# SSO and Subscription **URL:** \ **Category:** Elasticsearch\ **Created:** [December 9, 2021, 12:27am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275 "2021-12-09T00:27:38Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![suren\_es](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Post date:** [December 9, 2021, 12:27am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/1 "2021-12-09T00:27:38Z")
I did download ELK stack tarballs, installed, configured. All is working fine. But when I started enabling SSO (via parameter xpack.security.authc.realms.oidc.oidc1 in config file), it says that this is not possible without subscription. My questions: 1. Is license required to enable SSO? 2. If license is purchased, what do I get (maybe some license code that I can input somewhere in the config file)? 3. Is it still possible to use these tarballs with subscription without moving to Elastic cloud? Please help. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 9, 2021, 2:09am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/2 "2021-12-09T02:09:52Z")
Yes, to be able to use SSO you need at least a Platinum License, the only authentication method included in the free and basic license is the native realm. The license for self-hosted environments is a JSON file that you can update using the [license API](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-license.html#update-license) endpoint, you do not need to use elastic cloud, you can purchase a license for an on-premises/self-hosted cluster. You can know more abou the features included in each license tier on the [subscription page](https://www.elastic.co/subscriptions). ---
**Author:** ![suren\_es](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Post date:** [December 9, 2021, 2:19am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/3 "2021-12-09T02:19:52Z")
Thanks for quick response. I just signed for trial subscription. And I don't see any JSON file with license key to just test if it works. How to test what I wanted in a trial period? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 9, 2021, 2:38am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/4 "2021-12-09T02:38:03Z")
Signed where? To start a trial on a self-managed installation you need to make a request using the [license API](https://www.elastic.co/guide/en/elasticsearch/reference/current/start-trial.html#start-trial). ```auto POST /_license/start_trial ``` This will change your license from basic to the trial one, it will give all features for 30 days. You only get a file with a license if you buy one from Elasticsearch and have a self-manages installation, you do not get this if you start the trial using the above request or runs it in the elastic cloud, as a license is already included (but not the platinum one). ---
**Author:** ![suren\_es](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Post date:** [December 9, 2021, 3:08am UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/5 "2021-12-09T03:08:56Z")
Thanks, it worked with that POST API call. Will explore further and come back with any questions. Earlier I signed up at Elastic Cloud. ---
**Author:** ![suren\_es](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Post date:** [December 9, 2021, 1:31pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/6 "2021-12-09T13:31:56Z")
@leandrojmp With this type of license activation, we don't have to use Elastic Cloud, but just pay flat $22 per month? Is that correct? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 9, 2021, 1:46pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/7 "2021-12-09T13:46:50Z")
No, if you do not use Elastic Cloud, you need to buy a license for your self-managed cluster, for that you need to get in touch with elastic, only they can give you an estimated of the price. If you used `POST /_license/start_trial` in your self-managed cluster, you activated the trial license, this will work for 30 days, after that time it will stop working and you will need to revert to the basic license. ---
**Author:** ![suren\_es](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@suren\_es](https://discuss.elastic.co/u/suren_es)\ **Post date:** [December 9, 2021, 2:13pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/8 "2021-12-09T14:13:36Z")
Okay, I now see some errors. What's the expectation here? Do I need to create a user kibana\_system in my IdP? Also I expect the UI to use my logged-in user and should direct to the Kibana UI home page if the user exists and has a role as defined in my IdP and Elasticsearch. The Kibana UI now goes to login page. ```auto [2021-12-09T13:51:29,780][ERROR][o.e.x.s.a.e.ReservedRealm] [esmaster1] failed to retrieve password hash for reserved user [kibana_system] org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index [.security-7] is unavailable at org.elasticsearch.xpack.security.support.SecurityIndexManager.getUnavailableReason(SecurityIndexManager.java:148) ~[x-pack-security-7.14.0.jar:7.14.0] at org.elasticsearch.xpack.security.authc.esnative.NativeUsersStore.getReservedUserInfo(NativeUsersStore.java:492) [x-pack-security-7.14.0.jar:7.14.0] at org.elasticsearch.xpack.security.authc.esnative.ReservedRealm.getUserInfo(ReservedRealm.java:220) [x-pack-security-7.14.0.jar:7.14.0] at org.elasticsearch.xpack.security.authc.esnative.ReservedRealm.doAuthenticate(ReservedRealm.java:96) [x-pack-security-7.14.0.jar:7.14.0] at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.authenticateWithCache(CachingUsernamePasswordRealm.java:188) [x-pack-security-7.14.0.jar:7.14.0] [2021-12-09T13:51:29,792][INFO][o.e.x.s.a.AuthenticationService] [esmaster1] Authentication of [kibana_system] was terminated by realm [reserved] - failed to authenticate user [kibana_system] ``` ```auto POST /_cat/shards/.security-7?v index shard prirep state docs store ip node .security-7 0 p STARTED 72 172.1kb 10.45.11.47 esdata1 ``` xpack config settings: ```auto xpack.security.authc.token.enabled: true xpack.security.authc.realms.oidc.oidc1: order: 2 rp.client_id: "xxx" rp.response_type: code rp.redirect_uri: "xxx" op.issuer: "xxx" op.authorization_endpoint: "xxx" op.token_endpoint: "xxx" op.jwkset_path: "xxx" op.userinfo_endpoint: "hxxx" op.endsession_endpoint: "xxx" rp.post_logout_redirect_uri: "xxx" claims.principal: sub claims.groups: "" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2022, 2:14pm UTC](https://discuss.elastic.co/t/sso-and-subscription/291275/9 "2022-01-06T14:14:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.