Cannot logout from Kibana using AD SAML

donio4 · July 31, 2026, 6:35am

Hi. I have problem with logout using SAML SSO (with Azure)

"Something went wrong with sso connector. Cannot read properties of undefined (reading 'nameIDFormat')"

"stackTrace": "TypeError: Cannot read properties of undefined (reading 'nameIDFormat')\n    at SAML._generateLogoutRequest (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/node-saml/src/saml.ts:362:42)\n    at SAML.getLogoutUrlAsync (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/node-saml/src/saml.ts:613:32)\n    at Strategy.logout (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/@node-saml/passport-saml/src/strategy.ts:238:8)\n    at /usr/share/kibana/plugins/readonlyrestkbn/proxy/preKibanaProxy/auth/saml/samlController.js:1:3039\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at SessionStrategy.strategy.pass (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:355:9)\n    at SessionStrategy.authenticate (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/strategies/session.js:126:10)\n    at attempt (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:378:16)\n    at authenticate (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/authenticate.js:379:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at initialize (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/passport/lib/middleware/initialize.js:98:5)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at session (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express-session/index.js:487:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at cookieParser (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/cookie-parser/index.js:46:14)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at urlencodedParser (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/body-parser/lib/types/urlencoded.js:91:7)\n    at handle (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/express.js:89:25)\n    at Layer.handle [as handle_request] (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/layer.js:95:5)\n    at trim_prefix (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:328:13)\n    at /usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:286:9\n    at router.process_params (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:346:12)\n    at next (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:280:10)\n    at router.handle (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:175:3)\n    at router (/usr/share/kibana/plugins/readonlyrestkbn/node_modules/express/lib/router/index.js:47:12)",

Kibana.yml

readonlyrest_kbn.cookiePass: "%%cookie_pass%%"
readonlyrest_kbn.cookies.sameSite: 'none'
readonlyrest_kbn.cookies.secure: true
readonlyrest_kbn.store_sessions_in_index: true
readonlyrest_kbn.session_timeout_minutes: 43200
readonlyrest_kbn.sessions_probe_interval_seconds: 10
readonlyrest_kbn.whitelistedPaths: [".*/api/status$", ".*/api/stats"]
readonlyrest_kbn:
    # Do not log the expanded ReadonlyREST config: it contains authentication secrets.
    logLevel: error
    license:
        activationKeyRetrievalMode: "file"
        activationKeyFilePath: /etc/kibana/activation.key
    auth:
        signature_key: "%%signature_key%%"
        sso:
            buttonName: "SSO"
            enabled: true
            type: 'saml'
            issuer: '%%saml_issuer%%'
            protocol: 'https'
            cert: 'xyz'
            entryPoint: 'https://login.microsoftonline.com/%%tenant_id%%/saml2'
            kibanaExternalHost: '%%kibana_external_host%%'
            usernameParameter: 'http://schemas.microsoft.com/identity/claims/displayname'
            groupsParameter: 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups'
            logoutUrl: 'https://login.microsoftonline.com/%%tenant_id%%/saml2'
            authnContext:
                - 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'

Dzuming · July 31, 2026, 10:35am

Hello @donio4

Thanks for reporting the issue.

What version of the ReadonlyREST plugin do you use?
Do you use a load balancer with non-sticky sessions?

donio4 · July 31, 2026, 11:31am

Im using, 1.70.3 ROR version and 8.19.19 Kibana.
Yes, we using haproxy, because its deployed on k8s.

Dzuming · August 3, 2026, 7:08am

Hello @donio4

I was able to reproduce an issue on my side. The problem occurs in the case of HA and a non-sticky session when the logout event is sent to the instance, which doesn’t create a session. I have a fix for this issue, so I can provide a pre-release Docker image version with the fix.

If you want to wait for a release, the temporary solution would be to set sticky sessions in HAProxy

donio4 · August 3, 2026, 7:49am

We build the image ourselves, if you can, please send us the link to the zip file for the pre-release version of the plugin. Thanks!

Dzuming · August 3, 2026, 9:01am

readonlyrest_kbn_universal-1.71.0-pre5_es8.19.19.zip pre-release build; it’s compatible with ReadonlyREST Elasticsearch 1.70.3 plugin version

donio4 · August 3, 2026, 9:35am

It works! But can I redirect to the login page? Now I have the MS page after logout:
You have been logged out of your account.
It is recommended that you close all browser windows.

Dzuming · August 3, 2026, 9:53am

Yes, you should be redirected to the login page after logout. Please verify that the Logout URL configured in Microsoft Entra points to:

https://<your-kibana-host>/ror_kbn_saml_<connector-name>/notifylogout
Microsoft currently completes the logout but apparently does not send the LogoutResponse back to ReadonlyREST.

donio4 · August 3, 2026, 12:45pm

Thanks, its working!
Screen from docs with example Azure AD have bad uri.

Dzuming · August 3, 2026, 5:41pm

Thanks, its working!

Great!

Screen from docs with example Azure AD have bad uri.

Thanks for noticing it. I will update the docs with the correct URL

donio4 · September 15, 2026, 9:30am

Hi. After upgrade my image to new ror 1.71 i have problems again, now is from azure: AADSTS50068: Signout failed. The initiating application is not a participant in the current session.

Is any information stored locally in Kibana? I am not using any PV volumes in the Kibana pods.

My observations indicate that with every application redeploy - for example, a ReadonlyREST version change, the Kibana client has to manually delete cookies.

Dzuming · September 15, 2026, 12:15pm

Hello @donio4

Could you show the ReadonlyREST plugin logs from the moment when this error occurred on the Azure side?

Is any information stored locally in Kibana? I am not using any PV volumes in the Kibana pods.

Yes, there is a profile stored in the user session, which is sent on the logout call

donio4 · September 15, 2026, 12:34pm

i dont have any logs from the moment with this error from ror

Dzuming · September 15, 2026, 1:00pm

Looks like it’s not a problem with a profile, but with the issuer value, so the issuer value from a Kibana replica that initialized the SSO session is different from the issuer value of the Kibana replica where the logout button was clicked.

Could you verify that the issuer value in all replicas is the same? There should be information in the Kibana logs about the loaded configuration Successfully loaded ReadonlyREST Kibana plugin configuration:

donio4 · September 15, 2026, 2:04pm

yes, issuer is the same in all instances
[2026-09-15T15:57:29.116+02:00][info][plugins][ReadonlyREST][RorConfigManager] Successfully loaded ReadonlyREST Kibana plugin configuration: issuer=‘rordev’

(obfusced log)

Dzuming · September 16, 2026, 5:24am

Thanks, I will need a broader context to better understand a problem:

Does the problem also occur on this build readonlyrest_kbn_universal-1.71.0-pre5_es8.19.19.zip?
Is it a deterministic problem, and happens on the logout button click? If not, when does it occur?

donio4 · September 16, 2026, 6:07am

We haven’t noticed any issues with this version (at least, no users have reported any).
Yes, it happens when clicking logout; sometimes we also get a message from Kibana: “You do not have permission to access the requested page.”
But…
I started wondering if the extended session duration might be the culprit; I’ve just changed that in the config, and we’ll keep monitoring to see if the problem recurs.

Dzuming · September 17, 2026, 9:55am

Hi, did you have a chance to verify it?

donio4 · September 21, 2026, 12:20pm

We’ve checked. Unfortunately, we are now immediately redirected to the MS logout page. With this cookie, I am not redirected to the login page. If I have the correct cookies, the logout process works properly.

Dzuming · September 22, 2026, 4:45am

Hello @donio4

Which cookie do you have in mind, and what does it mean that it’s correct/incorrect?