# Elasticsearch SAML integration while using HTTP-Redirect **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 12, 2018, 2:08am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658 "2018-07-12T02:08:19Z")\ **Posts on this page:** 17\ **Page:** 3
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 26, 2018, 6:52am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/42 "2018-07-26T06:52:44Z")
SAML does not support mapping files. Which part of the docs lead you to believe it did? ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [July 26, 2018, 7:05am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/43 "2018-07-26T07:05:21Z")
in this [role mapping file](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/mapping-roles.html#mapping-roles-file) it shows how to uses the file-based method to map group to role, the user can be from Active Directory , so i think maybe the users who authenticate via SAML can also use it. I have a question when i use role mapping API if i have created a mapping role , curl -X PUT "[https://X.X.X.X:9200/\_xpack/security/role\_mapping/](https://X.X.X.X:9200/_xpack/security/role_mapping/)" -H 'Content-Type: application/json' -d' { "roles": ["superuser"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml3" } }, { "field": { "metadate.saml(Email)": "Dengfeng.Nguyen@Honeywell.com" } } ] } } i want to add user to this mapping, or i want to remove user in this mapping, do you have related API? ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [July 30, 2018, 8:54am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/44 "2018-07-30T08:54:39Z")
HI Ikakavas my configuration attributes.principal: "Email" attribute\_patterns.principal: "^([^@]+)@Honeywell.com$" in my understanding i can extract username from email . if my email name is [Dengfeng,Nguyen@Honeywell.com](mailto:Dengfeng,Nguyen@Honeywell.com), so my username will be Dengfeng,Nguyen. But when i try to get the user's information curl -X GET "[https://x.x.x.x:9200/\_xpack/security/user/Dengfeng.Nguyen](https://x.x.x.x:9200/_xpack/security/user/Dengfeng.Nguyen)" it just return {} can you tell me how to get the user's information who authenticate via SAML ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 30, 2018, 9:41am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/45 "2018-07-30T09:41:06Z")
The Users API returns information about users in the _Native_ realm. It will not show SAML users. If you want to know which users are authenticating via SAML, then you need to use the audit log. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 30, 2018, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/46 "2018-07-30T09:59:24Z")
In addition to what Tim has mentioned, if you are authenticated yourself as the user of which you want to get the information, you can use the [`_authenticate`](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html) API to get it. ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 1, 2018, 2:43am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/47 "2018-08-01T02:43:34Z")
HI ikakavas I have some questions about group mapping. from this [role mapping](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/saml-role-mapping.html) we can mapping group to different role . i think if the SAML session contain one group message it will work very well. 1 Can you tell me the situation that SAML session contain multi-groups, does the ELK can parse the group info? 2 if the answer is yes, does the ELK just pick the group configured in role\_mapping, and ignore others group message? 3 if one user both in group "user" and group “developer”, will he have the full permission of the both groups or just have one of groups' permission. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [August 1, 2018, 3:06am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/48 "2018-08-01T03:06:44Z")
I believe the Role Mapping API docs cover everything you are asking: - [Role mapping APIs | Elasticsearch Guide [6.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/security-api-role-mapping.html#mapping-roles-rule-field) > [@](#): > > ## User Fields > > **groups** _array-of-string_ > The groups to which the user belongs. > > ```auto > "groups" : [ > "cn=admin,ou=groups,dc=example,dc=com", > "cn=esusers,ou=groups,dc=example,dc=com > ] > > ``` > > The `groups` field is multi-valued; a user can belong to many groups. When a `field` rule is applied against a multi-valued field, it is considered to match if at least one of the member values matches. For example, the following rule matches any user who is a member of the admin group, regardless of any other groups they belong to: > > ```auto > { "field" : { "groups" : "admin" } } > > ``` ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 1, 2018, 3:14am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/49 "2018-08-01T03:14:29Z")
