SSO not working on ECK with Oracle cloud IDP

Elastic Stack Elasticsearch
1

Hi,
I am trying to configure SSO on elasticsearch. While login, it is redirecting to the SSO auth page and asks for username and password, followed by auth code. Once the auth code is entered, I am getting 404 - not found error. Screenshot below.

image
image738×164 10.8 KB

Elasticsearch and Kibana is installed via ECK on GKE. Currently using a trial license.

Elasticsearch.yaml (Saml config below) -

 xpack.security.authc.token.enabled: true
      xpack.security.authc.realms:
        saml:
          saml1:
            order: 0
            attributes.principal: "EmailAddress"
            attributes.groups: "roles"
            nameid_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            idp.metadata.path: /usr/share/elasticsearch/config/saml/idp-saml-metadata.xml
            idp.entity_id: "https://xxxxxx.identity.oraclecloud.com:443/fed"
            sp.entity_id: "https://example.com/"
            sp.acs: "https://example.com/api/security/v1/saml/acs"
            sp.logout: "https://example.com/logout"

Above values are configured in oracle cloud identity application.

Kibana.yaml (Saml config)

	xpack.security.authc.providers:
      saml.saml1:
        order: 0
        realm: "saml1"
      basic.basic1:
        order: 1

Also, created a role-mapping

{
  "saml-role" : {
    "enabled" : true,
    "roles" : [
      "admin"
    ],
    "rules" : {
      "field" : {
        "realm.name" : "saml1"
      }
    },
    "metadata" : { }
  }
}

Kibana logs -

[INFO ][plugins.security.authentication] Performing login attempt with "saml1" provider.
[INFO ][plugins.security.authentication] Login attempt with "saml1" provider succeeded (requires redirect: true).

Please let me know what could be the possible failure reason. Thanks in advance!

3

Where did you get this URL from? It's not the one covered in our docs,

The docs advise you to use: api/security/saml/callback

See:

4

Thanks a lot! Its working now.