Hi, I’m having an on-prem OpenSearch + Dashboards cluster and I’m unable to make it work with our (also on-prem) AD FS. I have it working on OpenDistro, but for some reason it’s not working with opensearch. Over the Dashboards interface I get { statusCode: 500, error: "Internal Server Error", mes…

@fuzzy_one Could you try commenting out force_authn:true and subject_key: NameID?

@pablo Thanks for the suggestion. I’ve made the changes, applied them with securityadmin.sh, restarted the cluster, but the result is the same SAML IDP initiated authentication workflow failed: Error: failed to get token

@fuzzy_one Did you notice any errors in the logs when uploading the configuration? Is the FederationMetadata.xml up to date? You have to update this file every time you make changes in the SAML configuration in ADFS. Have you tried to use metadata_url: instead?

@pablo The config push completes with no errors Security Admin v7 Will connect to 172.17.16.153:9300 ... done Connected as CN=admin.XXXXXXXXXX.com,OU=Ops,O=XXXXXX.com\, Inc.,DC=XXXXXXX.com OpenSearch Version: 1.3.1 OpenSearch Security Version: 1.3.1.0 Contacting opensearch cluster 'opensearch' ... …

I eventually found out that the FederationMetadata.xml was in the wrong location. I fixed that and now I get the following in the dashboard log {"type":"log","@timestamp":"2022-05-08T20:00:59Z","tags":["error","plugins","securityDashboards"],"pid":1782270,"message":"SAML IDP initiated authenticatio…

Issue SOLVED! The last error Unexpected token v in JSON at position 60 was actually a bit hard to investigate, and the reason was a very strange one. I managed to solve it by changing the claims policy in ADFS from Windows Account Name to UPN. The v token in the error was cause by how the SAML JSON…

@fuzzy_one The authentication should be still successful with <domain_name>\<username> format and Windows Account Name set in the claim.

I know it should, but for some reason it was returned as <domain>\\<username> and something flipped dashboards into thinking the JSON was not correctly formatted and it could not extract the value. I’ll investigate further in a few days and open up a bug report if needed. Thanks, Vlad

Hello Guys, I am struggling with the same with OpenSearch 1.2, having the same issue: Dec 06 03:03:54 wazuh-server opensearch-dashboards[9410]: {"type":"error","@timestamp":"2022-12-06T03:03:54Z","tags":["connection","client","error"],"pid":9410,"level":"error","error":{"message":"140539448248192:…

@Lord_Zetas Would you mind opening a new case and sharing your config.yml file?

AD FS auth not working

Security

Lord_Zetas December 6, 2022, 2:01pm 12

Hello @pablo
Here is the new post, thank you: SSO Integration with ADFS

Topic		Replies	Views
SSO Integration with ADFS Security troubleshoot	8	1968	December 7, 2022
Azure sso with saml issue OpenSearch troubleshoot	3	1249	November 30, 2022
Unable to configure SAML with Azure AD Security troubleshoot , configure	11	1684	December 2, 2022
HTTPSamlAuthenticator rejects login Security troubleshoot , configure	9	267	January 11, 2025
Configuration for SAML login in OpenSearch with Keycloak Security	20	1171	February 7, 2025

AD FS auth not working

Related topics