# SAML error with ELK Stack **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [January 17, 2019, 3:44pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673 "2019-01-17T15:44:38Z")\ **Posts on this page:** 12\ **Page:** 3
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 4:45pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/41 "2019-02-27T16:45:54Z")
Hi, So in the role i have set: ```auto GET /_xpack/security/role/Role.MS { "Role.MS" : { "cluster" : [], "indices" : [ { "names" : [ "index1-*", "index2-*", "index3-*" ], "privileges" : [ "all" ], "field_security" : { "grant" : [ "*" ] }, "query" : """{"term": {"providedAttributes.user.countryCode": "{{_user.metadata.saml(c)}}"}}""" } ], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "space_read" ], "resources" : [ "space:engineer" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` If i enter with the user the query is not returning anything.Meaning my dashboards are empty.It means no data from index matches the filtering query. I tried and replace the query term with match and still the same error. ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 5:22pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/42 "2019-02-27T17:22:46Z")
So, if i set query: ```auto {"match": {"providedAttributes.user.countryCode": "{{_user.metadata.saml(c)}}"}} ``` Is not showing anything in the dashboard. if i set query: ```auto {"match": {"providedAttributes.user.countryCode": "AT"}} ``` The index filtered information is shown in the dashboard. I have tried also with term instead of match in both cases and no data is shown in dashboard. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 27, 2019, 11:45pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/43 "2019-02-27T23:45:43Z")
Login to Kibana using SAML. Call the [Elasticsearch Authenticate API](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-authenticate.html) from within the Kibana dev tools console. That will show you what metadata is included in the user object so you can confirm whether `_user.metadata.saml(c)` is indeed being populated. ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 28, 2019, 8:14am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/44 "2019-02-28T08:14:57Z")
Hi, this is the data which i received on Authenticate API: ```auto { "username" : "at.user", "roles" : [ "Role.AT" ], "full_name" : "at.user", "email" : null, "metadata" : { "saml(role)" : [ "Role.AT" ], "saml_nameid" : "at.user", "saml(partnername)" : [ "Partner.AT" ], "saml_nameid_format" : "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", "saml(c)" : [ "AT" ] }, "enabled" : true, "authentication_realm" : { "name" : "saml1", "type" : "saml" }, "lookup_realm" : { "name" : "saml1", "type" : "saml" } } ``` So i will try now to match it in the Role query via the match. Thanks, Victor ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 28, 2019, 8:24am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/45 "2019-02-28T08:24:37Z")
This is the role definition: ```auto { "Role.AT" : { "cluster" : [], "indices" : [ { "names" : [ "index1-*", "index2-*", "index3-*" ], "privileges" : [ "all" ], "field_security" : { "grant" : [ "*" ] }, "query" : """{"match": {"providedAttributes.user.countryCode": "{{_user.metadata.saml(c}}"}}""" } ], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "space_read" ], "resources" : [ "space:engineer" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 28, 2019, 8:56am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/46 "2019-02-28T08:56:15Z")
Hi, finally managed to solved that: the good query is: ```auto {"template":{"source":{"match":{"providedAttributes.user.countryCode":"{{_user.metadata.saml(c)}}"}}}} ``` so for me, match was working better than term looks like. Thank you very much guys for help and guidance! Victor ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [March 7, 2019, 5:31pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/47 "2019-03-07T17:31:20Z")
Hi Guys, One more thing arise with SAML. Can we have 2 IdP(identity providers) connected to one ELK for SAML access? The 2 SAML secure the same ELK for different accesses from different networks. What can i force from URL which SAML realm to be use? Is there a document about it? based on the order? SAML1: [kibana.dom1.com/elk/api/kibana/order=0](http://kibana.dom1.com/elk/api/kibana/order=0)? which redirect to idp 1? SAML2: [kibana.dom2.com/elk/api/kibana/order=1](http://kibana.dom2.com/elk/api/kibana/order=1)? which redirects to idp 2? In the same time i use also LDAP and native. Thank you in advance, Victor ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 7, 2019, 11:23pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/48 "2019-03-07T23:23:11Z")
To do this you need to have 2 separate Kibana instances. [https://www.elastic.co/guide/en/elastic-stack-overview/6.6/saml-kibana.html#\_operating\_multiple\_kibana\_instances](https://www.elastic.co/guide/en/elastic-stack-overview/6.6/saml-kibana.html#_operating_multiple_kibana_instances) ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [March 8, 2019, 7:45am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/49 "2019-03-08T07:45:06Z")
Hi Tim, Thank you for your answer, So the same collected data can be seen in all the instances. Great news, Thank you, Victor ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [April 3, 2019, 12:35pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/50 "2019-04-03T12:35:22Z")
Hi guys, on the 2 Kibana Instances, the Spaces, and the other objects are the same? Meaning, on the second instance i dont have other spaces or information? I manage to add a second instance, and here i see the same spaces as in first instances. Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 3, 2019, 1:45pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/51 "2019-04-03T13:45:48Z")
Please open a new post for that question, this is largely unrelated to the other things we discussed here so far ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2019, 1:45pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/52 "2019-05-01T13:45:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673.md?page=2)