# Azure Saml SSO

**URL:** <https://discuss.elastic.co/t/azure-saml-sso/308594>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [June 30, 2022, 2:05pm UTC](https://discuss.elastic.co/t/azure-saml-sso/308594 "2022-06-30T14:05:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Keemtaker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keemtaker/32/107773_2.png) [@Keemtaker](https://discuss.elastic.co/u/Keemtaker)\
**Post date:** [June 30, 2022, 2:05pm UTC](https://discuss.elastic.co/t/azure-saml-sso/308594/1 "2022-06-30T14:05:54Z")

</div>

I am trying to setup Single Sign-On for an instance by following this [guide](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-saml-azure.html) .

I am encountering the error '_You do not have permission to access the requested page_'. I have a feeling it has to do with the role mappings. I actually do not understand how it works so I did not alter or set any role mappings. The instance currently uses LDAP and we want to change to saml sso. I will appreciate any help on this.

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [June 30, 2022, 2:39pm UTC](https://discuss.elastic.co/t/azure-saml-sso/308594/2 "2022-06-30T14:39:45Z")

</div>

cc @Larry_Gregory can throw more light on this when he has some time.

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [June 30, 2022, 5:10pm UTC](https://discuss.elastic.co/t/azure-saml-sso/308594/3 "2022-06-30T17:10:24Z")

</div>

> [@Keemtaker](#):
>
> I am encountering the error '_You do not have permission to access the requested page_'. I have a feeling it has to do with the role mappings. I actually do not understand how it works so I did not alter or set any role mappings. The instance currently uses LDAP and we want to change to saml sso. I will appreciate any help on this.

Hey @Keemtaker, welcome to the discussion boards! Yes, this error message means that you were able to successfully _authenticate_ to Kibana, but your account failed our base _authorization_ checks. This typically means that either:

1. Role mappings are incorrect/missing
2. Roles are mapped correctly, but the roles do not grant access to Kibana

Since you didn't alter or set any role mappings, I'm guessing that's where we should look next. We have a guide on creating role mappings for SAML users here, which also explains why they are necessary, and what function they perform: [Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/saml-guide-stack.html#saml-role-mapping).

I'm happy to help further, but it's hard to offer more concrete guidance without more information. Let me know how you make out with this guide, and I can answer any specific questions you have from there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2022, 5:10pm UTC](https://discuss.elastic.co/t/azure-saml-sso/308594/4 "2022-07-28T17:10:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.