# ECE - SAML integration error **URL:** \ **Category:** Elastic Cloud Enterprise (ECE)\ **Created:** [May 10, 2019, 7:54pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616 "2019-05-10T19:54:33Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 10, 2019, 7:54pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/1 "2019-05-10T19:54:33Z")
Hello, I am trying to setup a SAML integration between ECE and PingFedaration. I have setup the new SAML provider and I get the following error: `Authentication cluster failed to process the request Message: Authentication cluster failed the request. Status: [500]; Data: [{\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL= **http** ://xxxxxx.com:12443/api/v1/users/auth/saml/_callback}]\"}],\"type\":\"security_exception\",\"reason\":\"Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL= **http** ://xxxxxx.com:12443/api/v1/users/auth/saml/_callback}]\"},\"status\":500}]` The odd thing is that the URL is showing as HTTP whereas I set the HTTPS one. I'm guessing that's the issue? Below my settings: **Assertion consumer service URL** : [https://xxxxxx.com:12443/api/security/v1/saml](https://xxxxxx.com:12443/api/security/v1/saml) (URL of admin console) **Logout URL** : [https://xxxxxx.com:12443/api/v1/users/auth/\_logout](https://xxxxxx.com:12443/api/v1/users/auth/_logout) (URL of admin console) Other settings are private and will not share, most likely not relevant. Thank you. ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 10, 2019, 8:18pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/2 "2019-05-10T20:18:03Z")
We're looking into this. In the meantime, if you look at the advanced editor for the security deployment, you should see all those settings mirrored in the "Plan" section - can you sanitize and share them? ---
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 13, 2019, 12:53pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/3 "2019-05-13T12:53:15Z")
@Alex_Piggott find the settings below: ``` "user_settings_override_json": { "xpack": { "watcher": { "enabled": false }, "security": { "audit": { "enabled": true }, "authc": { "realms": { "found": { "type": "file", "order": 0 }, "native": { "type": "native", "order": 1 }, "saml": { "force_authn": false, "enabled": true, "attributes": { "principal": "principal", "groups": "groups" }, "idp": { "entity_id": "https://xxxxxx.com", "use_single_logout": true, "metadata": { "path": "https://xxxxxx/ECE_Prod_Metadata.xml" } }, "order": 2, "type": "saml", "sp": { "entity_id": "xxxxxx", "acs": "https://xxxxxx.com:12443/api/security/v1/saml", "logout": "https://xxxxxx.com:12443/api/v1/users/auth/_logout" } } } } } } } ``` ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 14, 2019, 1:30pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/4 "2019-05-14T13:30:49Z")
OK so the cluster is correctly configured, so the rogue HTTP is coming from elsewhere What URL are you using to access the adminconsole? Is there a reverse proxy anywhere in the architecture? ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 14, 2019, 1:31pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/5 "2019-05-14T13:31:36Z")
And what does your ping federation config look like? ---
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 14, 2019, 1:46pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/6 "2019-05-14T13:46:31Z")
The admin console URL is: [https://xxx.com:12443](https://xxx.com:12443), I don't have any load balancer at the moment or reverse proxy. I don't have direct access to the ping federation config but I checked with them and the config I sent is the following: Endpoint URL/Assertion Consumer Service URL: [https://xxx.com:12443/api/security/v1/saml](https://xxx.com:12443/api/security/v1/saml) (Base is the Admin console URL) Logout URL: [https://xxx.com:12443/api/v1/users/auth/\_logout](https://xxx.com:12443/api/v1/users/auth/_logout) (Same base URL as above) ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 14, 2019, 2:10pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/7 "2019-05-14T14:10:46Z")
Looking at the code, it generates the ACS string that is failing by taking the URL of the `saml/_init` request and switching it to `saml/_callback`, leaving the rest of it unchanged. For some reason that URL seems to be `http` and not `https` Can you look in the adminconsole logs for that `saml/_init` request (it will probably be in 2 places - the main adminconsole logs and also the audit logs, not sure which of the two will be most useful) and post what the logs say? ---
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 14, 2019, 2:26pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/8 "2019-05-14T14:26:40Z")
I see different entries in the logs: `[2019-05-14 14:19:44,084][INFO][AuditRecordLoggerNoSensitive] {"request_id":"6a7a908fa3cf7bfc08009848390d0c75","method":"GET","path":"http://xxx.com:12443/api/v1/users/auth/saml/_init?state=%7B%22redirectTo%22:%22/%22%7D","headers":[{"name":"remote-address","value":"-"},{"name":"upgrade-insecure-requests","value":"1"},{"name":"connection","value":"keep-alive"},{"name":"dnt","value":"1"},{"name":"referer","value":"https://xxx.com:12443/login?redirectTo=%2F"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-US, en;q=0.5"},{"name":"accept","value":"text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8"},{"name":"user-agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:66.0) Gecko/20100101 Firefox/66.0"},{"name":"host","value":"xxx.com:12443"},{"name":"x-forwarded-for","value":"-"}]} {}` This one shows the error: `[2019-05-14 14:19:44,128][ERROR][no.found.adminconsole.http.requests] 502 Bad Gateway - unknown - 127.0.0.1 - 127.0.0.1 - GET //xxx.com:12443/api/v1/users/auth/saml/_init HTTP/1.1 in:0 out:748 (45 ms) {"proxy_ip":"127.0.0.1","request_url":"//xxx.com:12443/api/v1/users/auth/saml/_init","status_code":"502","response_length":"748","response_time":"45","request_method":"GET","commit_hash":"ba6ca6d92527cbb64e4daf136f083bcc70e6e4b2","request_host":"xxx.com","request_id":"6a7a908fa3cf7bfc08009848390d0c75","request_length":"0","user":"unknown","client_ip":"127.0.0.1"}` ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 14, 2019, 2:30pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/9 "2019-05-14T14:30:03Z")
Oh yeah they are both showing as `HTTP` ☹, looks like it's a problem on our side. Going to go dig some more... ---
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 14, 2019, 2:32pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/10 "2019-05-14T14:32:59Z")
Thanks for looking into this. This step is important in our enterprise to show the value of the tool. ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 15, 2019, 2:28pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/11 "2019-05-15T14:28:35Z")
We're not finished looking into this, but it looks like the SAML support in beta only covers HTTP (obviously this is an oversight) We'll be releasing a patch very soon to cover HTTPS support. Apologies for the inconvenience, and thanks for the very helpful bug report Alex ---
**Author:** ![afuggetta](https://avatars.discourse-cdn.com/v4/letter/a/71e660/32.png) [@afuggetta](https://discuss.elastic.co/u/afuggetta)\ **Post date:** [May 15, 2019, 2:33pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/12 "2019-05-15T14:33:42Z")
Thanks @Alex_Piggott, I'll keep an eye here for the patch release. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 29, 2019, 2:33pm UTC](https://discuss.elastic.co/t/ece-saml-integration-error/180616/13 "2019-05-29T14:33:52Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.