# OOD 1.8 and SAML2 and ADFS authentication

**URL:** <https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137>\
**Category:** Get Help\
**Tags:** question\
**Created:** [September 28, 2020, 7:27pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137 "2020-09-28T19:27:40Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![praiswater](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/praiswater/32/518_2.png) [@praiswater](https://discourse.openondemand.org/u/praiswater)\
**Post date:** [September 28, 2020, 7:27pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/1 "2020-09-28T19:27:40Z")

</div>

I am installed OOD 1.8.12 on CentOS 7.8 and configured it to authenticate using mod\_auth\_mellon using the provided instructions. [https://osc.github.io/ood-documentation/latest/authentication/adfs-with-auth-mellon.html](https://osc.github.io/ood-documentation/latest/authentication/adfs-with-auth-mellon.html). I am getting an error when I try to authenticate that the post URL does not exist. The ADFS authentication appears to be successful. I am wondering if I missed something on the OOD side. I get a 404 error with this request [https://xxxx.xxx.xxx.org/mellon/metadata/postResponse](https://xxxx.xxx.xxx.org/mellon/metadata/postResponse).

The apache log provides this information.

Endpoint “metadata/ls” not handled by mod\_auth\_mellon.  
[Mon Sep 28 11:05:19.781119 2020] [auth\_mellon:error] [pid 143499] [client x.x.x.x:56253] Endpoint “metadata/postResponse” not handled by mod\_auth\_mellon.

## /opt/rh/httpd24/root/etc/httpd/conf.d/auth\_mellon.conf

MellonCacheSize 100  
MellonLockFile “/run/httpd24-mod\_auth\_mellon/lock”  
  
MellonSPPrivateKeyFile /opt/rh/httpd24/root/etc/httpd/mellon/mellon.key  
MellonSPCertFile /opt/rh/httpd24/root/etc/httpd/mellon/mellon.cert  
MellonSPMetadataFile /opt/rh/httpd24/root/etc/httpd/mellon/mellon\_metadata.xml  
MellonIdPMetadataFile /opt/rh/httpd24/root/etc/httpd/mellon/idpmetadata.xml

MellonEndpointPath /mellon  
MellonEnable “auth”

My guess is mod\_auth\_mellon is not configured correctly but I am not sure where to start to debug this. What should apache return for **/mellon/metadata/ls** and **/mellon/metadata/postResponse**? Any help is greatly appreciated.

Thx,  
Brad

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 1, 2020, 8:59pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/2 "2020-12-01T20:59:59Z")

</div>

Hey, I’m so sorry for the delay. @tdockendorf do you have any experience with this? I’d guess setting that module’s log level to debug or trace is a good place to start if you haven’t already.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [December 1, 2020, 10:35pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/3 "2020-12-01T22:35:45Z")

</div>

I’ve never used mod\_auth\_mellon, so I am not sure what could be wrong. That particular documentation was a community contribution I believe, not something I was involved with.

---

<div class="post-metadata">

**Author:** ![bp85](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bp85/32/640_2.png) [@bp85](https://discourse.openondemand.org/u/bp85)\
**Post date:** [December 8, 2020, 10:27pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/4 "2020-12-08T22:27:55Z")

</div>

I’m also getting same error. Nothing useful in debug logs.

---

<div class="post-metadata">

**Author:** ![bp85](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bp85/32/640_2.png) [@bp85](https://discourse.openondemand.org/u/bp85)\
**Post date:** [January 5, 2021, 3:34pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/5 "2021-01-05T15:34:04Z")

</div>

Is there any update on this? we’re currently struck at this step with our OOD implementation.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [January 5, 2021, 4:59pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/6 "2021-01-05T16:59:27Z")

</div>

`ls` seems to be a mellon api. from the docs it was #1 in pre-requisites, “The SAML 2.0 service URL”.

In any case, here are my thoughts on next steps:

- the docs also indicate to wrap the entires in `auth_mellon.conf` in a `<Location>` block. I can’t say this is the issue, but I’d like to rule it out one way or another. OIDC adds a new location, so maybe this is important as `/mellon` really isn’t found or isn’t understood.

```auto
  <Location "/oidc">
    AuthType openid-connect
    Require valid-user
  </Location>

```

- turn debug logs on with `LogLevel auth_mellon_module:debug` (that may or may not be the right module name).
- I could only find [this related auth mellon issue](https://code.google.com/archive/p/modmellon/issues/16) where the user had a directory in /var/www. Mabye that’s a part of the mod\_auth\_mellon install? I can’t say - but I’d look for that directory.
- OIDC requires and adds a new location

---

<div class="post-metadata">

**Author:** ![bp85](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bp85/32/640_2.png) [@bp85](https://discourse.openondemand.org/u/bp85)\
**Post date:** [January 7, 2021, 6:54pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/7 "2021-01-07T18:54:10Z")

</div>

I think I found the issue, testing now.

The instructions for generating metadata mentioned in [SAML Authentication with Active Directory Federated Services (ADFS) and mod\_auth\_mellon — Open OnDemand 1.8.12 documentation](https://osc.github.io/ood-documentation/latest/authentication/adfs-with-auth-mellon.html#configure-mod-auth-mellon) are wrong.

I think Actual command for metadata generation should be the following (swap ARG1 \<-\> ARG2)  
/usr/libexec/mod\_auth\_mellon/mellon\_create\_metadata.sh “{mellon\_endpoint}/metadata" "{mellon\_endpoint}”

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [January 7, 2021, 7:07pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/8 "2021-01-07T19:07:07Z")

</div>

Thanks! from [these mellon docs](https://jdennis.fedorapeople.org/doc/mellon-install/mellon-install-guide.html) it looks like you’re right. Let me know what happens and I’ll update our docs for the same.

---

<div class="post-metadata">

**Author:** ![bp85](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bp85/32/640_2.png) [@bp85](https://discourse.openondemand.org/u/bp85)\
**Post date:** [April 22, 2021, 10:53pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/9 "2021-04-22T22:53:45Z")

</div>

Hi @jeff.ohrstrom,

Took really long time than expected, but I can confirm that creating metadata after swapping both ARG is working.

From my experience, most users would need this [workaround](https://discourse.openondemand.org/t/forcing-lowercase-username-after-login/491/4) as most ADFS systems return Attributes like “sAMaccountName” which is case-insensitive where as unix won’t like it.  
Perhaps adding a section in the [page](https://osc.github.io/ood-documentation/master/authentication/adfs-with-auth-mellon.html) with above info might help others.

Initially I configured SSSD to be case-insensitive, which didn’t work all the way (logs suggest my login was successful) because nginx failed to get lock on socket which is expected because PUN is started as REMOTE\_USER.

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:42pm UTC](https://discourse.openondemand.org/t/ood-1-8-and-saml2-and-adfs-authentication/1137/10 "2022-05-26T15:42:55Z")

</div>

Closed on May 26, 2022, 3:42pm UTC