18:03:16 INFO: Wazuh indexer cluster initialized.
23/09/2024 18:03:16 INFO: --- Wazuh server ---
23/09/2024 18:03:16 INFO: Starting the Wazuh manager installation.
23/09/2024 18:05:03 INFO: Wazuh manager installation finished.
23/09/2024 18:05:03 INFO: Wazuh manager vulnerability detection configuration finished.
23/09/2024 18:05:03 INFO: Starting service wazuh-manager.
23/09/2024 18:05:17 INFO: wazuh-manager service started.
23/09/2024 18:05:17 INFO: Starting Filebeat installation.
23/09/2024 18:05:35 INFO: Filebeat installation finished.
23/09/2024 18:05:44 INFO: Filebeat post-install configuration finished.
23/09/2024 18:05:44 INFO: Starting service filebeat.
23/09/2024 18:05:47 INFO: filebeat service started.
23/09/2024 18:05:47 INFO: --- Wazuh dashboard ---
23/09/2024 18:05:47 INFO: Starting Wazuh dashboard installation.
23/09/2024 18:15:19 INFO: Wazuh dashboard installation finished.
23/09/2024 18:15:19 INFO: Wazuh dashboard post-install configuration finished.
23/09/2024 18:15:19 INFO: Starting service wazuh-dashboard.
23/09/2024 18:15:20 INFO: wazuh-dashboard service started.
23/09/2024 18:15:21 INFO: Updating the internal users.
23/09/2024 18:15:32 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
23/09/2024 18:15:55 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
23/09/2024 18:16:49 INFO: Initializing Wazuh dashboard web application.
23/09/2024 18:16:49 INFO: Wazuh dashboard web application not yet initialized. Waiting...
23/09/2024 18:17:05 INFO: Wazuh dashboard web application not yet initialized. Waiting...
23/09/2024 18:17:20 INFO: Wazuh dashboard web application initialized.
23/09/2024 18:17:20 INFO: --- Summary ---
23/09/2024 18:17:20 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
User: admin
Password: n?*E.EhEgS8.2aBfrAQzz21K0B.6YsQQ
23/09/2024 18:17:20 INFO: Installation finished.
Agent 🟢
root@fedora:/home/tomas# cat /etc/os-release
NAME="Fedora Linux"
VERSION="39 (Workstation Edition)"
ID=fedora
VERSION_ID=39
VERSION_CODENAME=""
PLATFORM_ID="platform:f39"
PRETTY_NAME="Fedora Linux 39 (Workstation Edition)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:39"
DEFAULT_HOSTNAME="fedora"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f39/system-administrators-guide/"
SUPPORT_URL="https://ask.fedoraproject.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=39
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=39
SUPPORT_END=2024-05-14
VARIANT="Workstation Edition"
VARIANT_ID=workstation
root@fedora:/home/tomas# rpm --import https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
root@fedora:/home/tomas# cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages-dev.wazuh.com/pre-release/yum/
protect=1
EOF
root@fedora:/home/tomas# WAZUH_MANAGER="x.x.x.x" yum install wazuh-agent
EL-39 - Wazuh 7.1 MB/s | 30 MB 00:04
Last metadata expiration check: 0:00:12 ago on Mon 23 Sep 2024 07:40:55 PM -03.
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
wazuh-agent x86_64 4.9.1-1 wazuh 10 M
Transaction Summary
================================================================================
Install 1 Package
Total download size: 10 M
Installed size: 31 M
Is this ok [y/N]: y
Downloading Packages:
wazuh-agent-4.9.1-1.x86_64.rpm 2.7 MB/s | 10 MB 00:03
--------------------------------------------------------------------------------
Total 2.7 MB/s | 10 MB 00:03
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Running scriptlet: wazuh-agent-4.9.1-1.x86_64 1/1
Installing : wazuh-agent-4.9.1-1.x86_64 1/1
Running scriptlet: wazuh-agent-4.9.1-1.x86_64 1/1
Verifying : wazuh-agent-4.9.1-1.x86_64 1/1
Installed:
wazuh-agent-4.9.1-1.x86_64
Complete!
root@fedora:/home/tomas# /var/ossec/bin/wazuh-control start
Starting Wazuh v4.9.1...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
[root@localhost bin]# /var/ossec/bin/agent_control -l
Wazuh agent_control. List of available agents:
ID: 000, Name: localhost.localdomain (server), IP: 127.0.0.1, Active/Local
ID: 001, Name: fedora, IP: any, Active
ConclusionThe agent has been deployed and connected successfully. |
Okta SSO 🟢Okta configuration 🟢
Wazuh indexer configuration 🟢
[root@localhost opensearch-security]# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
**************************
* This tool will be deprecated in the next major release of OpenSearch *
* https://github.com/opensearch-project/security/issues/1755 *
**************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-indexer/opensearch-security
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success
[root@localhost opensearch-security]# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
**************************
* This tool will be deprecated in the next major release of OpenSearch *
* https://github.com/opensearch-project/security/issues/1755 *
**************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-indexer/opensearch-security
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
SUCC: Configuration for 'rolesmapping' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null
Done with successWazuh dashboard configuration 🟢
opensearch_security.auth.type: "saml"
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
opensearch_security.session.keepalive: false
SSO with Admin role 🟢
SSO with Read-only role 🟢All steps are the same as before, except that the role mapping will be done from the dashboard to provide the read-only roles.
The role mapping was done successfully. ConclusionIntegration was successful. |
Microsoft Entra ID 🟢ME-ID configuration 🟢
{
"allowedMemberTypes": [
"User"
],
"description": "Wazuh role",
"displayName": "Wazuh_role",
"id": "xxx",
"isEnabled": true,
"origin": "Application",
"value": "Wazuh_role"
},
Wazuh indexer configuration 🟢
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users databa$
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: intern
saml_auth_domain:
http_enabled: true
transport_enabled: false
order: 1
http_authenticator:
type: saml
challenge: true
config:
idp:
metadata_url: 'https://login.microsoftonline.com/xxx'
entity_id: 'https://sts.windows.net/xxx'
sp:
entity_id: 'wazuh-saml4'
kibana_url: https://x.x.x.x
roles_key: Roles
exchange_key: 'c1ce071xxx'
authentication_backend:
type: noop[root@localhost wazuh-dashboard]# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
**************************
* This tool will be deprecated in the next major release of OpenSearch *
* https://github.com/opensearch-project/security/issues/1755 *
**************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-dashboard
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
SUCC: Configuration for 'config' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["config"],"updated_config_size":1,"message":null} is 1 (["config"]) due to: null
Done with success
## Default roles mapping
all_access:
reserved: true
hidden: false
backend_roles:
- "admin"
- "Wazuh_role"
hosts: []
users: []
and_backend_roles: []
description: "Maps admin to all_access"[root@localhost wazuh-dashboard]# export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h 127.0.0.1 -nhnv
**************************
* This tool will be deprecated in the next major release of OpenSearch *
* https://github.com/opensearch-project/security/issues/1755 *
**************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /etc/wazuh-dashboard
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
SUCC: Configuration for 'rolesmapping' created or updated
SUCC: Expected 1 config types for node {"updated_config_types":["rolesmapping"],"updated_config_size":1,"message":null} is 1 (["rolesmapping"]) due to: null
Done with successWazuh dashboard configuration 🟢
opensearch_security.auth.type: "saml"
server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
opensearch_security.session.keepalive: false
Instant redirection to Microsoft sign-in URl.
SSO with Admin role 🟢
SSO with Read-only role 🟢Since all steps are the same as mentioned before they will be resumed.
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users databas$
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: intern
saml_auth_domain:
http_enabled: true
transport_enabled: false
order: 1
http_authenticator:
type: saml
challenge: true
config:
idp:
metadata_url: 'https://login.microsoftonline.com/xxx'
entity_id: 'https://sts.windows.net/xxx'
sp:
entity_id: 'wazuh-saml5'
kibana_url: https://x.x.x.x
roles_key: Roles
exchange_key: 'c1ce071c6xxx'
authentication_backend:
type: noop
ConclusionIntegration was successful. |
|
Hi @TomasTurina, reviewing your problem with configuring the SSO with Microsoft Entra ID #25829 (comment), I see a possible syntax error in the configuration of Wazuh indexer, see the |
|
Hi @Desvelao, I've managed to fix this, thanks. I'll update my previous comment. |
|
Hi @TomasTurina, the test looks good. 🟢 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
End-to-End (E2E) Testing Guideline
Release testingobjective andUrgentpriority. Communicate these to the team and QA via the c-release Slack channel.For the conclusions and the issue testing and updates, use the following legend:
Status legend
Issue delivery and completion
review_assigneefield in the project. The reviewer must then review the test steps and results. Ensure that all iteration cycles are completed by Sep 24, 2024 date (issue must be inPending final reviewstatus) and notify the QA team via Slack using the c-release channel.Deployment requirements
Test description
Following documentation from Single sign-on https://documentation-dev.wazuh.com/v4.9.1-rc1/user-manual/user-administration/single-sign-on/index.html, try the best effort to complete the steps and test the dashboard login using Okta and Microsoft Entra ID
Known issues
Conclusions
Summarize the errors detected (Known Issues included). Illustrate using the table below. REMOVE CURRENT EXAMPLES:
Feedback
We value your feedback. Please provide insights on your testing experience.
Reviewers validation
The criteria for completing this task is based on the validation of the conclusions and the test results by all reviewers.
All the checkboxes below must be marked in order to close this issue.
The text was updated successfully, but these errors were encountered: