Update SAML configuration

realm_id string required

The Elasticsearch Security realm identifier.

version string

When specified, checks for conflicts against the version stored in the persistent store (returned in 'x-cloud-resource-version' of the GET request)

The SAML configuration

id string required

The identifier for the security realm

name string required

The friendly name of the security realm

idp object required

The configuration for the Elasticsearch security SAML Identity Provider.

− hide properties

entity_id string required

The Entity ID of the SAML Identity Provider. An Entity ID is a URI with a maximum length of 1024 characters. It can be a URL or a URN and can be found in the configuration or the SAML metadata of the Identity Provider.

metadata_path string required

The URL to a SAML 2.0 metadata file describing the capabilities and configuration of the Identity Provider

use_single_logout boolean

Indicates whether to utilise the Identity Provider's Single Logout service

sp object required

The configuration for the Elasticsearch security SAML Service Provider.

− hide properties

entity_id string required

The Entity ID to use for this SAML Service Provider. This should be entered as a URI.

acs string required

The URL of the Assertion Consumer service

logout string required

The URL of the Single Logout service

attributes object required

The mapping configuration for the Elasticsearch security SAML attribute.

− hide properties

principal string required

The name of the SAML attribute that contains the user's principal (username). This name should map to a value that does not contain commas or slashes.

groups string required

The name of the SAML attribute that contains the user's groups

name string

The name of the SAML attribute that contains the user's full name

mail string

The name of the SAML attribute that contains the user's email address

dn string

The name of the SAML attribute that contains the user's X.50 Distinguished Name

nameid_format string

The NameID format. If not specified the IdP default is used. Example: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'

role_mappings object

The mapping ruleset for the Elasticsearch security SAML role.

− hide properties

default_roles string[] required

The default roles applied to all users

rules object[] required

The role mapping rules to evaluate

− hide properties

type enum required

The type of role mapping rule

Values: username groups dn

roles string[] required

The roles that are applied when the mapping rule is successfully evaluated

value string required

The value to match when evaluating this rule

enabled boolean

When true, enables the security realm

order integer · format: int32

The order that the security realm is evaluated

force_authn boolean

Specifies whether to set the ForceAuthn attribute when requesting that the IdP authenticate the current user. If set to true, the IdP is required to verify the user's identity, irrespective of any existing sessions they might have.

signing_certificate_url string

The SAML signing certificate bundle URL. The bundle should be a zip file containing 'signing.key' and 'signing.pem' files in the directory '/saml/:id', where :id is the value of the [id] field.

signing_certificate_url_password string

The password to the signing certificate bundle

signing_saml_messages string[]

A list of SAML message types that should be signed. Each element in the list should be the local name of a SAML XML Element. Supported element types are AuthnRequest, LogoutRequest and LogoutResponse. Only valid if a signing certificate is also specified.

encryption_certificate_url string

The SAML encryption certificate bundle URL. The bundle should be a zip file containing 'encryption.key' and 'encryption.pem' files in the directory '/saml/:id', where :id is the value of the [id] field.

encryption_certificate_url_password string

The password to the encryption certificate bundle

ssl_certificate_url string

The SSL trusted CA certificate bundle URL. The bundle should be a zip file containing a single keystore file 'keystore.ks' Note that all keys should omit the 'xpack.security.authc.realms.saml.{realm_id}' prefix. For example, when the realm ID is set to 'saml1', the advanced configuration 'xpack.security.authc.realms.saml.saml1.ssl.verification_mode: full' should be added as 'ssl.verification_mode: full'.

ssl_certificate_url_truststore_password string

The password to the SSL certificate bundle URL truststore

ssl_certificate_url_truststore_type enum

The format of the keystore file. Should be jks to use the Java Keystore format or PKCS12 to use PKCS#12 files. The default is jks.

Values: jks PKCS12

override_yaml string

Advanced configuration options in YAML format. Any settings defined here will override any configuration set via the API. Note that all keys should omit 'xpack.security.authc.realms.{realm_type}.{realm_id}'.