SAML & Azure/Entra

[stoppsjl]

Has anyone had any recent success with Redash 10.10 and Azure for SAML?

We've overcome some initial issues in relation to the set-up with thanks to the PR at https://github.com/getredash/redash/pull/6202/files and made sure we have all the right security updates for pysaml2 etc, but we are still getting a verification failure when the user is returned from the Azure login. It's made us wonder if this is actually working for anyone.

Thanks in advance for assistance, we will share anything we learn or overcome as we proceed.

[stoppsjl]

Hi All,

Just revisiting this question - we've not made any progress with SAML on Redash 10.10 (we get a signature verification error in the logs on return from Azure login).I appreciate everyone's time is tight - but can I get a vote to see if anyone has this working or if we should stop perusing this? Just a "Yes we use it" or "No, never worked for us" would be really helpful at this stage.

Thanks all :-)

[eradman]

@DSigmund do you know the answer to this question?

[DSigmund]

Well, i can just say using SAML and ADFD it works as expected. Did not test it with Azure AD Login

[stoppsjl]

Thanks for coming back on this, it is really helpful to know this is working with ADFD as it gives us a potential starting point. We will see if this is something we can test and feedback on any outcomes.

[stoppsjl]

Now Resolved:

After confirmation that others had this working (thumbs up to DSigmund), we revisited our SAML implementation across every stage and have managed to get SAML working. The key considerations for us were:

1. We had to make sure 100% that redash was using the modified version of the redash/authentication/saml_auth.py file that has the fix for the entity_id. Our working version has:

#    if acs_url is not None and acs_url != "":
#        saml_settings["entityid"] = acs_url

    if entity_id is not None and entity_id != "":
        saml_settings["entityid"] = entity_id

at line 88, which indicates where the entity_id is being set (as per the PR at https://github.com/getredash/redash/pull/6202/files).

2. We had to use static SAML configuration in Redash, we couldn't get dynamic to work. In Redash we set the:

a) SAML Single Sign-on URL to a https://login.microsoftonline.com/{YOUR-PRIVATE-VALUE}/saml2
b) SAML Entity ID to the same value as the Entra ID, Basic SAML Configuration, Identifier (Entity ID) - which is something like https://sts.windows.net/{YOUR-PRIVATE-VALUE}/
c) We downloaded the Certificate (Base64) version from the Entra/Azure portal. Importantly, when we pasted this in the Redash settings SAML x509 cert we had to remove the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- certificate lines (those who are used to using SSL certificate entry boxes such as in WHM might leave them in by mistake, we certainly did).
d) We set Signing Option to 'Sign SAML response and assertion' (this might not be required, the default could be fine).

---

Hopefully this will help anyone else aiming to setup SAML with Entra.