AWS Opensearch with SAML authentication - amazon-web-services

Question

I have configured SAML for my AWS Opensearch Service Dashboard and keep getting 'Internal Server Error' after succesfully logging in to Okta and getting redirected to the sso endpoint (https://*****.eu-west-1.es.amazonaws.com/_dashboards/_opendistro/_security/saml/acs). I am using the service provider initiated login flow.
The SAML request looks like:
Host: *****
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: nl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://***.okta.com/
Content-Type: application/x-www-form-urlencoded
Content-Length: 10427
Origin: https://***.okta.com
Connection: keep-alive
Cookie: security_authentication=Fe26.2**a179694d11de140222bccdb1b628732ad44371158089d49e851960cdfa74e711*rMo5VnNKA2FukJOaGT4zlw*9I-VJlFm20BlqKCAu7Sg9IUqtnLkPjVb-SBBMrEoSr9qX8NU24K6d7hiK6Q4ONPYo0cUbiGy25qudhs2DfYFrkRYTA1a0zf8fHRdxuQ6FNYXrkqWZ1s__kZVo-sAcwhcA6PbAXjFK3J-Mjy3-2N-VA**f25a0b1ddd9d36f949193a49ea74d88ff8fdb29fc2c0fc6d23102748a645a239*hL7oHPYT2TRQlaFw81ptxtKSFmXhzmcPkFkpF4U0j9U; STATE-TOKEN=fed6e87a-a743-4b36-a0e9-b62a579635a5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2.0 500 Internal Server Error
date: Mon, 18 Oct 2021 10:06:18 GMT
content-type: application/json; charset=utf-8
content-length: 77
x-amzn-requestid: 7c0a8527-c780-4bc9-b55a-4b8e0e468923
cache-control: private, no-cache, no-store, must-revalidate
osd-name: ip-10-212-37-230.eu-west-1.compute.internal
X-Firefox-Spdy: h2
<saml2p:Response Destination="****/_dashboards/_opendistro/_security/saml/acs"
ID="id12441206744048667167559313"
InResponseTo="ONELOGIN_e54a9652-c4b3-46b1-a9af-192b7892982e"
IssueInstant="2021-10-18T10:15:48.540Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
>
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>http://www.okta.com/exk4crh6pK2EwG3xz696</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#id12441206744048667167559313">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>wb2AqxWez2/KbOC81HYKxMoHDgxku2lXWXqrURo0k7k=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>fSB69UWpOukV0hfX7gtoOd5lRU9Z7wKjWiYEfiAXi9eNLJGdzWA35eR5kxL/aSWp3r6TPj0ArcfgVOXgSKQfERWLsNaHuGFd2/vfEPsvb49NruitDgEmCVB+YMxTHZ3DujPlgf2/ADFI5hKV5nJfNkfFaJP/Y6cgnimDlBsXaV+E3wOrs2tfph5WbDYXIjKRlHb24cDJh7SRKK7WEmJR6HRPzlwCOkXGnc/UN1yqFHze+EMw+6buxPq04IoVA2waxNtsKwmm/LBSh5Up+UJdpvZ1ULF3GrTAbSiIbfxHHEQQWXTkwWJufdO+p24SOjcdgyMHqhtPO9Hs5Xa3lSISjg==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDljCCAn6gAwIBAgIGAXyPqbX/MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxDDAKBgNVBAMMA3Z1YjEcMBoGCSqGSIb3DQEJARYNaW5mb0Bv
a3RhLmNvbTAeFw0yMTEwMTcxOTA5MzZaFw0zMTEwMTcxOTEwMzZaMIGLMQswCQYDVQQGEwJVUzET
MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0
YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxDDAKBgNVBAMMA3Z1YjEcMBoGCSqGSIb3DQEJARYNaW5m
b0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJIbVHXi6RpEpOpM3JIj
0kZV4zw54qUVXNPbS8epUGAekHvpDqoCKGbWTG8vUBhLFQehhrBSzopLsVY2jzJIa+FKqviKWchv
5772IsVIn8/KAcTnW2lS8zs86mWbklL39/chIXT19m338E9goN0BhJEW0Hh1JmGzss4juE+WBhu0
7NTVVa2xSE5ELe1dyzwQrfbtn2HEBXe3PRnX1n7Mp8LGdUb3YQGQSzy90vc0D0rx24cCtnkaxWHn
c9vKj6U7unf1c+mJyihXVgGcRl89tc0CqYX41+TgH+Z6ygqNq+EKvx+94+4BvjHnDJMCLzKUAcS3
yiyyzTIra0Hj07hCux8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAhYATs51fcjglJZcob4nwFRvt
X8WWOxB3jyBweGgYdKKbkJuC8mmtINCaEMkCyPQNqxdEK0xRKqDZOD4Ay9s+1TKKn9L8FTCBIw9H
sYPBpjPLaU1+9Z1B47qHSXw/wgmSbVOCmr6ryLvj+rmaVEZRu38BS4E8EFUT1Bl8vGsKG2vbeT4j
