# Help setting up XDMoD 10.0 Dashboard integrated in OOD 2.0.28 and Keyclock(SAML) Single Sign On Authentication

**URL:** <https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349>\
**Category:** Get Help\
**Tags:** ondemand2, question, doc-request\
**Created:** [October 29, 2022, 7:03pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349 "2022-10-29T19:03:10Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 7, 2022, 7:57pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/21 "2022-11-07T19:57:52Z")

</div>

A blank page makes me think something in the PHP stack is broken like syntax mistake in authsources.php or something. I’d check both Apache logs and XDMOD logs to see if maybe it’s printing any errors. The Apache logs on XDMOD side should be in `/var/log/httpd` and XDMOD is at `/var/log/xdmod`. If there are PHP errors I think those would make their way into the Apache logs.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 7, 2022, 8:56pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/22 "2022-11-07T20:56:02Z")

</div>

OK, I added ‘directory’ =\> ‘/etc/xdmod/simplesamlphp/metadata/’ nano /etc/xdmod/simplesamlphp/config/config.php

```auto
...
'metadata.sources' => array(
     array('type' => 'flatfile', 'directory' => '/etc/xdmod/simplesamlphp/metadata/'),
   ),
...

```

It’s in the documentation: [https://open.xdmod.org/10.0/simpleSAMLphp.html](https://open.xdmod.org/10.0/simpleSAMLphp.html)

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/c/c6772befeef128120ce3f663feefb18d9b55220d.png)

Now I have the XDMoD page with login

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/3/3559083ab6f20250dafbb99aed1c03383610fb86.png)

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/c/c20ee233e986a27a1e240547baedf8ef37b4d70c.jpeg)

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/8/832754604a698c2e003d849e9cf4b53a36b54f78.jpeg)

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 7, 2022, 9:10pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/23 "2022-11-07T21:10:07Z")

</div>

You will have to check the Keycloak logs as to what the error is around the processing of the response. I can’t really advise where those logs would be since it’s really unique depending on how you installed Keycloak. I run Keycload under a systemd service with logging to stdout so the logs end up in journald and syslog.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 7, 2022, 9:37pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/24 "2022-11-07T21:37:45Z")

</div>

I enabled Keycloak logs and caught the Java error when I logged into XDMoD:

```auto
2022-11-07 21:34:45,528 INFO [org.keycloak.services] (executor-thread-5) KC-SERVICES0106: Created script engine 'Oracle Nashorn', version '11.0.16.1' for the mime type 'text/javascript'
2022-11-07 21:34:46,501 ERROR [org.keycloak.protocol.saml.SamlProtocol] (executor-thread-5) failed: org.keycloak.saml.common.exceptions.ProcessingException: failed to encrypt
        at org.keycloak.saml.BaseSAML2BindingBuilder.encryptDocument(BaseSAML2BindingBuilder.java:253)
        at org.keycloak.saml.BaseSAML2BindingBuilder$BasePostBindingBuilder.<init>(BaseSAML2BindingBuilder.java:154)
        at org.keycloak.protocol.saml.JaxrsSAML2BindingBuilder$PostBindingBuilder.<init>(JaxrsSAML2BindingBuilder.java:49)
        at org.keycloak.protocol.saml.JaxrsSAML2BindingBuilder.postBinding(JaxrsSAML2BindingBuilder.java:105)
        at org.keycloak.protocol.saml.SamlProtocol.buildAuthenticatedResponse(SamlProtocol.java:551)
        at org.keycloak.protocol.saml.SamlProtocol.authenticated(SamlProtocol.java:542)
        at org.keycloak.services.managers.AuthenticationManager.redirectAfterSuccessfulFlow(AuthenticationManager.java:968)
        at org.keycloak.services.managers.AuthenticationManager.redirectAfterSuccessfulFlow(AuthenticationManager.java:916)
        at org.keycloak.services.managers.AuthenticationManager.finishedRequiredActions(AuthenticationManager.java:1069)
        at org.keycloak.authentication.AuthenticationProcessor.authenticationComplete(AuthenticationProcessor.java:1131)
        at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:998)
        at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:321)
        at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:292)
        at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:276)
        at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:349)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:524)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:474)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:476)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:434)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:192)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:141)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:32)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:492)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:261)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:82)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:42)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
        at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:67)
        at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:55)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
        at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:380)
        at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:358)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
        at org.keycloak.quarkus.runtime.integration.web.QuarkusRequestFilter.lambda$createBlockingHandler$1(QuarkusRequestFilter.java:71)
        at io.vertx.core.impl.ContextImpl.lambda$null$0(ContextImpl.java:159)
        at io.vertx.core.impl.AbstractContext.dispatch(AbstractContext.java:100)
        at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$1(ContextImpl.java:157)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$13.runWith(VertxCoreRecorder.java:543)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.RuntimeException: PL00069: Parser: Type not supported:unsupported publicKey Algo:EC
        at org.keycloak.saml.common.DefaultPicketLinkLogger.unsupportedType(DefaultPicketLinkLogger.java:174)
        at org.keycloak.saml.processing.core.util.XMLEncryptionUtil.getXMLEncryptionURLForKeyUnwrap(XMLEncryptionUtil.java:466)
        at org.keycloak.saml.processing.core.util.XMLEncryptionUtil.encryptKey(XMLEncryptionUtil.java:95)
        at org.keycloak.saml.processing.core.util.XMLEncryptionUtil.encryptElement(XMLEncryptionUtil.java:135)
        at org.keycloak.saml.BaseSAML2BindingBuilder.encryptDocument(BaseSAML2BindingBuilder.java:249)
        ... 63 more

