# An error occurred while enabling session management: Error: Failed when trying to obtain the endpoints from your IdP

**URL:** <https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993>\
**Category:** Kibana\
**Created:** [July 29, 2020, 4:37am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993 "2020-07-29T04:37:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kundan\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kundan_singh/32/51011_2.png) [@Kundan\_Singh](https://discuss.elastic.co/u/Kundan_Singh)\
**Post date:** [July 29, 2020, 4:37am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/1 "2020-07-29T04:37:33Z")

</div>

I am configuring kibana 7.2 with Single Sign-On with OpenID and Keycloak for https and its throwing error unable to obtain IDP endpoint.

Kibana.yml

```
# Kibana is served by a back end server. This setting specifies the port to use.

server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

# The default is 'localhost', which usually means remote machines will not be able to connect.

# To allow connections from remote users, set this parameter to a non-loopback address.

server.host: "0.0.0.0"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.

# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath

# from requests it receives, and to prevent a deprecation warning at startup.

# This setting cannot end in a slash.

#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with

# `server.basePath` or require that they are rewritten by your reverse proxy.

# This setting was effectively always `false` before Kibana 6.3 and will

# default to `true` starting in Kibana 7.0.

#server.rewriteBasePath: false

# The maximum payload size in bytes for incoming server requests.

#server.maxPayloadBytes: 1048576

# The Kibana server's name. This is used for display purposes.

#server.name: "your-hostname"

# The URLs of the Elasticsearch instances to use for all your queries.

elasticsearch.hosts: ["https://elastic_domain_name"]

# When this setting's value is true Kibana uses the hostname specified in the server.host

# setting. When the value of this setting is false, Kibana uses the hostname of the host

# that connects to this Kibana instance.

#elasticsearch.preserveHost: true

# Kibana uses an index in Elasticsearch to store saved searches, visualizations and

# dashboards. Kibana creates a new index if the index doesn't already exist.

#kibana.index: ".kibana"

# The default application to load.

#kibana.defaultAppId: "home"

# If your Elasticsearch is protected with basic authentication, these settings provide

# the username and password that the Kibana server uses to perform maintenance on the Kibana

# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which

# is proxied through the Kibana server.

#elasticsearch.username: "user"

#elasticsearch.password: "pass"

# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.

# These settings enable SSL for outgoing requests from the Kibana server to the browser.

#server.ssl.enabled: false

#server.ssl.certificate: /path/to/your/server.crt

#server.ssl.key: /path/to/your/server.key

# Optional settings that provide the paths to the PEM-format SSL certificate and key files.

# These files validate that your Elasticsearch backend uses the same key files.

#elasticsearch.ssl.certificate: /path/to/your/client.crt

#elasticsearch.ssl.key: /path/to/your/client.key

# Optional setting that enables you to specify a path to the PEM file for the certificate

# authority for your Elasticsearch instance.

#elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.

#elasticsearch.ssl.verificationMode: full

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of

# the elasticsearch.requestTimeout setting.

#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value

# must be a positive integer.

#elasticsearch.requestTimeout: 30000

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side

# headers, set this value to [] (an empty list).

#elasticsearch.requestHeadersWhitelist: [authorization]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten

# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.

#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.

#elasticsearch.shardTimeout: 30000

# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.

#elasticsearch.startupTimeout: 5000

# Logs queries sent to Elasticsearch. Requires logging.verbose set to true.

#elasticsearch.logQueries: false

# Specifies the path where Kibana creates the process ID file.

#pid.file: /var/run/kibana.pid

# Enables you specify a file where Kibana stores log output.

#logging.dest: stdout

# Set the value of this setting to true to suppress all logging output.

#logging.silent: false

# Set the value of this setting to true to suppress all logging output other than error messages.

#logging.quiet: false

# Set the value of this setting to true to log all events, including system usage information

# and all requests.

logging.verbose: true

# Set the interval in milliseconds to sample system and process performance

# metrics. Minimum is 100ms. Defaults to 5000.

#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.

#i18n.locale: "en"

elasticsearch.username: "kibanaserver"

elasticsearch.password: "kibanaserver"

elasticsearch.ssl.verificationMode: none

xpack.security.enabled: false

searchguard.multitenancy.enabled: true

searchguard.openid.connect_url: "https://keycloak_domain_name/auth/realms/kibana-realm/.well-known/openid-configuration"

searchguard.openid.client_id: "kibana-sso"

searchguard.openid.client_secret: " ***********************"

searchguard.openid.base_redirect_url: "https://kibana_domain_name/"

elasticsearch.requestHeadersWhitelist: ["Authorization", "sgtenant"]

#searchguard.basicauth.enabled: false

searchguard.auth.type: "openid"

#searchguard.jwt.enabled: true

#searchguard.jwt.url_param: jwtparam

#searchguard.jwt.header: jwtheader

xpack.monitoring.enabled: false

xpack.graph.enabled: false

xpack.ml.enabled: false

xpack.security.enabled: false

xpack.watcher.enabled: false

xpack.reporting.enabled: false

#sentinl configuration for email

sentinl:

es:

hosts: ["https://elastic_domain_name"]

settings:

email:

active: true

user: EMAIL

password: PASSWORD

host: smtp.gmail.com

port: 465

ssl: true

tls: false

#searchguard.openid.root_ca: "/home/smart/smart/certs/CACert.crt"

#searchguard.openid.verify_hostnames: false
```