1KUTNNh0v4N3Fe763EGvj0lbOLTWfTWu4/4cRcB5oZs6ybaZAfQ9DejYumFxf1dADxPqjjWEi4ay
gZZpQHNdRWd0mdBjFwnf9alxi7Kx69qqu6PRvQK0BZSI8teX+XnsihoV9D+QJPaTlXzjCqIUCRZD
hNwmmISRthgHsw==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</saml2p:Status>
<saml2:Assertion ID="id124412067441340881963049510"
IssueInstant="2021-10-18T10:15:48.540Z"
Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
>
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>http://www.okta.com/exk4crh6pK2EwG3xz696</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#id124412067441340881963049510">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>3XV/aXHpIRIXjJob312hhWsHbdoo5cqXCgoVM6MakEA=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>TgN3QlXBHPumS7wrixp6R7oX30kyWWeT+dfu/raqBsqBOGb/iyvliPl3FX8AWkTRBjWou4Kbwfo6ashoUq0WvYNWwYZiEPwJVao8WPSzyHWLL8B0NCOoa68sQojWkVsTqGUQPDHqDq08Kxm0GZEudQuOf9SYwE4d+znmoUaBOorgZbFojbPD2AqnunAR9e9VCQYOsinoURVxrGqjIUnxwDpxvBcDl+i5CVcTCYmrG3VbPiLNaAdUXYAyyie4z3wa19reLk+O9NJ0EgqNxOnhEKc2SyJ7YxgA+UWTDjPIkqcww8AJl/LAmx6WY+KRu7nrlcwA4UWoNRuqgUaw2JoB7Q==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDljCCAn6gAwIBAgIGAXyPqbX/MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxDDAKBgNVBAMMA3Z1YjEcMBoGCSqGSIb3DQEJARYNaW5mb0Bv
a3RhLmNvbTAeFw0yMTEwMTcxOTA5MzZaFw0zMTEwMTcxOTEwMzZaMIGLMQswCQYDVQQGEwJVUzET
MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0
YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxDDAKBgNVBAMMA3Z1YjEcMBoGCSqGSIb3DQEJARYNaW5m
b0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJIbVHXi6RpEpOpM3JIj
0kZV4zw54qUVXNPbS8epUGAekHvpDqoCKGbWTG8vUBhLFQehhrBSzopLsVY2jzJIa+FKqviKWchv
5772IsVIn8/KAcTnW2lS8zs86mWbklL39/chIXT19m338E9goN0BhJEW0Hh1JmGzss4juE+WBhu0
7NTVVa2xSE5ELe1dyzwQrfbtn2HEBXe3PRnX1n7Mp8LGdUb3YQGQSzy90vc0D0rx24cCtnkaxWHn
c9vKj6U7unf1c+mJyihXVgGcRl89tc0CqYX41+TgH+Z6ygqNq+EKvx+94+4BvjHnDJMCLzKUAcS3
yiyyzTIra0Hj07hCux8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAhYATs51fcjglJZcob4nwFRvt
X8WWOxB3jyBweGgYdKKbkJuC8mmtINCaEMkCyPQNqxdEK0xRKqDZOD4Ay9s+1TKKn9L8FTCBIw9H
sYPBpjPLaU1+9Z1B47qHSXw/wgmSbVOCmr6ryLvj+rmaVEZRu38BS4E8EFUT1Bl8vGsKG2vbeT4j
1KUTNNh0v4N3Fe763EGvj0lbOLTWfTWu4/4cRcB5oZs6ybaZAfQ9DejYumFxf1dADxPqjjWEi4ay
gZZpQHNdRWd0mdBjFwnf9alxi7Kx69qqu6PRvQK0BZSI8teX+XnsihoV9D+QJPaTlXzjCqIUCRZD
hNwmmISRthgHsw==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">jeroenvanpelt#hotmail.com</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData InResponseTo="ONELOGIN_e54a9652-c4b3-46b1-a9af-192b7892982e"
NotOnOrAfter="2021-10-18T10:20:48.540Z"
Recipient="****/_dashboards/_opendistro/_security/saml/acs"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2021-10-18T10:10:48.540Z"
NotOnOrAfter="2021-10-18T10:20:48.540Z"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:AudienceRestriction>
<saml2:Audience>opensearch-saml</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2021-10-18T10:15:47.768Z"
SessionIndex="ONELOGIN_e54a9652-c4b3-46b1-a9af-192b7892982e"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Attribute Name="roles"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
>
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>all_access</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
The error response in the browser is: {"statusCode":500,"error":"Internal Server Error","message":"Internal Error"}.
In the error logs (Cloudwatch), I have found the following messages:
[2021-10-18T01:45:40,286][WARN ][c.a.d.a.h.s.AuthTokenProcessorHandler] [ba6ca9920d4df640d8973f488f4c11c3] Error while validating SAML response in __PATH__
