@@ -444,52 +444,50 @@ Assertion Consumer Service URL of the SAML Service Provider is.
444
444
.. {kib} constructs this value using the `server.host` and `server.port` in
445
445
`kibana.yml`. For instance:
446
446
+
447
- --
448
447
[source, shell]
449
448
-----------------------------------------------
450
449
server.host: kibanaserver.org
451
450
server.port: 3456
452
451
-----------------------------------------------
453
-
452
+ +
454
453
These settings would mean that {kib} would construct the Assertion Consumer
455
454
Service URL as `https://kibanaserver.org:3456/api/secuirity/v1/saml`. However,
456
455
if for example, {kib} is behind a reverse proxy and you have configured the
457
456
following `xpack.security.public.*` settings:
458
-
457
+ +
459
458
[source, shell]
460
459
-----------------------------------------------
461
460
xpack.security.public:
462
461
protocol: https
463
462
hostname: kibana.proxy.com
464
463
port: 8080
465
464
-----------------------------------------------
466
-
465
+ +
467
466
These settings would instruct {kib} to construct the Assertion Consumer Service
468
467
URL as `https://kibana.proxy.com:8080/api/secuirity/v1/saml`
469
- --
470
468
471
469
.. The SAML Identity Provider is either explicitly configured by the IdP
472
470
administrator or consumes the SAML metadata that are generated by {es} and as
473
471
such contain the same value for the Assertion Consumer Service URL as the one
474
472
that is configured in the the `sp.acs` setting in the {es} SAML realm
475
473
configuration.
476
-
474
+ --
475
+ +
477
476
The error encountered here indicates that the Assertion Consumer Service URL
478
477
that {kib} has constructed via one of the aforementioned ways
479
478
(`https://my.kibana.url/api/security/v1/saml`) is not the one that {es} is
480
479
configured with. Note that these two URLs are compared as case-sensitive strings
481
480
and not as canonicalized URLs.
482
-
481
+ +
483
482
Often, this can be resolved by changing the `sp.acs` URL in `elasticearch.yml`
484
483
to match the value that {kib} has constructed. Note however, that the SAML IdP
485
484
configuration needs to also be adjusted to reflect this change.
486
-
485
+ +
487
486
Alternatively, if you think {kib} is using the wrong value for the Assertion
488
487
Consumer Service URL, you will need to change the configuration in `kibana.yml`
489
488
by adjusting either the `server.host` and `server.port` to change the URL {kib}
490
489
listens to or the `xpack.security.public.*` settings to make {kib} aware about
491
490
its correct public URL.
492
- --
493
491
494
492
. *Symptoms:*
495
493
+
0 commit comments