Type to search.

Authenticate SAML

  • POST /_security/saml/authenticate
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 7.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Submit a SAML response message to Elasticsearch for consumption.

Note

This API is intended for use by custom web applications other than Kibana. If you are using Kibana, refer to the documentation for configuring SAML single-sign-on on the Elastic Stack.

The SAML message that is submitted can be:

  • A response to a SAML authentication request that was previously created using the SAML prepare authentication API.
  • An unsolicited SAML message in the case of an IdP-initiated single sign-on (SSO) flow.

In either case, the SAML message needs to be a base64 encoded XML document with a root element of <Response>.

After successful validation, Elasticsearch responds with an Elasticsearch internal access token and refresh token that can be subsequently used for authentication. This API endpoint essentially exchanges SAML responses that indicate successful authentication in the IdP for Elasticsearch access and refresh tokens, which can be used for authentication against Elasticsearch.

More about SAML authentication

Request body

content string required

The SAML response as it was sent by the user's browser, usually a Base64 encoded XML document.

ids union oneOf required

A JSON array with all the valid SAML Request Ids that the caller of the API has for the current user.

One of: string[] or string
realm string

The name of the realm that should authenticate the SAML response. Useful in cases where many SAML realms are defined.

Response

application/json
access_token string required

The access token that was generated by Elasticsearch.

username string required

The authenticated user's name.

expires_in number required

The amount of time (in seconds) left until the token expires.

refresh_token string required

The refresh token that was generated by Elasticsearch.

realm string required

The name of the realm where the user was authenticated.

in_response_to string

The id of the request that initiated the authentication process.