---

<div class="post-metadata">

**Author:** ![Kundan\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kundan_singh/32/51011_2.png) [@Kundan\_Singh](https://discuss.elastic.co/u/Kundan_Singh)\
**Post date:** [July 29, 2020, 4:40am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/2 "2020-07-29T04:40:39Z")

</div>

sg\_config.yml

```
_sg_meta:
  type: "config"
  config_version: 2
sg_config:
  dynamic:
      http:
        anonymous_auth_enabled: false
        xff:
          enabled: false
          internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
          #internalProxies: '.*' # trust all internal proxies, regex pattern
          #remoteIpHeader: 'x-forwarded-for'
          ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
          ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
          ###### and here https://tools.ietf.org/html/rfc7239
          ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
      authc:
        openid_auth_domain:
          http_enabled: true
          transport_enabled: true
          order: 1
          http_authenticator:
            type: openid
            challenge: false
            config:
              subject_key: preferred_username
              roles_key: roles
              openid_connect_url: "https://domain_name/auth/realms/kibana-realm/.well-known/openid-configuration"
              #enable_ssl: false
              #verify_hosts: false
              #enable_ssl_client_auth: false
              #pemtrustedcas_filepath: "/home/smart/smart/CACert.crt"
              #pemcert_filepath: "/home/smart/smart/cert_name.crt"
              #pemkey_filepath: "/home/smart/smart/cert_name.crt.key"
          authentication_backend:
            type: noop
        kerberos_auth_domain: 
          http_enabled: false
          transport_enabled: false
          order: 6
          http_authenticator:
            type: kerberos # NOT FREE FOR COMMERCIAL USE
            challenge: true                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     
            config:                                                                                                                                                                                                                                                                                                                           
              # If true a lot of kerberos/security related debugging output will be logged to standard out
              krb_debug: false
              # If true then the realm will be stripped from the user name
              strip_realm_from_principal: true
          authentication_backend:
            type: noop
        basic_internal_auth_domain: 
          description: "Authenticate via HTTP Basic against internal users database"
          http_enabled: true
          transport_enabled: true
          order: 4
          http_authenticator:
            type: basic
            challenge: true
          authentication_backend:
            type: intern
        proxy_auth_domain:
          description: "Authenticate via proxy"
          http_enabled: false
          transport_enabled: false
          order: 3
          http_authenticator:
            type: proxy
            challenge: false
            config:
              user_header: "x-proxy-user"
              roles_header: "x-proxy-roles"
          authentication_backend:
            type: noop
        jwt_auth_domain:
          http_enabled: false
          transport_enabled: false
          order: 2
          http_authenticator:
            type: jwt
            challenge: false
            config:
              signing_key: |-
                -----BEGIN PUBLIC KEY-----
              key_conatct
               -----END PUBLIC KEY-----
              jwt_header: "Authorization"
              jwt_url_parameter: jwtparam
              roles_key: roles
              subject_key: preferred_username
          authentication_backend:
            type: noop
        clientcert_auth_domain:
          description: "Authenticate via SSL client certificates"
          http_enabled: false
          transport_enabled: false
          order: 2
          http_authenticator:
            type: clientcert 
            config:
              username_attribute: cn #optional, if omitted DN becomes username
            challenge: false
          authentication_backend:
            type: noop
        ldap:
          description: "Authenticate via LDAP or Active Directory"
          http_enabled: false
          transport_enabled: false
          order: 5
          http_authenticator:
            type: basic
            challenge: false
          authentication_backend:
            # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
            type: ldap # NOT FREE FOR COMMERCIAL USE
            config:
              # enable ldaps
              enable_ssl: false
              # enable start tls, enable_ssl should be false
              enable_start_tls: false
              # send client certificate
              enable_ssl_client_auth: false
              # verify ldap hostname
              verify_hostnames: true
              hosts:
                - localhost:8389
              bind_dn: null
              password: null
              userbase: 'ou=people,dc=example,dc=com'
              # Filter to search for users (currently in the whole subtree beneath userbase)
              # {0} is substituted with the username 
              usersearch: '(sAMAccountName={0})'
              # Use this attribute from the user as username (if not set then DN is used)
              username_attribute: null
      authz:    
        roles_from_myldap:
          description: "Authorize via LDAP or Active Directory"
          http_enabled: false
          transport_enabled: false
          authorization_backend:
            # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
            type: ldap # NOT FREE FOR COMMERCIAL USE
            config:
              # enable ldaps
              enable_ssl: false
              # enable start tls, enable_ssl should be false
              enable_start_tls: false
              # send client certificate
              enable_ssl_client_auth: false
              # verify ldap hostname
              verify_hostnames: true
              hosts:
                - localhost:8389
              bind_dn: null
              password: null
              rolebase: 'ou=groups,dc=example,dc=com'
        roles_from_another_ldap:
          description: "Authorize via another Active Directory"
          http_enabled: false
          transport_enabled: false
          authorization_backend:
            type: ldap # NOT FREE FOR COMMERCIAL USE
            #config goes here ...
  # auth_failure_listeners:
  # ip_rate_limiting:
  # type: ip
  # allowed_tries: 10
  # time_window_seconds: 3600
  # block_expiry_seconds: 600
  # max_blocked_clients: 100000
  # max_tracked_clients: 100000
  # internal_authentication_backend_limiting:
  # type: username
  # authentication_backend: intern        
  # allowed_tries: 10
  # time_window_seconds: 3600
  # block_expiry_seconds: 600
  # max_blocked_clients: 100000
  # max_tracked_clients: 100000
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 29, 2020, 4:40am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/3 "2020-07-29T04:40:55Z")

</div>

We can't provide support on searchguard sorry, it's a 3rd party plugin.

---

<div class="post-metadata">

**Author:** ![Kundan\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kundan_singh/32/51011_2.png) [@Kundan\_Singh](https://discuss.elastic.co/u/Kundan_Singh)\
**Post date:** [July 29, 2020, 4:49am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/4 "2020-07-29T04:49:02Z")

</div>

Hi [warkolm](https://discuss.elastic.co/u/warkolm)

I appreciate your quick response. So you are saying the issue is not related to kibana. [warkolm](https://discuss.elastic.co/u/warkolm) it possible to see the logs on the system level or specific plugin level.

Thanks  
kundan

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 29, 2020, 5:01am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/5 "2020-07-29T05:01:34Z")

</div>

The error it talking about the openid endpoint, and that would be searchguard trying to connect to it. Kibana logs are normally stored in `/var/log/kibana`.

Note - we also provide [free security](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free) controls for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2020, 5:01am UTC](https://discuss.elastic.co/t/an-error-occurred-while-enabling-session-management-error-failed-when-trying-to-obtain-the-endpoints-from-your-idp/242993/6 "2020-08-26T05:01:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.