[2021-10-18T00:52:39,445][WARN ][r.suppressed ] [ba6ca9920d4df640d8973f488f4c11c3] path: __PATH__ params: {settings_filter=plugins.security.ssl.transport.pemkey_filepath,plugins.security.cert.oid,plugins.security.enable_snapshot_restore_privilege,plugins.security.audit.config.pemtrustedcas_filepath,reindex.ssl.supported_protocols,opendistro_security.compliance.history.external_config_enabled,plugins.security.ssl.transport.truststore_password,plugins.security.ssl.transport.keystore_alias,plugins.security.ssl.transport.keystore_type,plugins.security.check_snapshot_restore_write_privileges,plugins.security.advanced_modules_enabled,reindex.ssl.truststore.password,opendistro_security.*,plugins.security.ssl.transport.truststore_alias,plugins.security.unsupported.accept_invalid_config,plugins.security.audit.config.webhook.format,plugins.security.audit.config.webhook.ssl.pemtrustedcas_filepath,plugins.security.audit.config.pemkey_password,plugins.security.background_init_if_securityindex_not_exist,plugins.security.ssl.transport.enabled,plugins.security.audit.config.webhook.ssl.verify,plugins.security.ssl.transport.keystore_keypassword,plugins.security.protected_indices.roles,plugins.security.audit.config.index,plugins.security.ssl.http.keystore_alias,plugins.security.audit.config.webhook.url,plugins.security.allow_unsafe_democertificates,plugins.security.unsupported.restapi.allow_securityconfig_modification,plugins.security.allow_default_init_securityindex,plugins.security.ssl.http.truststore_type,plugins.security.ssl.transport.keystore_password,plugins.security.audit.config.log4j.logger_name,reindex.ssl.keystore.key_password,reindex.ssl.truststore.type,plugins.security.ssl.http.keystore_filepath,plugins.security.kerberos.krb5_filepath,plugins.security.ssl.transport.keystore_filepath,plugins.security.ssl.client.external_context_id,plugins.security.ssl.transport.pemcert_filepath,plugins.security.unsupported.inject_user.enabled,plugins.security.ssl.http.pemkey_password,opendistro_security.audit.enable_rest,reindex.ssl.key_passphrase,opendistro_security.audit.resolve_bulk_requests,plugins.security.restapi.password_validation_regex,plugins.security.unsupported.allow_now_in_dls,plugins.security.audit.config.type,plugins.security.ssl.transport.truststore_type,plugins.security.audit.threadpool.max_queue_len,plugins.security.audit.config.pemcert_filepath,plugins.security.audit.config.password,plugins.security.ssl.transport.enforce_hostname_verification,plugins.security.unsupported.restore.securityindex.enabled,plugins.security.*,plugins.security.config_index_name,plugins.security.audit.config.pemtrustedcas_content,plugins.security.ssl.transport.pemtrustedcas_filepath,reindex.ssl.truststore.path,plugins.security.ssl.http.pemcert_filepath,reindex.ssl.keystore.password,reindex.ssl.certificate_authorities,plugins.security.compliance.disable_anonymous_authentication,opendistro_security.audit.resolve_indices,plugins.security.audit.config.pemcert_content,plugins.security.ssl.http.truststore_password,plugins.security.ssl.http.crl.prefer_crlfile_over_ocsp,plugins.security.audit.config.pemkey_filepath,opendistro_security.compliance.history.read.metadata_only,opendistro_security.compliance.history.write.log_diffs,plugins.security.ssl.transport.extended_key_usage_enabled,plugins.security.unsupported.load_static_resources,plugins.security.compliance.salt,plugins.security.filter_securityindex_from_all_requests,reindex.ssl.certificate,plugins.security.ssl.http.crl