Commit ae00efd3 authored by Suvinya Mullaseril's avatar Suvinya Mullaseril Committed by Kent Japhet Ballon
Browse files

New kibana tip to retrieve saml_response of user

parent b8d4bff9
Loading
Loading
Loading
Loading
+50 −0
Original line number Diff line number Diff line
@@ -242,6 +242,56 @@ In the `pubsub-rails-inf-gprd-*` log:

After decoding the SAML response, and observing the results corresponding to your chosen filters, you can see if there are any missing or misconfigured attributes.

#### SAML response

To obtain the SAML response of a particular user:

- Example group: [gitlab-silver](https://gitlab.com/gitlab-silver/)
- Example user: `user@domain.com`

In the `pubsub-rails-inf-gprd-*` log:

1. Set the date range to a value that you believe will contain the result. Set it to `Last 7 days` if you're unsure.
1. Add a positive filter on `json.saml_response.audiences` for the path of the group. `gitlab-silver` in this example case.
1. Add a positive filter on `json.payload_type` for `saml_response`.
1. Add a positive filter on `json.saml_response.attributes.email` for the email address of the user whose `saml_response` you are retrieving. `user@domain.com` in this example case
1. Review the values in `json.saml_response.attributes` 

Example: 1

```json
"attributes": {
  "email": [
    "user@domain.com"
  ],
  "groups": [
    "saml-group-1-developer",
    "saml-group-2-maintainer"
  ]
},
```

Example 2:

```json
"attributes": {
    "email": [
       "user@domain.com"
     ],
    "firstname": [
      "John"
    ],
     "lastname": [
       "Doe"
    ],
    "name": [
       "John Doe"
    ]
   }
```

- [Quick link to search](https://log.gprd.gitlab.net/app/r/s/hdVqu)

#### SCIM provisioning and de-provisioning

To investigate SCIM problems: