# Debug SAML Auth on AWX

**URL:** <https://forum.ansible.com/t/debug-saml-auth-on-awx/2400>\
**Category:** Get Help\
**Tags:** rhel, awx, collections, kubernetes\
**Created:** [November 15, 2023, 3:15pm UTC](https://forum.ansible.com/t/debug-saml-auth-on-awx/2400 "2023-11-15T15:15:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dustin](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin/32/2573_2.png) [@Dustin](https://forum.ansible.com/u/Dustin)\
**Post date:** [November 15, 2023, 3:15pm UTC](https://forum.ansible.com/t/debug-saml-auth-on-awx/2400/1 "2023-11-15T15:15:16Z")

</div>

**My Setup**  
All running on one RHEL server  
Kubernetes: Rancher  
Install Method: Rancher + AWX-Operator 2.7.2 using Kustomize  
External Access: NGINX Installed on the same RHEL server to proxy external connections on HTTPS to the awx\_web pod

**What’s Wrong**  
I cannot get SAML to work. My SSO team has setup the SSO portion of the SAML login.  
I setup the SAML settings in Settings-\>Authentication-\>SAML Settings.  
I have the SSO Login button on the login page.  
When I click the SSO button on the login page:

1. I get forwarded to the SSO URL
2. SSO Sends me through the SAML login process
3. SSO forwards me back to my [https://awx/sso/complete/saml/](https://awx/sso/complete/saml/) URL
4. My AWX forwards me to /sso/error

When I use kubectl logs to watch the awx\_web pod logs, the only error I see is "ERROR … Social: ‘RelayState’. I cannot figure out how to do any real debugging on this issue to point me in the right direction to get this working.

Does anyone have any pointers or tips?

---

<div class="post-metadata">

**Author:** ![jdp11d](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jdp11d](https://forum.ansible.com/u/jdp11d)\
**Post date:** [April 11, 2024, 10:28pm UTC](https://forum.ansible.com/t/debug-saml-auth-on-awx/2400/2 "2024-04-11T22:28:37Z")

</div>

Running into the same issue on version 2.4.0. I am wondering if its related to the way my service is set up. Were you able to find a solution or a way to output better logs ? How are you generating your cert/key that saml requires? self signed?

---

<div class="post-metadata">

**Author:** ![Dustin](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dustin/32/2573_2.png) [@Dustin](https://forum.ansible.com/u/Dustin)\
**Post date:** [April 11, 2024, 11:39pm UTC](https://forum.ansible.com/t/debug-saml-auth-on-awx/2400/3 "2024-04-11T23:39:14Z")

</div>

In my instance, I had the wrong name configured in my SAML config. I’m not in office at the moment, but I can check when I get back in office on Monday.

I used the same cert and key for the SSO config that I used for Web interface, which is a cert signed by a trusted ca.

---

<div class="post-metadata">

**Author:** ![csmith](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/csmith/32/4194_2.png) [@csmith](https://forum.ansible.com/u/csmith)\
**Post date:** [July 11, 2024, 2:13am UTC](https://forum.ansible.com/t/debug-saml-auth-on-awx/2400/4 "2024-07-11T02:13:35Z")

</div>

Can you tell me what you mean by “name in the SAML config”? I’m having a similar issue and don’t get much at all in the web logs other than I get forwarded to /sso/error