# SAML with Keycloak - Error: failed parsing SAML config

**URL:** <https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379>\
**Category:** Security\
**Created:** [June 29, 2021, 5:52pm UTC](https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379 "2021-06-29T17:52:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gferrette](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gferrette](https://forum.opensearch.org/u/gferrette)\
**Post date:** [June 29, 2021, 5:52pm UTC](https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379/1 "2021-06-29T17:52:57Z")

</div>

Hello,

I’m trying to configure ODFE 1.13.2 to work with Keycloak by SAML, but i’m facing the error below:  
Please, am I doing something wrong?

kibana: Error: failed parsing SAML config  
kibana: at SecurityClient.getSamlHeader (/usr/share/kibana/plugins/opendistroSecurityKibana/server/backend/opendistro\_security\_client.ts:176:15)  
kibana: at process.\_tickCallback (internal/process/next\_tick.js:68:7)

My config:

saml\_auth\_domain:  
http\_enabled: true  
transport\_enabled: false  
order: 1  
http\_authenticator:  
type: saml  
challenge: true  
config:  
idp:  
metadata\_url: “[https://URL/protocol/saml/descriptor](https://URL/protocol/saml/descriptor)”  
entity\_id: “[https://URL/auth/realms/dummy-auth](https://URL/auth/realms/dummy-auth)”  
sp:  
entity\_id: kibana.amb.hm.tst  
kibana\_url: “[https://kibana.amb.hm.tst/](https://kibana.amb.hm.tst/)”  
roles\_key: Role  
exchange\_key: ‘dummykey’  
authentication\_backend:  
type: noop

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 30, 2021, 9:02am UTC](https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379/2 "2021-06-30T09:02:07Z")

</div>

Hello @gferrette

Could you share Kibana and Keycloack SAML config?

---

<div class="post-metadata">

**Author:** ![gferrette](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gferrette](https://forum.opensearch.org/u/gferrette)\
**Post date:** [June 30, 2021, 11:24am UTC](https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379/3 "2021-06-30T11:24:21Z")

</div>

Hello @pablo !

Thanks for replying, follow below kibana config:

Just a question, we are using kibana without https inside the server because we only access kibana behind a reverse proxy, and the reverse proxy is secure with https. Do we need to use kibana with https inside server to work with SAML?

server.port: PORT  
server.host: “IP”  
elasticsearch.hosts: [http://IP](http://IP):PORT  
elasticsearch.ssl.verificationMode: none  
elasticsearch.username: username  
elasticsearch.password: password  
elasticsearch.requestHeadersWhitelist: [“securitytenant”,“Authorization”]

opendistro\_security.multitenancy.enabled: true  
opendistro\_security.multitenancy.tenants.enable\_private: false  
opendistro\_security.multitenancy.tenants.enable\_global: false  
opendistro\_security.multitenancy.tenants.preferred: [“Global”, “Private”]  
opendistro\_security.readonly\_mode.roles: [“kibana\_read\_only”]

opendistro\_security.basicauth.header\_trumps\_session: true

kibana.autocompleteTerminateAfter: 500000

#SAML  
opendistro\_security.auth.type: “saml”  
server.xsrf.whitelist: [“/\_opendistro/\_security/saml/acs”, “/\_opendistro/\_security/saml/logout”]

opendistro\_security.cookie.secure: false

newsfeed.enabled: false  
telemetry.optIn: false  
telemetry.enabled: false  
security.showInsecureClusterWarning: false

map.includeElasticMapsService: false

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 30, 2021, 12:05pm UTC](https://forum.opensearch.org/t/saml-with-keycloak-error-failed-parsing-saml-config/6379/4 "2021-06-30T12:05:54Z")

</div>

@gferrette

In your config.yml I’ve found that you use metadata\_url with keycloak’s HTTPS address. According to documentation, you’ll have to add the following to your config.yml to make it work.

```auto
   enable_ssl: true
   verify_hostnames: true
   pemtrustedcas_filepath: "path to keycloak certificate"

```

> **[SAML](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/saml/#tls-settings)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.

Alternatively, you could download the metadata XML file from keycloak

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/45110aa2ed38c33495f8ac599d174fd30f2626d4.png)

and use metadata\_file in config.yml. Then you won’t need to add

```auto
   enable_ssl: true
   verify_hostnames: true
   pemtrustedcas_filepath: "path to keycloak certificate"

```

Please also remember that exchange\_key must have at least 32 characters.

> **[SAML](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/saml/#exchange-key-settings)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.

Does sp: entity\_id correspond with SAML ClientID in Keycloak?

> **[SAML](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/saml/#idp-and-service-provider-entity-id)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.