# SAML integration error

**URL:** <https://forum.ansible.com/t/saml-integration-error/27736>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [June 7, 2018, 2:08pm UTC](https://forum.ansible.com/t/saml-integration-error/27736 "2018-06-07T14:08:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahmed](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ahmed](https://forum.ansible.com/u/ahmed)\
**Post date:** [June 7, 2018, 2:08pm UTC](https://forum.ansible.com/t/saml-integration-error/27736/1 "2018-06-07T14:08:18Z")

</div>

Hi,

I’m currently trying to implement SAML on AWX 1.0.3 in the IdP-initiated mode.

This is the current configuration:

- AWX is behind a RP

- ACS URL: [https://10.203.12.139:8443/sso/metadata/saml/](https://10.203.12.139:8443/sso/metadata/saml/)

- Entity ID : aia-01

- SAML Enabled IDP:{

When I request access to AWX via the IdP link, the browser receives the following SAML response from the IdP:

https://idp\_host xxxxxxx xxxxxxx xxxxxxx https://idp\_host xxx@xxxxx.com aia-01 urn:oasis:names:tc:SAML:2.0:ac:classes:Password xxxxxxx xxxxxxx

However when this response is posted to AWX, I get the following error in awx\_web container logs : **2018-06-07 14:01:09,395 ERROR social “‘RelayState’”.**

 ![](https://us1.discourse-cdn.com/ansible/original/2X/8/8be08df3490099c530d593a04a0ff6d02f4ebd0b.png)

Is something missing in the SAML response sent by the IdP ??

Thank you.

---

<div class="post-metadata">

**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\
**Post date:** [June 7, 2018, 2:48pm UTC](https://forum.ansible.com/t/saml-integration-error/27736/2 "2018-06-07T14:48:26Z")

</div>

![](https://us1.discourse-cdn.com/ansible/original/2X/a/a7cfdd1d082e75b4be75c10cd155b34e6ad1f864.png)

The RelayState is passed to the IDP in the first GET request i.e. [https://ansible-redhat-dev.onelogin.com/trust/saml2/http-post/sso/721709?SAMLRequest=](https://ansible-redhat-dev.onelogin.com/trust/saml2/http-post/sso/721709?SAMLRequest=)\<base\_64\_stuff\_here\>&RelayState=westidp  
In the POST reply the relay state should be included in the payload ie. RelayState: westidp

In your case RelayState should be RelayState: my IdP

> **(attachments)**
>
> ![Auto Generated Inline Image 1.png](https://us1.discourse-cdn.com/ansible/original/2X/8/8be08df3490099c530d593a04a0ff6d02f4ebd0b.png)

---

<div class="post-metadata">

**Author:** ![ahmed](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ahmed](https://forum.ansible.com/u/ahmed)\
**Post date:** [June 8, 2018, 2:15pm UTC](https://forum.ansible.com/t/saml-integration-error/27736/3 "2018-06-08T14:15:35Z")

</div>

I add the ReplayState to the first get as follow: [https://idp\_host/affwebservices/public/saml2sso?SPID=aia-01&ProtocolBinding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&RelayState=my](https://idp_host/affwebservices/public/saml2sso?SPID=aia-01&ProtocolBinding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&RelayState=my) IdP and it is included in the post to AWX. However I get the same error

Should I append the ReplayState=my idp to URL in the SAML Enabled IDP ?

> **(attachments)**
>
> ![Auto Generated Inline Image 1.png](https://us1.discourse-cdn.com/ansible/original/2X/8/8be08df3490099c530d593a04a0ff6d02f4ebd0b.png)  
> ![image.png](https://us1.discourse-cdn.com/ansible/original/2X/a/a7cfdd1d082e75b4be75c10cd155b34e6ad1f864.png)