# Configuring SAML Authentication: Encryption and Logout

**URL:** <https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540>\
**Category:** Site Operators\
**Created:** [October 30, 2023, 9:36am UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540 "2023-10-30T09:36:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alareo](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/alareo/32/5828_2.png) [@Alareo](https://discuss.openedx.org/u/Alareo)\
**Post date:** [October 30, 2023, 9:36am UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540/1 "2023-10-30T09:36:24Z")

</div>

Hi,

I’ve configured SAML authentication with my Open edX instance as an SP, and now I have access to the metadata. However, I am facing two problems:

1. I don’t know how to configure a **Logout URL**.

2. I’d like to force SSL encryption, but I don’t know how to do it. My instance is running behind a load balancer that provides SSL and forces HTTPS, but I use HTTP connections behind this proxy, so some URLs in the metadata.xml are HTTP instead of HTTPS. For example, this line: `<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://openedxinstance.myhost.com/auth/complete/tpa-saml/" index="1"/>`. Other URLs are defined in the configuration, but this one seems to be dynamically built, and I have no idea how to force it to use HTTPS.

My security configuration now looks like this:

```json
"SECURITY_CONFIG": {
    "metadataCacheDuration": 604800,
    "signMetadata": true,
    "nameIdEncrypted": true,
    "authnRequestsSigned": true,
    "logoutRequestSigned": true,
    "logoutResponseSigned": true,
    "wantMessagesSigned": true,
    "wantAssertionsSigned": true,
    "wantNameIdEncrypted": true
}

```

Any suggestions would be greatly appreciated.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![braden](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/braden/32/46_2.png) [@braden](https://discuss.openedx.org/u/braden)\
**Post date:** [October 30, 2023, 6:36pm UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540/2 "2023-10-30T18:36:17Z")

</div>

For the second part of your question (about HTTPS), see this thread: [SSO and SSL: tpa-saml - #3 by braden](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/3)

---

<div class="post-metadata">

**Author:** ![Alareo](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/alareo/32/5828_2.png) [@Alareo](https://discuss.openedx.org/u/Alareo)\
**Post date:** [November 8, 2023, 4:08pm UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540/3 "2023-11-08T16:08:07Z")

</div>

Thanks, @braden! I manage to solve the issue forcing https in the request.

Now my SECURITY\_CONFIG now looks like this:

```auto
"SECURITY_CONFIG": {
    "metadataCacheDuration": 604800,
    "signMetadata": true,
    "nameIdEncrypted": false,
    "authnRequestsSigned": true,
    "wantMessagesSigned": true,
    "wantAssertionsSigned": true,
    "wantNameIdEncrypted": false
}

```

Note that `nameIdEncrypted` and `wantNameIdEncrypted` are now set to false. Also, I removed logout-related entries since I still didn’t find a way to configure logout.

I have a different problem now during login:  
 ![image](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/8/8eeb4c73152c53b07c44b4e62b3058efa3cd9762.png)

```auto
Authentication failed: SAML login failed: ['invalid_response'] (The status code of the Response was not Success, was Responder -> No authentication sources exist for the requested AuthnContextClassRefs: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport)

```

I don’t know if I should (or can) change the authentication method.

---

<div class="post-metadata">

**Author:** ![Tim\_McCormack](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/tim_mccormack/32/9733_2.png) [@Tim\_McCormack](https://discuss.openedx.org/u/Tim_McCormack)\
**Post date:** [November 8, 2023, 6:17pm UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540/4 "2023-11-08T18:17:06Z")

</div>

For #1, does `TPA_AUTOMATIC_LOGOUT_ENABLED` help?

---

<div class="post-metadata">

**Author:** ![braden](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/braden/32/46_2.png) [@braden](https://discuss.openedx.org/u/braden)\
**Post date:** [November 9, 2023, 5:52pm UTC](https://discuss.openedx.org/t/configuring-saml-authentication-encryption-and-logout/11540/5 "2023-11-09T17:52:00Z")

</div>

> [@Alareo](#):
>
> I don’t know if I should (or can) change the authentication method.

Yeah, you might need to change a setting on the IdP side, to allow `PasswordProtectedTransport`. But I’m not totally sure. It’s been a while since I was working on the details of SAML setup.