# SAML/Okta login to Kibana not working with roles **URL:** \ **Category:** Security\ **Created:** [April 14, 2020, 3:18pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588 "2020-04-14T15:18:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![clsa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/clsa/32/582_2.png) [@clsa](https://forum.opensearch.org/u/clsa)\ **Post date:** [April 14, 2020, 3:18pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/1 "2020-04-14T15:18:50Z")
I’m using v1.3.0 of the Docker images. I can successfully login to Kibana if I configure Kibana/ES for login with SAML/Okta **without** roles ```nohighlight # config.yml authc: basic_internal_auth_domain: ... saml_auth_domain: http_enabled: true transport_enabled: false order: 1 http_authenticator: type: saml challenge: true config: idp: entity_id: metadata_file: okta-metadata.xml sp: entity_id: kibana-saml kibana_url: #roles_key: Roles exchange_key: authentication_backend: type: noop # removed authz ``` But if I add `roles_key: Roles` and change `roles_mapping.yml` to ```nohighlight # roles_mapping.yml ... kibana_user: reserved: false backend_roles: - "kibanauser" - "myrole2" description: "Maps kibanauser to kibana_user" users: - "*" ... ``` and try to login I get redirected to the login page again without error message in the UI. In the logs I can see that the roles are returned by Okta and parsed correctly by the security plugin. ```auto [TRACE][c.a.o.s.a.BackendRegistry] [myhost] Try to extract auth creds from saml http authenticator [DEBUG][c.a.o.s.a.BackendRegistry] [myhost] Rest user 'User [name=myusername, backend_roles=[myrole1, myrole2, ....], requestedTenant=null]' is authenticated ``` It seems like the roles are not evaluated. Kibana is configured with ```nohighlight # kibana.yml --- server.name: kibana server.host: "0" opendistro_security.auth.type: "saml" server.xsrf.whitelist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout"] ``` For debugging I added ```nohighlight # log4j2.properties logger.token.name = com.amazon.dlic.auth.http.saml.Token logger.token.level = debug logger.opendistro_security_br.name = com.amazon.opendistroforelasticsearch.security.auth.BackendRegistry logger.opendistro_security_br.level = trace opendistro_security.audit.config.log4j.logger_name = auditlogger opendistro_security.audit.config.log4j.level = INFO ``` What am I doing wrong? How can I debug this any further? ---
**Author:** ![jovant](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@jovant](https://forum.opensearch.org/u/jovant)\ **Post date:** [May 25, 2020, 10:22pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/2 "2020-05-25T22:22:01Z")
Hi Clifford, If you remember we have discussed on my post recently also ([Unable to configure SAML with Jumpcloud and Opendistro](https://forum.opensearch.org/t/unable-to-configure-saml-with-jumpcloud-and-opendistro/2776)), I was using Jumpcloud instead of Okta. However, I wanted to try your approach and wanted to see will it work. 1. I created new Okta trial account, I will upload pictures of the configuration. ![Screenshot_4](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/ca697a6aa7946bfbd896302f0cf9a3430c9d1b66.png) ![Screenshot_5](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/bb5654160371334518b492eb29d2ee4749d6b497.png) 2. From Opendistro side, my configuration is absolutely same, except for secret stuff of course (exchange\_key of 32 characters, Okta`s idp entity\_id, kibana\_url). I had “roles\_key: Roles” both commented and uncommented. 3. I have not changed roles\_mapping.yml. 4. I have also followed these two articles: [Add Single Sign-On (SSO) to Open Distro for Elasticsearch Kibana using SAML and Okta | AWS Open Source Blog](https://aws.amazon.com/pt/blogs/opensource/open-distro-for-elasticsearch-saml-okta/) [Add Single Sign-On to Open Distro for Elasticsearch Kibana Using SAML and ADFS | AWS Open Source Blog](https://aws.amazon.com/blogs/opensource/open-distro-for-elasticsearch-single-sign-on-saml-adfs/) specially second one on **Role mapping** part, to ensure having same name for my Okta group where my user is, as the name of Backend Role for all\_access Role. (not sure if that can help with your Roles issue) However, I am still not able to login onto Kibana with SAML, I am using 1.4 Opendistro version. Do you might have any additional configuration or any advice what should I look for since I am also using Okta? I also cannot find any useful logs in ES logs, even I added additional log levels in log4j2.properties. Regards, Jovan ---
**Author:** ![clsa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/clsa/32/582_2.png) [@clsa](https://forum.opensearch.org/u/clsa)\ **Post date:** [June 3, 2020, 7:08pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/3 "2020-06-03T19:08:28Z")
Hi Jovan, sorry for not answering earlier. I also created a test account to debug the role permission issue I have. To my surprise I also can’t login into Kibana when configured to use this test account. I compared the configuration with our working production account and couldn’t find any differences. This is really weird. Regards, Clifford ---
**Author:** ![jovant](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@jovant](https://forum.opensearch.org/u/jovant)\ **Post date:** [June 8, 2020, 7:35pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/4 "2020-06-08T19:35:08Z")
Hi Clifford, I have finally managed to setup SAML. I created new topic that can be used as a reffer for setup. My roles mapping also works properly. I assume my biggest issue was not having same ES config on all nodes. However, you can try to look into it here, I hope it will help you! > [@How to setup SAML with Jumpcloud - Solved](https://forum.opensearch.org/t/how-to-setup-saml-with-jumpcloud-solved/3010): > > Hi team, I decided to create a Topic where I have fixed and solved SAML authentication issue with Jumpcloud as IDP and Kibana as SP on other side, with practical example so it can help people trying to set SAML on their own. I had a topic with an issue that I had trying to solve it with @clsa : [SAML/Okta login to Kibana not working with roles](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588) My configuration consists of 3 Elasticsearch nodes, 1 Kibana, Opendistro version 1.4. Important note is to have oss elasticsearch, and proper versions … ---
**Author:** ![clsa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/clsa/32/582_2.png) [@clsa](https://forum.opensearch.org/u/clsa)\ **Post date:** [June 10, 2020, 5:31am UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/5 "2020-06-10T05:31:17Z")
Hi Jovan, glad you worked it out and thank you for your detailed description of the solution. Your remark > **IMPORTANT NOTE** make sure that you have configuration same on all 3 Elasticsearch nodes, this ate me serious time. Security script does update your security config index, but for some reason you need to have configuration on all nodes. made me think. When I tried to enabled roles I bootstrapped a cluster on our test environment with the current working configuration (with roles disabled), changed the `config.yml` to enabled roles on one of the nodes and executed the admin script. So after reading your remark I bootstrapped the cluster with roles enabled from the beginning. Sadly this didn’t solve the issue for me. So I still have to investigate more. Regards Clifford ---
**Author:** ![clsa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/clsa/32/582_2.png) [@clsa](https://forum.opensearch.org/u/clsa)\ **Post date:** [February 15, 2021, 8:08pm UTC](https://forum.opensearch.org/t/saml-okta-login-to-kibana-not-working-with-roles/2588/6 "2021-02-15T20:08:27Z")
Since we upgraded to 1.12.0 it works. Regards Clifford