Hello @ikakavas
We are using elastic cloud hosting version 7.5.
We have below configuration for user overrides sections of elasticsearch and kibana.we have created roles in kibana and created a AD user group in Azure called. We have also added user to this group in azure end. Also used the PUT command to assign roles to this user group in kibana.
Configuration on elastic:
xpack:
security:
authc:
realms:
saml:
saml2:
order: 2
attributes.principal: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
attributes.groups: "user.assignedroles"
idp.metadata.path: "<idp metadata path>"
idp.entity_id: "<idp entity url>"
sp.entity_id: "<KIBANA_URL>"
sp.acs: "<KIBANA_URL>/api/security/v1/saml"
sp.logout: "<KIBANA_URL>/logout"
xpack.security.authc.providers: [saml]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.authc.saml.realm: saml2
Current Roles added:
"CLOUD_SAML2_ReadOnly" : {
"enabled" : true,
"roles" : [
"AWS-Elastic-P-Kibana-ReadOnly"
],
"rules" : {
"all" : [
{
"field" : {
"realm.name" : "saml2"
}
},
{
"field" : {
"groups" : "AWS-Elastic-P-Kibana-ReadOnly"
}
}
]
},
"metadata" : {
"version" : 1
}
},
"CLOUD_SAML2_Hades" : {
"enabled" : true,
"roles" : [
"Hades_User"
],
"rules" : {
"all" : [
{
"field" : {
"realm.name" : "saml2"
}
},
{
"field" : {
"groups" : "AWS-Elastic-P-Kibana-ReadOnly"
}
}
]
},
"metadata" : {
"version" : 1
}
},
"CLOUD_SAML2_kibana_user" : {
"enabled" : true,
"roles" : [
"kibana_user"
],
"rules" : {
"all" : [
{
"field" : {
"realm.name" : "saml2"
}
},
{
"field" : {
"groups" : "AWS-Elastic-P-Kibana-ReadOnly"
}
}
]
},
"metadata" : {
"version" : 1
}
}
}
AD Groups Created :
AWS-Elastic-P-Kibana-ReadOnly
**Changes in SAML **
Claims are : givenname, name, emailaddress,roles ,surname.
Roles are user.assignedroles
We do not have roles assigned in SAML side. This is what the SAML response depicts.
What roles need need to be configured on SAML end?
Do we need to configure tenant url on SAML side?if so what is the exact value to be configured
