Configure OpenSearch SSO with Google Workspace

ClusterNest Managed OpenSearch can delegate Dashboards login to Google over OIDC or SAML. SAML is the recommended option - see the disclaimer under OIDC below for why. A cluster takes several auth sources side by side, with at most one SAML source and one OIDC source offered on Dashboards.

You'll need your cluster's OpenSearch Dashboards hostname before registering the app. Set dashboards_custom_hostname so you know it upfront, or create the cluster first without an auth source and note the generated opensearch_dashboards_url output before adding it.

SAML

SAML

1. In the Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app. Name it (e.g. "OpenSearch Dashboards").
2. Google shows its IdP details on the next screen - a SSO URL, a Entity ID, and a Download Metadata link. Save the metadata file's URL as idp_metadata_url, and the Entity ID as idp_entity_id (it looks like https://accounts.google.com/o/saml2?idpid=<idpid>).
3. On the Service provider details step, enter:
   • ACS URL: https://<dashboards-hostname>/_opendistro/_security/saml/acs
   • Entity ID: the value you'll use as sp_entity_id below
   • Name ID format: EMAIL, Name ID: Basic Information > Primary email
4. Under Attribute mapping, map a Google directory field (e.g. a custom Groups field) to the SAML attribute name you'll set as roles_key, if you want role mapping. This is the reason SAML is preferred here - see the OIDC tab.
5. Google apps are OFF for all users by default - turn the app ON for the relevant OUs/groups from the app's overview page.

roles_key defaults to an ADFS-style claim URI that Google never emits - leave it unset (uses the SAML subject/NameID) unless you configured an attribute mapping in step 4, in which case set it to that attribute's name.

Console

In the ClusterNest console, open the cluster's create/edit form and add a SAML source under Authentication. Choose a Name (it becomes the text of the Dashboards button, "Login with" followed by this name), then fill in:

• IDP Metadata URL: the metadata file URL from step 2
• IDP Entity ID: https://accounts.google.com/o/saml2?idpid=C0123abcd
• SP Entity ID: opensearch-dashboards
• Roles Key: only if you configured an attribute mapping in step 4

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "google"
      type             = "saml"
      idp_metadata_url = "https://accounts.google.com/o/saml2/metadata?idpid=C0123abcd"
      idp_entity_id    = "https://accounts.google.com/o/saml2?idpid=C0123abcd"
      sp_entity_id     = "opensearch-dashboards"
    },
  ]

  dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

OIDC

OIDC

Prefer SAML above

Google's standard OIDC token carries no group/role claim at all, and Workspace has no equivalent of a SAML attribute mapping for OIDC - there's no groups-shaped claim to point roles_key at without also wiring up the Admin SDK Directory API server-side, which is outside what this integration does. If you need group-based OpenSearch role mapping, use the SAML tab instead; OIDC here only gets you authentication, not role mapping.

Google Workspace doesn't expose generic OIDC app registration in the Admin console either - that's done from Google Cloud Console against the Cloud project tied to your Workspace org.

1. In Google Cloud Console, open APIs & Services > OAuth consent screen. Set User type to Internal if you want to restrict login to your Workspace org.
2. Go to APIs & Services > Credentials > Create Credentials > OAuth client ID, application type Web application.
   • Authorized redirect URIs: https://<dashboards-hostname>/auth/openid/login
3. Note the generated Client ID and Client secret.

Google's ID token has no preferred_username claim, so subject_key must be overridden to email.

Console

In the ClusterNest console, open the cluster's create/edit form and add an OIDC source under Authentication. Choose a Name (it becomes the text of the Dashboards button, "Login with" followed by this name), tick Offer on OpenSearch Dashboards, then fill in:

• Connect URL: https://accounts.google.com/.well-known/openid-configuration
• Client ID / Client Secret: from Google Cloud Console
• Subject Key: email
• Roles Key: leave blank

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_sources = [
    {
      name             = "google"
      type             = "oidc"
      connect_url      = "https://accounts.google.com/.well-known/openid-configuration"
      client_id        = var.oidc_client_id
      client_secret    = var.oidc_client_secret
      subject_key      = "email"
      dashboards_login = true
    },
  ]

  dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

See the Terraform resource reference for the full field list.