# SAML authentication with shibboleth iDP **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [November 30, 2018, 11:03pm UTC](https://forum.ansible.com/t/saml-authentication-with-shibboleth-idp/29170 "2018-11-30T23:03:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dmakovey](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmakovey](https://forum.ansible.com/u/dmakovey)\ **Post date:** [November 30, 2018, 11:03pm UTC](https://forum.ansible.com/t/saml-authentication-with-shibboleth-idp/29170/1 "2018-11-30T23:03:39Z")
Hi, has anyone configured AWX to use SAML auth with shibboleth? SAML configuration screens in Tower do not map into the same realm as some of the other apps I've configured to use with SAML in the past, nor was I able to produce "clean" metadata that I can submit to IDP without editing. Here's what I've figured (and done) so far: 1. generated cert/key and pasted them into Tower's interface 2. filled out SAML SP organization info: { "en-US": {   "url": "[http://mytower.stanford.edu](http://mytower.stanford.edu)",   "displayname": "My Ansible Tower",   "name": "my-ansible" } } 3. provided service contact 4. provided technical contact 5. under SAML Enabled Identity providers got something like: { "susaml": {   "url": "[https://login.stanford.edu/idp/profile/SAML2/Redirect/SSO"](https://login.stanford.edu/idp/profile/SAML2/Redirect/SSO"),   "entity\_id": "[https://idp-uat.stanford.edu/"](https://idp-uat.stanford.edu/"),   "x509cert": "......" } } 6. grabbed metadata from [https://mytower.stanford.edu/sso/metadata/saml/](https://mytower.stanford.edu/sso/metadata/saml/) 7. submitted metadata to idp.... and here's where I'm stuck with "The login service was unable to identify a compatible way to respond to the requested application. This is generally due to a misconfiguration on the part of the application and should be reported to the application's support team or owner. " which is me.... so what am I missing in this process? ---
**Author:** ![dmakovey](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmakovey](https://forum.ansible.com/u/dmakovey)\ **Post date:** [November 30, 2018, 11:06pm UTC](https://forum.ansible.com/t/saml-authentication-with-shibboleth-idp/29170/2 "2018-11-30T23:06:52Z")
> Hi, > > has anyone configured AWX to use SAML auth with shibboleth? > > SAML configuration screens in Tower do not map into the same realm as > some of the other apps I've configured to use with SAML in the past, nor > was I able to produce "clean" metadata that I can submit to IDP without > editing. Here's what I've figured (and done) so far: > > 1. generated cert/key and pasted them into Tower's interface > 2. filled out SAML SP organization info: > { > "en-US": { >   "url": "[http://mytower.stanford.edu](http://mytower.stanford.edu)", >   "displayname": "My Ansible Tower", >   "name": "my-ansible" > } > } > 3. provided service contact > 4. provided technical contact > 5. under SAML Enabled Identity providers got something like: > { > "susaml": { >   "url": "[https://login.stanford.edu/idp/profile/SAML2/Redirect/SSO"](https://login.stanford.edu/idp/profile/SAML2/Redirect/SSO"), >   "entity\_id": "[https://idp-uat.stanford.edu/"](https://idp-uat.stanford.edu/"), >   "x509cert": "......" > } > } > 6. grabbed metadata from [https://mytower.stanford.edu/sso/metadata/saml/](https://mytower.stanford.edu/sso/metadata/saml/) 6a. heavy edited metadata for IDP compliance. ---
**Author:** ![Foley\_John](https://avatars.discourse-cdn.com/v4/letter/f/e495f1/32.png) [@Foley\_John](https://forum.ansible.com/u/Foley_John)\ **Post date:** [December 1, 2018, 12:03am UTC](https://forum.ansible.com/t/saml-authentication-with-shibboleth-idp/29170/3 "2018-12-01T00:03:35Z")
Disclaimer: I got it working with Centrify IDP, so this is not based on Shib, But, maybe the metadata ingest is not working correctly? Sounds like Shib does not know how to offload back to AWX. I tried the metadata URL with Centrify and it failed. I didn’t bother looking at why it failed, and just entered the SP Configuration information in manually. All I ended up entering was the SP Entity ID (which I set as “tower” from within AWX, and set the ACS to what AWX said it was (“[https://tower.domain/sso/complete/saml](https://tower.domain/sso/complete/saml)”). It worked after that (and after setting up my SAML response in the Centrify IDP of course). Hope this helps, or points you in the right direction. J. Foley Library of Congress ---
**Author:** ![dmakovey](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmakovey](https://forum.ansible.com/u/dmakovey)\ **Post date:** [December 1, 2018, 12:10am UTC](https://forum.ansible.com/t/saml-authentication-with-shibboleth-idp/29170/4 "2018-12-01T00:10:18Z")
thanks John, I may follow your footsteps and manually generate the metadata altogether rather than editing it after AWX had a chance to generate it. Which is sub-optimal as I need my team to be able to maintain this setup and it's not as trivial as our typical shibboleth/mod\_shib setups along with simpleSAMLphp in it's current state (not to mention that it doesn't work).