# ADFS SAML Authentication in Elastic Stack **URL:** \ **Category:** Elasticsearch\ **Created:** [April 23, 2018, 1:50pm UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127 "2018-04-23T13:50:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![soch234](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@soch234](https://discuss.elastic.co/u/soch234)\ **Post date:** [April 23, 2018, 1:50pm UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127/1 "2018-04-23T13:50:25Z")
Hi there, I've tested Kibana /Elasticsearch 6.2.4 SAML Authentication with MS ADFS and noticed a strange behavoir. The elasticsearch.yml file contains the following config: xpack.security.authc.realms.saml1: type: saml order: 1 idp.metadata.path: [https://adfs.fqdn.com/federationmetadata/2007-06/federationmetadata.xml](https://adfs.fqdn.com/federationmetadata/2007-06/federationmetadata.xml) idp.entity\_id: "[fqdn.com - This website is for sale! - fqdn Resources and Information.](http://adfs.fqdn.com/adfs/services/trust)" sp.entity\_id: "[https://kibana.fqdn.com/](https://kibana.fqdn.com/)" sp.acs: "[https://kibana.fqdn.com:443/api/security/v1/saml](https://kibana.fqdn.com:443/api/security/v1/saml)" sp.logout: "[https://kibana.fqdn.com/logout](https://kibana.fqdn.com/logout)" attributes.principal: "[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn)" If ADFS is configured to just send UPN from AD by using "Send LDAP Attributes as Claims" ADFS show up the follwing message in log: > The SAML authentication request had a NameID Policy that could not be satisfied. > Requestor: [https://kibana.fqdn.com/](https://kibana.fqdn.com/) > Name identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient > SPNameQualifier: > Exception details: > MSIS7070: The SAML request contained a NameIDPolicy that was not satisfied by the issued token. Requested NameIDPolicy: AllowCreate: False Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient SPNameQualifier: . Actual NameID properties: Format: , NameQualifier: SPNameQualifier: , SPProvidedId: . The Elasticsearch-Log shows up: > [WARN][o.e.x.s.a.AuthenticationService] [hostname] Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML Response is not a 'success' response: Code=urn:oasis:names:tc:SAML:2.0:status:Requester Message=null Detail=null]) If I also configure custom tranformation rules to also provide an nameid attribute described in the follwing article the login works correctly: [Name Identifiers in SAML assertions | Microsoft Learn](https://blogs.msdn.microsoft.com/card/2010/02/17/name-identifiers-in-saml-assertions/) Could it be, that the SAML-Plugin always requests the _urn:oasis:names:tc:SAML:2.0:nameid-format:transient SPNameQualifier_ attribute whether it is used within elasticsearch or not? If so it would be great if this could be fixed because ADFS would be much easier to configure if the attribute wouldn't be requested. Best regards ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 24, 2018, 5:21am UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127/2 "2018-04-24T05:21:44Z")
> [@soch234](#): > > SAML-Plugin always requests the urn:oasis:names:tc:SAML:2.0:nameid-format:transient SPNameQualifier attribute whether it is used within elasticsearch or not? Elasticsearch's SAML implementation always includes a NameIDPolicy in the AuthnRequest, although the format of that NameID is configurable. We _should_ provide a mechanism to disable the NameID policy entirely, but current versions do not offer that. ---
**Author:** ![soch234](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@soch234](https://discuss.elastic.co/u/soch234)\ **Post date:** [April 24, 2018, 6:41am UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127/3 "2018-04-24T06:41:05Z")
Thanks a lot TimV. Defining the nameid\_format is the solution. For everyone who is interested in my working ADFS elasticsearch.yml-Config: > #SAML Config > xpack.security.authc.token.enabled: true > xpack.security.authc.realms.native1: > type: native > order: 0 > xpack.security.authc.realms.saml1: > type: saml > order: 1 > idp.metadata.path: [https://adfs.fqdn.com/federationmetadata/2007-06/federationmetadata.xml](https://adfs.fqdn.com/federationmetadata/2007-06/federationmetadata.xml) > idp.entity\_id: "[fqdn.com - This website is for sale! - fqdn Resources and Information.](http://adfs.fqdn.com/adfs/services/trust)" > sp.entity\_id: "[https://kibana.fqdn.com/](https://kibana.fqdn.com/)" > sp.acs: "[https://kibana.fqdn.com/api/security/v1/saml](https://kibana.fqdn.com/api/security/v1/saml)" > sp.logout: "[https://kibana.fqdn.com/logout](https://kibana.fqdn.com/logout)" > attributes.principal: "nameid" > attributes.groups: "[http://schemas.microsoft.com/ws/2008/06/identity/claims/role](http://schemas.microsoft.com/ws/2008/06/identity/claims/role)" > nameid\_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Within in ADFS you only need to configure "Send LDAP Attributes as Claims" with an UPN or whatever you want as identifyer. I also send the LDAP-Attribute "Token-Groups - Unqualified Names" as role-claim to map my AD-groups within ES. Best regards. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 24, 2018, 6:49am UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127/4 "2018-04-24T06:49:33Z")
I'm glad that worked for you, and thanks for the followup - I'm sure your example config will be very helpful to others. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 22, 2018, 6:52am UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127/5 "2018-05-22T06:52:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.