mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-01 16:39:11 +00:00
b27f23a80d
This change adds the spec for the new REST APIs that we introduce for the IDP and documentation for each of the APIs. The documentation pages are intentionally not included in the API reference so as to minimize unnecessary exposure. supersedes: #53858
57 lines
4.0 KiB
Plaintext
57 lines
4.0 KiB
Plaintext
[role="xpack"]
|
|
[[idp-saml-metadata]]
|
|
=== Generate SAML metadata for the IDP
|
|
++++
|
|
<titleabbrev>Generate SAML metadata for the IDP</titleabbrev>
|
|
++++
|
|
Generates a SAML metadata document for the Identity Provider, describing its configuration and capabilities.
|
|
|
|
[[idp-saml-metadata-request]]
|
|
==== {api-request-title}
|
|
|
|
`GET /_idp/saml/metadata/{sp_entity_id}`
|
|
|
|
[[idp-saml-metadata-prereqs]]
|
|
==== {api-prereq-title}
|
|
|
|
* To use this API, you must have a role that grants the `cluster:admin/idp/saml/metadata` privilege.
|
|
|
|
[[idp-saml-metadata-desc]]
|
|
==== {api-description-title}
|
|
|
|
This API generates a SAML metadata XML Document that can be consumed by a service provider in order
|
|
to be configured to work with this identity provider
|
|
|
|
[[idp-saml-metadata-path-params]]
|
|
==== {api-path-parms-title}
|
|
|
|
`sp_entity_id::
|
|
(string) The SAML entity Id of the service provider that will consume this SAML metadata document.
|
|
|
|
`acs`::
|
|
(Optional, string) The SAML Assertion Consumer Service URL of the service provider that will consume this SAML.
|
|
If this is not set, then this API will ignore any wildcard services and will fail if `sp_entity_id` is not a directly registered Service Provider.
|
|
metadata document.
|
|
|
|
[[idp-saml-metadata-example]]
|
|
==== {api-examples-title}
|
|
|
|
The following example generates a SAML metadata document to be consumed by the service provider with
|
|
entity Id `https://some.sp.org/`.
|
|
|
|
[source, console]
|
|
--------------------------------------------------------------------
|
|
GET /_idp/saml/metadata/https%3A%2F%2Fsome.sp.org%2F?acs=https%3A%2F%2Fsome.sp.org%2Fsaml%2Facs
|
|
--------------------------------------------------------------------
|
|
// TEST[skip:Do not enable identity provider for the docs cluster, at least not yet]
|
|
|
|
a successful call returns the SAML metadata as an XML String
|
|
|
|
[source, console-result]
|
|
--------------------------------------------------------------------
|
|
{
|
|
"metadata" : "<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://idp.org"><md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>MIIDYzCCAkugAwIBAgIVAITQVqXYYUT0w04Z2gWAZ6pv7gwbMA0GCSqGSIb3DQEBCwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2VuZXJhdGVkIENBMCAXDTIwMDEyODA2MzczNloYDzIxNjgxMDE5MDYzNzM2WjBRMRMwEQYKCZImiZPyLGQBGRYDb3JnMR0wGwYKCZImiZPyLGQBGRYNZWxhc3RpY3NlYXJjaDEMMAoGA1UECxMDaWRwMQ0wCwYDVQQDEwR0ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAujk+mVzI+qmf4gSJZdVVDdhFTi06kikb7FxG5JPu+gmU9Ke0LVEpP7Jp3gmhwsa18JUuvaepL1jnKmbbepKkEsvqUj4FuI/gImvFwb7X+xUwzNTYZAEvnZ4n16k0sBPuDuDibF0MGniVeLG3bD2VF3crFQrphFr+GZSXbVk5zIcSf6D6nSDcKmCNpVAK3jX9iV0nkr8cPtHOgprv1Y7mZgk5jwli9to0QD7r7OG5Db34R06JTMGTji+RULPISH1bc8FHdurRASkGmsei5GlJqPSuKdViuaKPmDrvKR8OK6gMzUd3pikJgD8veLxEuZ640FHPndPlvwJrSLwhitRgPQIDAQABo00wSzAdBgNVHQ4EFgQUD87H31WVQNfCc85/H2qhpzs3XfowHwYDVR0jBBgwFoAUVenAN+T06rqNDxjMcvgimnTw+FgwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEAIvHYxT30cvoHWUE2saDVJ4qs/e0G3WusDyem3e4HkqwLEah06RDSgVCaOfW3ey5Q6CIQW3HHGUYqO0nU8JVCWdAk3+bUYJJOeLnwD+SbDxxKBhxLdx+BjWata85lfJTR9+dXs0RXAAN8dSiIaj9NSgnwiJqQQZf7i66S7XB58TDTdZlV3d26STLy5h7Uy6vyCka8Xu8HFQ4hH2qf2L6EhBbzVTB6tuyPQOQwrlLE65nhUNkfBbjZlre45UMc9GuxzHkbvd3HEQaroMHZxnu+/n/JDlgsrCYUEXnZnOXvgUPupPynoRdDN1F6r95TLyU9pYjDf/6zNPE854VF6y1TqQ==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.org/slo/post"/><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.org/sso/redirect"/></md:IDPSSODescriptor></md:EntityDescriptor>"
|
|
}
|
|
--------------------------------------------------------------------
|
|
// TESTRESPONSE[skip:Do not enable identity provider for the docs cluster, at least not yet]
|