# Elastic - SAML (Azure) integration issue **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 17, 2020, 1:28pm UTC](https://discuss.elastic.co/t/elastic-saml-azure-integration-issue/223934 "2020-03-17T13:28:57Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![AjitR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajitr/32/51311_2.png) [@AjitR](https://discuss.elastic.co/u/AjitR)\ **Post date:** [March 17, 2020, 1:28pm UTC](https://discuss.elastic.co/t/elastic-saml-azure-integration-issue/223934/1 "2020-03-17T13:28:57Z")
Hi All, Below are my SAML configuration for Elasticsearch and Kibana, but getting Warning as `[WARN][o.e.x.s.a.AuthenticationService] [SA145] Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML content is in-response-to _8ca119eb20c3a44e54c0edba4538500bf62b3879 but expected one of [] ])` On Debugging in IE gets below error in Response Body, `{"statusCode":401,"error":"Unauthorized","message":"[security_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/saml/authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } }"}` Need help to identify actually where issue lie, in ELK configuration or in Azure configuration. Below is my complete configuration ```auto **1. Node A - Elasticsearch Config** cluster.name: sap node.name: SAP145 node.master: true node.data: true network.host: 10.11.12.145 http.port: 5081 discovery.seed_hosts: ["10.11.12.145"] xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.authc.accept_default_password: false xpack.security.authc.token.enabled: true xpack.security.authc.realms.saml.saml1: order: 0 idp.metadata.path: saml/idp-metadata.xml idp.entity_id: "https://sts.windows.net/40d9d3d6-53ad-415c-aee8-72de90a76ab0/" sp.entity_id: "https://10.12.12.111:5080/" sp.acs: "https://10.12.12.111:5080/api/security/v1/saml" attributes.principal: "http://schemas.microsoft.com/identity/claims/emailaddress" ``` **2. Node B Elasticsearch Config** cluster.name: sap node.name: SA146 node.master: true node.data: true ``` network.host: 10.11.12.146 http.port: 5081 discovery.seed_hosts: ["10.11.12.145","10.11.12.146"] xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.authc.accept_default_password: false xpack.security.authc.token.enabled: true xpack.security.authc.realms.saml.saml1: order: 2 idp.metadata.path: saml/idp-metadata.xml idp.entity_id: "https://sts.windows.net/40d9d3d6-53ad-415c-aee8-72de90a76ab0/" sp.entity_id: "https://10.12.12.111:5080/" sp.acs: "https://10.12.12.111:5080/api/security/v1/saml" attributes.principal: "http://schemas.microsoft.com/identity/claims/emailaddress" ``` **Kibana Config** server.port: 5080 server.host: "10.12.12.111" elasticsearch.hosts: ["[https://10.11.12.145:5081](https://10.11.12.145:5081)"] ``` server.ssl.enabled: true server.ssl.certificate: /elk_7.4.1/kibana-7.4.0-linux-x86_64/config/certs/kibana-server.crt server.ssl.key: /elk_7.4.1/kibana-7.4.0-linux-x86_64/config/certs/kibana-server.key elasticsearch.ssl.certificateAuthorities: "/elk_7.4.1/kibana-7.4.0-linux-x86_64/config/certs/elasticsearch-ca.pem" elasticsearch.ssl.verificationMode: full elasticsearch.username: "elastic" elasticsearch.password: "elastic" xpack.reporting.capture.browser.chromium.disableSandbox: true csp.warnLegacyBrowsers: false xpack.security.authc.providers: [saml,basic] xpack.security.authc.saml.realm: saml1 xpack.security.sessionTimeout: 10000 server.xsrf.whitelist: [/api/security/v1/saml] ``` ```auto ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 17, 2020, 1:46pm UTC](https://discuss.elastic.co/t/elastic-saml-azure-integration-issue/223934/2 "2020-03-17T13:46:41Z")
Why not continue in [SAML configuration with NameID as unspecified - #3 by AjitR](https://discuss.elastic.co/t/saml-configuration-with-nameid-as-unspecified/222704/3) ? > ` Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML content is in-response-to _8ca119eb20c3a44e54c0edba4538500bf62b3879 but expected one of [] ]` This should only be a transient error. Is it reproducible on your side in a new incognito browser window ? 1. Please enable trace logging as described in [Common SAML issues | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/trb-security-saml.html) 2. Describe to us what you are doing in the browser ( which URL do you navigate to , what happens next etc. ) to get this error, or even better capture a HAR from your browser. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2020, 1:46pm UTC](https://discuss.elastic.co/t/elastic-saml-azure-integration-issue/223934/3 "2020-04-14T13:46:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.