Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

Cannot find any matching realm for [SamlPrepareAuthenticationRequest{realmName=saml1,
assertionConsumerServiceURL=https://my.kibana.url/api/security/v1/saml}]

Resolution:

In order to initiate a SAML authentication, Kibana needs to know which SAML realm it should use from the ones that are configured in Elasticsearch. You can use the xpack.security.authc.saml.reaml setting to explicitly set the SAML realm name in Kibana. It must match the name of the SAML realm that is configured in Elasticsearch.

If you get an error like the one above, it possibly means that the value of xpack.security.authc.saml.reaml in your Kibana configuration is wrong. Verify that it matches the name of the configured realm in Elasticsearch, which is the string after xpack.security.authc.realms.saml. in your Elasticsearch configuration.

Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

Authentication to realm saml1 failed - Provided SAML response is not valid for realm
saml/saml1 (Caused by ElasticsearchSecurityException[Conditions [https://some-url-here...]
do not match required audience [https://my.kibana.url]])

Resolution:

We received a SAML response that is addressed to another SAML Service Provider. This usually means that the configured SAML Service Provider Entity ID in elasticsearch.yml (sp.entity_id) does not match what has been configured as the SAML Service Provider Entity ID in the SAML Identity Provider documentation.

To resolve this issue, ensure that both the saml realm in Elasticsearch and the IdP are configured with the same string for the SAML Entity ID of the Service Provider.

These strings are compared as case-sensitive strings and not as canonicalized URLs even when the values are URL-like. Be mindful of trailing slashes, port numbers, etc.

Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

Cannot find metadata for entity [your:entity.id] in [metadata.xml]

Resolution:

We could not find the metadata for the SAML Entity ID your:entity.id in the configured metadata file (metadata.xml).

Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

unable to authenticate user [<unauthenticated-saml-user>]
for action [cluster:admin/xpack/security/saml/authenticate]

Resolution:

This error indicates that Elasticsearch failed to process the incoming SAML authentication message. Since the message can’t be processed, Elasticsearch is not aware of who the to-be authenticated user is and the <unauthenticated-saml-user> placeholder is used instead. To diagnose the actual problem, you must check the Elasticsearch logs for further details.

Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

Authentication to realm my-saml-realm failed -
Provided SAML response is not valid for realm saml/my-saml-realm
(Caused by ElasticsearchSecurityException[SAML Response is not a 'success' response:
 The SAML IdP did not grant the request. It indicated that the Elastic Stack side sent
 something invalid (urn:oasis:names:tc:SAML:2.0:status:Requester). Specific status code which might
 indicate what the issue is: [urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy]]
)

Resolution:

This means that the SAML Identity Provider failed to authenticate the user and sent a SAML Response to the Service Provider (Elastic Stack) indicating this failure. The message will convey whether the SAML Identity Provider thinks that the problem is with the Service Provider (Elastic Stack) or with the Identity Provider itself and the specific status code that follows is extremely useful as it usually indicates the underlying issue. The list of specific error codes is defined in the SAML 2.0 Core specification - Section 3.2.2.2 and the most commonly encountered ones are:

Symptoms:

Authentication in Kibana fails and the following error is printed in the Elasticsearch logs:

The XML Signature of this SAML message cannot be validated. Please verify that the saml
realm uses the correct SAMLmetadata file/URL for this Identity Provider

Resolution:

This means that Elasticsearch failed to validate the digital signature of the SAML message that the Identity Provider sent. Elasticsearch uses the public key of the Identity Provider that is included in the SAML metadata, in order to validate the signature that the IdP has created using its corresponding private key. Failure to do so, can have a number of causes:

The private keys and public keys and self-signed X.509 certificates that are used in SAML for digital signatures as described above have no relation to the keys and certificates that are used for TLS either on the transport or the http layer. A failure such as the one described above has nothing to do with your xpack.ssl related configuration.

Symptoms:

Users are unable to login with a local username and password in Kibana because SAML is enabled.

Resolution:

If you want your users to be able to use local credentials to authenticate to Kibana in addition to using the SAML realm for Single Sign-On, you must enable the basic authProvider in Kibana. The process is documented in the SAML Guide