SAML with Azure AD

[hmayer (Heinz Mayer)]

I wanted to share my SAML configuration with Azure AD
No documentation I found is 100% correct
In a hot-warm deployment you must configure both elasticsearch instances

Elasticsearch config

xpack:
security:
authc:
realms:
saml:
cloud-saml:
order: 2
attributes.principal: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"
idp.metadata.path: "https://login.microsoftonline.com/tenant-id/federationmetadata/2007-06/federationmetadata.xml?appid=application-id"
idp.entity_id: "https://sts.windows.net/tenant-id/"
sp.entity_id: "https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/"
sp.acs: "https://1234567.eu-central-1.aws.cloud.es.ioeu-central-1.aws.cloud.es.io:9243/api/security/v1/saml"
sp.logout: "https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/logout"

Kibana config

xpack.security.authProviders: [ "saml", "basic" ]
server.xsrf.whitelist: [ "/api/security/v1/saml" ]
xpack.security.public:
protocol: "https"
hostname: "1234567.eu-central-1.aws.cloud.es.io"
port: 9243

[Alex_Piggott]

Really appreciate this, thanks!

What were the docs that were wrong? Was is just that you had to do it in 2 places for hot-warm (the need to do everything under all topologies is something we're addressing soon)

[hmayer (Heinz Mayer)]

type: saml -> does not work with newer versions of elasticsearch

attributes.principal: "nameid:persistent" -> that does not work with Azure AD, even if you set nameid persistent in the Azure config

[ikakavas (Ioannis Kakavas)]

@hmayer

type: saml -> does not work with newer versions of elasticsearch

This is true because the realm configuration syntax changed slightly in 7.0 for Elasticsearch and it is not very easy to document for Elastic Cloud as it supports multiple versions of Elasticsearch. We are working on it and we will update the documentation accordingly.

@hmayer

attributes.principal: "nameid:persistent" -> that does not work with Azure AD, even if you set nameid persistent in the Azure config

Can you please share with us what "does not work" meant in your case ? By the way, if you refer to the docs in Secure your clusters with SAML | Elasticsearch Service Documentation | Elastic, we - attempt to - clearly state that nameid:persistent is only used as an example of how attributes.principal can be configured and we point to the relevant docs explaining the options you have.

Defines the SAML attribute that is going to be mapped to the principal (username) of the authenticated user in Kibana. In this example, nameid:persistent maps the NameID with the urn:oasis:names:tc:SAML:2.0:nameid-format:persistent format from the Subject of the SAML Assertion. See the attribute mapping documentation for details and available options

We'd be more than happy to get your feedback regarding whether you still found this unclear and why.

[forloop (Russ Cam)]

@hmayer This may help in determining what claims are supported by Azure Active Directory, by default:

SAML configuration - Azure Active Directory

I see a couple of potential issues: I believe these also must include the port (even though you're using the default HTTPS port of 443). These values do not look like ones that are typically found within the claims that Azure Active Directory supports. If you request the App Federation Metadata URL to retrieve the XML that lists the supported claims, amongst other metadata, it'll look something like <?xml version="1.0" encoding="ISO-8859-1"?> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML…

[hmayer (Heinz Mayer)]

For me it was not clear that I could not use
attributes.principal: "nameid:persistent" with Azure AD

The mapping "nameid:persistent" does not work with Azure AD