# Cannot find metadata for entity \[...\] in SAML xml despite it being there **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 29, 2019, 3:12pm UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369 "2019-05-29T15:12:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Wolfie\_Venturi](https://avatars.discourse-cdn.com/v4/letter/w/e99b99/32.png) [@Wolfie\_Venturi](https://discuss.elastic.co/u/Wolfie_Venturi)\ **Post date:** [May 29, 2019, 3:12pm UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/1 "2019-05-29T15:12:08Z")
Hello, We have been trying to implement SAML authentication on our ELK stack. The kibana version is 6.7. Despite following the SAML configurations guide and double checking values we are encountering the following issue: The xml has been acquired from an Enterprise Application that is enabled for SAML single-sign on in our Azure environment. Google doesn't provide many answers. Any solutions or information would be greatly appreciated. ``` ... 6 more Caused by: org.elasticsearch.ElasticsearchSecurityException: Cannot find metadata for entity [https://sts.windows.net/2371b655-962f- at org.elasticsearch.xpack.security.authc.saml.SamlUtils.samlException(SamlUtils.java:105) ~[?:?] at org.elasticsearch.xpack.security.authc.saml.SamlRealm.resolveEntityDescriptor(SamlRealm.java:609) ~[?:?] at org.elasticsearch.xpack.security.authc.saml.SamlRealm.lambda$parseFileSystemMetadata$10(SamlRealm.java:601) ~[?:?] at org.elasticsearch.xpack.security.authc.saml.SamlRealm.getIdpConfiguration(SamlRealm.java:274) ~[?:?] at org.elasticsearch.xpack.security.authc.saml.SamlRealm.create(SamlRealm.java:199) ~[?:?] at org.elasticsearch.xpack.security.authc.InternalRealms.lambda$getFactories$5(InternalRealms.java:106) ~[?:?] at org.elasticsearch.xpack.security.authc.Realms.initRealms(Realms.java:192) ~[?:?] at org.elasticsearch.xpack.security.authc.Realms.(Realms.java:69) ~[?:?] at org.elasticsearch.xpack.security.Security.createComponents(Security.java:485) ~[?:?] at org.elasticsearch.xpack.security.Security.createComponents(Security.java:414) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:472) ~[elasticsearch-6.7.0.jar:6.7.0] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:267) ~[?:1.8.0_212] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_212] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:482) ~[?:1.8.0_212] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:472) ~[?:1.8.0_212] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_212] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_212] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_212] at org.elasticsearch.node.Node.(Node.java:475) ~[elasticsearch-6.7.0.jar:6.7.0] at org.elasticsearch.node.Node.(Node.java:266) ~[elasticsearch-6.7.0.jar:6.7.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:212) ~[elasticsearch-6.7.0.jar:6.7.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.7.0.jar:6.7.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) ~[elasticsearch-6.7.0.jar:6.7.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-6.7.0.jar:6.7.0] ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 29, 2019, 9:15pm UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/2 "2019-05-29T21:15:21Z")
Can you please share your saml realm configuration from elasticsearch.yml and the metadata file? Aldo please take s look at number 3 here : [https://www.elastic.co/guide/en/elastic-stack-overview/current/trb-security-saml.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/trb-security-saml.html) Finally, this line seems truncated ```auto Caused by: org.elasticsearch.ElasticsearchSecurityException: Cannot find metadata for entity [https://sts.windows.net/2371b655-962f- ``` Is it like this in your log or was this truncated on copy paste? ---
**Author:** ![Wolfie\_Venturi](https://avatars.discourse-cdn.com/v4/letter/w/e99b99/32.png) [@Wolfie\_Venturi](https://discuss.elastic.co/u/Wolfie_Venturi)\ **Post date:** [May 31, 2019, 7:49am UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/3 "2019-05-31T07:49:40Z")
The saml-metadata.xml is located in the /etc/elasticsearch, same folder as elasticsearch.yml. the line is only truncated in the copy/paste, i have obfuscated it here as well as include a "mydomain" alias in place of our actual dns. We've tried step 3 on the common issues aswell to no avail. ``` xpack.security.authc.realms.saml1: type: saml order: 2 idp.metadata.path: saml-metadata.xml idp.entity_id: "https://sts.windows.net/237####################" sp.entity_id: "https://mydomain.cloudapp.azure.com:5601" sp.acs: "https://mydomain.cloudapp.azure.com:5601/api/security/v1/saml" sp.logout: "https://mydomain.westeurope.cloudapp.azure.com:5601/logout" attributes.principal: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 3, 2019, 4:40pm UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/4 "2019-06-03T16:40:53Z")
> [@Wolfie\_Venturi](#): > > We've tried step 3 on the common issues aswell to no avail. Can you clarify what you have tried ? Is there an `` in the metadata of the Identity Provider ? Is it _exactly_ the same String as the one you have configured in `idp.entity_id:` ? ---
**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\ **Post date:** [June 4, 2019, 1:40am UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/5 "2019-06-04T01:40:49Z")
> [@Wolfie\_Venturi](#): > > idp.metadata.path: saml-metadata.xml Have you tried making this an absolute path i.e. ```yaml idp.metadata.path: /etc/elasticsearch/saml-metadata.xml ``` Also, does the `elasticsearch` user have necessary permissions to read this file? ---
**Author:** ![Wolfie\_Venturi](https://avatars.discourse-cdn.com/v4/letter/w/e99b99/32.png) [@Wolfie\_Venturi](https://discuss.elastic.co/u/Wolfie_Venturi)\ **Post date:** [June 4, 2019, 9:15am UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/6 "2019-06-04T09:15:09Z")
We solved the issue. It turns out there was a trailing "/" in the metadata file for the entityID value that we did not include in our SAML realm config. So it was not an exact match. Thanks for the help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 2, 2019, 9:15am UTC](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/7 "2019-07-02T09:15:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.