@@ -443,52 +443,50 @@ Assertion Consumer Service URL of the SAML Service Provider is.
443443.. {kib} constructs this value using the `server.host` and `server.port` in
444444`kibana.yml`. For instance:
445445+
446- --
447446[source, shell]
448447-----------------------------------------------
449448server.host: kibanaserver.org
450449server.port: 3456
451450-----------------------------------------------
452-
451+ +
453452These settings would mean that {kib} would construct the Assertion Consumer
454453Service URL as `https://kibanaserver.org:3456/api/secuirity/v1/saml`. However,
455454if for example, {kib} is behind a reverse proxy and you have configured the
456455following `xpack.security.public.*` settings:
457-
456+ +
458457[source, shell]
459458-----------------------------------------------
460459xpack.security.public:
461460 protocol: https
462461 hostname: kibana.proxy.com
463462 port: 8080
464463-----------------------------------------------
465-
464+ +
466465These settings would instruct {kib} to construct the Assertion Consumer Service
467466URL as `https://kibana.proxy.com:8080/api/secuirity/v1/saml`
468- --
469467
470468.. The SAML Identity Provider is either explicitly configured by the IdP
471469administrator or consumes the SAML metadata that are generated by {es} and as
472470such contain the same value for the Assertion Consumer Service URL as the one
473471that is configured in the the `sp.acs` setting in the {es} SAML realm
474472configuration.
475-
473+ --
474+ +
476475The error encountered here indicates that the Assertion Consumer Service URL
477476that {kib} has constructed via one of the aforementioned ways
478477(`https://my.kibana.url/api/security/v1/saml`) is not the one that {es} is
479478configured with. Note that these two URLs are compared as case-sensitive strings
480479and not as canonicalized URLs.
481-
480+ +
482481Often, this can be resolved by changing the `sp.acs` URL in `elasticearch.yml`
483482to match the value that {kib} has constructed. Note however, that the SAML IdP
484483configuration needs to also be adjusted to reflect this change.
485-
484+ +
486485Alternatively, if you think {kib} is using the wrong value for the Assertion
487486Consumer Service URL, you will need to change the configuration in `kibana.yml`
488487by adjusting either the `server.host` and `server.port` to change the URL {kib}
489488listens to or the `xpack.security.public.*` settings to make {kib} aware about
490489its correct public URL.
491- --
492490
493491. *Symptoms:*
494492+
0 commit comments