# SAML configuration - Azure Active Directory

**URL:** <https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314>\
**Category:** Elasticsearch\
**Created:** [May 22, 2019, 7:54pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314 "2019-05-22T19:54:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![keenan.sequeira](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keenan.sequeira](https://discuss.elastic.co/u/keenan.sequeira)\
**Post date:** [May 22, 2019, 7:54pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/1 "2019-05-22T19:54:08Z")

</div>

Hey, I've followed the SAML config documentation and setup elasticsearch & kibana. However, I am encountering errors when attempting to use the SAML login (basic still works).

Version info: v7.0.1 (elasticsearch and kibana)

Here is what I currently see in my kibana logs:

```
{
   "type":"log",
   "@timestamp":"2019-05-22T19:36:28Z",
   "tags":[
      "info",
      "authentication"
   ],
   "pid":1,
   "message":"Authentication attempt failed: [security_exception] Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}]"
}

{
   "type":"error",
   "@timestamp":"2019-05-22T19:36:28Z",
   "tags":[

   ],
   "pid":1,
   "level":"error",
   "error":{
      "message":"[security_exception] Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}]",
      "name":"Error",
      "stack":"[security_exception] Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}] :: {\"path\":\"/_security/saml/prepare\",\"query\":{},\"body\":\"{\\\"acs\\\":\\\"https://test-kibana.lcbo.com:443/api/security/v1/saml\\\"}\",\"statusCode\":500,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}]\\\"}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}]\\\"},\\\"status\\\":500}\"}\n at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:308:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:267:7)\n at HttpConnector.<anonymous> (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:166:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4935:19)\n at IncomingMessage.emit (events.js:194:15)\n at endReadableNT (_stream_readable.js:1103:12)\n at process._tickCallback (internal/process/next_tick.js:63:19)"
   },
   "url":{
      "protocol":null,
      "slashes":null,
      "auth":null,
      "host":null,
      "port":null,
      "hostname":null,
      "hash":null,
      "search":null,
      "query":{

      },
      "pathname":"/",
      "path":"/",
      "href":"/"
   },
   "message":"[security_exception] Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=null, assertionConsumerServiceURL=https://test-kibana.lcbo.com:443/api/security/v1/saml}]"
}

```

Here is my elasticsearch config file (edited to hide sensitive info):

```
cluster:
  name: ${CLUSTER_NAME}
  initial_master_nodes:
    - es-master-0

node:
  master: ${NODE_MASTER}
  name: ${NODE_NAME}
  data: ${NODE_DATA}
  ingest: ${NODE_INGEST}
  max_local_storage_nodes: ${MAX_LOCAL_STORAGE_NODES}

network:
  host: ${NETWORK_HOST}

path:
  data: /data/data
  logs: /data/log

bootstrap:
  memory_lock: ${MEMORY_LOCK}

http:
  compression: true
  cors:
    enabled: ${HTTP_CORS_ENABLE}
    allow-origin: ${HTTP_CORS_ALLOW_ORIGIN}

discovery:
  seed_hosts: ${DISCOVERY_SERVICE}

xpack:
  license.self_generated.type: trial
  security:
    enabled: true
    transport:
      ssl:
        enabled: true
        verification_mode: none
        keystore.path: /usr/share/elasticsearch/config/certs/elk-cert.p12
        truststore.path: /usr/share/elasticsearch/config/certs/elk-cert.p12
    http:
      ssl:
        enabled: true
        verification_mode: none
        keystore.path: /usr/share/elasticsearch/config/certs/elk-cert.p12
        truststore.path: /usr/share/elasticsearch/config/certs/elk-cert.p12
    authc:
      token:
        enabled: true
      realms:
        file:
          file1:
            order: 0
        saml:
          saml1:
            order: 2
            idp.metadata.path: "<AAD_federation_XML_URL>"
            idp.entity_id: "<EntityID_URL_from_metadata_xml_above>"
            sp.entity_id: "https://test-kibana.lcbo.com/"
            sp.acs: "https://test-kibana.lcbo.com/api/security/v1/saml"
            sp.logout: "https://test-kibana.lcbo.com/logout"
            attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"
            attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."
  monitoring:
    enabled: true

## Threadpool Settings ##
thread_pool:
  # Write
  write:
    queue_size: 3000
  search:
    size: 30
    queue_size: 500
    min_queue_size: 10
    max_queue_size: 1000
    auto_queue_frame_size: 2000
    target_response_time: 1s

