# SSO and SSL: tpa-saml

**URL:** <https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098>\
**Category:** Site Operations Help\
**Created:** [November 14, 2021, 9:13am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098 "2021-11-14T09:13:33Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![muneera\_salah](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/muneera_salah/32/2220_2.png) [@muneera\_salah](https://discuss.openedx.org/u/muneera_salah)\
**Post date:** [November 16, 2021, 8:48am UTC](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098/4 "2021-11-16T08:48:30Z")

</div>

Hi @braden  
Thank you so much. appreciate that.

I have a question, for fetching the metadata from Open edX? you mean run this link _[https://lmsdomian/auth/saml/metadata.xml](https://lmsdomian/auth/saml/metadata.xml)_, right? if is it, yes I used HTTPS  
but still, contain HTTP this

```auto
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lmsdomian/auth/complete/tpa-saml/" index="1"/>

```

  

**I followed these steps:**

1- Generate key and cert  
2- Add key and cert at the LMS configuration file _auth.env_

```auto
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT

```

3- and update these at the LMS configuration file _lms.env_

```auto
"FEATURES": {
...
"ENABLE_THIRD_PARTY_AUTH": true,
....
},
"THIRD_PARTY_AUTH_BACKENDS": [
        "third_party_auth.saml.SAMLAuthBackend"
    ],

```

4- add configration on admin/third\_party\_auth/samlconfiguration/

 ![image](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/5/5b48cfbf232272be559c42b7f5cb61785a2d262a.png)

5- Run restart lms command  
6- The metatda enabled _[https://lmsdomian/auth/saml/metadata.xml](https://lmsdomian/auth/saml/metadata.xml)_  
  
  
resource: [4.24.4. Configuring your Open edX Site as a SAML Service Provider — Installing, Configuring, and Running the Open edX Platform documentation](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_SAML_SP.html?highlight=saml#configure-your-open-edx-site-as-a-service-provider)

Are there any other configurations that I missed?

**And for `SECURE_PROXY_SSL_HEADER`**  
This is the default value at LMS

_path: edx-platform/lms/envs/aws.py_

```auto
# IMPORTANT: With this enabled, the server must always be behind a proxy that
# strips the header HTTP_X_FORWARDED_PROTO from client requests. Otherwise,
# a user can fool our server into thinking it was an https connection.
# See
# https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header
# for other warnings.
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

```

---

_[View the full topic](https://discuss.openedx.org/t/sso-and-ssl-tpa-saml/6098)._