# SAML integration with gsuite

**URL:** <https://forum.ansible.com/t/saml-integration-with-gsuite/27488>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [May 9, 2018, 7:52am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488 "2018-05-09T07:52:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Choon\_Ming\_Goh](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@Choon\_Ming\_Goh](https://forum.ansible.com/u/Choon_Ming_Goh)\
**Post date:** [May 9, 2018, 7:52am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/1 "2018-05-09T07:52:17Z")

</div>

Hi,

I’m currently using AWX 1.0.4.130 and I’m trying to implement SAML with it. I’ve configured the IDP as simple as it can be with the metadata from google

SAML Enabled IDP:

`

{  
“google”: {  
“url”: “[https://accounts.google.com/o/saml2/idp?idpid=xxxxx](https://accounts.google.com/o/saml2/idp?idpid=xxxxx)”,  
“entity\_id”: “[https://accounts.google.com/o/saml2?idpid=xxxxx](https://accounts.google.com/o/saml2?idpid=xxxxx)”,  
“x509cert”: “”  
}  
}

`

I did not add any additional mappings or attributes as I’m testing this out. However, when I try to login, I’m getting this error:

`  
Authentication failed: SAML login failed: [‘invalid\_response’] (There is no AttributeStatement on the Response).

`

Any pointers as to what I am missing?

---

<div class="post-metadata">

**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\
**Post date:** [May 9, 2018, 8:14am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/2 "2018-05-09T08:14:27Z")

</div>

[https://gist.github.com/chrismeyersfsu/3c34413be80339fa8c96e4f2c2e18d6f](https://gist.github.com/chrismeyersfsu/3c34413be80339fa8c96e4f2c2e18d6f) example saml transaction. Notice the AttributeStatement section in the second gist file.

I used a chrome saml extension to capture this transaction.

---

<div class="post-metadata">

**Author:** ![Choon\_Ming\_Goh](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@Choon\_Ming\_Goh](https://forum.ansible.com/u/Choon_Ming_Goh)\
**Post date:** [May 9, 2018, 8:20am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/3 "2018-05-09T08:20:21Z")

</div>

Hey Chris,

Thanks for the sample gist. I looked at my output and I do not see the AttributeStatement section. In which field did you add it in the SAML configuration on AWX? I’ve tried extending the SAML Enabled IDP field to

`

{  
“google”: {  
“url”: “[https://accounts.google.com/o/saml2/idp?idpid=xxxxx](https://accounts.google.com/o/saml2/idp?idpid=xxxxx)”,  
“entity\_id”: “[https://accounts.google.com/o/saml2?idpid=xxxx](https://accounts.google.com/o/saml2?idpid=xxxx)”,  
“x509cert”: “”,  
“attr\_user\_permanent\_id”: “name\_id”,  
“attr\_first\_name”: “User.FirstName”,  
“attr\_last\_name”: “User.LastName”,  
“attr\_username”: “User.email”,  
“attr\_email”: “User.email”  
}  
}

`

---

<div class="post-metadata">

**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\
**Post date:** [May 9, 2018, 8:23am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/4 "2018-05-09T08:23:01Z")

</div>

The second payload, with the AttributeStatement, comes from your idp (gsuite). Setting the attributes in awx just instructs awx on what to look for in the payload. It will not influence what’s in the payload.

---

<div class="post-metadata">

**Author:** ![Choon\_Ming\_Goh](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@Choon\_Ming\_Goh](https://forum.ansible.com/u/Choon_Ming_Goh)\
**Post date:** [May 9, 2018, 8:25am UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/5 "2018-05-09T08:25:21Z")

</div>

On a deeper dive, I noticed this in my POST request

`  
saml2:Subject  
\<saml2:NameID  
Format=“urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”\>[user@example.com](mailto:user@example.com)  
\</saml2:NameID\>

`

The format is set as unspecified instead of emailAddress.

---

<div class="post-metadata">

**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\
**Post date:** [May 9, 2018, 1:49pm UTC](https://forum.ansible.com/t/saml-integration-with-gsuite/27488/6 "2018-05-09T13:49:00Z")

</div>

Choon,

That may or may not matter. Given the error message I would concentrate on the AttributeStatement section.