# SAML Error CSRF Verification Failed. Request aborted. **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [November 14, 2022, 8:41pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348 "2022-11-14T20:41:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 14, 2022, 8:41pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/1 "2022-11-14T20:41:31Z")
I setup SAML with Okta I’ve followed this [https://www.ansible.com/blog/using-saml-with-red-hat-ansible-tower](https://www.ansible.com/blog/using-saml-with-red-hat-ansible-tower) tower\_URL\_base is set, everything is set so backend enables. The SAML link on login page does the dance to Okta comes back and AWX reports: CSRF Verification Failed. Request aborted. then More information is available with DEBUG=True Not sure what else to check here. I have turned the logs up to Debug. Where should I even be able to see this verbose output? what is this CSRF verification? ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [November 16, 2022, 7:53pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/2 "2022-11-16T19:53:06Z")
CSRF is [Cross Site Request Forgery](https://owasp.org/www-community/attacks/csrf) at a very high level when you hit AWX for the first time in a browser you get a CSRF cookie and that cookie is used in combination with your session to ensure someone does not try and interject you into the application in a weird way. Can you look at the login page with a fresh session and look at the first call to api/ and validate that the response includes a Set-Cookie like: Set-Cookie: csrftoken=kSOU2LN8JAHQ76z85zgQ25fdCLcDNwr7yWYAyNFdPwEcrGspxIvQ1POzRfRcdAO6; Path=/; SameSite=Lax And then validate that when you get back from Okta you have the same token? If logs are set to debug you should see information when AWX is processing the SAML assertion in the AWX logs but I think invalid CSRF will knock you out before that process happens. -The AWX Team ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 16, 2022, 8:32pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/3 "2022-11-16T20:32:21Z")
I’m using helm chart deploy of awx-operator with nginx lb. Is there some reason that would cause this? OID doesn’t have an issue, but I can’t really do the group mappings I need in there from what I can see. ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 16, 2022, 8:33pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/4 "2022-11-16T20:33:19Z")
also i set logging to Debug in the GUI but the logs showing on the container don’t seem any different. Is there some other way I need to turn that on? ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [November 18, 2022, 6:30pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/5 "2022-11-18T18:30:11Z")
Hello, We have a follow-up question regarding the manner in which you are conducting your ngnix load balancing. Do you have more than one AWX web node behind the load balancer or is it just a front end for a single instance? When Okta is redirecting you back to AWX are you hitting a load balancer or the node directly? The DEBUG=True is a development setting and not something we would suggest turning on in production. If you are not running this in a production environment, or if you have a sandbox/testing environment, please let us know and we can further assist you with the steps to enable debugging. -AWX Team ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 18, 2022, 7:49pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/6 "2022-11-18T19:49:08Z")
I’m using node port ingress. I have only 1 awx web node. The ingress is what sets up a trusted certificate and registers DNS. apiVersion: v1 kind: Service metadata: labels: app: awx-demo name: awx-demo namespace: awx-test spec: type: NodePort ports: - name: http port: 80 targetPort: 30080 selector: app: awx-demo-service ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 22, 2022, 7:47pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/7 "2022-11-22T19:47:58Z")
I added: csrf\_cookie\_secureL ‘False’ but doesn’t seem like the setting is being applied even though I see it in the last-applied-configuration ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [November 28, 2022, 5:23pm UTC](https://forum.ansible.com/t/saml-error-csrf-verification-failed-request-aborted/37348/8 "2022-11-28T17:23:22Z")
still failing with csrf\_cookie\_secure: ‘False’ per documentation … how do I get this working?