# Elasticsearch cloud SAML settings errors **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 31, 2019, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711 "2019-05-31T11:16:05Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [May 31, 2019, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/1 "2019-05-31T11:16:05Z")
I am running ES version v7.1.0 on the cloud . I am not able to enter the SAML settings for OKTA integration in the "User settings overrides" box. It is throwing errors like 'xpack.security.authc.realms.cloud-saml.type': is not allowed According to this link, settings are limited. Where do I put in the SAML settings ? [https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html](https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 3, 2019, 3:07am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/2 "2019-06-03T03:07:14Z")
Realms settings were changed slightly in Elasticsearch 7, which makes it difficult for the cloud documentation (because cloud supports multiple versions of Elasticsearch). We're working on fixing the docs for this. In 6.x, your cloud SAML realm should look like this: ```auto xpack: security: authc: realms: cloud-saml: type: saml order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "" idp.entity_id: "" sp.entity_id: "KIBANA_ENDPOINT_URL/" sp.acs: "KIBANA_ENDPOINT_URL/api/security/v1/saml" sp.logout: "KIBANA_ENDPOINT_URL/logout" ``` In 7.x, that same configuration should look like: ```auto xpack: security: authc: realms: saml: cloud-saml: order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "" idp.entity_id: "" sp.entity_id: "KIBANA_ENDPOINT_URL/" sp.acs: "KIBANA_ENDPOINT_URL/api/security/v1/saml" sp.logout: "KIBANA_ENDPOINT_URL/logout" ``` What used to be a "type" in the realm (cloud-saml.type: saml) is now part of the configuration key. ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 3, 2019, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/3 "2019-06-03T09:48:01Z")
This worked . thank you . But kibana does not appear to log me out completely . it appears like an authentication loop. How do i get back to my OKTA page ? ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f4d7171bdd39a331f82c634150659013a514af2.png) ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 3, 2019, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/4 "2019-06-03T15:52:55Z")
> [@ajayraghuraj](#): > > But kibana does not appear to log me out completely . it appears like an authentication loop. How do i get back to my OKTA page ? Can you explain in a little more detail: - What is the behavior you experience after logout - What would you like to happen instead? What is the behavior you'd want to see. Can you also share your `cloud-saml` realm configuration? ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 4, 2019, 2:19am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/5 "2019-06-04T02:19:27Z")
> [@TimV](#): > > "KIBANA\_ENDPOINT\_URL/" As you can see in the screenshot posted earlier, user lands on the kibana login page after logging out . Click on 'login' will take the user back to Kibana. I would like the user to land on the OKTA login screen after logging out of Kibana. here are the Elasticsearch and Kibana user settings Elasticsearch user settings\>\> ``` xpack: security: authc: realms: saml: cloud-saml: order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "https://xxxxxxx.okta.com/app/exkl4glcoc065460h7/sso/saml/metadata" idp.entity_id: "http://www.okta.com/ffffffffffffffff" sp.entity_id: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/" sp.acs: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/api/security/v1/saml" sp.logout: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/logout" ``` kibana user settings\>\> ``` xpack.security.authProviders: [saml, basic] server.xsrf.whitelist: [/api/security/v1/saml] xpack.security.public: protocol: https hostname: dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io port: 9243 ``` in addition , i ran something like on the API console. "elasticadmins" is a group created in OKTA . Users added to the group ``` POST /_xpack/security/role_mapping/CLOUD_SAML_ELASTICADMIN_TO_SUPERUSER { "enabled": true, "roles": ["superuser"], "rules": { "all" : [ { "field": { "realm.name": "cloud-saml" } }, { "field": { "groups": "elasticadmins" } } ]}, "metadata": { "version": 1 } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 4, 2019, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/6 "2019-06-04T02:34:58Z")
@ajayraghuraj just a quick note that formating your code/logs/config using the `` button, or markdown style back ticks really helps to make things easy to read which helps us help you 🙂 ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 4, 2019, 5:22am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/7 "2019-06-04T05:22:24Z")
@warkolm edited and formatted 🙂 ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 4, 2019, 6:48am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/8 "2019-06-04T06:48:14Z")
The behavior you are seeing means that either Okta is not configured to support Single Logout and thus Elasticsearch assumes there is no point to redirect you to the SAML IdP. You can verify that by looking at your Okta configuration or by looking at the metadata in `https://xxxxxxx.okta.com/app/exkl4glcoc065460h7/sso/saml/metadata` . I'd expect there is no `` in there ( this is the URL in Okta where the Elastic Stack would redirect you upon Logout ) . You could contact Okta support to assist you in enabling Single Logout or look at their documentation. Keep in mind that according to the SAML specification [section 3.7](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) what usually happens in SAML Single Logout is that the session participant ( That is the Elastic Stack ) should redirect the user to the SAML IdP ( that is Okta ) with a SAML Logout Request and then the SAML IDP will attempt to terminate the session and redirect the user back to the Session Participant with a SAML Logout response. This would mean that you would still end up in Kibana after completing the logout - unless Okta has some setting to keep you to their Dashboard, instead of redirecting you back to Kibana with the SAML Response in the end. ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 4, 2019, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/9 "2019-06-04T08:53:28Z")
