# Native azure integration with Azure AD SSO failures

**URL:** <https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [August 22, 2022, 11:37pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660 "2022-08-22T23:37:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![samjpv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samjpv/32/109954_2.png) [@samjpv](https://discuss.elastic.co/u/samjpv)\
**Post date:** [August 22, 2022, 11:37pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660/1 "2022-08-22T23:37:30Z")

</div>

I've been working to set up SSO with Azure AD on a native Azure integrated elasticsearch cluster following this guide: [How to set up OpenID Connect on Elastic Cloud (with Azure, Google, Okta) | Elastic Blog](https://www.elastic.co/blog/how-to-set-up-openid-connect-on-elastic-cloud-with-azure-google-okta). As far as I can tell, the actual authentication with Azure upon login works, but after that, I get this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67480e511005f4ac4793c2873f7fe63bd616635a.png)

My current elastic user settings are identical to the tutorial's, with kibana endpoint, app registration tenant/app id, claim\_patterns.principal email regex all positively correct. The fact that I'm getting this error now rather than a "failed to authenticate with azure" or something like that leads me to believe that the issue resides somewhere in my role mapping rules, which are as follows:

```auto
{ 
    "enabled": true, 
    "roles": ["superuser"],  
    "rules" : { 
      "all" : [ 
        { 
          "field" : { 
            "realm.name" : "oidc1" 
          } 
        }, 
        { 
          "field" : { 
            "username" : "*"
          } 
        } 
      ] 
    }, 
    "metadata": { "version": 1 } 
}

```

This is also pretty much identical to the tutorial, except not restricted on username. Kibana user settings are also identical to the tutorial's.  
Like I mentioned, I'm not thinking this is an issue with my Azure app registration, though I haven't ruled it out.

Is there a good way to debug why this isn't working or an obvious reason for the failure? Any info would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [August 23, 2022, 1:11am UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660/2 "2022-08-23T01:11:38Z")

</div>

> [@samjpv](#):
>
> This is also pretty much identical to the tutorial, except not restricted on username.

If you don't need username restriction, you can just simplify the role mapping rule to

```auto
{
  "enabled": true,
  "roles": [
    "superuser"
  ],
  "rules": {
    "field": {
      "realm.name": "oidc1"
    }
  }
}

```

Please double check that the realm is actually named as `oidc1`.

> Is there a good way to debug why this isn't working or an obvious reason for the failure?

You can enable trace logging on Elasticsearch and it should output detailed messages on how roles are resolved/mapped during log in time.

```auto
PUT _cluster/settings
{
  "transient": {
    "logger.org.elasticsearch.xpack.security.authc": "trace"
  }
}

```

---

<div class="post-metadata">

**Author:** ![samjpv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samjpv/32/109954_2.png) [@samjpv](https://discuss.elastic.co/u/samjpv)\
**Post date:** [August 23, 2022, 3:08pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660/3 "2022-08-23T15:08:34Z")

</div>

This inexplicably started working after a few hours with nothing changed. I'm guessing I needed to wait a few minutes to re-login on the account I was testing SSO with to actually have permissions applied. Thanks for the tip on mapping, and I'll keep in mind trace logging if I run into any similar issues in the future.

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [August 23, 2022, 11:44pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660/4 "2022-08-23T23:44:10Z")

</div>

> [@samjpv](#):
>
> re-login on the account

Role mapping changes do not apply to your SSO user's existing kibana sessions. So yes you probably just needed re-login.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2022, 11:44pm UTC](https://discuss.elastic.co/t/native-azure-integration-with-azure-ad-sso-failures/312660/5 "2022-09-20T23:44:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.