Could use some help with Azure SSO for community edition Cortex XSOAR

[DriveYourAceOff]

Hello,

I have tried many settings and can't seem to quite figure out what text is to be entered into the setup section within Xsoar for the Azure SAML SSO setup. I keep getting this error: 

" {"id":"errSAMLLogin","status":400,"title":"Failed to login via SAML","detail":"Failed to login via SAML","error":"","encrypted":false,"multires":null} "

I have tried many different names and mappings to Azure. Any insight as to what the entry should look like on the Xsoar side would be greatly appreciated.

This is what I have currently made my entries in Azure to be, and have used the claim name in Xsoar and am still getting the error.

Thank you,

Richard

[jfernandes1]

Hi Richard,

Your claim details don't look right for Azure. They should look like this. 

Take a look at this documentation - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/users-and-roles/authent...

[DriveYourAceOff]

Thank you very much for the reply, I have never removed the schema before and have tried it both ways. I have re-added the schema back and still get the same error. I think what I am in need of is what the entry should look like on xsoar side of things. I got the removal of the schema line by looking at the example above in the link that you gave me. 

Here is a screen shot of my saml response with the schemas being sent to xsoar:

Any other ideas would be greatly welcomed.

Richard

[cstone]

can you share a screenshot of your integration settings as well please

[DriveYourAceOff]

My current settings: 

If you want to see all of the settings, please let me know. I can take additional screen shots.

[cstone]

Yes please

[DriveYourAceOff]

Thank you again for assisting.

Richard

[jfernandes1]

Hi @DriveYourAceOff, it should looks like this.

Also the last option should look like this. According to the documentation - 

"In the Service Identifier (ADFS) field, copy the characters after the appid value, which can be found at the end of the App Federation Metadata URL (section 3 in SAML Certificate)."

Let me know if this works for your. 

Thanks, Jeremy.

 

[DriveYourAceOff]

Is there any way that you can tell me what the fields say at the end of the attributes you used.

[DriveYourAceOff]

Thanks again, I am still getting the same error however. Here are my new settings, and I believe that they are correct. I am thinking that I may start fresh and try again, but here are my newest settings:

I se the appid section and copied that value to put in below:

The only field in question is the group field. I feel like that may be wrong as there are several different ways to make the group throughout the instructions. I have used the below method, and it does look like it is getting the correct group from Azure in the saml response xml.

Thanks again for the help!

Richard

[jfernandes1]

Hi Richard,

I'm not sure about the iDP Metadata URL. You can copy then from the below 

Attribute to get group should be set in a similar way.

 

Thanks, Jeremy

[Hartmann]

In Cortex XSOAR, go to Settings > Integrations > Credentials and create a new credentials set.In the Username parameter, enter your registered app Application D.In the Password parameter, enter the secret value you created.Copy your tenant ID for the integration configuration usage.

[DriveYourAceOff]

I updated the group to include the namespace, but am still getting the same error.

[DriveYourAceOff]

Can you please send me the link to this documentation in xsoar so that I can follow it, this makes sense but I want to make sure that I get the values from the correct places. There is no secret with an Enterprise Application in Azure, so that is where I am getting a little bit lost. 

Thanks!

[jfernandes1]

Here you go - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/users-and-roles/authent...