@@ -371,53 +371,51 @@ Assertion Consumer Service URL of the SAML Service Provider is.
371
371
.. {kib} constructs this value using the `server.host` and `server.port` in
372
372
`kibana.yml`. For instance:
373
373
+
374
- --
375
374
[source, shell]
376
375
-----------------------------------------------
377
376
server.host: kibanaserver.org
378
377
server.port: 3456
379
378
-----------------------------------------------
380
-
379
+ +
381
380
These settings would mean that {kib} would construct the Assertion Consumer
382
- Service URL as `https://kibanaserver.org:3456/api/secuirity /v1/saml`. However,
381
+ Service URL as `https://kibanaserver.org:3456/api/security /v1/saml`. However,
383
382
if for example, {kib} is behind a reverse proxy and you have configured the
384
383
following `xpack.security.public.*` settings:
385
-
384
+ +
386
385
[source, shell]
387
386
-----------------------------------------------
388
387
xpack.security.public:
389
388
protocol: https
390
389
hostname: kibana.proxy.com
391
390
port: 8080
392
391
-----------------------------------------------
393
-
392
+ +
394
393
These settings would instruct {kib} to construct the Assertion Consumer Service
395
394
URL as `https://kibana.proxy.com:8080/api/security/v1/saml`
396
- --
397
395
398
396
.. The SAML Identity Provider is either explicitly configured by the IdP
399
397
administrator or consumes the SAML metadata that are generated by {es} and as
400
398
such contain the same value for the
401
399
as the one
402
400
that is configured in the the `sp.acs` setting in the {es} SAML realm
403
401
configuration.
404
-
402
+ --
403
+ +
405
404
The error encountered here indicates that the Assertion Consumer Service URL
406
405
that {kib} has constructed via one of the aforementioned ways
407
406
(`https://my.kibana.url/api/security/v1/saml`) is not the one that {es} is
408
407
configured with. Note that these two URLs are compared as case-sensitive strings
409
408
and not as canonicalized URLs.
410
-
409
+ +
411
410
Often, this can be resolved by changing the `sp.acs` URL in `elasticearch.yml`
412
411
to match the value that {kib} has constructed. Note however, that the SAML IdP
413
412
configuration needs to also be adjusted to reflect this change.
414
-
413
+ +
415
414
Alternatively, if you think {kib} is using the wrong value for the Assertion
416
415
Consumer Service URL, you will need to change the configuration in `kibana.yml`
417
416
by adjusting either the `server.host` and `server.port` to change the URL {kib}
418
417
listens to or the `xpack.security.public.*` settings to make {kib} aware about
419
418
its correct public URL.
420
- --
421
419
422
420
. *Symptoms:*
423
421
+
0 commit comments