# SAML authentication request scoping (using IDP proxy)

**URL:** <https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 22, 2022, 4:34pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932 "2022-02-22T16:34:25Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cap\_Ho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cap_ho/32/79703_2.png) [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\
**Post date:** [February 22, 2022, 4:34pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/1 "2022-02-22T16:34:25Z")

</div>

Hi all,

I am now trying to test the ELK do auth using SAML. the basic flow is ok since i may follow the documentation. But i think that one of the case is not fit. i would like to use ELK as SP and connect to a IDP proxy and forward to request the real IDP. But i find that there is no configuration in Elasticsearch so that i may create the tag in saml authnrequest xml. So i cannot use the IDP approach. Any idea on that?

thx

capho

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 22, 2022, 4:43pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/2 "2022-02-22T16:43:49Z")

</div>

Hi there,

What tag would that be ? Can you point us to the relevant specification that describes the idp proxy flow that you’re trying to implement ? Thanks !

---

<div class="post-metadata">

**Author:** ![Cap\_Ho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cap_ho/32/79703_2.png) [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\
**Post date:** [February 23, 2022, 5:04am UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/3 "2022-02-23T05:04:39Z")

</div>

Hi @ikakavas ,

I referencing the documentation for the IDP proxy setup

[https://wikis.forgerock.org/confluence/display/openam/SAMLv2+IDP+Proxy+Part+1.+Setting+up+a+simple+Proxy+scenario](https://wikis.forgerock.org/confluence/display/openam/SAMLv2+IDP+Proxy+Part+1.+Setting+up+a+simple+Proxy+scenario)

[https://docs.oracle.com/cd/E19316-01/820-3746/ghgfu/index.html](https://docs.oracle.com/cd/E19316-01/820-3746/ghgfu/index.html)

One of the criteria on setting up IDP proxy is that the SP (that mean ELK) need to enable the IDP proxy in the authrequest. But Elasticsearch.yaml don't have this configuration.

So the request for a IDP proxy support then should be :

```auto
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="s27974e1a9401fcf8031f0fb001fc297f03def1398"
                    Version="2.0"
                    IssueInstant="2022-02-22T15:11:47Z"
                    Destination="http://idpproxy.example.com:8084/openamIDPProxy/SSORedirect/metaAlias/proxyidp"
                    ForceAuthn="false" IsPassive="false"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    AssertionConsumerServiceURL="http://sp.example.net:8082/openamSP/Consumer/metaAlias/sp">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://sp.example.net:8082/openamSP</saml:Issuer>
    <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                        SPNameQualifier="http://sp.example.net:8082/openamSP" AllowCreate="true"></samlp:NameIDPolicy>
    <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact">
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
            urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
    <samlp:Scoping xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ProxyCount="2">
    </samlp:Scoping>
</samlp:AuthnRequest>

```

The samlp:Scoping/ is required for the IDP proxy

```auto
    <samlp:Scoping xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ProxyCount="2">
    </samlp:Scoping>

```

But since there are not similar options in Elasticsearch.yaml. i may just make it like:

```auto
xpack.security.authc.realms.saml.saml1:
  order: 2
  idp.metadata.path: saml/idp-metadata.xml
  idp.entity_id: "idpproxy.example.com"
  sp.entity_id: "kibana.example.com"
  sp.acs: "http://kibana.example.com/api/security/saml/callback"
  sp.logout: "http://kibana.example.com/logout"
  attributes.principal: "nameid"
  attributes.groups: "roles"
  nameid_format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
  nameid.allow_create: true
  force_authn : true
  nameid.sp_qualifier: "kibana.example.com"
  req_authn_context_class_ref: "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"

```

so that the Kibana generated Authrequest will be

```auto
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     ID="_ac8bafc45f29621b382132dceb5730f6bce7ead0"
                     Version="2.0"
                     IssueInstant="2022-02-22T15:34:29.791Z"
                     Destination="http://idpproxy.example.com:8084/openamIDPProxy/SSORedirect/metaAlias/proxyidp"

                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                     AssertionConsumerServiceURL="http://kibana.example.com/api/security/saml/callback">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">kibana.example.com</saml2:Issuer>
    <saml2p:NameIDPolicy AllowCreate="true"
                         Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                         SPNameQualifier="kibana.example.com"/>
    <saml2p:RequestedAuthnContext Comparison="exact">
        <saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </saml2:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

```

So i just want to see how to add the "Scoping" field in the Kibana request for my IDP proxy route

thx

capho

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 23, 2022, 8:39am UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/4 "2022-02-23T08:39:34Z")

</div>

Thanks for the additional details ! We unfortunately don’t support this as you have figured out. I see you have opened an issue in our GitHub repository so you can keep track of the progress there.

---

<div class="post-metadata">

**Author:** ![Cap\_Ho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cap_ho/32/79703_2.png) [@Cap\_Ho](https://discuss.elastic.co/u/Cap_Ho)\
**Post date:** [February 27, 2022, 3:14pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/5 "2022-02-27T15:14:43Z")

</div>

One more question, i will trying to setup the SSO connection using ELK (version 8) with OpenAM. i find that the NameID policy : "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" is never work. Only other nameid policy is working. Is it Elasticsearch don't allow ?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 27, 2022, 4:04pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/6 "2022-02-27T16:04:34Z")

</div>

> [@Cap\_Ho](#):
>
> i find that the NameID policy : "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" is never work.

This is hardly enough information for anyone to help you. Can you please explain how it does not work with this nameid policy ? What do you expect to happen, what happens instead ? What is the error message ? What are the associated logs ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2022, 4:04pm UTC](https://discuss.elastic.co/t/saml-authentication-request-scoping-using-idp-proxy/297932/7 "2022-03-27T16:04:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.