[BUG] auth/http/saml/Saml2SettingsProvider.java still using _opendistro/ instead of _plugins/

[kzinas-adv]

What is the bug?
A clear and concise description of the bug.
opensearch-project/security-dashboards-plugin in version 2.1.0 changed SAML2 authentication endpoint to _plugins/_security/saml/acs
while opensearch-project/security use old one /_opendistro/_security/saml/acs
This creates clash as users need modify this place by hand to get SAML working.

How can one reproduce the bug?
Steps to reproduce the behavior:
Use opensearch 2.1.0 with SAML

What is the expected behavior?
A clear and concise description of what you expected to happen.
Get opensearch 2.2.0 working out of the box.

security-dashboards-plugin BUG issue:
opensearch-project/security-dashboards-plugin#1031

[kzinas-adv]

Would it be enough such patch?

diff --git a/src/main/java/com/amazon/dlic/auth/http/saml/Saml2SettingsProvider.java b/src/main/java/com/amazon/dlic/auth/http/saml/Saml2SettingsProvider.java
index 52745695..3bd0b7cc 100644
--- a/src/main/java/com/amazon/dlic/auth/http/saml/Saml2SettingsProvider.java
+++ b/src/main/java/com/amazon/dlic/auth/http/saml/Saml2SettingsProvider.java
@@ -214,9 +214,9 @@ public class Saml2SettingsProvider {
     private String buildAssertionConsumerEndpoint(String dashboardsRoot) {
 
         if (dashboardsRoot.endsWith("/")) {
-            return dashboardsRoot + "_opendistro/_security/saml/acs";
+            return dashboardsRoot + "_plugins/_security/saml/acs";
         } else {
-            return dashboardsRoot + "/_opendistro/_security/saml/acs";
+            return dashboardsRoot + "/_plugins/_security/saml/acs";
         }
     }

[kzinas-adv]

Will be fixed once PR #1936 will be commited

[peternied]

Lets put some more attention back onto this issue during the triage meeting. All the history boils down to we need to make this change backwards compatible with both paths and when it was originally rolled out it wasn't compatible

[stephen-crawford]

[Triage] This issue should be reviewed again since it is not currently backwards compatible. Let's have someone pick up the issue to become BWC.

[peternied]

@RyanL1997 You might want to look into multiple endpoints, seems like it is supported in SAML 2.0 [1] [2].

• [1] https://stackoverflow.com/q/28659811/533057
• [2] https://stackoverflow.com/q/39567112/533057

[RyanL1997]

Update on Aug/30/2023

Transferring the internal discussion result here: security team decided to deprecate all the legacy prefix thats related to SAML usages all at once at the next major version. Plz use the issue (#3271) for better tracking.