# SAML with Onelogin

**URL:** <https://discuss.elastic.co/t/saml-with-onelogin/203524>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 14, 2019, 9:07pm UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524 "2019-10-14T21:07:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakobant](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@jakobant](https://discuss.elastic.co/u/jakobant)\
**Post date:** [October 14, 2019, 9:07pm UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/1 "2019-10-14T21:07:29Z")

</div>

I am currently trying to get SAML auth working with OneLogin .  
Version : Elastic Cloud Cluster 7.4

```auto
{"statusCode":401,"error":"Unauthorized","message":"[security_exception] unable to authenticate user [<unauthenticated-saml-user>] for action [cluster:admin/xpack/security/saml/authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } }"}

```

Elasticsearch config:

```auto
xpack:
  security:
    authc:
      realms:
        saml: 
          cloud-saml: 
            order: 2
            attributes.principal: "nameid:persistent" 
            attributes.groups: "groups" 
            idp.metadata.path: "https://app.onelogin.com/saml/metadata/xxx" 
            idp.entity_id: "https://app.onelogin.com/saml/metadata/xxx" 
            sp.entity_id: "https://8e1d.us-east-1.aws.found.io:9243/" 
            sp.acs: "https://8e1d.us-east-1.aws.found.io:9243/api/security/v1/saml"
            sp.logout: "https://8e1d.us-east-1.aws.found.io:9243/logout"

```

Kibana config:

```auto
xpack.security.authc.providers: [saml, basic]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.authc.saml.realm: cloud-saml

```

SAML Stuff for /api/security/v1/saml

```auto
<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="Rf6dd186d758d8bba33ea4d110d8990b2958ce5a8" Version="2.0" IssueInstant="2019-10-14T22:02:47Z" Destination="{recipient}" InResponseTo="_f39ff7cc60b3fb475bc0d4d1c51e8369fe3b99c4">
   <saml:Issuer>https://app.onelogin.com/saml/metadata/13e12235-b801-4ff4-85c6-5cadc0ee3890</saml:Issuer>
   <samlp:Status>
      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
   </samlp:Status>
   <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfxd6935572-7039-d89c-e643-c11bbd71491d" IssueInstant="2019-10-14T22:02:47Z">
      <saml:Issuer>https://app.onelogin.com/saml/metadata/13e12235-b801-4ff4-85c6-5cadc0ee3890</saml:Issuer>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
         <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#pfxd6935572-7039-d89c-e643-c11bbd71491d">
               <ds:Transforms>
                  <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                  <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
               </ds:Transforms>
               <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
               <ds:DigestValue>xxx</ds:DigestValue>
            </ds:Reference>
         </ds:SignedInfo>
         <ds:SignatureValue></ds:SignatureValue>
         <ds:KeyInfo>
            <ds:X509Data>
               <ds:X509Certificate>ccccc</ds:X509Certificate>
            </ds:X509Data>
         </ds:KeyInfo>
      </ds:Signature>
      <saml:Subject>
         <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">jakobant@gmail.com</saml:NameID>
         <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml:SubjectConfirmationData NotOnOrAfter="2019-10-14T22:05:47Z" Recipient="{recipient}" InResponseTo="_f39ff7cc60b3fb475bc0d4d1c51e8369fe3b99c4" />
         </saml:SubjectConfirmation>
      </saml:Subject>
      <saml:Conditions NotBefore="2019-10-14T21:59:47Z" NotOnOrAfter="2019-10-14T22:05:47Z">
         <saml:AudienceRestriction>
            <saml:Audience>{audience}</saml:Audience>
         </saml:AudienceRestriction>
      </saml:Conditions>
      <saml:AuthnStatement AuthnInstant="2019-10-14T22:02:46Z" SessionNotOnOrAfter="2019-10-15T22:02:47Z" SessionIndex="_47fbf670-d0fc-0137-c88e-31b1babba584">
         <saml:AuthnContext>
            <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
         </saml:AuthnContext>
      </saml:AuthnStatement>
      <saml:AttributeStatement>
         <saml:Attribute Name="groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml:AttributeValue xsi:type="xs:string">asdf</saml:AttributeValue>
         </saml:Attribute>
      </saml:AttributeStatement>
   </saml:Assertion>
</samlp:Response>

```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 15, 2019, 1:52am UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/2 "2019-10-15T01:52:33Z")

</div>

I'm sorry you're going to need to give more details in order for us to be able to help you.

- What environment are you running in? Your config has `cloud-saml` - are you running on the Elastic Cloud Elasticsearch Service?
- What do the elasticsearch logs say?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 15, 2019, 3:59am UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/3 "2019-10-15T03:59:28Z")

</div>

Please don't post unformatted code, logs, or configuration as it's very hard to read.

