# SAML Issue in ELK 7.6.4 **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [September 25, 2020, 2:35am UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890 "2020-09-25T02:35:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Post date:** [September 25, 2020, 2:35am UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/1 "2020-09-25T02:35:08Z")
Hi All, I was trying to integrate Okta with elasticsearch, getting below error while logging into console, `{"statusCode":401,"error":"Unauthorized","message":"[security_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/saml/authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } }"}` below is my Okta integration part from elasticsearch.yml ``` xpack.security.authc.realms.saml.prod-saml: order: 2 idp.metadata.path: "/etc/elasticsearch/ELK_ProdV1.xml" idp.entity_id: "http://www.okta.com/jurjyh1asdwreZJ2PSmblgj0" sp.entity_id: "https://itdashboard.iff.com:5601" sp.acs: "https://itdashboard.iff.com:5601/api/security/v1/saml" sp.logout: "https://itdashboard.iff.com:5601/logout" attributes.principal: "nameid" attributes.groups: "groups" ``` In elasticsearch logs below is the only error i am getting, ``` [2020-09-25T02:24:56,159][INFO][o.o.c.c.InitializationService] [1.3.5.3] Initializing OpenSAML using the Java Services API [2020-09-25T02:24:56,858][INFO][o.o.x.a.AlgorithmRegistry] [1.3.5.3] Algorithm failed runtime support check, will not be usable: http://www.w3.org/2001/04/xmlenc#ripemd160 ``` Any idea where i'm doing the mistake. THanks Gautham ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 25, 2020, 7:01am UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/2 "2020-09-25T07:01:51Z")
This is an INFO level message, so it doesn't indicate an error or a misconfiguration. You should look further down in your log, the appropriate error message will be printed out. ---
**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Post date:** [September 25, 2020, 7:17am UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/3 "2020-09-25T07:17:59Z")
@ikakavas I tried drilling down further and tried a change like giving IP address instead of DNS entry and it worked , so this means there is a problem with DNS entry?? In my dev box i was using **"http"** (and was using dns name) and didnt had any problem, but in production box i was using **https** , this dns issue might be due to some certificate problem or so Thanks Gautham ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/4 "2020-09-25T09:07:12Z")
Apologies but I don't follow you. What did you drill down ? Where did you "give your IP address" ? Where were you using http instead of https ? This might be obvious to you since you are performing the actions but the rest if us lack any context as to what these sentences might mean. ---
**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Post date:** [September 27, 2020, 12:02pm UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/5 "2020-09-27T12:02:07Z")
@ikakavas Sorry forgot to mention in detail. I have changed the details in elasticsearch.yml , okta configuration sp.entity\_id: "[https://1.1.3.4:5601](https://1.1.3.4:5601)" sp.acs: "[https://1.1.3.4:5601/api/security/v1/saml](https://1.1.3.4:5601/api/security/v1/saml)" sp.logout: "[https://itdashboard.iff.com:5601/logout](https://itdashboard.iff.com:5601/logout)" If i change the above mentioned sp.entity\_id as DNS name, kibana is not working. with IP address its sucessful Thanks Gautham ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 1, 2020, 3:35pm UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/6 "2020-10-01T15:35:01Z")
sp.entity\_id needs to match what you have configured in Okta. Same for the `sp.acs` . `sp.entity_id` can be whatever your wish it to be, it's just a string in SAML. The `sp.acs` affects other stuff too so if you want to access your kibana by IP , use an IP, if you want to access it via the DNS name, set the DNS name. Just do the same exactly configuration both in Okta and in the elastic stack. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 29, 2020, 3:35pm UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890/7 "2020-10-29T15:35:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.