.validate,reindex.ssl.verification_mode,opendistro_security.audit.enable_transport,plugins.security.ssl.http.crl.validation_date,plugins.security.audit.config.enable_ssl_client_auth,plugins.security.ssl.http.pemtrustedcas_filepath,plugins.security.ssl.http.keystore_keypassword,plugins.security.ssl_only,opendistro_security.compliance.history.write.metadata_only,opendistro_security.audit.log_request_body,plugins.security.unsupported.inject_user.admin.enabled,plugins.security.audit.config.webhook.ssl.pemtrustedcas_content,plugins.security.ssl.http.pemkey_filepath,plugins.security.ssl_cert_reload_enabled,plugins.security.audit.config.username,plugins.security.ssl.http.crl.disable_crldp,plugins.security.audit.threadpool.size,plugins.security.roles_mapping_resolution,plugins.security.audit.config.pemkey_content,reindex.ssl.keystore.path,plugins.security.ssl.http.enabled,plugins.security.kerberos.acceptor_keytab_filepath,plugins.security.system_indices.enabled,plugins.security.audit.config.cert_alias,reindex.ssl.client_authentication,reindex.ssl.keystore.type,plugins.security.audit.config.log4j.level,plugins.security.ssl.transport.truststore_filepath,plugins.security.audit.type,plugins.security.disabled,reindex.ssl.cipher_suites,plugins.security.disable_envvar_replacement,plugins.security.restapi.password_validation_error_message,plugins.security.ssl.http.crl.check_only_end_entities,opendistro_security.compliance.history.internal_config_enabled,opendistro_security.audit.exclude_sensitive_headers,secret_key,plugins.security.ssl.http.enable_openssl_if_available,plugins.security.ssl.http.clientauth_mode,plugins.security.protected_indices.enabled,plugins.security.unsupported.disable_rest_auth_initially,reindex.ssl.key,plugins.security.ssl.http.crl.file_path,plugins.security.audit.config.enable_ssl,plugins.security.kerberos.acceptor_principal,plugins.security.cert.intercluster_request_evaluator_class,reindex.ssl.keystore.algorithm,plugins.security.audit.config.verify_hostnames,plugins.security.ssl.http.keystore_type,plugins.security.ssl.http.truststore_filepath,plugins.security.cache.ttl_minutes,plugins.security.ssl.transport.pemkey_password,plugins.security.system_indices.indices,plugins.security.ssl.transport.enable_openssl_if_available,access_key,plugins.security.ssl.http.keystore_password,plugins.security.ssl.http.crl.disable_ocsp,plugins.security.ssl.http.truststore_alias,plugins.security.ssl.transport.principal_extractor_class,plugins.security.protected_indices.indices,plugins.security.ssl.transport.resolve_hostname,plugins.security.unsupported.disable_intertransport_auth_initially, filter_path=nodes.*.attributes.di_number}
OpenSearchSecurityException[OpenSearch Security not initialized for __PATH__]
at org.opensearch.security.filter.SecurityFilter.apply0(SecurityFilter.java:296)
at org.opensearch.security.filter.SecurityFilter.apply(SecurityFilter.java:154)
at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:191)
at org.opensearch.action.support.TransportAction.execute(TransportAction.java:169)
at org.opensearch.action.support.TransportAction.execute(TransportAction.java:97)
at org.opensearch.client.node.NodeClient.executeLocally(NodeClient.java:99)
at org.opensearch.client.node.NodeClient.doExecute(NodeClient.java:88)
at org.opensearch.client.support.AbstractClient.execute(AbstractClient.java:428)
at org.opensearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:717)
at org.opensearch.client.support.AbstractClient$ClusterAdmin.state(AbstractClient.java:747)