Got it ,thank you ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 2, 2018, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/50 "2018-08-02T08:26:34Z")
HI TimV I have a problem when i logout the kibana, when i click the Logout, the kibana will reload, and than login the kibana again. that's mean i can not logout. my configuration in elastic is sp.acs: "[https://sent2-kibana-dev.dsentience.net:443/api/security/v1/saml](https://sent2-kibana-dev.dsentience.net:443/api/security/v1/saml)" sp.logout: "[https://sent2-kibana-dev.dsentience.net:443/logout](https://sent2-kibana-dev.dsentience.net:443/logout)" ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 3, 2018, 1:08am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/51 "2018-08-03T01:08:28Z")
HI TimV Can you tell the situation that SAML session contain two groups one is top grpup "cn=elastic\_user,ou=internal,o=Honeywell" another is subgroup "cn=GroupAdministrator,cn=elastic\_user,ou=internal,o=Honeywell" if i only map subgroup to a role, the user in the subgroup have no permission related to the role. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [August 3, 2018, 1:32am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/52 "2018-08-03T01:32:12Z")
Multiple groups should work fine. You'll need to look at the logs and try and see what's going wrong for you. ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 3, 2018, 2:13am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/53 "2018-08-03T02:13:02Z")
Is there sub group concept in ELK? if we need map one group to one role. we just need call the api below no matter the group is top group or sub group. curl -X PUT "[https://x.x.x.x:9200/\_xpack/security/role\_mapping/mapping](https://x.x.x.x:9200/_xpack/security/role_mapping/mapping)" -H 'Content-Type: application/json' -d' { "roles": ["kibana\_user", "machine\_learning\_user"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml3" } }, { "field": { "metadata.saml(Group)": "cn=elastic\_user,ou=internal,o=honeywell" } } ] } } ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [August 3, 2018, 4:03am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/54 "2018-08-03T04:03:37Z")
> [@talon](#): > > Is there sub group concept in ELK? What does sub-group mean to you? We take the groups in the SAML assertion, and pass it through role-mapping. If the group is listed in the assertion, it should work. ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 3, 2018, 4:31am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/55 "2018-08-03T04:31:05Z")
for example top group is "cn=elastic\_user,ou=internal,o=Honeywell". the subgroup "cn=GroupAdministrator,cn=elastic\_user,ou=internal,o=Honeywell", and this group is part of the top group. cn=GroupAdministrator ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 7, 2018, 2:07am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/56 "2018-08-07T02:07:19Z")
HI TimV Can you give me some advice about logging out the kibana, when i click the Logout, the kibana will reload, and than login the kibana again. that's mean i can not logout. my configuration in elastic is sp.acs: "[https://sent2-kibana-dev.dsentience.net:443/api/security/v1/saml](https://sent2-kibana-dev.dsentience.net:443/api/security/v1/saml)" sp.logout: "[https://sent2-kibana-dev.dsentience.net:443/logout](https://sent2-kibana-dev.dsentience.net:443/logout)" i have checked the matadate file provided by IDP, but i can not find any information about SingleLogoutService, is that mean the idp do not support single logout? another question is can i just logout without single logout? if i can , how to configure the ELK? i got the answer from here [https://www.elastic.co/guide/en/x-pack/current/\_configure\_elasticsearch\_for\_saml\_authentication.html](https://www.elastic.co/guide/en/x-pack/current/_configure_elasticsearch_for_saml_authentication.html) thank you ---
**Author:** ![talon](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@talon](https://discuss.elastic.co/u/talon)\ **Post date:** [August 7, 2018, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/57 "2018-08-07T05:42:18Z")
HI TimV I have some question about Session Control and Timeout 1 Does the ELK will limit the number of active concurrent sessions that are allowed for each account as appropriate. 2 the idp team provide me one Logout URL, i want to goto this URL when i click the logout, can you tell how to configure it? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2018, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658/58 "2018-09-04T05:42:18Z")
Closed on September 4, 2018, 5:42am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/elasticsearch-saml-integration-while-using-http-redirect/139658.md?page=2)