Instead, paste the text and format it with \</\> icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

You have configured elasticsearch to try an extract a NameId with persistent (`"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"` ) format from the Subject of the SAML Assertion in order to map it as the user's principal

```auto
attributes.principal: "nameid:persistent"

```

but your IDP is sending a NameId with transient format

```auto
<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">jakobant@gmail.com</saml:NameID>

```

Either configure your IDP to change the format of the NameId it sends, or change your configuration to

```auto
attributes.principal: "nameid"

```

---

<div class="post-metadata">

**Author:** ![jakobant](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@jakobant](https://discuss.elastic.co/u/jakobant)\
**Post date:** [October 15, 2019, 8:15am UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/4 "2019-10-15T08:15:13Z")

</div>

Thank you for your reply.

I am rather new to SAML and there is a lot of material to read up on.

I will look into the IDP the Onelogin service has and see how I can change it.

---

<div class="post-metadata">

**Author:** ![jakobant](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@jakobant](https://discuss.elastic.co/u/jakobant)\
**Post date:** [October 15, 2019, 8:16am UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/5 "2019-10-15T08:16:59Z")

</div>

Yes, I am running on the Elastic Cloud Elasticsearch service.  
There are not much error, warn to gain from the logs.  
Perhaps there is a way to enable more logging in the cloud services that I could access.

---

<div class="post-metadata">

**Author:** ![jakobant](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@jakobant](https://discuss.elastic.co/u/jakobant)\
**Post date:** [October 15, 2019, 10:12pm UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/6 "2019-10-15T22:12:23Z")

</div>

After various trial and error, I gave up on the Cloud... for a while.

Installed elasticsearch and kibana with docker-compose to get the debugging logs that I needed.  
(in basic started from : [http://codingfundas.com/setting-up-elasticsearch-6-8-with-kibana-and-x-pack-security-enabled/index.html](http://codingfundas.com/setting-up-elasticsearch-6-8-with-kibana-and-x-pack-security-enabled/index.html) with few tweeks)  
Enable trial license... .i.e. [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/start-trial.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/start-trial.html)

docker-compose.yml

```auto
version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.4.0
    environment:
      - discovery.type=single-node
      - logger.level=DEBUG
    ports:
      - 9200:9200
    volumes:
      - ./elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      - ./elastic-certificates.p12:/usr/share/elasticsearch/config/elastic-certificates.p12
      - ./docker-data-volumes/elasticsearch:/usr/share/elasticsearch/data

  kibana:
    depends_on:
      - elasticsearch
    image: docker.elastic.co/kibana/kibana:7.4.0
    ports:
      - 5601:5601
    volumes:
      - ./kibana.yml:/usr/share/kibana/config/kibana.yml

```

elasticsearch.yml

```auto
cluster.name: my-elasticsearch-cluster
network.host: 0.0.0.0
#xpack.security.enabled: true
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.keystore.type: PKCS12
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.type: PKCS12
xpack.security.authc.token.enabled: true
xpack.security.authc.realms:
  saml:
    saml1:
      order: 2
      idp.metadata.path: "https://app.onelogin.com/saml/metadata/xxxxx"
      idp.entity_id: "https://app.onelogin.com/saml/metadata/xxxxx"
      sp.entity_id: "http://localhost:5601/"
      sp.acs: "http://localhost:5601/api/security/v1/saml"
      sp.logout: "http://localhost:5601/logout"
      attributes.principal: "nameid"
      attributes.groups: "memberOf"
      attributes.name: "name"

```

kibana.yml

```auto
server.name: kibana
server.host: "0"
elasticsearch.hosts: ["http://elasticsearch:9200"]
elasticsearch.username: kibana
elasticsearch.password: xxxxxxxxxxx

xpack.security.authc.providers: [saml, basic]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.authc.saml.realm: saml1

```

OneLogin setup:

 ![53](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3c0ca7a433729c3d932f4c1c72ca50152ef520df.png)  
 ![52](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad172dadbda97bf4a9c919c4b22d8c7dda8c2373.png)

**The basic error that I was getting was because of the missing/lacking "Audience" and "Recipient" with the OneLogin configuration**  
The lack of debugging from the cloud is not good.

Implemented for the [elastic.co](http://elastic.co) Cloud Elasticsearch .....

End results for the cloud:

```auto
xpack:
  security:
    authc:
      realms:
        saml: 
          cloud-saml: 
            order: 2
            attributes.principal: "nameid"
            attributes.groups: "memberOf"
            attributes.name: "name"
            idp.metadata.path: "https://app.onelogin.com/saml/metadata/xxxxx"
            idp.entity_id: "https://app.onelogin.com/saml/metadata/xxxxx"
            sp.entity_id: "https://kibana....us-east-1.aws.found.io:9243/"
            sp.acs: "https://kibana.....us-east-1.aws.found.io:9243/api/security/v1/saml"
            sp.logout: "https://kibana....us-east-1.aws.found.io:9243/logout"

```

```auto
xpack.security.authc.providers: [saml, basic]
server.xsrf.whitelist: [/api/security/v1/saml]
xpack.security.authc.saml.realm: cloud-saml

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2019, 10:12pm UTC](https://discuss.elastic.co/t/saml-with-onelogin/203524/7 "2019-11-12T22:12:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.