```

Here is my kibana config:

```
server:
  name: kibana
  host: "0.0.0.0"
  xsrf.whitelist: [/api/security/v1/saml]

elasticsearch:
  ssl:
    certificateAuthorities: /usr/share/kibana/config/certs/elk-cert.p12
    verificationMode: none
  username: kibana
  password: <hidden>
  hosts: ["https://elasticsearch:9200"]

xpack:
  security:
    authProviders: [saml, basic]
    public:
      protocol: https
      hostname: test-kibana.lcbo.com
      port: 443
    encryptionKey: "<hidden>"
  monitoring:
    enabled: true
    ui.container.elasticsearch.enabled: true
    elasticsearch:
      ssl:
        certificateAuthorities: /usr/share/kibana/config/certs/elk-cert.p12
        verificationMode: none

```

Any ideas where this is failing? I am able to login to the kibana instance using the /login page (basic auth), however I have not been able to get past the above error.

I've followed this troubleshooting topic and it did not prove to be helpful: [https://www.elastic.co/guide/en/elastic-stack-overview/7.0/trb-security-saml.html](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/trb-security-saml.html)

Thanks!

---

<div class="post-metadata">

**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\
**Post date:** [May 23, 2019, 2:34am UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/2 "2019-05-23T02:34:55Z")

</div>

I see a couple of potential issues:

> [@keenan.sequeira](#):
>
> sp.entity\_id: "[https://test-kibana.lcbo.com/](https://test-kibana.lcbo.com/)"  
> sp.acs: "[https://test-kibana.lcbo.com/api/security/v1/saml](https://test-kibana.lcbo.com/api/security/v1/saml)"  
> sp.logout: "[https://test-kibana.lcbo.com/logout](https://test-kibana.lcbo.com/logout)"

I believe these also **must** include the port (even though you're using the default HTTPS port of 443).

> [@keenan.sequeira](#):
>
> attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"  
> attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."

These values do not look like ones that are typically found within the claims that Azure Active Directory supports. If you request the App Federation Metadata URL to retrieve the XML that lists the supported claims, amongst other metadata, it'll look something like

```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sts.windows.net/{id}/" ID="{id}">
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <!-- snip for brevity -->
    </Signature>
    <RoleDescriptor xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706" xsi:type="fed:SecurityTokenServiceType">
        <KeyDescriptor use="signing">
            <!-- snip for brevity -->
        </KeyDescriptor>
        <fed:ClaimTypesOffered>
            <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <auth:DisplayName>Name</auth:DisplayName>
                <auth:Description>The mutable display name of the user.</auth:Description>
            </auth:ClaimType>
            <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier">
                <auth:DisplayName>Subject</auth:DisplayName>
                <auth:Description>An immutable, globally unique, non-reusable identifier of the user that is unique to the application for which a token is issued.</auth:Description>
            </auth:ClaimType>
            <!-- etc... -->
        </fed:ClaimTypesOffered>
    </RoleDescriptor>
</EntityDescriptor>

```

Under `<fed:ClaimTypesOffered>` are the claims supported by Azure Active Directory, where the `Uri` value is the one to use in elasticsearch.yml for configuring the SAML realm.

For example, [Elastic's Azure Marketplace template](https://github.com/elastic/azure-marketplace) uses [`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` for `attributes.principal`](https://github.com/elastic/azure-marketplace/blob/a8d1bf5ea42982d0272bec1eb65f2b55dfd77912/src/scripts/elasticsearch-install.sh#L1136-L1139), which is the Name claim above.

