# Discourse-saml: There was an error authorizing your account
**URL:** https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469
**Category:** SSO
**Created:** [2016年十二月19日 04:55 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469 "2016-12-19T04:55:37Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月19日 04:55 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/1 "2016-12-19T04:55:37Z")
Hi All,
So, following on from my [post yesterday](https://meta.discourse.org/t/discourse-saml-user-creation-and-authentication-attribute/54443/1) I have installed the `discourse-saml` plugin. Our iDP has setup everything on their end, but whenever we attempt to login the following message appears:
> Sorry, there was an error authorizing your account. Perhaps you did not approve authorization?
Searching around meta I have found others with this same issues, but it usually relates to social login (e.g. Facebook, Twitter, etc.) rather than using a SSO plugin like `discourse-saml`.
Looking in the logs, here is the error message:
`(saml) Authentication failure! invalid_ticket: OneLogin::RubySaml::ValidationError, The response was received at https://example.com/auth/saml/callback instead of http://example.com/auth/saml/callback`
So it looks like the response is going to the https site, whereas it wants to go to the http site. Not sure why it wants the response on the http site - does anyone have an idea about how to tell the plugin to expect the response on the https site?
Thanks in advance!
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月19日 05:10 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/2 "2016-12-19T05:10:13Z")
Digging a little bit deeper into the source code of the `discourse-saml` plugin:
```
omniauth.provider :saml,
...
:issuer => Discourse.base_url,
...
:assertion_consumer_service_url => Discourse.base_url + "/auth/saml/callback",
```
I think the issue is related to these lines. I am guessing that the `Discourse.base_url` has the URL of the Discourse instance defined as `http` which is then being picked up by the `assertion_consumer_service_url` so that’s `http` as well.
So, is it possible to change the `Discourse.base_url` so that it’s `https`?
Thanks!
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月20日 03:10 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/3 "2016-12-20T03:10:52Z")
So, after doing a fair bit of experimenting I have gotten SAML 2.0 authentication fully working with our Discourse instance. I thought it would be worthwhile posting here in case others would like to do the same thing.
We are running Discourse over HTTPS with a Let’s Encrypt certificate (although the exact issuer is irrelevant, the fact that it’s running over HTTPS is important). As per the first message in this thread, ~~the callback from the iDP was being sent to the HTTP version of our site, not HTTPS~~.
**EDIT:** Sorry, there’s a mistake above. It should read _the callback from the iDP was being sent to the HTTPS version of our site, but Discourse was expecting it to be sent to the HTTP version._
Despite changing all the settings I could find in Discourse to force HTTPS it still didn’t want to cooperate, and I couldn’t find an easy way change the `Discourse.base_url` to be HTTPS, rather than HTTP.
So, I did a bit of a hacky solution. I forked the [discourse-saml](https://github.com/discourse/discourse-saml) repo on GitHub and replaced the four references to `Discourse.base_url` with the hardcoded HTTPS URL to our Discourse instance (e.g. `https://forum.example.com`). I then referenced that repo as the plugin in the `app.yml` file (so that it used my version instead) and all worked.
Additionally, thanks to @sam [on this thread](https://meta.discourse.org/t/saml-plugin-in-repo-multisite/38755/15) I also made another modification which means that if SAML is the only authentication method being used (which it is for our instance, we have disabled local user accounts) it won’t pop-up for authentication but will instead follow through in the main web browser window. Makes the flow a bit nicer, without additionally windows popping up everywhere.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年十二月20日 03:35 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/4 "2016-12-20T03:35:06Z")
> [@skoota](#):
>
> We are running Discourse over HTTPS with a Let’s Encrypt certificate (although the exact issuer is irrelevant, the fact that it’s running over HTTPS is important). As per the first message in this thread, the callback from the iDP was being sent to the HTTP version of our site, not HTTPS. Despite changing all the settings I could find in Discourse to force HTTPS it still didn’t want to cooperate, and I couldn’t find an easy way change the Discourse.base\_url to be HTTPS, rather than HTTP.
This is almost certainly incorrect.
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月20日 03:50 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/5 "2016-12-20T03:50:38Z")
Just corrected the typo.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年十二月20日 05:31 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/6 "2016-12-20T05:31:43Z")
Either you do not have force https set in your site settings, or you are proxying from nginx without the proper headers to pass https.
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月20日 05:42 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/7 "2016-12-20T05:42:06Z")
The force https setting is definitely enabled in the site settings. In terms of the proxying from nginx, I followed the instructions to automatically setup https using Let’s Encrypt from the instructions found in the [howto here](https://meta.discourse.org/t/setting-up-lets-encrypt/40709) - I haven’t made any config changes beyond what was described there.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年十二月20日 05:56 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/8 "2016-12-20T05:56:57Z")
Perhaps @eviltrout can advise because no such hack was needed for the customers we have using SAML.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [2016年十二月20日 17:01 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/9 "2016-12-20T17:01:11Z")
You should be able to just set the `force_https` setting to true and `base_url` will return `https`
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月20日 21:58 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/10 "2016-12-20T21:58:26Z")
I tried that but it didn’t work - that said, I never checked what the `base_url` was actually returning (I am fairly unfamiliar with Ruby). However, when I did the hardcoding hack in the plugin everything started working, so I can only assume that when `force_https` was enabled in the settings it wasn’t setting the `base_url` to `https`…at least as far as the `discourse-saml` plugin was concerned.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [2016年十二月20日 22:00 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/11 "2016-12-20T22:00:25Z")
Did you restart your server after you changed the setting? The saml plugin is initialized to that URL only when the app starts.
---
### Author:  [@skoota](https://meta.discourse.org/u/skoota)
#### Post date: [2016年十二月21日 03:27 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/12 "2016-12-21T03:27:23Z")
Yep, that was the problem. Thanks for the advice 🙂 All fixed following a restart, and back to using the `base_url` variable rather than the hardcoded URL.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [2016年十二月21日 15:45 UTC](https://meta.discourse.org/t/discourse-saml-there-was-an-error-authorizing-your-account/54469/13 "2016-12-21T15:45:44Z")