# SAML with Azure AD **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 29, 2019, 4:42pm UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388 "2019-05-29T16:42:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hmayer](https://avatars.discourse-cdn.com/v4/letter/h/7ab992/32.png) [@hmayer](https://discuss.elastic.co/u/hmayer)\ **Post date:** [May 29, 2019, 4:42pm UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/1 "2019-05-29T16:42:40Z")
I wanted to share my SAML configuration with Azure AD No documentation I found is 100% correct In a hot-warm deployment you must configure both elasticsearch instances Elasticsearch config xpack: security: authc: realms: saml: cloud-saml: order: 2 attributes.principal: "[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name)" attributes.groups: "[http://schemas.microsoft.com/ws/2008/06/identity/claims/groups](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups)" idp.metadata.path: "[https://login.microsoftonline.com/tenant-id/federationmetadata/2007-06/federationmetadata.xml?appid=application-id](https://login.microsoftonline.com/tenant-id/federationmetadata/2007-06/federationmetadata.xml?appid=application-id)" idp.entity\_id: "[https://sts.windows.net/tenant-id/](https://sts.windows.net/tenant-id/)" sp.entity\_id: "[https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/](https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/)" sp.acs: "[https://1234567.eu-central-1.aws.cloud.es.ioeu-central-1.aws.cloud.es.io:9243/api/security/v1/saml](https://1234567.eu-central-1.aws.cloud.es.ioeu-central-1.aws.cloud.es.io:9243/api/security/v1/saml)" sp.logout: "[https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/logout](https://1234567.eu-central-1.aws.cloud.es.io.eu-central-1.aws.cloud.es.io:9243/logout)" Kibana config xpack.security.authProviders: ["saml", "basic"] server.xsrf.whitelist: ["/api/security/v1/saml"] xpack.security.public: protocol: "https" hostname: "[1234567.eu-central-1.aws.cloud.es.io](http://1234567.eu-central-1.aws.cloud.es.io)" port: 9243 ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [May 29, 2019, 6:04pm UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/2 "2019-05-29T18:04:16Z")
Really appreciate this, thanks! What were the docs that were wrong? Was is just that you had to do it in 2 places for hot-warm (the need to do everything under all topologies is something we're addressing soon) ---
**Author:** ![hmayer](https://avatars.discourse-cdn.com/v4/letter/h/7ab992/32.png) [@hmayer](https://discuss.elastic.co/u/hmayer)\ **Post date:** [May 31, 2019, 8:43am UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/3 "2019-05-31T08:43:39Z")
type: saml -\> does not work with newer versions of elasticsearch attributes.principal: "nameid:persistent" -\> that does not work with Azure AD, even if you set nameid persistent in the Azure config ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 3, 2019, 4:36pm UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/4 "2019-06-03T16:36:24Z")
> [@hmayer](#): > > type: saml -\> does not work with newer versions of elasticsearch This is true because the realm configuration syntax changed slightly in 7.0 for Elasticsearch and it is not very easy to document for Elastic Cloud as it supports multiple versions of Elasticsearch. We are working on it and we will update the documentation accordingly. > [@hmayer](#): > > attributes.principal: "nameid:persistent" -\> that does not work with Azure AD, even if you set nameid persistent in the Azure config Can you please share with us what "does not work" meant in your case ? By the way, if you refer to the docs in [Secure your clusters with SAML | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-SAML.html), we - attempt to - clearly state that `nameid:persistent` is _only_ used _as an example_ of how `attributes.principal` can be configured and we point to the relevant docs explaining the options you have. > Defines the SAML attribute that is going to be mapped to the principal (username) of the authenticated user in Kibana. In this example, `nameid:persistent` maps the `NameID` with the `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` format from the Subject of the SAML Assertion. See [the attribute mapping documentation](https://www.elastic.co/guide/en/elastic-stack-overview/master/saml-guide-authentication.html#saml-attribute-mapping) for details and available options We'd be more than happy to get your feedback regarding whether you still found this unclear and why. ---
**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\ **Post date:** [June 4, 2019, 1:26am UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/5 "2019-06-04T01:26:48Z")
@hmayer This may help in determining what claims are supported by Azure Active Directory, by default: > [@SAML configuration - Azure Active Directory](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314/2): > > I see a couple of potential issues: I believe these also must include the port (even though you're using the default HTTPS port of 443). These values do not look like ones that are typically found within the claims that Azure Active Directory supports. If you request the App Federation Metadata URL to retrieve the XML that lists the supported claims, amongst other metadata, it'll look something like \ \ **Author:** ![hmayer](https://avatars.discourse-cdn.com/v4/letter/h/7ab992/32.png) [@hmayer](https://discuss.elastic.co/u/hmayer)\ **Post date:** [June 4, 2019, 9:50am UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/6 "2019-06-04T09:50:52Z") For me it was not clear that I could not use attributes.principal: "nameid:persistent" with Azure AD The mapping "nameid:persistent" does not work with Azure AD ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 18, 2019, 9:50am UTC](https://discuss.elastic.co/t/saml-with-azure-ad/183388/7 "2019-06-18T09:50:53Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.