# Unable to set up SAML on elastic cloud 7.9 deployment **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [November 20, 2020, 11:38pm UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203 "2020-11-20T23:38:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![cguerrero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cguerrero/32/79430_2.png) [@cguerrero](https://discuss.elastic.co/u/cguerrero)\ **Post date:** [November 20, 2020, 11:38pm UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203/1 "2020-11-20T23:38:45Z")
Deployment ID: 020c87b v7.9.3 I keep running into the following error while trying to authenticate to kibana on an elastic cloud deployment, using SAML (OneLogin). ```auto Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML response pfx0e3d66c7-9838-3d32-cc90-3f9a4c795988 is for destination null but this realm uses https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243/api/security/v1/saml]) ``` **OneLogin Setup:** ```auto ACS URL - https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243/api/security/v1/saml SAML nameID format - Persistent SAML issuer type - Specific SAML signature element - Response Issuer URL - https://app.onelogin.com/saml/metadata/7f1a1ba1-f3c8-4faa-86ee-1990b1e0beaf ``` **Elasticsearch.yml user settings** ```auto xpack: security: authc: realms: saml: saml1: order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "https://app.onelogin.com/saml/metadata/7f1a1ba1-f3c8-4faa-86ee-1990b1e0beaf" idp.entity_id: "https://app.onelogin.com/saml/metadata/7f1a1ba1-f3c8-4faa-86ee-1990b1e0beaf" sp.entity_id: "https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243" sp.acs: "https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243/api/security/v1/saml" sp.logout: "https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243/logout" ``` **kibana.yml user settings** ```auto xpack.security.authc.providers: saml.saml1: order: 2 realm: saml1 description: "Log in with OneLogin" basic.basic1: order: 0 ``` Every related doc/post I can find indicates that Kibana is not generating the correct ACS URL to match with what elasticsearch is configured with. But in those cases, it seems the resolution has always been to confirm the acs is exactly the same configured on the IdP side and the elasticsearch side. I have confirmed this multiple times but keep running into this error. Is there anything noticeable within the configs I pasted that might explain why I keep seeing this error? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 22, 2020, 11:30am UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203/2 "2020-11-22T11:30:48Z")
I think your Identity Provider is misconfigured or its implementation has a bug. It looks like it adds a `Destination` element to the signed SAML Response with a value of `null` ( as in the String "null" ) The [standard - 3.5.5.2](https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf) and [3.2.2](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) mentions that the Destination element is optional and should only be verified when the SAML Response is signed. Since your SAML Response is signed, and the `Destination` element has a value, we attempt to verify it's value and fail to do so as the expected value would be `https://e1074d7a2b5a463cb1ae0a2ff799cc3d.us-east-1.aws.found.io:9243/api/security/v1/saml` for your deployment. I would look into your One Login configuration to see if you can add a value for `Destination` or if there is an option to not include it in the SAML Response at all. If none is available, I would suggest that you open a support ticket with them so that they can fix their configuration/implementation if need be. You can reference this post here in your ticket if need be. A short term workaround would be to configure One Login to sign the SAML Assertion instead of the SAML Response but I would **not** suggest that as a permanent setup. ---
**Author:** ![cguerrero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cguerrero/32/79430_2.png) [@cguerrero](https://discuss.elastic.co/u/cguerrero)\ **Post date:** [November 23, 2020, 5:55am UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203/3 "2020-11-23T05:55:47Z")
@ikakavas - Thanks a lot. Following your advice to focus on the IdP side, I was able to find what exactly was wrong. It turns out OneLogin config for this was missing the Recipient field which seems to translate to the Destination element as it started working once I added this field. Cheers. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2020, 5:55am UTC](https://discuss.elastic.co/t/unable-to-set-up-saml-on-elastic-cloud-7-9-deployment/256203/4 "2020-12-21T05:55:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.