# SAML - Migrate to new IDP

**URL:** <https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534>\
**Category:** Elasticsearch\
**Created:** [August 10, 2023, 9:39am UTC](https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534 "2023-08-10T09:39:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![heric](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heric/32/70748_2.png) [@heric](https://discuss.elastic.co/u/heric)\
**Post date:** [August 10, 2023, 9:39am UTC](https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534/1 "2023-08-10T09:39:36Z")

</div>

Hi All,

I have 5 nodes cluster of elasticsearch integrated to SAML IDP.  
i want to migrate to new SAML IDP but i don't have working test environment to integrate to this new IDP.

Below scenario that i can think of, do you think this will be feasible ( mostly the part where i want to change the SAML configuration on one node only to test the integration ).

- create local users and provide existing users with this temporary local users
- offload 1 elasticsearch node ( because i didn't enable replica and restart of the live node will have impact to the service )
- configure kibana elasticsearch host to this offloaded node
- configure new SAML IDP in this node and test the integration
- if it is working, rollout to the other nodes.

Thanks.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 11, 2023, 7:42am UTC](https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534/2 "2023-08-11T07:42:11Z")

</div>

Doing it on one node will work fine.

However, you can have multiple SAML realms on a node, and configure Kibana to prompt users to pick which one to use.  
If your old IdP is going to remain available during the migration, you should be able to add the new IdP, test it, and then remove the old one without needing to isolate a node.

---

<div class="post-metadata">

**Author:** ![heric](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heric/32/70748_2.png) [@heric](https://discuss.elastic.co/u/heric)\
**Post date:** [August 11, 2023, 2:29pm UTC](https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534/3 "2023-08-11T14:29:14Z")

</div>

Thank you Tim.

i am using elasticsearch 7.16.2 and kibana 7.13.2 , is that multiple saml realm supported and whether kibana will show the login selector by default or need to be configured

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2023, 2:29pm UTC](https://discuss.elastic.co/t/saml-migrate-to-new-idp/340534/4 "2023-09-08T14:29:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.