# SSO and SSL: tpa-saml

**URL:** <https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098>\
**Category:** Site Operations Help\
**Created:** [November 14, 2021, 9:13am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098 "2021-11-14T09:13:33Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 14, 2021, 9:13am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/1 "2021-11-14T09:13:33Z")

</div>

hi  
I have an issue with open edx,  
after I set up the setting of open edx for SSO and the metadata was generated, there is an issue for the HTTP it is without “S” even I already have an SSL certificate in a domain?

```auto
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lmsdomain/auth/complete/tpa-saml/" index="1"/>
    </md:SPSSODescriptor>

```

because of this issue, when I tried to login by SSO the page appears to me.

 ![image](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/3/3e7208b11bc3342a0f6d3fe1cfab5dd318577d40.png)

  
  
and this is the error shown when I tried to add "s" to HTTP  
  

```auto
 Internal Server Error: /auth/complete/tpa-saml/
Traceback (most recent call last):
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/handlers/exception.py", line 41, in inner
    response = get_response(request)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/handlers/base.py", line 249, in _legacy_get_response
    response = self._get_response(request)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/handlers/base.py", line 187, in _get_response
    response = self.process_exception_by_middleware(e, request)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/handlers/base.py", line 185, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/utils/decorators.py", line 185, in inner
    return func(*args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/views/decorators/cache.py", line 57, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
    return view_func(*args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social_django/utils.py", line 49, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social_django/views.py", line 33, in complete
    *args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social_core/actions.py", line 41, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social_core/backends/base.py", line 40, in complete
    return self.auth_complete(*args, **kwargs)
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social_core/backends/saml.py", line 295, in auth_complete
    idp_name = self.strategy.request_data()['RelayState']
  File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/utils/datastructures.py", line 85, in __getitem__
    raise MultiValueDictKeyError(repr(key))
MultiValueDictKeyError: "'RelayState'"

```

---

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 15, 2021, 9:30am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/2 "2021-11-15T09:30:33Z")

</div>

appreciate your support @braden @giovannicimolin

---

<div class="post-metadata">

**Author:** ![braden](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/braden/32/46_2.png) [@braden](https://discuss.openedx.org/u/braden)\
**Post date:** [November 15, 2021, 7:10pm UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/3 "2021-11-15T19:10:12Z")

</div>

First, make sure you use HTTPS when fetching the metadata from Open edX. Otherwise it will use http in the metadata.

Second, when you view the metadata, if you are accessing the metadata over HTTPS but it contains an `http` URL, then django is mis-configured. Whatever proxy server is handling your HTTPS connection should be passing some headers to Django to indicate that the request was HTTPS, but Django isn’t seeing those headers. Check the `SECURE_PROXY_SSL_HEADER` setting, which should be what you need to change to fix it.

---

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 16, 2021, 8:48am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/4 "2021-11-16T08:48:30Z")

</div>

Hi @braden  
Thank you so much. appreciate that.

I have a question, for fetching the metadata from Open edX? you mean run this link _[https://lmsdomian/auth/saml/metadata.xml](https://lmsdomian/auth/saml/metadata.xml)_, right? if is it, yes I used HTTPS  
but still, contain HTTP this

```auto
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lmsdomian/auth/complete/tpa-saml/" index="1"/>

```

  

**I followed these steps:**

1- Generate key and cert  
2- Add key and cert at the LMS configuration file _auth.env_

```auto
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT

```

3- and update these at the LMS configuration file _lms.env_

```auto
"FEATURES": {
...
"ENABLE_THIRD_PARTY_AUTH": true,
....
},
"THIRD_PARTY_AUTH_BACKENDS": [
        "third_party_auth.saml.SAMLAuthBackend"
    ],

```

4- add configration on admin/third\_party\_auth/samlconfiguration/

 ![image](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/5/5b48cfbf232272be559c42b7f5cb61785a2d262a.png)

5- Run restart lms command  
6- The metatda enabled _[https://lmsdomian/auth/saml/metadata.xml](https://lmsdomian/auth/saml/metadata.xml)_  
  
  
resource: [4.24.4. Configuring your Open edX Site as a SAML Service Provider — Installing, Configuring, and Running the Open edX Platform documentation](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_SAML_SP.html?highlight=saml#configure-your-open-edx-site-as-a-service-provider)

Are there any other configurations that I missed?

**And for `SECURE_PROXY_SSL_HEADER`**  
This is the default value at LMS

_path: edx-platform/lms/envs/aws.py_

```auto
# IMPORTANT: With this enabled, the server must always be behind a proxy that
# strips the header HTTP_X_FORWARDED_PROTO from client requests. Otherwise,
# a user can fool our server into thinking it was an https connection.
# See
# https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header
# for other warnings.
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

---

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 16, 2021, 9:34am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/5 "2021-11-16T09:34:01Z")

</div>

also, this is server-side setup

```auto
users ======(https)====>Haproxy ====(http)==>Nginx====(http)===>LMS

```

haproxy config :

````auto
#adding front-end
frontend LMS_DEV
bind *:80
bind *:443 ssl crt lms_dev.pem crt mysite.pem no-tls-tickets ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA384:AES128-SHA256:AES128-SHA:AES256-SHA256:AES256-SHA:!MD5:!aNULL:!DH:!RC4
http-request redirect scheme https unless { ssl_fc }
http-request set-header X-Forwarded-Proto https```
````

---

<div class="post-metadata">

**Author:** ![braden](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/braden/32/46_2.png) [@braden](https://discuss.openedx.org/u/braden)\
**Post date:** [November 17, 2021, 7:09pm UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/6 "2021-11-17T19:09:30Z")

</div>

There is probably something wrong either with your haproxy config, your nginx config, or your django config, and it’s resulting in Django not knowing that the connection is secure.

I suspect that your haproxy config is correct but nginx is stripping out the `X-Forwarded-Proto` header before it gets to the LMS.

---

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 21, 2021, 9:00am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/7 "2021-11-21T09:00:13Z")

</div>

Thanks, Mr. @braden really appreciate your support.  
it is working now by adding

````auto
http-request set-header X-Forwarded-Proto https```

````

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/e/e0015f89e879bc75925b71fd11133ab15fe98297.png) [@system](https://discuss.openedx.org/u/system)\
**Post date:** [February 19, 2022, 9:01am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/8 "2022-02-19T09:01:12Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.