```

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 7, 2022, 9:53pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/25 "2022-11-07T21:53:35Z")

</div>

There is something messed up with the encryption between simplesamlphp and Keycloak for SAML. I have never had that issue before with XDMOD but with other SAML services I don’t control I’ve seen that error. I’d recommend for the Keycloak client for XDMOD disable `Encrypt Assertions`. Not the most secure so might be worth making sure you have the certs correct in Keycloak and correctly setup on XDMOD in simplesamlphp.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 7, 2022, 10:14pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/26 "2022-11-07T22:14:28Z")

</div>

Correct, in Keycloak we no longer have the error. Then I solve this problem of certificates to re-enable Encrypt Assertions.  
Now changed to:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/6/6c34156554a91154ba1ea57eed7d050aaede2ee1.png)

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 8, 2022, 2:43pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/27 "2022-11-08T14:43:56Z")

</div>

I’m not sure where that error would come from in XDMOD. Might have to send help request to XDMOD folks [Open XDMoD - Support](https://open.xdmod.org/10.0/support.html).

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 9, 2022, 1:40pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/28 "2022-11-09T13:40:09Z")

</div>

I installed all my power and configured everything again and now I have this:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/6/6a99c098c10a01e17b3a3f8553e7df812aee4548.png)

When I log into XDMoD

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/f/ff3abbfbe452657783a3e7acd9f2b7b005bdaa31.png)

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 9, 2022, 2:03pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/29 "2022-11-09T14:03:57Z")

</div>

I think you’ll have to open a support ticket with XDMOD developers as I’ve never seen that error before. The only thing I can think that might be the issue is your instance of XDMOD has no job data for your username so your username doesn’t exist in database but that shouldn’t cause an exception.

---

<div class="post-metadata">

**Author:** ![krishmoodbidri](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/krishmoodbidri/32/196_2.png) [@krishmoodbidri](https://discourse.openondemand.org/u/krishmoodbidri)\
**Post date:** [November 9, 2022, 4:33pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/30 "2022-11-09T16:33:25Z")

</div>

> [@tdockendorf](#):
>
> Open XDMoD - Support

Hello Leonardo, could you explain mean by `I installed all my power and configured everything again`. I’m having the same issue as you, Using Simplesamlphp as my SP and testsaml.id as my idp. Seeing the Access forbidden error.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 9, 2022, 5:02pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/31 "2022-11-09T17:02:11Z")

</div>

Greetings, Kris! I’ve been on a journey to implement XDMoD in OOD with Keycloak as you can see in this long topic which I’ve been getting help from Trey Dockendorf and Jeff Ohrstrom. Many of the issues have been fixed and there are some details that make a difference. If your case is the same, we can try to follow and solve it. If you need any details on what I’ve done so far, don’t hesitate to ask. I also opened a ticket at [Support : Center for Computational Research](https://ubccr.freshdesk.com/support/home) and am awaiting a return.

---

<div class="post-metadata">

**Author:** ![krishmoodbidri](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/krishmoodbidri/32/196_2.png) [@krishmoodbidri](https://discourse.openondemand.org/u/krishmoodbidri)\
**Post date:** [November 9, 2022, 5:39pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/32 "2022-11-09T17:39:08Z")

</div>

> [@tdockendorf](#):
>
> Encrypt Assertions

I believe the Access forbidden error you saw (after configuring your SP -simplesamlphp, with your idp -keycloak) was resolved by disabling `Encrypt Assertions` in your SP. Could you post a code snippet of it, if that is the case.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 9, 2022, 5:53pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/33 "2022-11-09T17:53:32Z")

</div>

The `Encrypt Assertions` can be disabled in Keycloak web UI on the Client page for XDMOD’s SAML client. Should be unnecessary if encryption is setup correctly between simplsamlphp and Keycloak.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 9, 2022, 5:58pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/34 "2022-11-09T17:58:31Z")

</div>

As for disabling encryptions, I’m doing it temporarily. The goal is to make the thing work and then I’ll work on security and rehabilitate whatever is necessary.

