Skip to content

New subdomains behavior for SAML SSO #6413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shainaraskas wants to merge 2 commits into
base: main
Choose a base branch
from
Open

New subdomains behavior for SAML SSO #6413

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5303d77
new subdomains behavior
shainaraskas May 11, 2026
9f3401c
less important xref removed
shainaraskas May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion deploy-manage/deploy/elastic-cloud/restrictions-known-problems.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,6 @@ To learn more about the features that are supported by {{ecloud}}, check [{{eclo
* File and LDAP realms cannot be used. The Native realm is enabled, but the realm configuration itself is fixed in {{ecloud}}. Alternatively, authentication protocols such as SAML, OpenID Connect, or Kerberos can be used.
* Client certificates, such as PKI certificates, are not supported.
* IPv6 is not supported.
* Additional limitations apply when using SAML SSO at the organization level. Refer to [Configure {{ecloud}} SAML single sign-on](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md#ec_risks_and_considerations) for more information.


## APIs [ec-restrictions-apis]
Expand Down
10 changes: 6 additions & 4 deletions deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,11 +45,11 @@
* You must have a SAML 2.0 compatible identity provider.


## Limitations, risks, and considerations [ec_risks_and_considerations]
## Risks and considerations [ec_risks_and_considerations]

Before you configure SAML SSO, familiarize yourself with the following limitations, risks, and considerations:
Before you configure SAML SSO, familiarize yourself with the following risks and considerations:

* You can claim a maximum of 10 domains for your organization, including subdomains.
* You can claim up to 10 domains. Claiming a domain also enables SSO for all of its subdomains.

Check notice on line 52 in deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md

View workflow job for this annotation

GitHub Actions / build / vale 

Elastic.Wordiness: Consider using 'all' instead of 'all of '.
* Actions taken on the IdP are not automatically reflected in {{ecloud}}. For example, if you remove a user from your IdP, they are not removed from the {{ecloud}} organization and their active sessions are not invalidated.

To immediately revoke a user’s active sessions, an [Organization owner](/deploy-manage/users-roles/cloud-organization/user-roles.md#ec_organization_level_roles) must [remove the user from the {{ecloud}} organization](https://cloud.elastic.co/account/members) or remove their assigned roles.
Expand All @@ -73,7 +73,9 @@

Before you can register and use your IdP with {{ecloud}}, you must claim one or more domains. Only users that have email addresses that match claimed domains can authenticate with your IdP.

If the members of your {{ecloud}} organization have email addresses from multiple domains, you can claim multiple domains. You can claim up to 10 domains, including subdomains.
You can claim up to 10 domains. Claiming a domain also enables SSO for all of its subdomains.

Check notice on line 76 in deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md

View workflow job for this annotation

GitHub Actions / build / vale 

Elastic.Wordiness: Consider using 'all' instead of 'all of '.

For example, if you claim `example.com`, users with email addresses like `user@team.example.com` or `user@dev.team.example.com` can authenticate through your IdP. You don't need to claim subdomains separately, and they don't count toward the 10-domain limit.

You must have authority to modify your domain’s DNS records and be a member of the **Organization owner** role in {{ecloud}} to complete this step.

Expand Down
Loading