1
realm: opensearch-realm
2
enabled: true
3
registrationAllowed: false
4
loginWithEmailAllowed: true
5
duplicateEmailsAllowed: false
6
resetPasswordAllowed: true
7
editUsernameAllowed: false
8
bruteForceProtected: true

1
opensearch.username: "kibanaserver"
2
opensearch.password: "kibanaserver"
3

4
# OIDC Configuration
5
opensearch_security.auth.type: "openid"
6
opensearch_security.openid.connect_url: "https://keycloak.example.com/auth/realms/opensearch-realm/.well-known/openid-configuration"
7
opensearch_security.openid.client_id: "opensearch-dashboards"
8
opensearch_security.openid.client_secret: "your-client-secret"
9
opensearch_security.openid.scope: "openid profile email"
10
opensearch_security.openid.header: "Authorization"
11
opensearch_security.openid.logout_url: "https://keycloak.example.com/auth/realms/opensearch-realm/protocol/openid-connect/logout"
12

13
# TLS Configuration
14
opensearch.ssl.certificateAuthorities:
15
  ["/usr/share/opensearch-dashboards/config/root-ca.pem"]
16
opensearch.ssl.verificationMode: certificate

1
const express = require("express");
2
const axios = require("axios");
3
const jwt = require("jsonwebtoken");
4
const app = express();
5

6
class SCIMBridge {
7
  constructor(config) {
8
    this.keycloakUrl = config.keycloakUrl;
9
    this.opensearchUrl = config.opensearchUrl;
10
    this.adminToken = config.adminToken;
11
  }
12

13
  // Handle Keycloak User Events
14
  async handleUserEvent(eventType, userData) {
15
    try {
16
      switch (eventType) {
17
        case "USER_CREATE":
18
          await this.createOpenSearchUser(userData);
19
          break;
20
        case "USER_UPDATE":
21
          await this.updateOpenSearchUser(userData);
22
          break;
23
        case "USER_DELETE":
24
          await this.deleteOpenSearchUser(userData);
25
          break;
26
      }
27
    } catch (error) {
28
      console.error(`Error handling ${eventType}:`, error);
29
    }
30
  }
31

32
  // Create User in OpenSearch
33
  async createOpenSearchUser(userData) {
34
    const userPayload = {
35
      password: this.generateTemporaryPassword(),
36
      backend_roles: this.mapKeycloakRolesToOpenSearch(userData.roles),
37
      attributes: {
38
        email: userData.email,
39
        firstName: userData.firstName,
40
        lastName: userData.lastName,
41
        keycloakId: userData.id,
42
      },
43
    };
44

45
    const response = await axios.put(
46
      `${this.opensearchUrl}/_plugins/_security/api/internalusers/${userData.username}`,
47
      userPayload,
48
      {
49
        headers: {
50
          Authorization: `Bearer ${this.adminToken}`,
51
          "Content-Type": "application/json",
52
        },
53
      }
54
    );
55

56
    console.log(`Created OpenSearch user: ${userData.username}`);
57
    return response.data;
58
  }
59

60
  // Update User in OpenSearch
61
  async updateOpenSearchUser(userData) {
62
    const updatePayload = [
63
      {
64
        op: "replace",
65
        path: "/backend_roles",
66
        value: this.mapKeycloakRolesToOpenSearch(userData.roles),
67
      },
68
      {
69
        op: "replace",
70
        path: "/attributes",
71
        value: {
72
          email: userData.email,
73
          firstName: userData.firstName,
74
          lastName: userData.lastName,
75
          keycloakId: userData.id,
76
        },
77
      },
78
    ];
79

80
    const response = await axios.patch(
81
      `${this.opensearchUrl}/_plugins/_security/api/internalusers/${userData.username}`,
82
      updatePayload,
83
      {
84
        headers: {
85
          Authorization: `Bearer ${this.adminToken}`,
86
          "Content-Type": "application/json",
87
        },
88
      }
89
    );
90

91
    console.log(`Updated OpenSearch user: ${userData.username}`);
92
    return response.data;
93
  }
94

95
  // Delete User from OpenSearch
96
  async deleteOpenSearchUser(userData) {
97
    const response = await axios.delete(
98
      `${this.opensearchUrl}/_plugins/_security/api/internalusers/${userData.username}`,
99
      {
100
        headers: {
101
          Authorization: `Bearer ${this.adminToken}`,
102
        },
103
      }
104
    );
105

106
    console.log(`Deleted OpenSearch user: ${userData.username}`);
107
    return response.data;
108
  }
109

