# Wazuh

## Presentation

Wazuh is an Open Source Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) solution that supports the SAML protocol.

## Configuration

### LL::NG

This page assumes you already have configured the SAML Service in LemonLDAP::NG, if not please follow : SAML service configuration

#### LL::NG SAML Key & Certificate

Wazuh requires a certificate in the published Identity Provider metadata (i.e. not a public key). Make sure you have generated a set of private key and public certificate in `SAML` » `Security` » `Keys`.

#### LL::NG SAML Configuration

Use RSA-SHA256 for the IDP signature method.

Now go in “Exported attributes” and add the ‘groups’ variables and put the name ‘Roles’ for the attribute name. The attribute name must match the ‘roles_key’ configuration of the Wazuh indexer.

You can generate the Service Provider xml using SAMLTool. Indicate `https://<WAZUH_DHASBOARD_DOMAIN>/_opendistro/_security/saml/acs` as the Attribute Consume Service Endpoint and `https://<WAZUH_DHASBOARD_DOMAIN>/` as the Logout Service Endpoint.

### Wazuh

Refer to the Wazuh documentation to configure your Wazuh server and Wazuh Dashboard.

#### Wazuh Indexer

This configuration must be present in `/usr/share/wazuh-indexer/opensearch-security/config.yml` :

    saml_auth_domain:
        http_enabled: true
        transport_enabled: false
        order: 1
        http_authenticator:
            type: saml
            challenge: true
            config:
            idp:
                # LLNG SAML metadata
                metadata_file: '/usr/share/wazuh-indexer/opensearch-security/idp.wazuh.xml'
                # URL of LLNG metadata
                entity_id: "https://LLNG_DOMAIN/saml/metadata"
            sp:
                entity_id: wazuh-saml
                # Wazuh SAML metadata
                metadata_file: /usr/share/wazuh-indexer/opensearch-security/sp.wazuh.xml
            kibana_url: https://WAZUH_DASHBOARD
            # Must match the groups exported attribute
            roles_key: Roles
            # Generate one with 'openssl rand -hex 32'
            exchange_key: 'key'

Also add the required role mappings in `/usr/share/wazuh-indexer/opensearch-security/roles_mapping.yml`.

Note that the SAML authentication requires the following JVM policy in the Wazuh indexer start command:

    grant {
        permission java.util.PropertyPermission "*","read,write";
    }

#### Wazuh Dashboard

Put the following configuration in `/etc/wazuh-dashboard/opensearch_dashboards.yml`:

    opensearch_security.auth.type: "saml"
    server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"]
    opensearch_security.session.keepalive: false