Can't start elasticsearch with config saml

Elastic Stack Elasticsearch
1

Hi, we are trying configure ELK with SAML (with ADFS) but when we add the realm configuration to elasticsearch.yml we get the following error.

Elasticseach.yml

bootstrap.memory_lock: false
cluster.name: elasticsearch
http.port: 9200
node.data: true
node.ingest: true
node.master: true
node.name: ABC
path.data: C:\ProgramData\Elastic\Elasticsearch\data
path.logs: C:\ProgramData\Elastic\Elasticsearch\logs
transport.tcp.port: 9300
xpack.license.self_generated.type: trial
xpack.security.authc.token.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/elastic-stack-ca.p12
xpack.security.http.ssl.truststore.path: certs/elastic-stack-ca.p12

xpack.security.authc.realms.saml1:
attributes.principal: "nameid:persistent"
type: saml
idp.entity_id: http://xxxxx/adfs/services/trust
idp.metadata.path: saml/metadata.xml
order: 0
sp.acs: https://127.0.0.1:5601/api/security/v1/saml
sp.entity_id: https://127.0.0.1:5601/
sp.logout: https://127.0.0.1:5601/logout

Error
Failed to instantiate SLF4J LoggerFactory
Reported exception:
java.lang.NoClassDefFoundError: org/apache/log4j/Level
at org.slf4j.LoggerFactory.bind(LoggerFactory.java:150)
at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124)
at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:412)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:357)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:383)
at org.opensaml.core.config.InitializationService.getLogger(InitializationService.java:83)
at org.opensaml.core.config.InitializationService.initialize(InitializationService.java:46)
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.lambda$initialize$0(SamlUtils.java:100)
at java.security.AccessController.doPrivileged(Native Method)
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.initialize(SamlUtils.java:97)
at org.elasticsearch.xpack.security.authc.saml.SamlRealm.create(SamlRealm.java:185)
at org.elasticsearch.xpack.security.authc.InternalRealms.lambda$getFactories$5(InternalRealms.java:119)
at org.elasticsearch.xpack.security.authc.Realms.initRealms(Realms.java:189)
at org.elasticsearch.xpack.security.authc.Realms.(Realms.java:75)
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:446)
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:377)
[ at org.elasticsearch.node.Node.lambda$new$7(Node.java:397)
2018-04-10T14:54:22,546] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:267)
[ERROR at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382)
][ at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
o.e.b.ElasticsearchUncaughtExceptionHandler] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
[x at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708)
] fatal error in thread at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
[main at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499)
], exiting at org.elasticsearch.node.Node.(Node.java:400)

2

Hi,

Can you please share your Elasticsearch and exact windows OS version ?

3

Elasticsearch 6.2.3
Microsoft Windows PRO [version 10.0.16299.309] 64bits

4

Hi again,

Please note that Windows 10 is not one of the supported platforms . This is strange as log4j should be in your classpath. Can you restart Elasticsearch and share the starting part of the log and at least the whole stacktrace from that specific exception ?

