# Okta saml auth error social 'RelayState' **URL:** \ **Category:** Get Help\ **Tags:** awx\ **Created:** [April 11, 2024, 10:51pm UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914 "2024-04-11T22:51:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jdp11d](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jdp11d](https://forum.ansible.com/u/jdp11d)\ **Post date:** [April 11, 2024, 10:51pm UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/1 "2024-04-11T22:51:11Z")
I am trying to set up Okta auth via saml on awx 2.4.0. I have set everything up as per documentation on the okta side and created a cert/key using ```auto openssl req -new -x509 -days 3652 -nodes -out sp.crt -keyout sp.key ``` { “okta”: { “attr\_user\_permanent\_id”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”, “attr\_username”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”, “entity\_id”: “”, “url”: “”, “x509cert”: “” } } When I try to auth with a valid account I get an error in logs ````auto social 'RelayState'. ``` and it just redirects me to the login page again. I do Okta was successful. VERSIONS DEFAULT_AWX_VERSION=22.5.0 OPERATOR_VERSION=2.4.0 Logs: I see the following on my logs ```` k logs awx-mgmt-web-ff8fc657d-g9w65 awx-mgmt-web -f 2024-04-11 22:39:53,465 ERROR [892518e519f4483eae21e9ef0a88d4a1] social ‘RelayState’. 2024-04-11 22:39:53,473 DEBUG [892518e519f4483eae21e9ef0a88d4a1] awx.analytics.performance request: \, response\_time: 0.089s 10.160.1.28 - - [11/Apr/2024:22:39:53 +0000] “GET /sso/complete/saml/ HTTP/1.1” 302 0 “” [Thu Apr 11 22:39:53 2024] GET /sso/complete/saml/ =\> generated 0 bytes in 91 msecs (HTTP/1.1 302) 10 headers in 461 bytes (1 switches on core 0) 2024-04-11 22:39:53,704 DEBUG [8c498d2fa8a6410fba930942b2ace3f0] awx.analytics.performance request: \, response\_time: 0.070s ```auto Any help would be appreciated, curious if there is another log with more information. ``` ---
**Author:** ![jbird](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jbird](https://forum.ansible.com/u/jbird)\ **Post date:** [April 19, 2024, 1:51am UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/2 "2024-04-19T01:51:25Z")
Please check this article for help resolving this issue. It’s a bit dated, and some doesn’t apply to OCP, but there is some helpful information in it. > **[How Do I Fix Show ERROR social "'RelayState'" Error in Ansible Tower Logs...](https://access.redhat.com/solutions/3453071)** > > Attempting to authenticate into Ansible Tower through a SAML configuration results in a RelayState error ## Resolution Verify that the Enabled IdP Provider `url` in the Ansible Tower configuration matches that of the IdP metadata. This field should be the SSO service’s location attribute. If the Ansible Tower application nodes are behind a load balancer, you will need to add the following lines into `/etc/tower/conf.d/custom.py` on each application node followed by `ansible-tower-service restart`: ```auto USE_X_FORWARDED_PORT = True USE_X_FORWARDED_HOST = True ``` ## Root Cause Ansible Tower hands off authentication to the third party SSO. The SSO successfully authenticates, but fails a relay state check when handing auth back to Tower. ## Diagnostic Steps /var/log/tower/tower.log: ```auto ERROR social "'RelayState'" ``` I hope this helps. Thanks, Jeff ---
**Author:** ![jbird](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jbird](https://forum.ansible.com/u/jbird)\ **Post date:** [April 19, 2024, 1:57am UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/3 "2024-04-19T01:57:49Z")
ooops, I reread your description and saw you have additional issues that should be addressed, too. ```auto { “okta”: { “attr_user_permanent_id”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”, “attr_username”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”, “entity_id”: “”, “url”: “”, “x509cert”: “” } } ``` You appear to be missing some required fields. The following docs should show you what you are missing. All fields MUST be defined. [https://docs.ansible.com/automation-controller/latest/html/administration/ent\_auth.html#saml-settings:~:text="onelogin"%3A,email" %20%20} }](https://docs.ansible.com/automation-controller/latest/html/administration/ent_auth.html#saml-settings:~:text=%22onelogin%22%3A,email%22%0A%20%20%7D%0A%7D) Also, the following article should help as it explains how to do exactly what you are trying to do. It is also a bit dated, but the same information applies and should help you out here. [https://access.redhat.com/solutions/4618191](https://access.redhat.com/solutions/4618191) I hope this helps. Jeff ---
