If it helps, this is the POST from Kibana.
{
“type”: “response”,
“@timestamp”: “2018-08-30T22:32:18Z”,
“tags”: ,
“pid”: 56,
“method”: “post”,
“statusCode”: 302,
“req”: {
“url”: “/searchguard/saml/acs”,
“method”: “post”,
“headers”: {
“x-forwarded-for”: “172.31.3.26”,
“x-forwarded-proto”: “https”,
“x-forwarded-port”: “443”,
“host”: “kibana.xxx”,
“x-amzn-trace-id”: “Root=1-5b887072-d2b37cf4630cf00895ef73c4”,
“content-length”: “5997”,
“cache-control”: “max-age=0”,
“origin”: “https://accounts.google.com”,
“upgrade-insecure-requests”: “1”,
“content-type”: “application/x-www-form-urlencoded”,
“user-agent”: “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36”,
“accept”: “text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8”,
“referer”: “https://accounts.google.com/o/saml2/initsso?idpid=#####&spid=#####&forceauthn=false”,
“accept-encoding”: “gzip, deflate, br”,
“accept-language”: “en-US,en;q=0.9”
},
“remoteAddress”: “x.x.x.x”,
“userAgent”: “x.x.x.x”,
“referer”: “https://accounts.google.com/o/saml2/initsso?idpid=#####&spid=#####&forceauthn=false”
},
“res”: {
“statusCode”: 302,
“responseTime”: 29,
“contentLength”: 9
},
“message”: “POST /searchguard/saml/acs 302 29ms - 9.0B”
}
···
On Thursday, August 30, 2018 at 6:35:28 PM UTC-4, dc...@galileo.io wrote:
Hi Jochen,
Okay, so I don’t know why it initially failed to boot, but took your advice in setting
logger.token.name = com.floragunn.dlic.auth.http.saml.Token
logger.token.level = debug
in log4j2.properties, and Elasticsearch boots properly.
I’m still not seeing any debug logs for Token however, when attempting to login using SAML Google SSO. I receive the SAML authentication error on https://kibana.xxx/customerror?type=samlAuthError#?_g=(), but can’t seem to find any corresponding logs in Elasticsearch.
Is there another set of logs that I can look at that might provide more information?
Thanks,
Dan
On Thursday, August 30, 2018 at 5:43:17 PM UTC-4, Jochen Kressin wrote:
Well, the error message indicates that you confused the logger name with the log level (“Unknown level constant”). Something like:
logger.token.name: error
logger.token.level: com.floragunn.dlic.auth.http.saml.Token
``
Can you check for this both in log4j2.properties and elasticsearch.yml?
On Thursday, August 30, 2018 at 5:32:01 PM UTC-4, dc...@galileo.io wrote:
Hi Jochen,
Thanks for the replies so far.
I’m seeing an error when I add the logger in log4j2 properties in my Elasticsearch cluster, along the lines of Unknown level constant [COM.FLORAGUNN.DLIC.AUTH.HTTP.SAML.TOKEN].
Is there a way to get around this, or is this error supposed to not be happening?
Thanks,
Dan
On Thursday, August 30, 2018 at 5:28:21 PM UTC-4, Jochen Kressin wrote:
I think you can only change log levels via the cluster API. You will not be able to add a new logger that way.
So you can add the logger in log4j2.properties and set it to error:
logger.token.name = com.floragunn.dlic.auth.http.saml.Token
logger.token.level = error
``
And then use the cluster API to dynamically switch on debug level when needed.
On Thursday, August 30, 2018 at 2:43:13 PM UTC-4, dc...@galileo.io wrote:
Update with a new question!
Figured out that my Kibana setup was not deploying properly, and now I am correctly forwarding requests from Kibana to Elasticsearch, using “/searchguard/saml/acs”. Also, removed the duplicate YAML key for “server.xsrf.whitelist”
New question:
I am trying to debug SAML authentication error from the SSO (https://docs.search-guard.com/latest/troubleshooting-saml)
I attempted to enable com.floragunn.dlic.auth.http.saml.Token via cluster settings, but I am receiving an error response of illegal_argument_exception
$ curl -X PUT “https://user:password@elasticsearch.xxx:443/_cluster/settings” -H ‘Content-Type: application/json’ -d’
{
“transient”: {
"[logger.token2.name](http://logger.token2.name)": "com.floragunn.dlic.auth.http.saml.Token",
"logger.token2.level": "debug"
}
}
’
{“error”:{“root_cause”:[{“type”:“remote_transport_exception”,“reason”:“[CEPj10A][1.2.3.4:9300][cluster:admin/settings/update]”}],“type”:“illegal_argument_exception”,“reason”:“Unknown level constant [COM.FLORAGUNN.DLIC.AUTH.HTTP.SAML.TOKEN].”},“status”:400}
What else can I try to debug the SAML authentication error?
Thanks for the help so far,
Dan
On Wednesday, August 29, 2018 at 3:28:49 PM UTC-4, dc...@galileo.io wrote:
For additional information, my Kibana configuration looks like such:
server.name: kibana
server.host: 0.0.0.0
server.ssl.enabled: true
server.ssl.certificate: /usr/share/kibana/config/kibana.crt.pem
server.ssl.key: /usr/share/kibana/config/kibana.key.pem
elasticsearch.url: ELASTICSEARCH_URL
elasticsearch.username: ELASTICSEARCH_USERNAME
elasticsearch.password: ELASTICSEARCH_PASSWORD
searchguard.basicauth.enabled: true
searchguard.cookie.secure: true
searchguard.cookie.name: SEARCHGUARD_COOKIE_NAME
searchguard.cookie.password: SEARCHGUARD_COOKIE_PASSWORD
searchguard.cookie.ttl: 28800000
searchguard.session.ttl: 28800000
searchguard.session.keepalive: false
searchguard.auth.type: “saml”
server.xsrf.whitelist: [“/searchguard/saml/acs”]
server.xsrf.whitelist: [“/searchguard/saml/acs”, “/searchguard/saml/logout”]