---

<div class="post-metadata">

**Author:** ![krishmoodbidri](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/krishmoodbidri/32/196_2.png) [@krishmoodbidri](https://discourse.openondemand.org/u/krishmoodbidri)\
**Post date:** [November 9, 2022, 7:53pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/35 "2022-11-09T19:53:44Z")

</div>

I dont see an attribute `Encrypt Assertions` in my SP or IDP  
Here’s the error I’m seeing. I believe its similar (if not same) as the one described by Leonardo Loures

The difference is I’m using samltest as idp vs keycloak as described in this ticket.

 ![Screen Shot 2022-11-09 at 1.51.19 PM](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/e/e4273309cc3db2859df280c1efdaa8265d7e4de8.jpeg)  
 ![Screen Shot 2022-11-09 at 1.51.31 PM](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/d/da586d02d53b1731e424e031d1053d5138267980.png)  
 ![Screen Shot 2022-11-09 at 1.51.37 PM](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/0/0f8860b0a8e6af126f16c123a572bf11f026b9e7.png)

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 9, 2022, 8:30pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/36 "2022-11-09T20:30:09Z")

</div>

The setting “Encrypt Assertions” is specific to Keycloak. I am not familiar with any other IDP besides Keycloak. The error you are facing is specific to XDMOD so likely need to open a case with that product’s support.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 9, 2022, 8:55pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/37 "2022-11-09T20:55:05Z")

</div>

I had to do some settings in the `authsources.php` and `config.php` files that made a difference. I don’t know how yours are.  
For example in `config.php`

```auto
...
'enable.saml20-idp' => true,
...
'metadata.sources' => array(
     array('type' => 'flatfile', 'directory' => '/etc/xdmod/simplesamlphp/metadata/'),

```

I believe you also configured the files:

```auto
/etc/ood/config/ondemand.d/ondemand.yml
/etc/ood/config/nginx_stage.yml
/etc/ood/config/clusters.d/cluster.yml
/etc/xdmod/portal_settings.ini

```

---

<div class="post-metadata">

**Author:** ![krishmoodbidri](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/krishmoodbidri/32/196_2.png) [@krishmoodbidri](https://discourse.openondemand.org/u/krishmoodbidri)\
**Post date:** [November 9, 2022, 9:03pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/38 "2022-11-09T21:03:31Z")

</div>

I have both those changes in `authsources.php` and `config.php`.  
And regarding the “Encrypt Assertions” change suggested by @tdockendorf , seems like samltest defaults to false for Encrypt Assertions. Ref. [SimpleSAMLphp Documentation](https://simplesamlphp.org/docs/1.18/simplesamlphp-reference-sp-remote.html#:~:text=Encrypting%20assertions,-It%20is%20possible&text=There%20are%20two%20modes%20of,the%20certificate%20of%20the%20SP).

I believe it was something on your SP end that got you past the Access forbidden error.

---

<div class="post-metadata">

**Author:** ![krishmoodbidri](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/krishmoodbidri/32/196_2.png) [@krishmoodbidri](https://discourse.openondemand.org/u/krishmoodbidri)\
**Post date:** [November 9, 2022, 9:06pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/39 "2022-11-09T21:06:57Z")

</div>

and the only `Assertions` attributes I see in my SP’s metadata is

` <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://xdmod.rc.uab.edu/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp"/> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://xdmod.rc.uab.edu/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp" index="0"/> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://xdmod.rc.uab.edu/simplesaml/module.php/saml/sp/saml1-acs.php/default-sp" index="1"/> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://xdmod.rc.uab.edu/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp" index="2"/> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://xdmod.rc.uab.edu/simplesaml/module.php/saml/sp/saml1-acs.php/default-sp/artifact" index="3"/> </md:SPSSODescriptor>`

and none in my idp’s metadata that I downloaded.

---

<div class="post-metadata">

**Author:** ![luvres](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/luvres/32/1211_2.png) [@luvres](https://discourse.openondemand.org/u/luvres)\
**Post date:** [November 9, 2022, 9:07pm UTC](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349/40 "2022-11-09T21:07:26Z")

</div>

How is your XDMoD panel in OOD? Mine is like this:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/3/363dae2f129554fa4d9eddbed20756d703aec891.png)

[Previous page](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349.md?page=1)

[Next page](https://discourse.openondemand.org/t/help-setting-up-xdmod-10-0-dashboard-integrated-in-ood-2-0-28-and-keyclock-saml-single-sign-on-authentication/2349.md?page=3)