# Unable to perform SAML **URL:** \ **Category:** Security\ **Created:** [November 7, 2019, 3:04am UTC](https://forum.opensearch.org/t/unable-to-perform-saml/1826 "2019-11-07T03:04:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![xathras1982](https://avatars.discourse-cdn.com/v4/letter/x/71c47a/32.png) [@xathras1982](https://forum.opensearch.org/u/xathras1982)\ **Post date:** [November 7, 2019, 3:04am UTC](https://forum.opensearch.org/t/unable-to-perform-saml/1826/1 "2019-11-07T03:04:02Z")
Hi Team, I followed articles: [https://opendistro.github.io/for-elasticsearch-docs/docs/security-configuration/saml/](https://opendistro.github.io/for-elasticsearch-docs/docs/security-configuration/saml/) and [Add Single Sign-On (SSO) to Open Distro for Elasticsearch Kibana using SAML and Okta | AWS Open Source Blog](https://aws.amazon.com/blogs/opensource/open-distro-for-elasticsearch-saml-okta/). I am currently getting the following error: > SAML configuration error. Something went wrong while retrieving the SAML configuration, please check your settings. In Elasticsearch logs (after enabling debug i see following) > [2019-11-07T02:28:32,174][WARN][c.a.o.s.a.BackendRegistry] [odfe-node1] Authentication finally failed for null from 172.18.0.2:47336 If i look at Chrome Dev Tools. the SAML assertion is never made nor do we see entries to our IDP. ## My config.yml looks like: ``` authc: basic_internal_auth_domain: http_authenticator: authentication_backend: saml_auth_domain: http_authenticator: challenge: true config: idp: entity_id: "http://www.okta.com/<>" metadata_url: "https://mydomain.okta.com/app/<>/sso/saml/metadata" sp: authentication_backend: type: noop entity_id: kibana-saml kibana_url: "https://<>" roles_key: Role type: saml http_enabled: true order: 1 transport_enabled: false type: intern challenge: false type: basic http_enabled: true order: 0 transport_enabled: true ``` My Kibana.yml has added: ```auto opendistro_security.auth.type: "saml" server.xsrf.whitelist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout"] ``` I tried reapply settings and no issues reported: `./securityadmin.sh -cd ../securityconfig/ -icl -nhnv -cacert ../../../config/root-ca.pem -cert ../../../config/kirk.pem -key ../../../config/kirk-key.pem` Response from command is: > Open Distro Security Admin v7 > Will connect to localhost:9300 … done > Connected as CN=kirk,OU=client,O=client,L=test,C=de > Elasticsearch Version: 7.2.0 > Open Distro Security Version: 1.2.0.0 > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > Clustername: odfe-cluster > Clusterstate: GREEN > Number of nodes: 2 > Number of data nodes: 2 > .opendistro\_security index already exists, so we do not need to create one. > Populate config from /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig > Will update ‘\_doc/config’ with ../securityconfig/config.yml > SUCC: Configuration for ‘config’ created or updated > Will update ‘\_doc/roles’ with ../securityconfig/roles.yml > SUCC: Configuration for ‘roles’ created or updated > Will update ‘\_doc/rolesmapping’ with ../securityconfig/roles\_mapping.yml > SUCC: Configuration for ‘rolesmapping’ created or updated > Will update ‘\_doc/internalusers’ with ../securityconfig/internal\_users.yml > SUCC: Configuration for ‘internalusers’ created or updated > Will update ‘\_doc/actiongroups’ with ../securityconfig/action\_groups.yml > SUCC: Configuration for ‘actiongroups’ created or updated > Will update ‘\_doc/tenants’ with ../securityconfig/tenants.yml > SUCC: Configuration for ‘tenants’ created or updated > Done with success Any assistance on troubleshooting would be appreciated. ---
**Author:** ![\_aw](https://avatars.discourse-cdn.com/v4/letter/_/47e85d/32.png) [@\_aw](https://forum.opensearch.org/u/_aw)\ **Post date:** [November 12, 2019, 11:08pm UTC](https://forum.opensearch.org/t/unable-to-perform-saml/1826/2 "2019-11-12T23:08:51Z")
The blogs posts, while helpful, are formatted badly. After a lot of playing, I figured out that it needs to be: ``` saml_auth_domain: http_enabled: true transport_enabled: false order: 1 http_authenticator: type: saml challenge: true config: idp: metadata_file: saml.xml entity_id: (entity_url) sp: entity_id: (entity-id) kibana_url: (kibana_url) roles_key: roles exchange_key: 'somestringthatyouprovide' ``` I wish whoever was running the blog would proofread. ☹ ---
**Author:** ![xathras1982](https://avatars.discourse-cdn.com/v4/letter/x/71c47a/32.png) [@xathras1982](https://forum.opensearch.org/u/xathras1982)\ **Post date:** [November 14, 2019, 10:54pm UTC](https://forum.opensearch.org/t/unable-to-perform-saml/1826/3 "2019-11-14T22:54:16Z")
That did the trick. Thanks. ---
**Author:** ![ashishpatil09](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@ashishpatil09](https://forum.opensearch.org/u/ashishpatil09)\ **Post date:** [February 27, 2020, 1:50pm UTC](https://forum.opensearch.org/t/unable-to-perform-saml/1826/4 "2020-02-27T13:50:14Z")
> [@xathras1982](#): > > authc: basic\_internal\_auth\_domain: http\_authenticator: authentication\_backend: saml\_auth\_domain: http\_authenticator: challenge: true config: idp: entity\_id: “[http://www.okta.com/](http://www.okta.com/)\<\>” metadata\_url: “[https://mydomain.okta.com/app/](https://mydomain.okta.com/app/)\<\>/sso/saml/metadata” sp: authentication\_backend: type: noop entity\_id: kibana-saml kibana\_url: “https://\<\>” roles\_key: Role type: saml http\_enabled: true order: 1 transport\_enabled: false type: intern challenge: false type: basic http\_enabled: true order: 0 transport\_enabled: true What was the solution here?