Cannot logout from Kibana using AD SAML

1

Hi. I have problem with logout using SAML SSO (with Azure)

"Something went wrong with sso connector. Cannot read properties of undefined (reading 'nameIDFormat')"

"stackTrace": "TypeError: Cannot read properties of undefined (reading 'nameIDFormat')\n    at SAML._generateLogoutRequest (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/node-saml/src/saml.ts:362:42)\n    at SAML.getLogoutUrlAsync (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/node-saml/src/saml.ts:613:32)\n    at Strategy.logout (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/passport-saml/src/strategy.ts:238:8)\n    at /usr/share/kibana/plugins/readonlyrestkbn/proxy/preKibanaProxy/auth/saml/samlController.js:1:3039\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at SessionStrategy.strategy.pass (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:355:9)\n    at SessionStrategy.authenticate (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/strategies/session.js:126:10)\n    at attempt (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:378:16)\n    at authenticate (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:379:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at initialize (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/initialize.js:98:5)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at session (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express-session/index.js:487:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at cookieParser (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/cookie-parser/index.js:46:14)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at urlencodedParser (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/body-parser/lib/types/urlencoded.js:91:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at router.handle (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:175:3)\n    at router (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:47:12)",

Kibana.yml

readonlyrest_kbn.cookiePass: "%%cookie_pass%%"
readonlyrest_kbn.cookies.sameSite: 'none'
readonlyrest_kbn.cookies.secure: true
readonlyrest_kbn.store_sessions_in_index: true
readonlyrest_kbn.session_timeout_minutes: 43200
readonlyrest_kbn.sessions_probe_interval_seconds: 10
readonlyrest_kbn.whitelistedPaths: [".*/api/status$", ".*/api/stats"]
readonlyrest_kbn:
    # Do not log the expanded ReadonlyREST config: it contains authentication secrets.
    logLevel: error
    license:
        activationKeyRetrievalMode: "file"
        activationKeyFilePath: /etc/kibana/activation.key
    auth:
        signature_key: "%%signature_key%%"
        sso:
            buttonName: "SSO"
            enabled: true
            type: 'saml'
            issuer: '%%saml_issuer%%'
            protocol: 'https'
            cert: 'xyz'
            entryPoint: 'https://login.microsoftonline.com/%%tenant_id%%/saml2'
            kibanaExternalHost: '%%kibana_external_host%%'
            usernameParameter: 'http://schemas.microsoft.com/identity/claims/displayname'
            groupsParameter: 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups'
            logoutUrl: 'https://login.microsoftonline.com/%%tenant_id%%/saml2'
            authnContext:
                - 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'
2

Hello @donio4

Thanks for reporting the issue.

  1. What version of the ReadonlyREST plugin do you use?
  2. Do you use a load balancer with non-sticky sessions?
3
  1. Im using, 1.70.3 ROR version and 8.19.19 Kibana.
  2. Yes, we using haproxy, because its deployed on k8s.
4

Hello @donio4

I was able to reproduce an issue on my side. The problem occurs in the case of HA and a non-sticky session when the logout event is sent to the instance, which doesn’t create a session. I have a fix for this issue, so I can provide a pre-release Docker image version with the fix.

If you want to wait for a release, the temporary solution would be to set sticky sessions in HAProxy

5

We build the image ourselves, if you can, please send us the link to the zip file for the pre-release version of the plugin. Thanks!

6

readonlyrest_kbn_universal-1.71.0-pre5_es8.19.19.zip pre-release build; it’s compatible with ReadonlyREST Elasticsearch 1.70.3 plugin version

7

It works! But can I redirect to the login page? Now I have the MS page after logout:
You have been logged out of your account.
It is recommended that you close all browser windows.

8

Yes, you should be redirected to the login page after logout. Please verify that the Logout URL configured in Microsoft Entra points to:

https://<your-kibana-host>/ror_kbn_saml_<connector-name>/notifylogout
Microsoft currently completes the logout but apparently does not send the LogoutResponse back to ReadonlyREST.

9

Thanks, its working!
Screen from docs with example Azure AD have bad uri.

10

Thanks, its working!

Great!

Screen from docs with example Azure AD have bad uri.

Thanks for noticing it. I will update the docs with the correct URL