**Author:** ![jdp11d](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jdp11d](https://forum.ansible.com/u/jdp11d)\ **Post date:** [May 9, 2024, 5:29pm UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/4 "2024-05-09T17:29:20Z")
Hi Jeff! Thank you for your reply. Sorry for late reply I was out on a work trip. I was able to follow the steps you suggested. by adding the following to my awx config. ```auto --- apiVersion: awx.ansible.com/v1beta1 kind: AWX metadata: name: awx-mgmt spec: secret_key_secret: awx-mgmt-secret-key extra_settings: - setting: USE_X_FORWARDED_HOST value: "True" --- apiVersion: v1 kind: Secret metadata: name: awx-mgmt-secret-key namespace: awx stringData: secret_key: --- apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: ca namespace: awx spec: securityPolicy: name: internal-networks --- apiVersion: v1 kind: Service metadata: annotations: beta.cloud.google.com/backend-config: '{"ports": {"80":"ca"}}' name: awx-mgmt-manual-service namespace: awx labels: app: awx-mgmt spec: ports: - port: 80 name: http targetPort: 8052 protocol: TCP selector: app.kubernetes.io/component: awx app.kubernetes.io/managed-by: awx-operator app.kubernetes.io/name: awx-mgmt-web type: NodePort --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: awx-mgmt-manual-ingress namespace: awx annotations: cert-manager.io/cluster-issuer: letsencrypt acme.cert-manager.io/http01-edit-in-place: "true" kubernetes.io/ingress.allow-http: "true" spec: tls: - hosts: - awx-mgmt.com secretName: awx-mgmt-tls rules: - host: awx-mgmt.prd.it.com http: paths: - path: /* pathType: ImplementationSpecific backend: service: name: awx-mgmt-manual-service port: name: http ``` here is settings.py file ```auto bash-5.1$ tail -n 10 /etc/tower/settings.py USE_X_FORWARDED_PORT = True BROADCAST_WEBSOCKET_PORT = 8052 BROADCAST_WEBSOCKET_PROTOCOL = 'http' RECEPTOR_LOG_LEVEL = 'info' USE_X_FORWARDED_HOST = True ``` Regarding the missing field I removed them for security but I will paste below what I have now with some dummy data. ```auto { "okta": { "attr_user_permanent_id": "name_id", "attr_first_name": "User.FirstName", "attr_last_name": "User.LastName", "attr_username": "User.email", "attr_email": "User.email", "entity_id": "http://www.okta.com/", "url": "https://okta.com/app///sso/saml", "x509cert": "" } } ``` I also went ahead and restarted my node and it was to the same results as before relay error. I tried upgrading our dev to current latest version and I also seem to be getting an error there but that one seems a bit different That error takes me to the following page instead. ![image](https://us1.discourse-cdn.com/ansible/original/2X/5/574eaf3a9f9b6736cd1cb0b986c906b5163d9090.png) I am starting to think this is perhaps an issue on how I set my ingress/service. I will keep playing around with it. If I find something Ill post here. Dev I setup a bit different using AWX operator to set up ingress see below. ```auto --- apiVersion: awx.ansible.com/v1beta1 kind: AWX metadata: name: awx-poc spec: no_log: false csrf_cookie_secure: 'False' session_cookie_secure: 'False' secret_key_secret: awx-poc-secret-key service_type: NodePort service_annotations: | environment: sandbox beta.cloud.google.com/backend-config: '{"ports": {"80":"ca"}}' ingress_type: ingress ingress_hosts: - hostname: awx-poc.com tls_secret: sample-tls-secret ingress_annotations: | environment: sandbox cert-manager.io/cluster-issuer: letsencrypt acme.cert-manager.io/http01-edit-in-place: "true" kubernetes.io/ingress.allow-http: "true" extra_settings: - setting: USE_X_FORWARDED_HOST value: "True" - setting: LOG_AGGREGATOR_LEVEL value: "'DEBUG'" # error with debug level extra_volumes: | - name: awx-web-debug emptyDir: {} web_extra_volume_mounts: | - name: awx-web-debug mountPath: "/var/log/tower" --- apiVersion: v1 kind: Secret metadata: name: awx-poc-secret-key namespace: awx-poc stringData: secret_key: key --- apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: ca namespace: awx-poc spec: securityPolicy: name: internal-networks ``` Thank you, jdp1 ---
**Author:** ![jdp11d](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jdp11d](https://forum.ansible.com/u/jdp11d)\ **Post date:** [May 9, 2024, 7:43pm UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/5 "2024-05-09T19:43:19Z")
After a lot of testing I went back and had a call with our OKTA admin. Seems that the error was on their side. I did not need any extra settings other than what I had listed above for saml config. This article helped him set things up on his side correctly. A trailing “/” was what was breaking this before. [https://medium.com/@sazipkin/setting-up-ansible-tower-with-okta-a132644be980](https://medium.com/@sazipkin/setting-up-ansible-tower-with-okta-a132644be980) ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [June 8, 2024, 7:43pm UTC](https://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/6 "2024-06-08T19:43:30Z")
Closed on June 8, 2024, 7:43pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.