1 Like
5

λ elasticsearch.exe
[2018-04-10T15:59:59,509][INFO ][o.e.n.Node ] [PC] initializing ...
[2018-04-10T15:59:59,607][INFO ][o.e.e.NodeEnvironment ] [PC] using [1] data paths, mounts [[System (C:)]], net usable_space [32.8gb], net total_space [118.7gb], types [NTFS]
[2018-04-10T15:59:59,608][INFO ][o.e.e.NodeEnvironment ] [PC] heap size [1.9gb], compressed ordinary object pointers [true]
[2018-04-10T16:00:00,008][INFO ][o.e.n.Node ] [PC] node name [PC], node ID [QwwlmWafQ2SZBn4yP90WZw]
[2018-04-10T16:00:00,008][INFO ][o.e.n.Node ] [PC] version[6.2.3], pid[20648], build[c59ff00/2018-03-13T10:06:29.741383Z], OS[Windows 10/10.0/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_161/25.161-b12]
[2018-04-10T16:00:00,009][INFO ][o.e.n.Node ] [PC] JVM arguments [-XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=${ES_TMPDIR}, -XX:+HeapDumpOnOutOfMemoryError, -Xmx2048m, -Xms2048m, -Delasticsearch, -Des.path.home=C:\Program Files\Elastic\Elasticsearch\6.2.3, -Des.path.conf=C:\ProgramData\Elastic\Elasticsearch\config]
[2018-04-10T16:00:04,749][INFO ][o.e.p.PluginsService ] [PC] loaded module [aggs-matrix-stats]
[2018-04-10T16:00:04,749][INFO ][o.e.p.PluginsService ] [PC] loaded module [analysis-common]
[2018-04-10T16:00:04,749][INFO ][o.e.p.PluginsService ] [PC] loaded module [ingest-common]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [lang-expression]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [lang-mustache]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [lang-painless]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [mapper-extras]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [parent-join]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [percolator]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [rank-eval]
[2018-04-10T16:00:04,750][INFO ][o.e.p.PluginsService ] [PC] loaded module [reindex]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded module [repository-url]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded module [transport-netty4]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded module [tribe]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-core]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-deprecation]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-graph]
[2018-04-10T16:00:04,751][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-logstash]
[2018-04-10T16:00:04,752][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-ml]
[2018-04-10T16:00:04,752][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-monitoring]
[2018-04-10T16:00:04,752][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-security]
[2018-04-10T16:00:04,752][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-upgrade]
[2018-04-10T16:00:04,752][INFO ][o.e.p.PluginsService ] [PC] loaded plugin [x-pack-watcher]
[2018-04-10T16:00:11,074][INFO ][o.e.x.m.j.p.l.CppLogMessageHandler] [controller/18164] [Main.cc@128] controller (64 bit): Version 6.2.3 (Build e43a9a2b267ef4) Copyright (c) 2018 Elasticsearch BV
Failed to instantiate SLF4J LoggerFactory
Reported exception:
java.lang.NoClassDefFoundError: org/apache/log4j/Level
at org.slf4j.LoggerFactory.bind(LoggerFactory.java:150)
at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124)
at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:412)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:357)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:383)
at org.opensaml.core.config.InitializationService.getLogger(InitializationService.java:83)
at org.opensaml.core.config.InitializationService.initialize(InitializationService.java:46)
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.lambda$initialize$0(SamlUtils.java:100)
at java.security.AccessController.doPrivileged(Native Method)
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.initialize(SamlUtils.java:97)
at org.elasticsearch.xpack.security.authc.saml.SamlRealm.create(SamlRealm.java:185)
at org.elasticsearch.xpack.security.authc.InternalRealms.lambda$getFactories$5(InternalRealms.java:119)
at org.elasticsearch.xpack.security.authc.Realms.initRealms(Realms.java:189)
at org.elasticsearch.xpack.security.authc.Realms.(Realms.java:75)
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:446)
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:377)
at org.elasticsearch.node.Node.lambda$new$7(Node.java:397)
at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:267)
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382)
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708)
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499)
at org.elasticsearch.node.Node.(Node.java:400)
at org.elasticsearch.node.Node.(Node.java:246)
at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:213)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323)
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121)
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85)

6

[Caused by: java.lang.ClassNotFoundException: org.apache.log4j.Level
2018-04-10T16:00:11,728 at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
][ERROR at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
] at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
[o.e.b.ElasticsearchUncaughtExceptionHandler ... 36 more
] [PC] fatal error in thread [main], exiting
java.lang.NoClassDefFoundError: org/apache/log4j/Level
at org.slf4j.LoggerFactory.bind(LoggerFactory.java:150) ~[slf4j-api-1.7.25.jar:1.7.25]
at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124) ~[slf4j-api-1.7.25.jar:1.7.25]
at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:412) ~[slf4j-api-1.7.25.jar:1.7.25]
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:357) ~[slf4j-api-1.7.25.jar:1.7.25]
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:383) ~[slf4j-api-1.7.25.jar:1.7.25]
at org.opensaml.core.config.InitializationService.getLogger(InitializationService.java:83) ~[?:?]
at org.opensaml.core.config.InitializationService.initialize(InitializationService.java:46) ~[?:?]
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.lambda$initialize$0(SamlUtils.java:100) ~[?:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_161]
at org.elasticsearch.xpack.security.authc.saml.SamlUtils.initialize(SamlUtils.java:97) ~[?:?]
at org.elasticsearch.xpack.security.authc.saml.SamlRealm.create(SamlRealm.java:185) ~[?:?]
at org.elasticsearch.xpack.security.authc.InternalRealms.lambda$getFactories$5(InternalRealms.java:119) ~[?:?]
at org.elasticsearch.xpack.security.authc.Realms.initRealms(Realms.java:189) ~[?:?]
at org.elasticsearch.xpack.security.authc.Realms.(Realms.java:75) ~[?:?]
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:446) ~[?:?]
at org.elasticsearch.xpack.security.Security.createComponents(Security.java:377) ~[?:?]
at org.elasticsearch.node.Node.lambda$new$7(Node.java:397) ~[elasticsearch-6.2.3.jar:6.2.3]
at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:267) ~[?:1.8.0_161]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1382) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471) ~[?:1.8.0_161]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_161]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_161]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_161]
at org.elasticsearch.node.Node.(Node.java:400) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.node.Node.(Node.java:246) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:213) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.2.3.jar:6.2.3]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-6.2.3.jar:6.2.3]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~[elasticsearch-6.2.3.jar:6.2.3]
Caused by: java.lang.ClassNotFoundException: org.apache.log4j.Level
at java.net.URLClassLoader.findClass(URLClassLoader.java:381) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:424) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_161]
... 36 more

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.