Role-Based Access Control and OpenSearch Document Level Security (DLS) Configuration Guide

Configure OpenSearch Document-Level Security (DLS) via Advanced Group Mappings.

Overview

This guide walks through configuring Document-Level Security (DLS) and tenant permissions on OpenSearch using SAML Advanced Group Mappings.

Supported Deployments and Protocols

This feature is currently available for On-Premise AgileSec deployments with SAML 2.0 Identity Providers.

Limitations

DLS constraints and limitations include the following:

1. SAML Only: RBAC and DLS is not available for local (username/password) users or non-SAML SSO methods.

2. Standard Role Mapping groups override DLS: A user in an advanced group and in a group from the standard Role Mapping also gets the built-in org role, which can read all organization data. Because OpenSearch adds up roles, multiple-group users see everything.

   1. Solution: Create dedicated IdP groups for restricted users and map them only under Advanced Group Mappings.

3. Only Org User access can be restricted. Root users are never restricted.

4. AgileSec UI does not manage the OpenSearch side: User-created roles, DLS queries, tenant permissions, and role mappings all have to be created in AgileSec and OpenSearch. Default AgileSec roles do not need to be manually added to OpenSearch.

5. Group changes take effect at the next user login.

Glossary of Terms

The following key concepts are used throughout this guide.

Configuration Flow

Advanced Group Mappings allow you to dynamically restrict user access to specific dashboard visualizations and data records based on IdP user groups.

The configuration flow involves three main steps:

1. Configure IdP: Configure your SAML 2.0 Identity Provider to release group attributes.

2. Configure AgileSec Advanced Group Mappings: Link the IdP group to the OpenSearch backend role.

   1. Under Advanced Group Mappings, only IdP groups explicitly mapped in AgileSec can grant custom OpenSearch backend roles. Unmapped IdP groups do not grant any DLS-scoped access or backend roles.

3. Configure OpenSearch Security: Define the security roles and map them to backend roles directly inside OpenSearch settings.

4. Runtime Enforcement: Upon SAML login, AgileSec extracts the user's groups, maps them, and communicates the active backend roles to OpenSearch. OpenSearch then natively filters data before rendering it to the user.

Step 1: IdP Configuration (SAML 2.0)

Configure your SAML 2.0 Identity Provider to release group attributes:

1. Locate Attribute Statements:
   In your SAML IdP application setup, locate settings for Attribute Statements.

2. Add/Verify Group Claim:
   Ensure a claim is configured to emit the user's group memberships. Take note of the exact Name of the attribute (e.g., memberOf or roles).

3. Verify Group Values:
   Record the exact spelling and casing of the group values sent by the IdP (e.g., Finance, Security).

Step 2: AgileSec Configuration

Navigate to Role Mapping Configuration inside the AgileSec Web UI.

Set the Claim Key

In the Role Assignment Claim Key field, enter the exact attribute name from your SAML provider (e.g., roles).

Configure Advanced Group Mappings (For DLS)

1. Expand the Advanced Group Mappings section.

2. Click + Add Role.

3. In IDP Role, enter the group name as sent by your IdP (e.g., Finance).

4. The AgileSec User Type displays as Org User (standard viewer access) to ensure standard users do not gain administrative rights.

5. Review the AgileSec Backend Role preview. The platform automatically prefixes your organization identifier.

   1. The organization identifier comes from your organization’s email top-level domain with . replaced by _. Example: acme.com becomes acme_com.

Step 3: OpenSearch Configuration (On-Premise Only)

For self-hosted installations, configure the roles and mappings directly in OpenSearch.

Create the OpenSearch Role & Configure DLS

Create a role (e.g., opensearch-acme_corp-Finance) and define index permissions along with a DLS query to restrict query results.

For example, to restrict visibility only to objects where the type is Algorithm:

{
  "index_permissions": [
    {
      "index_patterns": ["analytics-*"],
      "dls": "{\"term\":{\"object.type\":\"Algorithm\"}}",
      "allowed_actions": ["read"]
    }
  ],
  "tenant_permissions": [
    {
      "tenant_patterns": ["acme_corp_tenant"],
      "allowed_actions": ["kibana_all_read"]
    }
  ]
}

Map to the AgileSec Backend Role

Create a Role Mapping in OpenSearch linking the OpenSearch Role you created (opensearch-acme_corp-Finance) to the exact Backend Role generated in your AgileSec Advanced Mappings (acme_corp-Finance):

{
  "backend_roles": [
    "acme_corp-Finance"
  ]
}

Step 4: Verification Checklist

After completing the configuration, verify the setup: