Error configuring OSD with okta saml

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):


Describe the issue:

Hello ,

I am trying to configure SAML authentication with OSD 2.5.0.

I am running OSD on port 8080 , the information I have from okta are : okta cert okta.crt , okta.xml file in in addition to okta URL .

I tried several combinations and still get this error.

Appreciate help .


config.yaml file

type: “config”
config_version: 2

anonymous_auth_enabled: false
order: 0
description: “HTTP basic authentication using the internal user database”
http_enabled: true
transport_enabled: true
type: basic
challenge: false
type: internal
order: 1
description: “SAML provider”
http_enabled: true
transport_enabled: false
type: saml
challenge: true
enable_ssl: true
metadata_file: “/usr/share/opensearch/config/opensearch-security/okta.xml”
entity_id: “
entity_id: “https://fqdn-of-server
kibana_url: “https://fqdn-of-server:8080
subject_key: UserID
roles_key: Role
type: noop

OSD config file

opensearch_security.auth.type: “saml”
#server.xsrf.whitelist: [/_plugins/_security/saml/acs,/_opendistro/_security/saml/acs,/_plugins/_security/saml/acs/idpinitiated,/_opendistro/_security/saml/acs/idpinitiated,/_plugins/_security/saml/logout,/_opendistro/_security/saml/logout]
#server.xsrf.whitelist: [“/_plugins/_security/saml/acs”, “/_plugins/_security/saml/logout”]

Relevant Logs or Screenshots:

{“type”:“log”,“@timestamp”:“2023-02-13T13:03:56Z”,“tags”:[“error”,“plugins”,“securityDashboards”],“pid”:1,“message”:“Failed to get saml header: Error: Error: failed parsing SAML config”}
{“type”:“error”,“@timestamp”:“2023-02-13T13:03:56Z”,“tags”:,“pid”:1,“level”:“error”,“error”:{“message”:“Internal Server Error”,“name”:“Error”,“stack”:“Error: Internal Server Error\n at HapiResponseAdapter.toError (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:143:19)\n at HapiResponseAdapter.toHapiResponse (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:97:19)\n at HapiResponseAdapter.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:92:17)\n at Router.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:164:34)\n at runMicrotasks ()\n at processTicksAndRejections (internal/process/task_queues.js:95:5)\n at handler (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:124:50)\n at exports.Manager.execute (/usr/share/opensearch-dashboards/node_modules/@hapi/hapi/lib/toolkit.js:60:28)\n at Object.internals.handler (/usr/share/opensearch-dashboards/node_modules/@hapi/hapi/lib/handler.js:46:20)\n at exports.execute (/usr/share/opensearch-dashboards/node_modules/@hapi/hapi/lib/handler.js:31:20)\n at Request._lifecycle (/usr/share/opensearch-dashboards/node_modules/@hapi/hapi/lib/request.js:371:32)\n at Request._execute (/usr/share/opensearch-dashboards/node_modules/@hapi/hapi/lib/request.js:281:9)”},“url”:“https://fqdn-of-server:8080/auth/saml/login?nextUrl=%2F&redirectHash=false",“message”:"Internal Server Error”}

I really appreciate any pointers to help get setup working. Thanks

I found this guide on troubleshooting:

and this topic on okta:

those may help.

@scrawfor - would you have time to assist? thanks

Hi @tru64jurus,

Thank you for taking the time to file this issue on the website. As @kris, mentioned, the two links provided may be helpful in resolving your issue. Looking at your configuration file, there are two things I noticed.

First, it may be a copy+paste issue, but you will need to make sure your configuration file is properly formatted in a yaml structure with the different levels of indentation for children elements. This means that metadata_file should be indented further then idp for example.

Second, I don’t see a specified exchange_key in your configuration file. Perhaps you have mapped the the UserID to this in some way but I would expect to see an exchange_key with for SAML since the idea is to not send credentials with each request.

If you checkout the links Kris shared you should be able to find a working configuration which can help you get started by swapping in your Okta information for the default values.

I hope this helps.



1 Like

Hi @tru64jurus !

You have commented out all of the server.xsrf.whitelist options in your opensearch_dashboards.yaml file. For SAML authentication you must provide server.xsrf.whitelist (OS v1.x) or server.xsrf.allowlist (OSv2.x). Please follow the documentation.