SAML-tracer | Firefox extension for examining SAML messages | Addon library

The answer lies beyond the AWS Console and must be completed within the Elastic Search cluster with the Master User that you created either within the cluster as an Internal User, via an IAM role or by using the Master User field in the SAML configuration section of the Modify Authentication Wizard in the AWS console for Elastic Search. You must:

1. Create a Backend role that matches your SAML attribute value
2. Create a Mapping between the new backend role and an actual Elastic Search Role

After you're done configuring your IdP by creating a custom Attribute/Claim like roles or groups and after you've configure SAML authentication integration in the Elastic search cluster.

1.-Log into Kibana using your master user 2.-Go to OpenDistro -> Security -> Roles -> The Role you want to grant access to, i.e. readall 3.-Go to the Mapped Users tab under the role screen 4.-On the Backend Roles field type the VALUE of the Azure Claim you created by following these steps: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-enterprise-app-role-management For reference the claim value is: user.assignedroles. The claim key is whatever you configure your Azure Enterprise application as. You'll have a key value pair of "Your chosen Claim Name": user.assignedroles 5.-Save the Mapping in Kibana

Using the Azure IdP log into Kibana using users with different Azure Claim assigned to them. The Open Distro Security plugin will parse the SAML token attribute find the field for user.assignedroles and map that as a Kibana Backend Role to the actual Elastic Search roles.

Looks like your configuration isn't correct. The IdentityProvider should POST the response to /Saml2/Acs, which is the endpoint where the response is processed and validated. That is where the AuthenticationResponseGrant is created which results in the external signin cookie being set.

After that, the Saml2 middleware redirects to /Account/ExternalLoginCallback.

Also, you should remove the Federation object from your configuration. It creates more IdentityProviders in the background, something that you don't want in this kind of setup.