From f522c0b13dc5b9e1e94bfe7e3b1adc8fd000ae0b Mon Sep 17 00:00:00 2001
From: Ajay Tripathy <4tripathy@gmail.com>
Date: Wed, 19 Aug 2020 15:41:44 -0700
Subject: [PATCH] Update user-management.md
---
user-management.md | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/user-management.md b/user-management.md
index 95e541d95..b132549c5 100644
--- a/user-management.md
+++ b/user-management.md
@@ -8,3 +8,41 @@ Kubecost’s SSO/SAML support makes it easy to manage application access and wor
+
+SAML troubleshooting
+
+Disable SAML and confirm that the cost-analzyer pod starts.
+If that is successful, but when SAML is added the pod is crashing or never enters the ready state, it is likely that there is panic loading or parsing SAML data. You should be able to pull the logs by fetching logs for the previous pod:
+
+kubectl logs -n kubecost --previous
+
+If you’re supplying the SAML from the address of an Identity Provider Server: curl the saml metadata endpoint from within the kubecost pod and ensure that a valid XML EntityDescriptor is being returned and downloaded. The response should be in this format:
+```
+kubectl exec kubecost-cost-analyzer-84fb785f55-2ssgj -c cost-analyzer-frontend -n kubecost -it -- /bin/sh
+curl https://dev-elu2z98r.auth0.com/samlp/metadata/c6nY4M37rBP0qSO1IYIqBPPyIPxLS8v2
+
+
+
+
+
+
+ ...
+
+
+
+
+
+ urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
+ urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
+ urn:oasis:names:tc:SAML:2.0:nameid-format:transient
+
+
+
+
+
+
+
+
+
+```
+Common errors are this URL 404-ing or returning HTML. Contact your SAML admin to find the URL on your identity provider that serves the raw XML file.