Hi All,
I have Updated the Elasticstack from 8.14.1 to 8.18.1.
Currently encountering error of SAML login. In our setup we are using SSO of Azure to login to Kibana.
Error I am getting in kibana logs
{"event":{"action":"user_login","category":["authentication"],"outcome":"failure"},"kibana":{"session_id":"qwertyui","authentication_provider":"kibana-realm","authentication_type":"saml"},"error":{"code":"ResponseError","message":"security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user for action [cluster:admin/xpack/security/saml/authenticate]"},"trace":{"id":"dd0bc6c3-28c9-42b1-9b5c-d4ae13810446"},"client":{"ip":"10.160.0.89"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-09-22T12:03:30.389+02:00","message":"Failed attempt to login using saml provider [name=kibana-realm]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":1181,"uptime":18037.822102144},"transaction":{"id":"123456"}}
{"event":{"action":"saved_object_open_point_in_time","category":["database"],"type":["creation"],"outcome":"unknown"},"kibana":{"space_id":"devops"},"trace":{"id":"qwertyuij"},"client":{},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-09-22T12:03:35.448+02:00","message":"User is opening point-in-time saved objects","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":1181,"uptime":18042.881158752},"transaction":{"id":"801e1475a1c5d976"}}
{"event":{"action":"saved_object_open_point_in_time","category":["database"],"type":["creation"],"outcome":"unknown"},"kibana":{"space_id":"devops"},"trace":{"id":"1234567"},"client":{},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-09-22T12:03:35.450+02:00","message":"User is opening point-in-time saved objects","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":1181,"uptime":18042.883200968},"transaction":{"id":"693bdf39eaff7e26"}}