# SAML Auth from behind Apache Reverse Proxy **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [September 27, 2017, 4:55pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616 "2017-09-27T16:55:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Drew\_Stinnett](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@Drew\_Stinnett](https://forum.ansible.com/u/Drew_Stinnett)\ **Post date:** [September 27, 2017, 4:55pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616/1 "2017-09-27T16:55:32Z")
Hi Gang, I’m trying to use SAML authentication on an AWX container that has an apache frontend, however AWX appears to be sending the wrong ACS. The apache service is just running TLS, and doing a proxypass to [http://127.0.0.1:80](http://127.0.0.1:80). The web interface at [https://awx.example.com](https://awx.example.com) works fine, and I have set the base url setting to [https://awx.example.com](https://awx.example.com). Under the SAML settings, the ACS shows correctly as “[https://awx.example.com/sso/complete/saml](https://awx.example.com/sso/complete/saml)”, however when I actually try to log in with SAML, AWX is sending “[http://127.0.0.1:80/sso/complete/saml/](http://127.0.0.1:80/sso/complete/saml/)”. Is there something I’m missing here, to have AWX send the expected ACS? Thanks!! Drew ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [September 27, 2017, 5:26pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616/2 "2017-09-27T17:26:40Z")
does this look like what you running into? [https://github.com/ansible/awx/issues/119](https://github.com/ansible/awx/issues/119) ---
**Author:** ![Drew\_Stinnett](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@Drew\_Stinnett](https://forum.ansible.com/u/Drew_Stinnett)\ **Post date:** [September 27, 2017, 5:35pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616/3 "2017-09-27T17:35:20Z")
Not exactly, but it may be related…it looks like that bug report is for the port not getting passed to the SAML request correctly. In our instance, the protocol (https), port (443) and host ([awx.example.com](http://awx.example.com)) are all getting passed through incorrectly I would expect to see the URL listed in the “SAML ASSERTION CONSUMER SERVICE (ACL) URL” field in the config (which is currently correct), to be what is sent as the ACS to the SAML provider, however it’s using the ‘[http://127.0.0.1:80](http://127.0.0.1:80)’, instead of ‘[https://awx.example.com](https://awx.example.com)’. I’m happy to open up a github bug report if that’s more handy than the mailing list! ---
**Author:** ![Drew\_Stinnett](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@Drew\_Stinnett](https://forum.ansible.com/u/Drew_Stinnett)\ **Post date:** [October 16, 2017, 3:07pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616/4 "2017-10-16T15:07:05Z")
I’m getting a little further now…I switched over to using nginx to do the SSL bits and proxy back to the container, and the correct ACS is sent. Now I’m getting the following error though after performing my authentication: Authentication failed: SAML login failed: [‘invalid\_response’] (The response was received at [https://awx.example.com:8052/sso/complete/saml/](https://awx.example.com:8052/sso/complete/saml/) instead of [https://awx.example.com/sso/complete/saml/](https://awx.example.com/sso/complete/saml/)). It looks like the container port is getting appended in somewhere it shouldn’t be. ---
**Author:** ![idyurev](https://avatars.discourse-cdn.com/v4/letter/i/a698b9/32.png) [@idyurev](https://forum.ansible.com/u/idyurev)\ **Post date:** [December 19, 2017, 6:19pm UTC](https://forum.ansible.com/t/saml-auth-from-behind-apache-reverse-proxy/25616/5 "2017-12-19T18:19:13Z")
Hello, I have similar problem , AWX frontend behind nginx sends to saml idp (adfs) [http://awx.somedomain.foo/sso/complete/saml](http://awx.somedomain.foo/sso/complete/saml) instead of [https://awx.somedomain.foo/sso/complete/saml](https://awx.somedomain.foo/sso/complete/saml) . I would be grateful if you share solution for solve this problem.