Provision users from WSO2IS to Active Directory - wso2

we would keep our user base in WSO2IS internal repository and we would like to provision users to an Active Directory ldap following our workflow, like Midpoint Evolveum or Apache Syncope do.
The use case is this: we have a new user, mr. Foo.
He has a role in the company:
external user: he is added to WSO2IS and he can access webmail (webmail server uses some protocol to communicate to WSO2IS)
internal user: he is added to WSO2IS, then WSO2IS provisions Foo to the company Active Directory.
Is it possible with WSO2 Identity Server?
Thanks,
Mario

WSO2 IS has rule based provisioning, where you can define rules to which User Store a user can be provisioned.
What you need to do is to set an attribute on the new user, which signifies the user is internal or external, after execution of your workflow. Then this attribute can be evaluated at XACML level to do the selective provisioning.
Following links might help.
Rule Based Provisioning
Workflow Management

Related

Authenticate AWS Opensearch dashboard using LDAP via keycloak

Requirement
I am working on a client project where we need to setup our AWS managed OpenSearch dashboard (Kibana). As per the requirement, we should use keycloak for SAML configurations. Also need to use LDAP as user federation.
Current Setup
AWS OpenSearch setup is completed and able to login with the master user credentials.
Integration of Keycloak with OpenSearch dashboard is done. I am able to login to the OpenSearch dashboard using keycloak local user by adding it in the all_access group in Dashboard (kibana).
LDAP integration with Keycloak is also completed. I can sync all LDAP users within Keycloak and able to login with individual LDAP users when adding them in the all_access group in Dashboard (Kibana).
Issue/Open tasks
How can I add the entire keycloak group to the OpenSearch Dashboard so I do not have to add individual users. I tried adding the group name in the dashboard under backend role section but it does not work. Also tried a few mappings (not sure if they were correct) but got no luck. Every time it gives "missing role-contact your administrator"
Same issue with LDAP groups as well, I can sync all LDAP groups within my Keycloak but not sure how to map them with OpenSearch Dashboard to login.
Ultimate Goal
Create two groups, one as admin and other as limitedaccess so that users who are part of admin group can login with the assigned permissions and users in limitedaccess group can login with their permissions.
I do not want to add individual users in the Dashboard rather they should be able to login directly based on role/group mapping.
The issue is resolved.
Following are the things I did, which may be useful for others looking for similar setup.
Created two groups in my Keycloak. "admin" and "limited".
Created two roles "admin_role" and "limited_role".
Made the limited group as default group and the limited_role as default role so the new users will directly get the limited permissions.
Next, which i was missing all the time (and thanks to other stack overflow answers) was to enable the Single Role mapping. For this, Go to Client scope role_list --> mappers --> role list --> enable "Single Role attribute"
Added the "Role" keyword in OpenSearch in the role key section (under additional settings in AWS OpenSearch SAML configs.). Also mentioned a generic user in the SAML master user section (generic user which I created in Keycloak) so that I can gain admin privileges to add backend roles in OpenSearch Dashboard.
Finally, logged in to my OpenSearch with this generic user. Go to the security --> Roles --> Manage mapping --> backend roles --> added my admin_role to the all_access and limited_role to the read roles.
Now I am able to login with all the users who are part of the respective groups in Keycloak.

How to map a SAML Attribute from your IdP to an AWS Elastic Search Role?

The recently added SAML support for AWS Elastic Search solution:
https://aws.amazon.com/about-aws/whats-new/2020/10/amazon-elasticsearch-service-adds-native-saml-authentication-kibana/
Lists in its documentation that backend roles are supported:
https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/saml.html
In Okta, for example, you might have a user, jdoe, who belongs to the group admins. If you add jdoe to the SAML master username field, only that user receives full permissions. If you add admins to the SAML master backend role field, any user who belongs to the admins group receives full permissions.
If you want to use backend roles (recommended), specify an attribute from the assertion in the Role key field, such as role or group. This is another situation in which tools like SAML-tracer can help.
But some users have problems finalizing the configuration once they are done with the AWS Console.
The answer lies beyond the AWS Console and must be completed within the Elastic Search cluster with the Master User that you created either within the cluster as an Internal User, via an IAM role or by using the Master User field in the SAML configuration section of the Modify Authentication Wizard in the AWS console for Elastic Search.
You must:
Create a Backend role that matches your SAML attribute value
Create a Mapping between the new backend role and an actual Elastic Search Role
After you're done configuring your IdP by creating a custom Attribute/Claim like roles or groups and after you've configure SAML authentication integration in the Elastic search cluster.
1.-Log into Kibana using your master user
2.-Go to OpenDistro -> Security -> Roles -> The Role you want to grant access to, i.e. readall
3.-Go to the Mapped Users tab under the role screen
4.-On the Backend Roles field type the VALUE of the Azure Claim you created by following these steps: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-enterprise-app-role-management
For reference the claim value is: user.assignedroles.
The claim key is whatever you configure your Azure Enterprise application as.
You'll have a key value pair of "Your chosen Claim Name": user.assignedroles
5.-Save the Mapping in Kibana
Using the Azure IdP log into Kibana using users with different Azure Claim assigned to them. The Open Distro Security plugin will parse the SAML token attribute find the field for user.assignedroles and map that as a Kibana Backend Role to the actual Elastic Search roles.

How to give service account access to two projects?

Using Google Cloud, there exists a BigQuery View table that queries two projects.
However, on the project where the view is located, we wish to run a query against it from Airflow/Composer. Currently it fails with a 403.
AFAIK it will use the default composer service account - however it doesn't have access to the 2nd project used in the sql of the view.
How do I give composer's service account access to the second project?
Think about a service account like a user account: you have a user email that you authorize on different project and component. Exactly the same thing with the service account email.
The service account belongs to a project. An user account belongs to a domain name/organisation. No real difference at the end.
So, you can use a service account email like any user accounts:
Grant authorization in any project
Add it in Google Groups
Even grant it viewer or editor role on GSuite document (Sheet, Docs, Slides,...) to allow it to access and to read/update these document!! Like any users!
EDIT
With Airflow, you can defined connexions and a default connexion. You can use this connexion in your DAG and thus use the service account that you want.
I think you have to add the service account into project IAM.

WSO2 API Manager (1.10.0) LDAP Roles

I have a LDAP Second store at APIM (1.10.0).
When I create one aplication, two roles is created like this:
- Application/<user>_<Name application>_PRODUCTION
- Application/<user>_<Name application>_SANDBOX
I' d like create it at LDAP automaticaly . How can I do this?
By design this role is created under Application which is an internal role. One of the benefits of creating under application is that this role can be assigned to a user of any domain(primary/secondary) where as if the role was created under a specific domain then the role would not be available for other domain users
regards,shavantha

WSO2 Identity Server: Automatically adding users to roles on sign-up

I'm working on upgrading from WSO2 Identity Server 4.1.0 to 4.5.0 and I've found that new users are now added to an internal/identity group instead of the in LDAP identity group that they were being added to formerly.
In particular I would like to add new users to the LDAP group (I've got a lot of things that expect and need accounts to be in that group). But it brings up another question, is there anyway to define groups / roles that a new user automatically gets added to during sign-up?
Users who are signing up would be added in to a Internal/identity role by default in 4.5.0. This internal role is created in the internal databases. Basically the user management database which has been defined in user-mgt.xml file.(UM_HYBRID_ROLE table). This is because, This role is created pragmatically, therefore is not good to create in the actual user store. I guess WSo2 Identity Server has not way to configure this role name and configure where it must be retrieved. I saw this as some limitation.