# Azure active directory integration with elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 17, 2019, 10:28am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023 "2019-10-17T10:28:21Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 17, 2019, 10:28am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/1 "2019-10-17T10:28:22Z")
Hello, I have elasticsearch server hosted on virtual machine in azure cloud. I have an azure default directory and users added to it. I want to login to elasticsearch using credentials for the users in active directory. I tried the setup by adding realm in elasticsearch configuration as given below but unable to achieve it. Getting > An error occurred while attempting to establish a connection to server [detaropwmail2com.onmicrosoft.com/127.0.0.1:636:](http://detaropwmail2com.onmicrosoft.com/127.0.0.1:636:) ConnectException(Connection refused), ldapSDKVersion=4.0.8, revision=28812 config xpack: security: authc: realms: active\_directory: my\_ad: order: 0 domain\_name: [detaropwmail2com.onmicrosoft.com](http://detaropwmail2com.onmicrosoft.com) url: ldap://detaropwmail2com.onmicrosoft.com:636 ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 17, 2019, 10:50am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/2 "2019-10-17T10:50:47Z")
Elasticsearch can't connect to your LDAP server at the URL you configured it to do so. - Is this the correct hostname ? - Is this the correct port and protocol ? `636` is most commonly used for ldap over TLS (ldaps), but you have `ldap://` there instead - Is there network connectivity between your Azure VM where elastocsearch runs and your azure directory server ? ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 17, 2019, 11:16am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/3 "2019-10-17T11:16:29Z")
1. I tried using default url but same error(i.e without specifying url in config) 2. [detaropwmail2com.onmicrosoft.com](http://detaropwmail2com.onmicrosoft.com) this is the domain displayed on active directory defaults directory page 3. As of now I don't have any idea about connectivity between elasticsearch server and active directory server, can you guide me how to establish that? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 17, 2019, 11:41am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/4 "2019-10-17T11:41:10Z")
This is information specific to your Azure VM and Azure Active Directory and I'm afraid I can't be much of help as I'm not familiar. I'd try and figure out what the URL for accessing your "active directory defaults directory" either from Azure documentation or their support. Once you have this, you can check connectivity with a simple test, `curl` handles `ldap(s)://` URLs, you could for example do a ```auto curl ldap://: ``` and see if this fails or not. ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 17, 2019, 11:47am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/5 "2019-10-17T11:47:05Z")
Thanks @ikakavas will check it ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 22, 2019, 9:48am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/6 "2019-10-22T09:48:24Z")
I am able to authenticate the user but not the role assigned to it in role\_mapping.yml file. Getting following error > {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [sanket07@detaropwmail2com.onmicrosoft.com]"}],"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [sanket07@detaropwmail2com.onmicrosoft.com]"},"status":403} AD Domain service : pros\*.onmicrosoft.com Azure AD default : [detaropwmail2com.onmicrosoft.com](http://detaropwmail2com.onmicrosoft.com) users: name: sanket username: sanket07 role\_mapping.yml ``` superuser: - "cn=sanket07,dc=prospera,dc=onmicrosoft,dc=com" ``` elasticsearch.yml ``` xpack: security: authc: realms: active_directory: my_ad: order: 0 domain_name: prospera.onmicrosoft.com files: role_mapping: "/etc/elasticsearch/role_mapping.yml" ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 22, 2019, 10:06am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/7 "2019-10-22T10:06:43Z")
I can only imagine that the DN of your user in your AD is _not_ `cn=sanket07,dc=prospera,dc=onmicrosoft,dc=com`. You need to figure out what the DN of your user is and use that in the configuration. The easiest way to do this is from within your Active Directory instance, so please try this first. If you can't figure this out from AD, then you could [enable extra logging](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/logging.html#configuring-logging-levels) in elasticsearch and specifically set ```auto org.elasticsearch.xpack.security.authc.support.mapper ``` and ```auto org.elasticsearch.xpack.security.authc.ldap ``` to `TRACE` and look at the Elasticsearch logs, as these will contain the information retrieved for your user from AD ( and the DN among them ) ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 22, 2019, 10:37am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/8 "2019-10-22T10:37:48Z")
Thanks a ton @ikakavas!!! Enabled the logs and found out the correct DN It worked!!👍 ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 23, 2019, 7:23am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/9 "2019-10-23T07:23:19Z")
Hi, any idea of integrating azure b2c active directory with elasticsearch?? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 23, 2019, 7:46am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/10 "2019-10-23T07:46:53Z")
Hi, I have no idea what this question means. Please add necessary information and details in your questions, this will make it considerably easier for people in these forums to assist you. - What is `b2c active directory` ? - What do you mean by "integrating" ? ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 23, 2019, 8:44am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/11 "2019-10-23T08:44:10Z")
B2C active directory allows users to login using identity providers like amazon, facebook etc. I want to authenticate elasticsearch using these accounts and not the predefined users as I did it in active directory ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 23, 2019, 8:58am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/12 "2019-10-23T08:58:17Z")
It looks like Azure AD B2C can operate as an OpenID Connect Provider, so it looks like you could Elasticsearch's OpenID Connect authentication realm for this ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 31, 2019, 11:47am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/13 "2019-10-31T11:47:05Z")
Now i am able to redirect kibana to login page but getting below error in elasticsearch logs `[Elasticsearch] Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML content is in-response-to _a5e013e54993435826399194d0d04aa0b87d685f but expected one of [_08363809bbcab6ae5fd6f32673a3eea7b38bec09] ])` ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 31, 2019, 12:32pm UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/14 "2019-10-31T12:32:41Z")
`[WARN][o.e.x.s.a.AuthenticationService] [Elasticsearch] Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[Failed to parse SAML message]; nested: SAXParseException[cvc-complex-type.2.4.a: Invalid content was found starting with element 'IsPolicySpecificError'. One of '{"urn:oasis:names:tc:SAML:2.0:protocol":StatusDetail}' is expected.];)` After enabling trace logs ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [October 31, 2019, 12:34pm UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/15 "2019-10-31T12:34:57Z")
What should be the reply URL set to for the elasticsearch application in azure? current reply urls: | [https://52.186.177.140:5601/](https://52.186.177.140:5601/) | | | --- | --- | | [https://52.186.177.140:5601/api/security/v1/saml](https://52.186.177.140:5601/api/security/v1/saml) | | ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2019, 2:20pm UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/16 "2019-10-31T14:20:48Z")
> [@sanket07](#): > > After enabling trace logs You should share a larger part of the logs, preferably one that contains the message the Azure AD is sending , but this doesn't look like a SAML Response > [@sanket07](#): > > What should be the reply URL set to for the elasticsearch application in azure? I have no idea what `reply URL` is in the context of the "elasticsearch application in Azure" so I can't help with that. If you want to share more details and information we might get to the bottom of this, but this is not a standard piece of information we have the answer for ready.. ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [November 1, 2019, 6:40am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/17 "2019-11-01T06:40:32Z")
This is the log generated when I try to signup , user is registered in active directory but getting unable to authenticate user error on kibana dashboard ``` [2019-11-01T06:33:25,613][TRACE][o.e.x.s.a.s.SamlRealm] [Elasticsearch] Constructed SAML Authentication Request: https://52.186.177.140:5601/ ``` If i try to use exsting credentials then i get invalid username or password and no logs are generated ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [November 1, 2019, 6:43am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/18 "2019-11-01T06:43:18Z")
``` xpack.security.authc.realms: saml: saml1: order: 0 idp.metadata.path: "https://elasticsso.b2clogin.com/elasticsso.onmicrosoft.com/B2C_1A_signup_signin_SAML/Samlp/metadata" idp.entity_id: "https://elasticsso.b2clogin.com/elasticsso.onmicrosoft.com/B2C_1A_signup_signin_SAML" sp.entity_id: "https://52.186.177.140:5601/" sp.acs: "https://52.186.177.140:5601/api/security/v1/saml" sp.logout: "https://52.186.177.140:5601/logout" attributes.principal: "email:persistent" ``` I am unable to figure out the significance of **attributes.principal** attribute and from where to get the value for that attribute? ---
**Author:** ![sanket07](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Post date:** [November 1, 2019, 9:22am UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/19 "2019-11-01T09:22:40Z")
Hi @ikakavas Now i am able to authenticate using saml realm but getting 403 forbidden error as roles are not assigned. How to assign roles as I can't use the api for role mapping as the elastic user won't work now? Do i need to disable realm, add role mapping and then again enable realm? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 2, 2019, 12:20pm UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023/20 "2019-11-02T12:20:19Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-kibana.html#saml-kibana-basic](https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-kibana.html#saml-kibana-basic) [Next page](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023.md?page=2)