# Elastic Cloud SAML Logout loop

**URL:** <https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 3, 2018, 1:58pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193 "2018-12-03T13:58:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hogbinj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hogbinj/32/14744_2.png) [@hogbinj](https://discuss.elastic.co/u/hogbinj)\
**Post date:** [December 3, 2018, 1:58pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193/1 "2018-12-03T13:58:43Z")

</div>

I've set up my SAML authentication. Login works like a champ now, however the logout is stuck in a loop, as set out in the[SAML Logout section](https://www.elastic.co/guide/en/x-pack/current/_configure_elasticsearch_for_saml_authentication.html#saml-enc-sign)

I'm testing Okta & OneLogin and both need the Logout to be signed.

How do you get Elastic cloud to do this?

James

---

<div class="post-metadata">

**Author:** ![hogbinj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hogbinj/32/14744_2.png) [@hogbinj](https://discuss.elastic.co/u/hogbinj)\
**Post date:** [December 3, 2018, 2:33pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193/2 "2018-12-03T14:33:24Z")

</div>

OK.

So on further exploration, Okta needs signatures, one login doesn't

So here is how I configured onelogin if anybody else is struggling:

Use the **SAML Test Connector (Advanced)** App

> RelayState: [Blank]  
> Audience: https://[uuid].europe-west1.gcp.cloud.es.io:9243/  
> Recipient: https://[uuid].europe-west1.gcp.cloud.es.io:9243/api/security/v1/saml  
> ACS (Consumer) URL Validator: ^https:\/\/[uuid].europe-west1.gcp.cloud.es.io:9243\/api\/security\/v1\/saml\*  
> ACS (Consumer) URL: https://[uuid].europe-west1.gcp.cloud.es.io:9243/api/security/v1/saml  
> Single logout URL: https://[uuid].europe-west1.gcp.cloud.es.io:9243/logout  
> Login URL: https://[uuid].europe-west1.gcp.cloud.es.io:9243/api/security/v1/saml  
> SAML Not valid before: 3  
> SAML not valid on or after: 3  
> SAML initiater: Service Provider  
> SAML nameID format: Persistent  
> SAML issuer type: Specific  
> SAML signature element: Response  
> Encrypt assertion : NOT checked

---

<div class="post-metadata">

**Author:** ![zanbel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanbel/32/20678_2.png) [@zanbel](https://discuss.elastic.co/u/zanbel)\
**Post date:** [December 6, 2018, 12:09pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193/3 "2018-12-06T12:09:58Z")

</div>

@hogbinj thanks for letting us know!  
We will further investigate and work towards fixing this issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 12:10pm UTC](https://discuss.elastic.co/t/elastic-cloud-saml-logout-loop/159193/4 "2019-01-03T12:10:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.