# Kibana Azure AD SSO Authentication

**URL:** <https://discuss.elastic.co/t/kibana-azure-ad-sso-authentication/348692>\
**Category:** Kibana\
**Created:** [December 6, 2023, 5:13am UTC](https://discuss.elastic.co/t/kibana-azure-ad-sso-authentication/348692 "2023-12-06T05:13:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ilter\_Sag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilter_sag/32/113820_2.png) [@Ilter\_Sag](https://discuss.elastic.co/u/Ilter_Sag)\
**Post date:** [December 6, 2023, 5:13am UTC](https://discuss.elastic.co/t/kibana-azure-ad-sso-authentication/348692/1 "2023-12-06T05:13:24Z")

</div>

Hello,

I am trying to setup Kibana Authentication with Azure AD SSO and getting this error. What will be the cause of that error?

My server has connection to [login.microsoftonline.com](http://login.microsoftonline.com) and can fetch federation xml.

Elasticsearch version is 8.11

I followed the [Documentation](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-saml-azure.html) and added the below lines to elasticsearch.yml. All setup at Azure is same as documentation.

```auto
xpack.security.authc.realms.saml.kibana-realm:
  order: 2
  attributes.principal: nameid
  attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"
  idp.metadata.path: "https://login.microsoftonline.com/36de9075-00fd-4382-bce5-f43274a4881e/federationmetadata/2007-06/federationmetadata.xml?appid=c71909a2-2791-4271-88c2-0ad7e359823d"
  idp.entity_id: "https://sts.windows.net/36de9075-00fd-4382-bce5-f43274a4881e"
  sp.entity_id: "https://xxxxxxx"
  sp.acs: "https://xxxxxxx/api/security/saml/callback"
  sp.logout: "https://xxxxxxx/logout"

```

```auto
{"statusCode":500,"error":"Internal Server Error","message":"[security_exception\n\tRoot causes:\n\t\tsecurity_exception: Cannot get role descriptors [type/name={urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor] because the metadata [location=https://login.microsoftonline.com/36de9075-00fd-4382-bce5-f43274a4881e/federationmetadata/2007-06/federationmetadata.xml?appid=c71909a2-2791-4271-88c2-0ad7e359823d] for SAML entity [id=https://sts.windows.net/36de9075-00fd-4382-bce5-f43274a4881e] could not be resolved]: Cannot get role descriptors [type/name={urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor] because the metadata [location=https://login.microsoftonline.com/36de9075-00fd-4382-bce5-f43274a4881e/federationmetadata/2007-06/federationmetadata.xml?appid=c71909a2-2791-4271-88c2-0ad7e359823d] for SAML entity [id=https://sts.windows.net/36de9075-00fd-4382-bce5-f43274a4881e] could not be resolved"}

```

---

<div class="post-metadata">

**Author:** ![Ilter\_Sag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ilter_sag/32/113820_2.png) [@Ilter\_Sag](https://discuss.elastic.co/u/Ilter_Sag)\
**Post date:** [December 6, 2023, 8:37am UTC](https://discuss.elastic.co/t/kibana-azure-ad-sso-authentication/348692/2 "2023-12-06T08:37:34Z")

</div>

Solution was.

> [@Cannot find metadata for entity \[...\] in SAML xml despite it being there](https://discuss.elastic.co/t/cannot-find-metadata-for-entity-in-saml-xml-despite-it-being-there/183369/4):
>
> Can you clarify what you have tried ? Is there an \<EntityDescriptor ... entityID="your value here"\> in the metadata of the Identity Provider ? Is it exactly the same String as the one you have configured in idp.entity\_id: ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2024, 8:38am UTC](https://discuss.elastic.co/t/kibana-azure-ad-sso-authentication/348692/3 "2024-01-03T08:38:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.