at org.opensearch.rest.action.admin.cluster.RestClusterStateAction.lambda$prepareRequest$0(RestClusterStateAction.java:125)
at org.opensearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:128)
at org.opensearch.security.filter.SecurityRestFilter$1.handleRequest(SecurityRestFilter.java:128)
at org.opensearch.rest.RestController.dispatchRequest(RestController.java:271)
at org.opensearch.rest.RestController.tryAllHandlers(RestController.java:353)
at org.opensearch.rest.RestController.dispatchRequest(RestController.java:204)
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
__AMAZON_INTERNAL__
at org.eclipse.jetty.server.handler.GzipHandler.handle(GzipHandler.java:301)
__AMAZON_INTERNAL__
at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:52)
__AMAZON_INTERNAL__
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)
at org.eclipse.jetty.server.Server.handle(Server.java:370)
at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)
at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)
at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)
at __PATH__(Thread.java:834)
I started a new Opensearch cluster after users started to complain they could no longer log in to an older ES Cluster that was recently updated to Opensearch. Instead of SAML authentication, it was using Cognito authentication. As it was working before, and I followed the instructions (https://docs.aws.amazon.com/opensearch-service/latest/developerguide/saml.html) carefully again for both Cognito authentication and SAML authentication, it feels like something is wrong with Opensearch itself.

Answer 1

Check the SAML URLs configured in your IdP Broker as they changed from ES 7.x to OpenSearch 1.x. Also, try switching between using either the IdP or SP URL.

Answer 2

I've got exactly the same issue as you and I've managed to fix it by changing the SubjectKey to a custom SAML attribute:
I've added an attribute named email to my IdP configuration (Okta in your case, AWS SSO in my case).
Then I've set it up as the SubjectKey in AWS Opensearch. Here is my configuration for comparision:
SAML_METADATA=$(cat saml.xml | sed 's/"/\\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
SAML_ENTITY_ID=$(grep entityID saml.xml | sed -r 's:.*entityID="(.*)".*:\1:')
aws opensearch update-domain-config \
--domain-name <name of the OpenSearch domain> \
--advanced-security-options '{"SAMLOptions":{"Enabled":true,"MasterUserName":"my-email#example.com", "Idp":{"EntityId":"'$SAML_ENTITY_ID'","MetadataContent":"'"$SAML_METADATA"'"}, "SessionTimeoutMinutes":180, "SubjectKey":"email"}}'

Answer 3

Here's what I did to solve the 500 internal server error with OpenSearch SSO login.
Note: Only if you are using AWS SSO
Log into AWS SSO console > Applications > Add New Application > search for OpenSearch (or select add custom SAML application)
Enter Display Name and Description and download AWS SSO SAML Metadata File
Go to the Application metadata section and add the Application ACS URL (Copy SSO URL (IdP initiated) from OpenSearch domain security configuration) > Save Changes
Go to Attribute mappings and add an attribute in the 1st column e.g email > value as ${user:email} > Save changes and Assignee required users.
Go to OpenSearch domain security configuration > upload the metadata file downloaded during step 2
Go to Additional Settings and add email (attribute name in step 4) to Subject key - optional
Go to your AWS SSO Start page you should see OpenSearch there.
Hope this helps