# Unable to enable saml for cloud deployment with Azure **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [November 9, 2022, 8:01am UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517 "2022-11-09T08:01:13Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\ **Post date:** [November 9, 2022, 8:01am UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/1 "2022-11-09T08:01:13Z")
Hello There, I am trying to enable saml for cloud deployment running with 8.3.2 version by following the below docs > **[Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide...](https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-guide-stack.html)** > **[Set up SAML with Azure Active Directory | Elasticsearch Service Documentation...](https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-saml-azure.html)** As a first step I am trying to add the below configuration in elasticsearch yml file. ```auto xpack.security.authc.realms.saml.saml1: order: 2 idp.metadata.path: "https://login.microsoftonline.com/ ****************/federationmetadata/2007-06/federationmetadata.xml?appid=******** 1" idp.entity_id: "http://stfs.bosch.com/adfs/services/trust" sp.entity_id: "https://name.kb.westeurope.azure.elastic-cloud.com:**" sp.acs: "https://name.kb.westeurope.azure.elastic-cloud.com:**/api/security/saml/callback" sp.logout: "https://name.kb.westeurope.azure.elastic-cloud.com:**/logout" attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1" attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1." ``` Since the above onw dint worked tried the below one (More or less same ) ```auto xpack.security.authc.realms.saml.kibana-realm: order: 2 attributes.principal: nameid attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" idp.metadata.path: "https://login.microsoftonline.com/ *******/federationmetadata/2007-06/federationmetadata.xml?appid=***** 51" idp.entity_id: "http://stfs.bosch.com/adfs/services/trust" sp.entity_id: "https://name.kb.westeurope.azure.elastic-cloud.com:**" sp.acs: "https://name.kb.westeurope.azure.elastic-cloud.com:**/api/security/saml/callback" sp.logout: "https://name.kb.westeurope.azure.elastic-cloud.com:**/logout" ``` However the deployment does not accept the above configuration and after cluster restart I could not see the above settigs in deployment. Any inputs on this topic from anyone ? why does the deployment does not accept the configuration. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 10, 2022, 12:30am UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/2 "2022-11-10T00:30:51Z")
> However the deployment does not accept the above configuration and after cluster restart I could not see the above settigs in deployment. You have to be more specific on what error you are having. What do you mean by "deployment does not accept above configuration"? Some configuration error will cause node to fail to start. Is that what you experiencing? Also, what does it mean "I could not see the above settigs in deployment"? How did you check that? Did you encounter any error? If so, what are the exact error messages (both from response and server logs)? ---
**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\ **Post date:** [November 10, 2022, 4:24pm UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/3 "2022-11-10T16:24:38Z")
Hello Yang, I dont see any error for this. After saving the setting cluster became unhealthy stating last configuration could not be applied. ```auto There was a problem applying this configuration change Please try again and if the problem persists contact Support. Plan change failed: Some instances were not running ``` After this error when i check the elasticsearch yml file I could not find the settings which i have added. Since it is on elastic cloud we are not able to see inside the node what went wrong. And I am wondering if the settings is correct. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 14, 2022, 12:35am UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/4 "2022-11-14T00:35:32Z")
> [@Jude\_Jerome](#): > > Since it is on elastic cloud we are not able to see inside the node what went wrong. And I am wondering if the settings is correct. Since you are on Elastic Cloud, I encourage you use your support contract and raise it to the support team (as suggested in the error message). The support team has experts and dedicated toolings that can make troubleshooting much easier than on the forum. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 11, 2022, 9:05pm UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/5 "2022-12-11T21:05:17Z")
---
**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\ **Post date:** [December 14, 2022, 1:33pm UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/6 "2022-12-14T13:33:38Z")
I think we have figured out to resolve this issue. The problem is unlike enterprise setting the attribute setting ```auto attributes.principal: nameid ``` Is not acceptable. Hence we need to change it to attributes.groups: "[http://schemas.microsoft.com/ws/2008/06/identity/claims/groups](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups)" Post that settings were accepted and saml enabled ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 11, 2023, 1:34pm UTC](https://discuss.elastic.co/t/unable-to-enable-saml-for-cloud-deployment-with-azure/318517/7 "2023-01-11T13:34:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.