[BUG] SAML Authentication does not apply local database roles to the user.

[clenkiu]

Describe the bug
A user authenticated in the OpenSearch Dashboard via SAML authentication doesn't have the backend roles assigned to him in the local database.
If the authentication configuration is changed from SAML to Basic, the roles are handled properly in the Dashboard.

To Reproduce
Steps to reproduce the behavior:

1. Create a user in the local database with a username matching to an existing user in the SAML Authentication Server
2. Assign a backend role to the created user. admin, by example
3. Configure the OpenSearch Dashboard to authenticate via the SAML Authentication Server
4. After authenticating the user check the backend roles via the menu View roles and identities
5. Dashboards show 0 backend_roles.

Expected behavior
OpenSearch should match the username received in the SAML element NameID and match the existing roles configured in the local database.

Plugins
[opensearch@ngls-opensearch ~]$ bin/opensearch-plugin list
opensearch-alerting
opensearch-anomaly-detection
opensearch-asynchronous-search
opensearch-index-management
opensearch-job-scheduler
opensearch-knn
opensearch-notebooks
opensearch-performance-analyzer
opensearch-reports-scheduler
opensearch-security
opensearch-sql

Screenshots

From the logs it seems that the code tries to get roles from the SAML response instead of using the local database.

[2021-08-17T20:53:19,075][WARN ][c.a.d.a.h.j.AbstractHTTPJwtAuthenticator] [opensearch-node] Failed to get roles from JWT claims with roles_key 'roles'. Check if this key is correct and available in the JWT payload.
[2021-08-17T20:53:19,075][DEBUG][o.o.s.a.BackendRegistry ] [opensearch-node] Rest user 'User [name=*************, backend_roles=[], requestedTenant=null]' is authenticated

[CEHENKLE]

Transferring to the security plugin. If this is an incorrect transfer, please @ me and I'll move it back.

Thanks!
/C

[AntonEliatra]

Hi @clenkiu as this issue doesn't seem to be related to any bug or feature request, It might be more helpful to raise a ticket in the OpenSearch forum where we are usually quick to help with similar questions.

[CEHENKLE]

@Anthony7774 Hey, can you say a few more words on why you think this isn't a bug? It seems like a gap in expected behavior. Thanks!

/C

[AntonEliatra]

@clenkiu This is by design, the internal backend role db is only for basic_auth, in case of SAML, the roles need to be provided and extracted from SAML response.

[davidlago]

Closing. @clenkiu please feel free to reopen if you disagree with @Anthony7774's assessment.