>
-----END CERTIFICATE-----"
DISCOURSE_SAML_SYNC_GROUPS: true
DISCOURSE_SAML_GROUPS_ATTRIBUTE: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
DISCOURSE_SAML_GROUPS_FULLSYNC: true
```
How can I enable the auth debug to get more info about this?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 14, 2021, 9:17pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/2 "2021-12-14T21:17:40Z")
Sorry to hear you’re having issues! You’re right that I’ve been doing a lot of refactoring on the SAML plugin in the last few weeks, so it could be related.
When does this happen? When users initiate login? Or when they are returned to Discourse?
Any chance you could share your site URL here, or via PM?
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 14, 2021, 9:32pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/3 "2021-12-14T21:32:59Z")
This happens whenever a user needs to login (a session expired or a new user tries to login).
It started to happen after I updated to the revision [9334abe249](https://github.com/discourse/discourse/commits/9334abe24900a863a3aaa80e747a536afd510b35) (was on 959923d3cf before)
Sorry but our forum is hosted internally in a private AWS account so you will not be able to access from outside our network.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 14, 2021, 9:50pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/6 "2021-12-14T21:50:13Z")
Where does the error appear? In the Discourse logs? On the user’s screen? In Azure?
Could you share some screenshots?
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 14, 2021, 9:50pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/7 "2021-12-14T21:50:13Z")
I also tried to find something on discourse’s logs but since the error occours on the Azure side, didn’t find any error message there.
On production.log the login process stops here (probably waiting a return from azure):
> Processing by StaticController#show as HTML
> Parameters: {“id”=\>“login”}
> Rendered static/login.html.erb (Duration: 17.5ms | Allocations: 1440)
> Completed 200 OK in 19ms (Views: 18.3ms | ActiveRecord: 0.0ms | Allocations: 2104)
> Started GET “/session/csrf” for \<\> at 2021-12-14 18:28:16 -0300
> Processing by SessionController#csrf as JSON
> Completed 200 OK in 1ms (Views: 0.1ms | ActiveRecord: 0.0ms | Allocations: 337)
> Started POST “/auth/saml” for \<\> at 2021-12-14 18:28:16 -0300
> (saml) Setup endpoint detected, running now.
> (saml) Request phase initiated.
The team responsible for azure is trying to get the XML they are receiving so maybe we are able see something “different” on it. I’ll let you know when they send me.
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 14, 2021, 10:17pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/8 "2021-12-14T22:17:12Z")
> [@david](#):
>
> Where does the error appear? In the Discourse logs? On the user’s screen? In Azure?
>
> Could you share some screenshots?
The error occours after the user click on the login button.
Then it gets redirected to the Azure login page with the following error:
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 14, 2021, 10:24pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/9 "2021-12-14T22:24:21Z")
I’m afraid it’s difficult to work out what’s happening here without access to the site.
The next step would be to try and obtain the XML which is being received by Azure, and work out what’s wrong with it. You should be able to do that by checking the payload in the browser’s Developer tools, and then decoding it using a tool like [this](https://www.samltool.com/decode.php)
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 14, 2021, 10:49pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/10 "2021-12-14T22:49:41Z")
Great!
The return of the request is a http code 400:
```plaintext
Request URL: https://login.microsoftonline.com/APP_ID/saml2
Request method: POST
Status code: 400 Bad Request
Remote address: 20.190.173.144:443
Referrer policy: strict-origin-when-cross-origin
```
The inflated SAMLRequest is (some IDs hidden for privacy):
`https://INTERNAL_URL`
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 14, 2021, 11:29pm UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/11 "2021-12-14T23:29:23Z")
One thing that I’ve noticed comparing my request with the example at [Single sign-on SAML (Security Assertion Markup Language) protocol - Microsoft identity platform | Microsoft Learn](https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol#authnrequest) is that in my AuthnRequest we don’t have the parameter
```plaintext
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
```
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 15, 2021, 12:31am UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/12 "2021-12-15T00:31:55Z")
> [@Bruno\_Salazar](#):
>
> suggests that this can be caused by “Compressed SAML Authentication Requests” which AzureAD doesn’t support.
Looks like my recent refactoring inadvertently added compression for the SAML POST binding. I’ve reverted that behaviour change in [FIX: Do not compress SAML request for POST binding (#55) · discourse/discourse-saml@792a51c · GitHub](https://github.com/discourse/discourse-saml/commit/792a51c9d1e93f4ee5e82244456478b71a1be276)
Please can you try updating the SAML plugin, and then see whether things are working better?
---
### Author:  [@Bruno\_Salazar](https://meta.discourse.org/u/Bruno_Salazar)
#### Post date: [December 15, 2021, 10:41am UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/13 "2021-12-15T10:41:30Z")
Hi David,
After updating to [FIX: Do not compress SAML request for POST binding (#55) · discourse/discourse-saml@792a51c · GitHub](https://github.com/discourse/discourse-saml/commit/792a51c9d1e93f4ee5e82244456478b71a1be276) the SAML auth is back to normal here.
Thank you for the help and all the work on the plugin!
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 16, 2021, 8:00am UTC](https://meta.discourse.org/t/azuread-error-aadsts7500525-using-saml-plugin/212092/14 "2021-12-16T08:00:00Z")
This topic was automatically closed after 20 hours. New replies are no longer allowed.