Session.ttl is ignored with SAML Integration

[TPuschl]

Hi,

we are using opendistor docker images 1.12 and made a SAML Integration. However the kibana setting "opendistro_security.session.ttl" to set the default logout time from 1h to 8h is simply ignored. We have to relogin every hour. Below are more Details regaridng version and Configuration.

Thx Thomas

amazon/opendistro-for-elasticsearch:1.12.0 amazon/opendistro-for-elasticsearch-kibana:1.12.0

securityconfig.yml: .... saml_auth: order: 1 description: "SAML provider"

elasticsearch.yml: ... opendistro_security.auth.type: "saml" opendistro_security.session.ttl: 28800000 opendistro_security.cookie.ttl: 28800000

[albgus]

I am seeing this issue as well. It is highly annoying because it resets the entire session, the search and all search filters every time it goes through the login process..

[gnan-mw]

This is what I tried for the non-docker version and it worked.

      saml_auth_domain:
        http_enabled: true
        transport_enabled: false
        order: 1
        http_authenticator:
          type: saml
          challenge: true
          config:
            idp:
              metadata_url: ...
              entity_id: ...
            sp:
              entity_id: ...
              forAuthn: false
            kibana_url: ...
            exchange_key: ....
            jwt:
              # 24 hours
              expiry: NOW+1440

Reference: https://github.com/opendistro-for-elasticsearch/security/blob/c0b1bacc923891c43d92365d48585bd2ff55b7ec/src/main/java/com/amazon/dlic/auth/http/saml/AuthTokenProcessorHandler.java#L330

[TPuschl]

@gnan-mw : Thx a lot the setting "jwt: expiry NOW+1440" resolved the issue. I added this setting into the security.yml file and loaded the new security setting into the cluster security config via the securityadmin.sh based on the documentation. Worked fine also in a docker environment