# SAML Authentication error

**URL:** <https://discuss.elastic.co/t/saml-authentication-error/150522>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 1, 2018, 7:26am UTC](https://discuss.elastic.co/t/saml-authentication-error/150522 "2018-10-01T07:26:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![drjackal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drjackal/32/33187_2.png) [@drjackal](https://discuss.elastic.co/u/drjackal)\
**Post date:** [October 1, 2018, 7:26am UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/1 "2018-10-01T07:26:09Z")

</div>

I am trying to configure SAML authentication together with our Windows 2016 ADFS server but whatever I try I am running into the following error:

Authentication to realm saml1 failed - SAML Attribute [nameid:persistent] for [attributes.principal] not found in [nameid=[username@domain.local]]

My SAML configuration looks like this:

```
xpack.security.authc.realms.saml1:
type: saml
order: 1
idp.metadata.path: saml\FederationMetadata.xml
idp.entity_id: "http://federation.domain.local/adfs/services/trust"
sp.entity_id: "https://elkserver.domain.local/"
sp.acs: "https://elkserver.domain.local:443/api/security/v1/saml"
sp.logout: "https://elkserver.domain.local/logout"
attributes.principal: "nameid:persistent"
nameid_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

```

On the ADFS side, I have just configured the outgoing claim for User-Principal-Name to nameid

![nameid](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b5afc214df5b36eedd59d4cfcc74d423c07ddf56.png)

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 1, 2018, 7:50am UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/2 "2018-10-01T07:50:30Z")

</div>

Hi,

The error you get is because you have configured Elasticsearch to try and map the `principal` attribute from the NameID with persistent format that it finds in the subject of the SAML Assertion. Since this is not found in the assertion, authentication fails because `principal` is required.

`nameid:persistent` has a specific meaning for the Elastic Stack SAML SP [as described here](https://www.elastic.co/guide/en/x-pack/current/_configure_elasticsearch_for_saml_authentication.html#saml-attribute-mapping) . I'm not very familiar with ADFS but the screenshot you provided seems to imply that ADFS will be sending the UPN as a SAML Attribute in the SAML Response's Attribute Statement with a name of `nameid` and not as the SAML NameID in the Assertion's subject. Or that it is releasing it as a NameID but with the wrong format (if I remember correctly from other posts in the forums, the default format for NameID in ADFS is `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.` You can verify my assumption by setting the SAML log to trace in Elasticsearch with

```auto
curl -H "Content-Type: application/json" -XPUT -uelastic 'https://<ES_FQDN>:9200/_cluster/settings' -d'
{
 "transient" : {
     "logger.org.elasticsearch.xpack.security.authc.saml" : "TRACE"
 }
}'

```

and looking at your the elasticsearch logs ( we print out the SAML Response and the attributes we extract from it ). Alternatively you can use a browser plugin (i.e. [SAML tracer](https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/)) to see the SAML Response in your browser.

When it comes to solutions for your problem now, you can either:

- Figure out how to configure ADFS to send out a NameID with format `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
- Map `principal` to the claim that you have configured ADFS to release, if this is the case.

---

<div class="post-metadata">

**Author:** ![drjackal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drjackal/32/33187_2.png) [@drjackal](https://discuss.elastic.co/u/drjackal)\
**Post date:** [October 2, 2018, 12:00pm UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/3 "2018-10-02T12:00:57Z")

</div>

Thank you Ioannis,

in the end, I only had to change the ADFS claim from nameid to nameid:persistent.

 ![saml](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbe3f384c00062a2758e5b6f65c822a44ce7a11e.png)

Now I can logon with SAML. Unfortunately the roles are not working yet (you can see that I map them to the roles claim).

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 2, 2018, 12:11pm UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/4 "2018-10-02T12:11:17Z")

</div>

> [@drjackal](#):
>
> Unfortunately the roles are not working yet

Can you be a little more specific please ? 🙂

From the original configuration you shared, I don't see you mapping the roles claim from ADFS into anything in Elasticsearch. See the [relevant part of our guide](https://www.elastic.co/guide/en/elastic-stack-overview/6.4/saml-guide-authentication.html#saml-attribute-mapping)  
I think the easiest path forward is to map the roles claim ( i.e. `http://schemas.microsoft.com/ws/2008/06/identity/claims/role` ) to the groups attribute of the Elasticsearch user by adding

```auto
attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

```

to your SAML realm configuration.  
Then you can use the values of the `groups` attribute to do map users to Elasticsearch roles as described in [here](https://www.elastic.co/guide/en/elastic-stack-overview/6.4/saml-role-mapping.html)

---

<div class="post-metadata">

**Author:** ![drjackal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drjackal/32/33187_2.png) [@drjackal](https://discuss.elastic.co/u/drjackal)\
**Post date:** [October 2, 2018, 12:31pm UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/5 "2018-10-02T12:31:53Z")

</div>

Hi Ionannis,

Sorry, I wasn not specific because I planned to fix this myself (as I did).

The thing is that you need to manage saml roles via the api and not via a mapping file as I started with.  
I did change the ADFS claims a bit:

 ![role](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b3b880a1c78ed5515af2f599b7f817c94dd787a.png)

So I map Token-Groups - Unqualified Names to the predefined Role outgoing claim. Then, when I use the api to assign a role to one of the users groups it works.  
As a test I used this:

```
PUT /_xpack/security/role_mapping/saml-superuser
{
"roles": ["superuser"],
"enabled": true,
"rules": { "all": [
    { "field": { "realm.name": "saml1" } },
    { "field": { "groups": "MyGroup" } }
 ] }
}

```

Thank you for pointing me in the right direction!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2018, 12:32pm UTC](https://discuss.elastic.co/t/saml-authentication-error/150522/6 "2018-10-30T12:32:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.