110
  // Map Keycloak roles to OpenSearch backend roles
111
  mapKeycloakRolesToOpenSearch(keycloakRoles) {
112
    const roleMapping = {
113
      opensearch_admin: ["all_access"],
114
      opensearch_user: ["readall"],
115
      opensearch_readonly: ["readall_and_monitor"],
116
      kibana_user: ["kibana_user"],
117
    };
118

119
    const mappedRoles = [];
120
    keycloakRoles.forEach(role => {
121
      if (roleMapping[role]) {
122
        mappedRoles.push(...roleMapping[role]);
123
      }
124
    });
125

126
    return [...new Set(mappedRoles)]; // Remove duplicates
127
  }
128

129
  generateTemporaryPassword() {
130
    return (
131
      Math.random().toString(36).slice(-12) +
132
      Math.random().toString(36).slice(-12).toUpperCase() +
133
      "!@#"
134
    );
135
  }
136
}
137

138
// Webhook endpoint for Keycloak events
139
app.post("/webhook/keycloak", async (req, res) => {
140
  try {
141
    const event = req.body;
142
    const bridge = new SCIMBridge({
143
      keycloakUrl: process.env.KEYCLOAK_URL,
144
      opensearchUrl: process.env.OPENSEARCH_URL,
145
      adminToken: process.env.OPENSEARCH_ADMIN_TOKEN,
146
    });
147

148
    await bridge.handleUserEvent(event.type, event.user);
149
    res.status(200).json({ status: "success" });
150
  } catch (error) {
151
    console.error("Webhook error:", error);
152
    res.status(500).json({ error: error.message });
153
  }
154
});
155

156
module.exports = SCIMBridge;

1
version: "3.8"
2
services:
3
  keycloak:
4
    image: quay.io/keycloak/keycloak:23.0
5
    environment:
6
      - KEYCLOAK_ADMIN=admin
7
      - KEYCLOAK_ADMIN_PASSWORD=admin
8
      - KC_DB=postgres
9
      - KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
10
      - KC_DB_USERNAME=keycloak
11
      - KC_DB_PASSWORD=password
12
    ports:
13
      - "8080:8080"
14
    depends_on:
15
      - postgres
16
    command: start-dev
17

18
  opensearch:
19
    image: opensearchproject/opensearch:2.11.0
20
    environment:
21
      - cluster.name=opensearch-cluster
22
      - node.name=opensearch-node1
23
      - discovery.seed_hosts=opensearch-node1
24
      - cluster.initial_cluster_manager_nodes=opensearch-node1
25
      - bootstrap.memory_lock=true
26
      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
27
      - plugins.security.ssl.transport.pemcert_filepath=esnode.pem
28
      - plugins.security.ssl.transport.pemkey_filepath=esnode-key.pem
29
      - plugins.security.ssl.http.enabled=true
30
      - plugins.security.ssl.http.pemcert_filepath=esnode.pem
31
      - plugins.security.ssl.http.pemkey_filepath=esnode-key.pem
32
    ulimits:
33
      memlock:
34
        soft: -1
35
        hard: -1
36
    ports:
37
      - "9200:9200"
38
      - "9600:9600"
39
    volumes:
40
      - opensearch-data:/usr/share/opensearch/data
41
      - ./certificates:/usr/share/opensearch/config/certificates
42

43
  opensearch-dashboards:
44
    image: opensearchproject/opensearch-dashboards:2.11.0
45
    ports:
46
      - "5601:5601"
47
    environment:
48
      - OPENSEARCH_HOSTS=["https://opensearch:9200"]
49
    depends_on:
50
      - opensearch
51
    volumes:
52
      - ./opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
53

54
  scim-bridge:
55
    build: ./scim-bridge
56
    environment:
57
      - KEYCLOAK_URL=http://keycloak:8080
58
      - OPENSEARCH_URL=https://opensearch:9200
59
      - OPENSEARCH_ADMIN_TOKEN=${OPENSEARCH_ADMIN_TOKEN}
60
    ports:
61
      - "3000:3000"
62
    depends_on:
63
      - keycloak
64
      - opensearch
65

66
  postgres:
67
    image: postgres:15
68
    environment:
69
      - POSTGRES_DB=keycloak
70
      - POSTGRES_USER=keycloak
71
      - POSTGRES_PASSWORD=password
72
    volumes:
73
      - postgres-data:/var/lib/postgresql/data
74

75
volumes:
76
  opensearch-data:
77
  postgres-data: