@@ -443,53 +443,51 @@ Assertion Consumer Service URL of the SAML Service Provider is.
443
443
.. {kib} constructs this value using the `server.host` and `server.port` in
444
444
`kibana.yml`. For instance:
445
445
+
446
- --
447
446
[source, shell]
448
447
-----------------------------------------------
449
448
server.host: kibanaserver.org
450
449
server.port: 3456
451
450
-----------------------------------------------
452
-
451
+ +
453
452
These settings would mean that {kib} would construct the Assertion Consumer
454
- Service URL as `https://kibanaserver.org:3456/api/secuirity /v1/saml`. However,
453
+ Service URL as `https://kibanaserver.org:3456/api/security /v1/saml`. However,
455
454
if for example, {kib} is behind a reverse proxy and you have configured the
456
455
following `xpack.security.public.*` settings:
457
-
456
+ +
458
457
[source, shell]
459
458
-----------------------------------------------
460
459
xpack.security.public:
461
460
protocol: https
462
461
hostname: kibana.proxy.com
463
462
port: 8080
464
463
-----------------------------------------------
465
-
464
+ +
466
465
These settings would instruct {kib} to construct the Assertion Consumer Service
467
466
URL as `https://kibana.proxy.com:8080/api/security/v1/saml`
468
- --
469
467
470
468
.. The SAML Identity Provider is either explicitly configured by the IdP
471
469
administrator or consumes the SAML metadata that are generated by {es} and as
472
470
such contain the same value for the
473
471
as the one
474
472
that is configured in the the `sp.acs` setting in the {es} SAML realm
475
473
configuration.
476
-
474
+ --
475
+ +
477
476
The error encountered here indicates that the Assertion Consumer Service URL
478
477
that {kib} has constructed via one of the aforementioned ways
479
478
(`https://my.kibana.url/api/security/v1/saml`) is not the one that {es} is
480
479
configured with. Note that these two URLs are compared as case-sensitive strings
481
480
and not as canonicalized URLs.
482
-
481
+ +
483
482
Often, this can be resolved by changing the `sp.acs` URL in `elasticearch.yml`
484
483
to match the value that {kib} has constructed. Note however, that the SAML IdP
485
484
configuration needs to also be adjusted to reflect this change.
486
-
485
+ +
487
486
Alternatively, if you think {kib} is using the wrong value for the Assertion
488
487
Consumer Service URL, you will need to change the configuration in `kibana.yml`
489
488
by adjusting either the `server.host` and `server.port` to change the URL {kib}
490
489
listens to or the `xpack.security.public.*` settings to make {kib} aware about
491
490
its correct public URL.
492
- --
493
491
494
492
. *Symptoms:*
495
493
+
0 commit comments