# X-pack Azure AD SAML auth

**URL:** <https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119>\
**Category:** Elasticsearch\
**Created:** [March 29, 2018, 4:10pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119 "2018-03-29T16:10:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_hall](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@william\_hall](https://discuss.elastic.co/u/william_hall)\
**Post date:** [March 29, 2018, 4:10pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/1 "2018-03-29T16:10:44Z")

</div>

Were having difficulty troubleshooting getting saml working with our Azure AD.  
i have been following this [thread](https://discuss.elastic.co/t/kibana-saml-authentication-issue/119420) and has been helpful and we have run into a similar issue. We are now getting a 401 error when trying to login. From the logs it seems to be a SAML metadata issues i was thinking from the metadata created by ES. i created the metadata with the cmd /usr/share/elasticsearch/bin/x-pack/saml-metadata using no options just take the configs that are entered. The SAML/Azure admin and I are both unsure why this is still an issue. Below are the error codes we get from the browser:

{"statusCode":401,"error":"Unauthorized","message":"[security\_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/saml/authenticate], with { header={ WWW-Authenticate="Basic realm=\"security\" charset=\"UTF-8\"" } } :: {"path":"/\_xpack/security/saml/authenticate","query":{},"body":"{\"ids\":[],\"content\":\

and in the ES logs we find:

The XML Signature of this SAML message cannot be validated. Please verify that the saml realm uses the correct SAMLmetadata file/URL for this Identity Provider  
[2018-03-28T21:42:39,927][WARN][o.e.x.s.a.AuthenticationService] [magellan-elasticsearch-data-qa-0.localdomain] Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML Signature [lb617vKxZbxLezNBhweFLzHNTIMM19ML...] could not be validated against [MIIC8DCCAdigAwIBAgIQOmhwXlZ+HblG/FMnDxqT7DANBgkqhkiG9w0BAQsFADA0...]])

this is our current config for ES and Kibana

elasticsearch.yml  
cluster.name: qa  
node.name: elasticsearch-data-qa-0.localdomain  
path.data: "/var/lib/elasticsearch"  
path.logs: "/var/log/elasticsearch"  
network.host: 0.0.0.0  
cloud:  
node.auto\_attributes: true  
discovery:  
zen.hosts\_provider: ec2  
ec2:  
endpoint: [ec2.us-west-2.amazonaws.com](http://ec2.us-west-2.amazonaws.com)  
host\_type: private\_ip  
groups: es-tf-qa  
tag.env: qa  
node\_cache\_time: 20s  
xpack:  
security.transport.ssl.enabled: 'true'  
security.transport.ssl.verification\_mode: certificate  
security.transport.ssl.keystore.path: "/etc/elasticsearch/es-cert.p12"  
security.transport.ssl.truststore.path: "/etc/elasticsearch/es-cert.p12"  
security.http.ssl.enabled: 'true'  
security.http.ssl.keystore.path: "/etc/elasticsearch/es-cert.p12"  
security.http.ssl.truststore.path: "/etc/elasticsearch/es-cert.p12"  
security.authc:  
token.enabled: true  
realms.saml1:  
type: saml  
order: 2  
idp.metadata.path: samles.xml  
idp.entity\_id: [https://sts.windows.net/dda1dc18-8a23-4b49-a9d4-f1d617ba8e0c/](https://sts.windows.net/dda1dc18-8a23-4b49-a9d4-f1d617ba8e0c/)  
sp.entity\_id: [https://kibana-qa.ops.example.com:5601/](https://kibana-qa.ops.example.com:5601/)  
sp.acs: [https://kibana-qa.ops.example.com:5601/api/security/v1/saml](https://kibana-qa.ops.example.com:5601/api/security/v1/saml)  
sp.logout: [https://kibana-qa.ops.example.com:5601/logout](https://kibana-qa.ops.example.com:5601/logout)  
attributes.principal: "[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn)"

# attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"

# attributes.groups: "urn:oid:1.3.6.1.4.1.5923.1.5.1."

# attributes.principal: "nameid:persistent"

# attributes.groups: "roles"

```
realms.native:
  type: native
  order: '0'

```

security.audit.enabled: 'true'

kibana.yml

server.port: 5601  
server.host: [kibana-qa.ops.example.com](http://kibana-qa.ops.example.com)  
elasticsearch.url: [https://es-qa.ops.example.com:9200](https://es-qa.ops.example.com:9200)  
elasticsearch.username: elastic  
elasticsearch.password: Password  
server.ssl.cert: /usr/local/kibana-6.2.3/config/star\_ops\_example\_com.bundle\_crt  
server.ssl.key: /usr/local/kibana-6.2.3/config/star\_ops\_example\_com.key  
logging.dest: /var/log/kibana.log  
xpack.security.authProviders: [saml]  
xpack.reporting.enabled: true  
server.xsrf.whitelist: [/api/security/v1/saml]

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 29, 2018, 4:34pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/2 "2018-03-29T16:34:10Z")

</div>

Hi William

The error you get says that Elasticsearch can't validate the digital signature of the SAML response. This most probably means that the SAML Response is signed with a different private key than the one that corresponds to the public key that is published in your IDPs metadata .

You can set trace log for SAML in elasticsearch using

```auto
curl -H "Content-Type: application/json" -XPUT -uelastic 'https://es-qa.ops.example.com:9200/_cluster/settings' -d'
{
 "transient" : {
     "logger.org.elasticsearch.xpack.security.authc.saml" : "TRACE"
 }
}'

```

This will print the whole SAML response elasticsearch receives in your logs and that response will contain the public key (certificate) that corresponds to the private key that the IDP used to sign it. You can then cross check it with the public key(certificate) that is contained in the IDP metadata in `samles.xml`.

In any case the trace log will allow us to get a better insight as to what the issue at hand is.

---

<div class="post-metadata">

**Author:** ![william\_hall](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@william\_hall](https://discuss.elastic.co/u/william_hall)\
**Post date:** [March 29, 2018, 5:12pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/3 "2018-03-29T17:12:22Z")

</div>

also worth mentioning our general ES architecture all AWS EC2 instances, we have 3 ES nodes behind and AWS ELB load balancer which is [es-qa.ops.example.com](http://es-qa.ops.example.com) and the kibana instance is a separate node as well from the 3 ES nodes.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 29, 2018, 5:34pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/4 "2018-03-29T17:34:05Z")

</div>

Thanks for the update. It will probably help down the line with troubleshooting but for now this looks like a SAML related misconfiguration. Let's verify that the metadata you have for the IDP ( `samles.xml` ) is correct and the values in there are what the IDP actually uses for signing with the process I described above and we'll take it from there.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 29, 2018, 11:55pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/5 "2018-03-29T23:55:57Z")

</div>

> [@william\_hall](#):
>
> From the logs it seems to be a SAML metadata issues i was thinking from the metadata created by ES.

I think this is where you've gone wrong. By my recollection, Azure AD doesn't have any way to import metadata from service providers (but I could be wrong there, it's been a while since I used Azure).

You didn't by any chance use the output from `saml-metadata` as your `samles.xml` did you?  
The `idp.metadata.path` needs to point to a file that you downloaded from Azure.

---

<div class="post-metadata">

**Author:** ![william\_hall](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@william\_hall](https://discuss.elastic.co/u/william_hall)\
**Post date:** [April 2, 2018, 2:56pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/6 "2018-04-02T14:56:23Z")

</div>

The samles.xml is downloaded from Azure and is not the metadata file that is generated with the saml-metadata command.

I am going to use the curl cmd Ioannis provided to ensure the keys are matching

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2018, 2:56pm UTC](https://discuss.elastic.co/t/x-pack-azure-ad-saml-auth/126119/7 "2018-04-30T14:56:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.