# SAML configuration - Azure Active Directory

**URL:** <https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314>\
**Category:** Elasticsearch\
**Created:** [May 22, 2019, 7:54pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314 "2019-05-22T19:54:08Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\
**Post date:** [May 23, 2019, 2:34am UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/2 "2019-05-23T02:34:55Z")

</div>

I see a couple of potential issues:

> [@keenan.sequeira](#):
>
> sp.entity\_id: "[https://test-kibana.lcbo.com/](https://test-kibana.lcbo.com/)"  
> sp.acs: "[https://test-kibana.lcbo.com/api/security/v1/saml](https://test-kibana.lcbo.com/api/security/v1/saml)"  
> sp.logout: "[https://test-kibana.lcbo.com/logout](https://test-kibana.lcbo.com/logout)"

I believe these also **must** include the port (even though you're using the default HTTPS port of 443).

> [@keenan.sequeira](#):
>
> attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"  
> attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."

These values do not look like ones that are typically found within the claims that Azure Active Directory supports. If you request the App Federation Metadata URL to retrieve the XML that lists the supported claims, amongst other metadata, it'll look something like

```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sts.windows.net/{id}/" ID="{id}">
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <!-- snip for brevity -->
    </Signature>
    <RoleDescriptor xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706" xsi:type="fed:SecurityTokenServiceType">
        <KeyDescriptor use="signing">
            <!-- snip for brevity -->
        </KeyDescriptor>
        <fed:ClaimTypesOffered>
            <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <auth:DisplayName>Name</auth:DisplayName>
                <auth:Description>The mutable display name of the user.</auth:Description>
            </auth:ClaimType>
            <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier">
                <auth:DisplayName>Subject</auth:DisplayName>
                <auth:Description>An immutable, globally unique, non-reusable identifier of the user that is unique to the application for which a token is issued.</auth:Description>
            </auth:ClaimType>
            <!-- etc... -->
        </fed:ClaimTypesOffered>
    </RoleDescriptor>
</EntityDescriptor>

```

Under `<fed:ClaimTypesOffered>` are the claims supported by Azure Active Directory, where the `Uri` value is the one to use in elasticsearch.yml for configuring the SAML realm.

For example, [Elastic's Azure Marketplace template](https://github.com/elastic/azure-marketplace) uses [`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` for `attributes.principal`](https://github.com/elastic/azure-marketplace/blob/a8d1bf5ea42982d0272bec1eb65f2b55dfd77912/src/scripts/elasticsearch-install.sh#L1136-L1139), which is the Name claim above.

---

_[View the full topic](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314)._