SAML settings on elasticsearch and kibana

[ikakavas (Ioannis Kakavas)]

@Muhammad_Umair_Baig

the shared saml request is generated when i hit https://localhost:5601/ in the browser.

Yes, I know but I shared with you documentation that explains that the signature is not enveloped in the message in this case. So the signature is calculated and becomes part of the URL. If you look at this in the logs then you might look at a point where we just print out the AuthNRequest, this is no indication that it is not signed. I think we can move forward with this at this point.

@Muhammad_Umair_Baig

as you can see in the request payload it is binding http-post.

No, it's not. Please read section 3.4.1 in https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf . The ProtocolBinding you see there doesn't dictate that this request is using that binding, but instructs the IDP that the response should use that binding.

@Muhammad_Umair_Baig

this is the error i get from sso IDP: FBTSML238E The SAML message signature could not be validated.

Understood, but I have already shared with you the answer for that part:

@ikakavas

TFIM cannot verify the signature of the SAML authentication request that we are sending. We can't know why from our side, as far as we know there is no bug with our SAML request signing. You should talk to your TFIM administrator and figure out if there is more in IBM's logs or if there is a known bug and a fixpack you can apply there.