Okay. Do I need to generate a certificate from the SP ( elasticsearch stack ) and upload into OKTA ? I believe the cert is required for decrypting the assertion ? Step#9 [https://saml-doc.okta.com/SAML\_Docs/How-to-Configure-SAML-2.0-for-Interact.html](https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Interact.html) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 5, 2019, 4:13am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/10 "2019-06-05T04:13:47Z")
No, that is not required (but it is possible). SAML assertions are typically signed (using the IdP's certificate) but not encrypted. If configured correctly, the `idp.metadata.path` provides Elasticsearch with a copy of the certificate it needs to verify the signature. If you _want_ to use encrypted assertions, that is possible and is documented here: - [https://www.elastic.co/guide/en/elastic-stack-overview/7.1/saml-guide-authentication.html#saml-enc-sign](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/saml-guide-authentication.html#saml-enc-sign) ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 5, 2019, 4:16am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/11 "2019-06-05T04:16:10Z")
Thanks Tim. Our OKTA service provider have asked for Single Logout URL, SP Issuer (usually same as entity id) and Signature Certificate to enable single logout ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 5, 2019, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/12 "2019-06-05T06:54:49Z")
Your previous question was asking about encryption, rather than signing. They are different. The link I provided above describes how to configure the SAML realm to sign logout requests. ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 9, 2019, 2:21am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/13 "2019-06-09T02:21:07Z")
I managed to generate the signing certificates with Openssl instead of elasticsearch-certutil . OKTA has been enabled for SLO. But here is the problem we are seeing now on the browser upon logout from Kibana "{"statusCode":404,"error":"Not Found","message":"Not Found"}" elasticsearch user settings ``` xpack: security: authc: realms: saml: cloud-saml: order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "https://xxxxxxx.okta.com/app/exkl4glcoc065460h7/sso/saml/metadata" idp.entity_id: "http://www.okta.com/ffffffffffffffff" sp.entity_id: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/" sp.acs: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/api/security/v1/saml" sp.logout: "https://dfwgfewrttrgrgg4gr4grgregrewgre.cloud.es.io:9243/logout" signing.certificate: saml/saml-sign.crt signing.key: saml/saml-sign.key ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 9, 2019, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/14 "2019-06-09T11:01:18Z")
> [@ajayraghuraj](#): > > But here is the problem we are seeing now on the browser upon logout from Kibana > > "{"statusCode":404,"error":"Not Found","message":"Not Found"}" Please, please , share more information. This is very little for anyone to try and assist in a meaningful way. 404 is just an HTTP error code, it doesn't mean much on its own. The more time you put in making your questions clear with all the details required, the fewer questions we'd have to ask back, and the more probable it will become that someone will take the time to try and help you resolve the problem. What happens when you click on the logout, where does your browser get redirected to ? What is the URL that gives you this 404 ? Even better, capture a HAR for your browser when you click on logout and share it with us by uploading it somewhere. ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 9, 2019, 11:33am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/15 "2019-06-09T11:33:42Z")
I ran a SAML tracer . noticed two GET and one POST request. My understanding is that the first GET request relates to the 'logout' from Kibana. URL in the Second GET is the 'HTTP REDIRECT'. But i dont understand why i get a POST response for the second 'GET' URL. The POST response is what is throwing the "404" error . let me know if this helps ![InkedCapture2](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1436c2e944a74a776573870404bcd2e57cd9692.gif) ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 13, 2019, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/16 "2019-06-13T06:20:18Z")
still not able to sort this . anyone have ideas ? ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 14, 2019, 7:25am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/17 "2019-06-14T07:25:43Z")
I noticed a conversation on github similar to the issue i am facing . So does Kibana not handle the SAML logout response issued by the session authority ( OKTA ) ? > ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 17, 2019, 1:23am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/18 "2019-06-17T01:23:37Z")
The `POST` appears to be sent incorrectly from Okta. I think you may need to follow up with them to find out why they are sending it. Kibana's Logout endpoint only accepts `GET` because it is designed to support the `HTTP-Redirect` binding (per the SAML interoperability profile) and does not support the `HTTP-POST` binding. I cannot see any way to change that in the Okta configuration screens, so I think it may require a conversation with Okta. At the moment we have 2 issues in the stack related to logout. 1. In some cases we can end up in a logout loop, where immediately after logging out you get sent back to the IdP Login page which _might_ automatically log you in again. 2. The issue referenced above, which is a fairly technical issue which does interact with the problem you're facing, and can make the logout loop worse, but isn't actually causing the issue here. ---
**Author:** ![ajayraghuraj](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@ajayraghuraj](https://discuss.elastic.co/u/ajayraghuraj)\ **Post date:** [June 18, 2019, 1:11am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/19 "2019-06-18T01:11:16Z")
Thanks Tim. I am working with OKTA support on this one. Will let you know if there is any progress `In some cases we can end up in a logout loop, where immediately after logging out you get sent back to the IdP Login page which *might* automatically log you in again.` what I noticed with the OKTA SSO integration is that the user session is terminated from the browser that initiated the log out . But I will still be able to login without re-authenticating if I have an active browser session on OKTA. Ideally when the user logs out of Kibana, all sessions for that user must end ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 16, 2019, 1:11am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-saml-settings-errors/183711/20 "2019-07-16T01:11:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.