# SAML integration

**URL:** <https://forum.ansible.com/t/saml-integration/38014>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [May 21, 2023, 6:11am UTC](https://forum.ansible.com/t/saml-integration/38014 "2023-05-21T06:11:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [May 21, 2023, 6:11am UTC](https://forum.ansible.com/t/saml-integration/38014/1 "2023-05-21T06:11:25Z")

</div>

Hi!

I am trying to integrate AWX with my company’s IdP using SAML. I have been able to get basic SAML authentication working, with users successfully authenticating. However I’m struggling to get team mapping and superuser attribute mapping working. Currently all users that successfully authenticate have no team mappings.

I have configured the IdP to send an attribute called “groups” in the SAML assertion, which I believe should contain the list of groups. I have set the value of “SOCIAL\_AUTH\_SAML\_TEAM\_ATTR” and “SOCIAL\_AUTH\_SAML\_USER\_FLAGS\_BY\_ATTR” as below.

```auto
    "SOCIAL_AUTH_SAML_TEAM_ATTR": {
        "remove": false,
        "team_org_map": [
            {
                "team_alias": "<Team in AWX>",
                "team": "<group ID in IdP>",
                "organization": "<Org created in AWX>"
            }
        ],
        "saml_attr": "groups"
    },
    "SOCIAL_AUTH_SAML_USER_FLAGS_BY_ATTR": {
        "is_superuser_attr": "groups",
        "is_superuser_value": [
            "<group ID in IdP>"
        ]
    }

```

Is there a way to see on AWX the list of assertions that it receives in the SAML response from the IdP? Can I set something in “SOCIAL\_AUTH\_SAML\_SP\_EXTRA” (currently empty) to do this?

I tried setting “SOCIAL\_AUTH\_SAML\_SP\_EXTRA” as below, but I couldn’t see any additional logging.

```auto
    "SOCIAL_AUTH_SAML_SP_EXTRA": {
        "debug": true
    },

```

Cheers

Rod

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [May 21, 2023, 6:58am UTC](https://forum.ansible.com/t/saml-integration/38014/2 "2023-05-21T06:58:29Z")

</div>

I should have added that I am running AWX 22.2.0 on Kubernetes, deployed with by the AWX Operator 2.1.0 using the AWX and AWX images from [quay.io](http://quay.io).

Is there an option that I can set via AWX API to enrich SAML debug logging or would this require customising the Python code relating to the “python-saml” library?

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [May 21, 2023, 8:04am UTC](https://forum.ansible.com/t/saml-integration/38014/3 "2023-05-21T08:04:05Z")

</div>

I solved my issue. The IdP was not passing a UUID for the group, but rather the name. I could see the list of assertions in the browser by following the sense of directions in [https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot\_saml\_view-saml-response.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml_view-saml-response.html).