We're trying to setup a web app (django) in Google App Engine connected via SAML to our idP, Okta. It has to be done as a Custom Flexible App because of a binary requirement, making it basically a container deployment. Running it locally with gunicorn (including SSL configuration) works flawlessly, but deploying it to Google, not that much.
The problem is that the idP to sP redirection fails with
Traceback: File "/env/lib/python3.6/site-packages/django/core/handlers/exception.py" in inner 34. response = get_response(request) File "/env/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response 115. response = self.process_exception_by_middleware(e, request) File "/env/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response 113. response = wrapped_callback(request, *callback_args, **callback_kwargs) File "/env/lib/python3.6/site-packages/django/views/decorators/csrf.py" in wrapped_view 54. return view_func(*args, **kwargs) File "/env/lib/python3.6/site-packages/django_saml2_auth/views.py" in acs 159. resp, entity.BINDING_HTTP_POST) File "/env/lib/python3.6/site-packages/saml2/client_base.py" in parse_authn_request_response 714. binding, **kwargs) File "/env/lib/python3.6/site-packages/saml2/entity.py" in _parse_response 1213. response.require_signature = require_signature Exception Type: AttributeError at /sso/acs/ Exception Value: 'NoneType' object has no attribute 'require_signature'
The current theory is that the Nginx proxy in front of the app is somehow messing with the POST request and breaking the SAML assertion but such settings or its documentation are yet to be found.
Some fresh ideas would be greatly appreciated.