Configure Elastic Cloud SAML single sign-on

Elastic Cloud supports SAML single sign-on (SSO) after you you register a SAML 2.0 identity provider (IdP). Your organization’s members can sign into an organization-specific SSO login URL then join your Elastic Cloud organization automatically.

Actions taken on the IdP are not automatically reflected in Elastic Cloud. For example, if you remove a user from your IdP, they are not removed from the Elastic Cloud organization and their active sessions are not invalidated. To immediately revoke a user’s active sessions, an organization owner must remove the user from the Elastic Cloud organization or remove their assigned roles.

At this time, users that join your Elastic Cloud organization by using IdP authentication are not automatically assigned roles. You must manually assign roles to organization members after they have joined the organization.

The IdP registration and domain claim features are available only by using APIs, which are in subject to change while in technical preview. The features are not yet available in the Elastic Cloud UI.

There is a known issue accessing the support portal when authenticated via SSO which will be fixed in a subsequent release. In the meantime, to access the support portal after authenticating via SSO, reset your password and sign in with email and password.

Before you can register and use your IdP with Elastic Cloud, you must claim one or more domains. Only users that have email addresses that match claimed domains can authenticate with your IdP.

You must have authority to modify your domain’s DNS records and an organization owner API key. To create the latter, refer to Access and authentication.

If the members of your Elastic Cloud organization have email addresses from multiple domains, you can claim multiple domains.

After you have claimed one or more domains, you can register your IdP with Elastic Cloud. The steps vary by IdP; for more specific details, refer to Register Elastic Cloud SAML in Microsoft Entra ID and Register Elastic Cloud SAML in Okta.

After you register the IdP in Elastic Cloud and configure your IdP, you can test authentication. To begin SSO, open the sso_login_url in your browser. If everything is configured correctly you should be redirected to your IdP for authentication and then redirected back to Elastic Cloud signed in. Users who are not a member of the Elastic Cloud organization can authenticate with your IdP to automatically create an Elastic Cloud account provided that their email matches the claimed domain.

At this time, new users in your Elastic Cloud organization will join without any roles assigned. An administrator must manually assign roles to the organization members.

After SSO is configured successfully, you may wish to enforce SSO authentication for members of your organization. This enforcement requires members to authenticate with SSO through the organization’s SAML IdP and prevents them from logging in by any other methods. It ensures that users who have been off-boarded in your IdP can no longer authenticate to Elastic Cloud.

To turn on enforcement, use the following API call:

curl -XPUT \
-H 'Content-Type: application/json' \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/organizations/$ORGANIZATION_ID" \
-d '
{
  "enforce_authentication_method": "sso"
}
'

To turn off enforcement, use the following API call:

curl -XPUT \
-H 'Content-Type: application/json' \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/organizations/$ORGANIZATION_ID" \
-d '
{
  "enforce_authentication_method": null
}
'

To disable SSO and make it unavailable for your organization, update the organization IdP with enabled: false. For example:

curl -XPUT \
-H 'Content-Type: application/json' \
-H "Authorization: ApiKey $EC_API_KEY" \
"https://api.elastic-cloud.com/api/v1/organizations/$ORGANIZATION_ID/idp" \
-d '
{
  "enabled": false,
  "login_identifier_prefix": "<businessname>",
  "saml_idp": {
    "public_certificate": [
      "<publiccert>"
    ],
    "issuer": "<issuer>",
    "sso_url": "<ssourl>"
  }
}
'

Double check the saml_idp.sso_url provided during IdP registration. This should be the HTTP-POST binding URL to your IdP’s SAML application. Elastic Cloud will redirect to this URL during sign in.

There could be a variety of issues that might result in sign in failure. Try tracing the SAML request and response with a SAML tracer. You should see a SAMLRequest field when redirecting to your IdP, and a SAMLResponse field when redirecting to the Cloud ACS.

If there was an error in your IdP, there may be a non-success Status field which should describe the error that occurred.

If the SAML response was successful, double-check the components of the SAML response:

At this time, the following features are not supported:

These features will be available in a future release.