Configure OpenSearch SSO with Google Workspace

ClusterNest Managed OpenSearch can delegate Dashboards login to Google over either OIDC or SAML. SAML is the recommended option - see the disclaimer under OIDC below for why. Pick one - auth_type accepts only a single mode per cluster.

You'll need your cluster's OpenSearch Dashboards hostname before registering the app. Set opensearch_dashboards_custom_hostname so you know it upfront, or create the cluster first with auth_type = "internal" and note the generated opensearch_dashboards_url output before switching it over.

SAML

SAML

1. In the Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app. Name it (e.g. "OpenSearch Dashboards").
2. Google shows its IdP details on the next screen - a SSO URL, a Entity ID, and a Download Metadata link. Save the metadata file's URL as idp_metadata_url, and the Entity ID as idp_entity_id (it looks like https://accounts.google.com/o/saml2?idpid=<idpid>).
3. On the Service provider details step, enter:
   • ACS URL: https://<dashboards-hostname>/_opendistro/_security/saml/acs
   • Entity ID: the value you'll use as sp_entity_id below
   • Name ID format: EMAIL, Name ID: Basic Information > Primary email
4. Under Attribute mapping, map a Google directory field (e.g. a custom Groups field) to the SAML attribute name you'll set as roles_key, if you want role mapping. This is the reason SAML is preferred here - see the OIDC tab.
5. Google apps are OFF for all users by default - turn the app ON for the relevant OUs/groups from the app's overview page.

roles_key defaults to an ADFS-style claim URI that Google never emits - leave it unset (uses the SAML subject/NameID) unless you configured an attribute mapping in step 4, in which case set it to that attribute's name.

Console

In the ClusterNest console, open the cluster's create/edit form and set Authentication Type to SAML, then fill in:

• IDP Metadata URL: the metadata file URL from step 2
• IDP Entity ID: https://accounts.google.com/o/saml2?idpid=C0123abcd
• SP Entity ID: opensearch-dashboards
• Roles Key: only if you configured an attribute mapping in step 4

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_type       = "saml"
  saml_config = {
    idp_metadata_url = "https://accounts.google.com/o/saml2/metadata?idpid=C0123abcd"
    idp_entity_id     = "https://accounts.google.com/o/saml2?idpid=C0123abcd"
    sp_entity_id      = "opensearch-dashboards"
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

OIDC

OIDC

Prefer SAML above

Google's standard OIDC token carries no group/role claim at all, and Workspace has no equivalent of a SAML attribute mapping for OIDC - there's no groups-shaped claim to point roles_key at without also wiring up the Admin SDK Directory API server-side, which is outside what this integration does. If you need group-based OpenSearch role mapping, use the SAML tab instead; OIDC here only gets you authentication, not role mapping.

Google Workspace doesn't expose generic OIDC app registration in the Admin console either - that's done from Google Cloud Console against the Cloud project tied to your Workspace org.

1. In Google Cloud Console, open APIs & Services > OAuth consent screen. Set User type to Internal if you want to restrict login to your Workspace org.
2. Go to APIs & Services > Credentials > Create Credentials > OAuth client ID, application type Web application.
   • Authorized redirect URIs: https://<dashboards-hostname>/auth/openid/login
3. Note the generated Client ID and Client secret.

Google's ID token has no preferred_username claim, so subject_key must be overridden to email.

Console

In the ClusterNest console, open the cluster's create/edit form and set Authentication Type to OIDC, then fill in:

• Connect URL: https://accounts.google.com/.well-known/openid-configuration
• Client ID / Client Secret: from Google Cloud Console
• Subject Key: email
• Roles Key: leave blank

Terraform

resource "clusternest_opensearch" "sso" {
  name            = "logs"
  tier            = "standard"
  organization_id = 123
  auth_type       = "oidc"
  oidc_config = {
    connect_url   = "https://accounts.google.com/.well-known/openid-configuration"
    client_id     = var.oidc_client_id
    client_secret = var.oidc_client_secret
    subject_key   = "email"
  }

  opensearch_dashboards_custom_hostname = "opensearch-dashboards.example.com"
}

See the Terraform resource reference for the full field list.