# SAML authentication not working with Kibana

**URL:** <https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703>\
**Category:** Search Guard\
**Created:** [December 2, 2019, 4:09pm UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703 "2019-12-02T16:09:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Srinivas](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@Srinivas](https://forum.search-guard.com/u/Srinivas)\
**Post date:** [December 2, 2019, 4:09pm UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/1 "2019-12-02T16:09:28Z")

</div>

Hi,

The SAML integration of kibana and elasticsearch with OKTA doesn’t seem to be working. I keep getting redirected to `customerror?type=samlConfigError#?_g=()` or to this `/customerror?type=samlAuthError#?_g=()` .

I have enabled debug log in the elasticsearch machine and logs being generated:

```auto
'org.apache.cxf.rs.security.jose.jws.JwsException: INVALID_COMPACT_JWS' extracting credentials from saml http authenticator
	at com.floragunn.dlic.auth.http.saml.HTTPSamlAuthenticator.extractCredentials(HTTPSamlAuthenticator.java:135) 

```

The kibana is running on a different server and the `Single sign on URL` added in the OKTA app is being proxy passed through a nginx machine.

Does the `kibana_url` in the below config.yml need to be the same one in OKTA or should I pass the FQDN of the kibana machine?

Here is the `sg_config.yml` file:

```auto
 saml:
       enabled: true
       order: 1
       http_authenticator:
         type: saml
         challenge: true
         config:
           idp:
             metadata_file: metadata.xml
             entity_id: http://www.okta.com/3jnkj3nlwj3nlekn3lkn2
           sp:
             entity_id: kibana-saml
           roles_key: 'Roles'
           kibana_url: https://kibana-node-1:5601
           exchange_key: 'asd4nlksanflkanl3k2nlknlk'
       authentication_backend:
         type: noop

```

In the `kibana.yml` I have added these two blocks as well.

```auto
searchguard.auth.type: "saml"

server.xsrf.whitelist: ["/searchguard/saml/acs/idpinitiated", "/searchguard/saml/acs", "/searchguard/saml/logout"]

```

Also the logs being generated in the kibana machine are not helpful.

Any ideas as to what can cause this issue?

---

<div class="post-metadata">

**Author:** ![hsaly](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/hsaly/32/21_2.png) [@hsaly](https://forum.search-guard.com/u/hsaly)\
**Post date:** [December 4, 2019, 10:36am UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/2 "2019-12-04T10:36:02Z")

</div>



---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [December 17, 2019, 9:34am UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/3 "2019-12-17T09:34:15Z")

</div>

> Does the kibana\_url in the below config.yml need to be the same one in OKTA or should I pass the FQDN of the kibana machine?

After you log in to your IdP (OKTA), it will issue an HTTP POST back to Kibana containing the SAML Response. Thus in `kibana_url`, you need to put the base URL of your Kibana installation. This URL must be accessible by OKTA. Make sure your network passes TCP 5601 data connection to the Kibana server.

Also, please read this troubleshooting doc [Kibana SAML Advanced Troubleshooting | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/troubleshooting-saml#saml-troubleshooting)

If the things above didn’t help, we need more data from you to be able to investigate the issue deeply:

- sg\_config.yml
- kibana.yml
- elasticsearch.yml
- Nginx logs. Try to authenticate, go to Nginx logs, and copy the logs.
- Kibana logs. Put `logging.verbose: true` to kibana.yml, try to authenticate, go to Kibana logs, and copy the logs.
- Elasticsearch logs.

---

<div class="post-metadata">

**Author:** ![hsaly](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/hsaly/32/21_2.png) [@hsaly](https://forum.search-guard.com/u/hsaly)\
**Post date:** [December 17, 2019, 9:56am UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/4 "2019-12-17T09:56:41Z")

</div>



---

<div class="post-metadata">

**Author:** ![hsaly](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/hsaly/32/21_2.png) [@hsaly](https://forum.search-guard.com/u/hsaly)\
**Post date:** [December 17, 2019, 9:56am UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/5 "2019-12-17T09:56:49Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [January 7, 2020, 9:56am UTC](https://forum.search-guard.com/t/saml-authentication-not-working-with-kibana/1703/6 "2020-01-07T09:56:51Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.