---

<div class="post-metadata">

**Author:** ![keenan.sequeira](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keenan.sequeira](https://discuss.elastic.co/u/keenan.sequeira)\
**Post date:** [May 23, 2019, 2:43pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/3 "2019-05-23T14:43:15Z")

</div>

Hey,

Thanks for the quick reply. The changes you made have helped. Here are the updated snippets for anyone else reading this:

```
idp.metadata.path: "<redacted>"
idp.entity_id: "<redacted>"
sp.entity_id: "https://test-kibana.lcbo.com:443/"
sp.acs: "https://test-kibana.lcbo.com:443/api/security/v1/saml"
sp.logout: "https://test-kibana.lcbo.com:443/logout"
attributes.principal: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

```

The above changes worked and now when I hit [test-kibana.lcbo.com](http://test-kibana.lcbo.com), I am successfully redirected to the AD login page. However, after logging in (successfully), I am redirected back to Kibana and see this in my browser:

```
{
  "statusCode":403,
  "error":"Forbidden",
  "message":"Forbidden"
}

```

And this in my Kibana logs:

```
{
   "type":"response",
   "@timestamp":"2019-05-23T14:35:43Z",
   "tags":[

   ],
   "pid":1,
   "method":"post",
   "statusCode":302,
   "req":{
      "url":"/api/security/v1/saml",
      "method":"post",
      "headers":{
         "host":"test-kibana.lcbo.com",
         "x-request-id":"9d564999edde715162ee00cdc57227cd",
         "x-real-ip":"<redacted>",
         "x-forwarded-for":"<redacted>",
         "x-forwarded-host":"test-kibana.lcbo.com",
         "x-forwarded-port":"443",
         "x-forwarded-proto":"https",
         "x-original-uri":"/api/security/v1/saml",
         "x-scheme":"https",
         "content-length":"7321",
         "user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0",
         "accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
         "accept-language":"en-US,en;q=0.5",
         "accept-encoding":"gzip, deflate, br",
         "referer":"https://login.microsoftonline.com/",
         "content-type":"application/x-www-form-urlencoded",
         "dnt":"1",
         "upgrade-insecure-requests":"1"
      },
      "remoteAddress":"<redacted>",
      "userAgent":"<redacted>",
      "referer":"https://login.microsoftonline.com/"
   },
   "res":{
      "statusCode":302,
      "responseTime":515,
      "contentLength":9
   },
   "message":"POST /api/security/v1/saml 302 515ms - 9.0B"
}{
   "type":"response",
   "@timestamp":"2019-05-23T14:35:43Z",
   "tags":[

   ],
   "pid":1,
   "method":"get",
   "statusCode":403,
   "req":{
      "url":"/",
      "method":"get",
      "headers":{
         "host":"test-kibana.lcbo.com",
         "x-request-id":"<redacted>",
         "x-real-ip":"<redacted>",
         "x-forwarded-for":"<redacted>",
         "x-forwarded-host":"test-kibana.lcbo.com",
         "x-forwarded-port":"443",
         "x-forwarded-proto":"https",
         "x-original-uri":"/",
         "x-scheme":"https",
         "user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0",
         "accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
         "accept-language":"en-US,en;q=0.5",
         "accept-encoding":"gzip, deflate, br",
         "referer":"https://login.microsoftonline.com/",
         "dnt":"1",
         "upgrade-insecure-requests":"1"
      },
      "remoteAddress":"<redacted>",
      "userAgent":"<redacted>",
      "referer":"https://login.microsoftonline.com/"
   },
   "res":{
      "statusCode":403,
      "responseTime":127,
      "contentLength":9
   },
   "message":"GET / 403 127ms - 9.0B"
}

```

I am unsure why this request is being rejected from Kibana after the successful login since I am unable to see any other messages. The rest of the config is the same as my first post.

Thanks again for your help, greatly appreciated.

---

<div class="post-metadata">

**Author:** ![keenan.sequeira](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@keenan.sequeira](https://discuss.elastic.co/u/keenan.sequeira)\
**Post date:** [May 23, 2019, 3:18pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/4 "2019-05-23T15:18:18Z")

</div>

I resolved this myself. I was missing the role mapping from AD roles -\> elasticsearch roles.

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2019, 3:18pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/5 "2019-06-20T15:18:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.