# Elasticsearch Cloud SSO with ActiveDirectory **URL:** \ **Category:** Kibana\ **Created:** [March 1, 2021, 8:11pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859 "2021-03-01T20:11:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![tchaudhry](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Post date:** [March 1, 2021, 8:11pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/1 "2021-03-01T20:11:06Z")
We jut subscribed to ElasticCloud. In the process of implementing SSO with Active Directory. Does SSO setup have to be done on a per deployment basis? The Kibana URLs I have used according to the following article: > [@SSO / Azure AD setup](https://discuss.elastic.co/t/sso-azure-ad-setup/230639): > > Having issues getting SAML based SSO setup for Azure AD. Not sure where to get the Identifier / Entity ID, Reply URL etc.. from are all specific to one deployment. I intend to create Elasticsearch deployments on the fly. How will this SSO work in that scenario? Thanks, Tauqir ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 1, 2021, 10:05pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/2 "2021-03-01T22:05:09Z")
Hi @tchaudhry The SSO setup is per deployment. Deployments can be [created via the Elastic Cloud API](https://www.elastic.co/guide/en/cloud/current/ec-restful-api.html) or the new [(still in beta)](https://www.elastic.co/blog/elastic-cloud-terraform-provider-now-available-in-beta) Terraform provider. Provider [Here](https://registry.terraform.io/providers/elastic/ec/latest/docs/resources/ec_deployment) and Github [Here](https://github.com/elastic/terraform-provider-ec) The elasticsearch.yml settings can be provided to each so then the Auth / Auth can be setup as you deploy. ---
**Author:** ![tchaudhry](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Post date:** [March 1, 2021, 10:31pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/3 "2021-03-01T22:31:48Z")
Hi Stephen, thanks, I am using the terraform provider. Is there a reference for the elasticsearch.yml settings corresponding to AD SAML SSO. Thanks, Tauqir ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 1, 2021, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/4 "2021-03-01T22:59:27Z")
I would set it up manually first before I would try to automate [here](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-SAML.html) are the docs for SAML setup. Also @tchaudhry this is Elastic Cloud so you can also open a support ticket if you run into issues ---
**Author:** ![tchaudhry](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Post date:** [March 1, 2021, 11:28pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/5 "2021-03-01T23:28:54Z")
I did open a support ticket, but got more feedback from you so far. Following [this](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/configuring-saml-realm.html?blade=supportportalv1) since we are 6.8. This documentation is for an on prem or physical infra focused. I am wondering how to translate paths like "certs/http.p12" to the cloud instance. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 1, 2021, 11:35pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/6 "2021-03-01T23:35:05Z")
The documents here below is for elastic cloud .. > **[Secure your clusters with SAML | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-SAML.html)** Since it already secured you will not be providing your own certs.... you will be focusing on the SAML portions if you want to Connect with AD. There may be some specifics for SAML for 6.8 ... but you won't be creating uploading your own certs. You will put your SAML settings in the elasticsearch.yml from the cloud console ![Screen Shot 2021-03-01 at 3.38.20 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c920fac84d722161e0300b95fe7539a5fc4cb50e.png) ---
**Author:** ![tchaudhry](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Post date:** [March 2, 2021, 6:21pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/7 "2021-03-02T18:21:33Z")
So I am getting a bunch of errors when saving elasticseach.yml (also tried the same in kibana.yml). Any idea what am I doing wrong ```auto xpack: security: authc: realms: saml: clarityfirst-sso: order: 2 attributes.principal: "mail" attributes.groups: "groups" idp.metadata.path: "https://login.microsoftonline.com/[tenantid]/federationmetadata/2007-06/federationmetadata.xml?appid=[sso app id]" idp.entity_id: "https://sts.windows.net/[tenantid]/" sp.entity_id: "https://[deployment].westus2.azure.elastic-cloud.com:9243" sp.acs: "https://[deployment].westus2.azure.elastic-cloud.com:9243/api/security/v1/saml" sp.logout: "https://[deployment].westus2.azure.elastic-cloud.com:9243/logout" ``` Errors: ```auto Elasticsearch - 'xpack.security.authc.realms.saml.clarityfirst-sso.order': is not allowed Elasticsearch - 'xpack.security.authc.realms.saml.clarityfirst-sso.attributes.principal': is not allowed ``` many other not allowed errors, one for each line ---
**Author:** ![tchaudhry](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tchaudhry](https://discuss.elastic.co/u/tchaudhry)\ **Post date:** [March 2, 2021, 7:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/8 "2021-03-02T19:22:49Z")
I know I am not getting this right xpack.security.authc.realms.saml.cloud-saml.\* from [here](https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html) so trying this does not work either: ```auto saml: cloud-saml: order: 2 ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 30, 2021, 7:23pm UTC](https://discuss.elastic.co/t/elasticsearch-cloud-sso-with-activedirectory/265859/9 "2021-03-30T19:23:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.