Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(opensearchservice): SAML authorization properties for Domain construct #26673

Merged
merged 5 commits into from
Aug 12, 2023
Merged

feat(opensearchservice): SAML authorization properties for Domain construct #26673

merged 5 commits into from
Aug 12, 2023

Conversation

lpizzinidev
Copy link
Contributor

Allows to specify SAML authentication for OpenSearch domains via high-level construct properties.

Example:

const domain = new Domain(this, 'Domain', {
  version: EngineVersion.OPENSEARCH_1_0,
  enforceHttps: true,
  nodeToNodeEncryption: true,
  encryptionAtRest: {
    enabled: true,
  },
  fineGrainedAccessControl: {
    masterUserName: 'master-user',
    samlAuthenticationEnabled: true,
    samlAuthenticationOptions: {
      idpEntityId: 'entity-id',
      idpMetadataContent: 'metadata-content-with-quotes-escaped',
    },
  },
});

Closes #26600.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Aug 8, 2023
@aws-cdk-automation aws-cdk-automation requested a review from a team August 8, 2023 12:13
@github-actions github-actions bot added the star-contributor [Pilot] contributed between 25-49 PRs to the CDK label Aug 8, 2023
@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Aug 8, 2023
devardee
devardee approved these changes Aug 10, 2023
View reviewed changes
Copy link

@devardee devardee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for picking this up. LGTM!!

@aws-cdk-automation aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Aug 10, 2023
colifran
colifran reviewed Aug 10, 2023
View reviewed changes
packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts
/**
* Container for information about the SAML configuration for OpenSearch Dashboards.
*/
readonly samlAuthenticationOptions?: SAMLOptionsProperty;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a default stating "no SAML authentication options"? - @default - no SAML authentication options

I also think we should add a note here saying that if SAML authentication options are set, then samlAuthenticationEnabled will be enabled

colifran
colifran reviewed Aug 10, 2023
View reviewed changes
packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts Outdated
@@ -1685,6 +1757,18 @@ export class Domain extends DomainBase implements IDomain, ec2.IConnectable {
masterUserName: masterUserName,
masterUserPassword: this.masterUserPassword?.unsafeUnwrap(), // Safe usage
},
samlOptions: samlAuthenticationEnabled ? {
enabled: true,
idp: {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about something like this so we can remove the ! operator:

idp: props.fineGrainedAccessControl && props.fineGrainedAccessControl.samlAuthenticationOptions ? {
  entityId: props.fineGrainedAccessControl.samlAuthenticationOptions.idpEntityId,
  metadataContent: props.fineGrainedAccessControl.samlAuthenticationOptions.idpMetadataContent,
} : undefined,

What do you think?

colifran
colifran reviewed Aug 10, 2023
View reviewed changes
packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts
* This SAML user receives full permission in OpenSearch Dashboards/Kibana.
* Creating a new master username does not delete any existing master usernames.
*/
readonly masterUserName?: string;
Copy link
Contributor

@colifran colifran Aug 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a default flag?

colifran
colifran reviewed Aug 10, 2023
View reviewed changes
packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts
* The backend role that the SAML master user is mapped to.
* Any users with this backend role receives full permission in OpenSearch Dashboards/Kibana.
*/
readonly masterBackendRole?: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a default flag for this one too?

colifran
colifran previously requested changes Aug 10, 2023
View reviewed changes
Copy link
Contributor

@colifran colifran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lpizzinidev This looks great! I left a few minor comments.

@mergify mergify bot dismissed colifran’s stale review August 11, 2023 06:48

Pull request has been modified.

colifran
colifran previously approved these changes Aug 11, 2023
View reviewed changes
Copy link
Contributor

@colifran colifran left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lpizzinidev Looks great! Thanks for your work on this.

@mergify
Copy link
Contributor

mergify bot commented Aug 11, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot dismissed colifran’s stale review August 12, 2023 00:33

Pull request has been modified.

@mergify
Copy link
Contributor

mergify bot commented Aug 12, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: e25f7bf
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 6e20cbf into aws:main Aug 12, 2023
9 checks passed
@mergify
Copy link
Contributor

mergify bot commented Aug 12, 2023

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@rehanvdm
Copy link

@lpizzinidev @colifran I don't see the docs having updated but I see the README.md was updated in this PR. Do you know when/how the docs will update?

image

@github-actions github-actions bot mentioned this pull request Sep 1, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@devardee devardee devardee approved these changes

@colifran colifran colifran approved these changes

Assignees
No one assigned
Labels
effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 star-contributor [Pilot] contributed between 25-49 PRs to the CDK
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

aws_opensearchservice: High Level Constructs For OpenSearch SamlOptions Feature
5 participants
@lpizzinidev @aws-cdk-automation @rehanvdm @devardee @colifran