We're trying to setup a web app (django) in Google App Engine connected via SAML to our idP, Okta. It has to be done as a Custom Flexible App because of a binary requirement, making it basically a container deployment. Running it locally with gunicorn (including SSL configuration) works flawlessly, but deploying it to Google, not that much.

The problem is that the idP to sP redirection fails with


File "/env/lib/python3.6/site-packages/django/core/handlers/exception.py" in inner
  34.             response = get_response(request)

File "/env/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response
  115.                 response = self.process_exception_by_middleware(e, request)

File "/env/lib/python3.6/site-packages/django/core/handlers/base.py" in _get_response
  113.                 response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "/env/lib/python3.6/site-packages/django/views/decorators/csrf.py" in wrapped_view
  54.         return view_func(*args, **kwargs)

File "/env/lib/python3.6/site-packages/django_saml2_auth/views.py" in acs
  159.         resp, entity.BINDING_HTTP_POST)

File "/env/lib/python3.6/site-packages/saml2/client_base.py" in parse_authn_request_response
  714.                                         binding, **kwargs)

File "/env/lib/python3.6/site-packages/saml2/entity.py" in _parse_response
  1213.             response.require_signature = require_signature

Exception Type: AttributeError at /sso/acs/
Exception Value: 'NoneType' object has no attribute 'require_signature'

The current theory is that the Nginx proxy in front of the app is somehow messing with the POST request and breaking the SAML assertion but such settings or its documentation are yet to be found.

Some fresh ideas would be greatly appreciated.


The problem was simple enough: the reverse proxy configuration changes the HTTP request (HTTPS scheme to HTTP) which makes the Okta plugin (https://github.com/fangli/django-saml2-auth) fail with the obscure error. Adding the ASSERTION_URL entry to the SAML2_AUTH dict in you settings.py Django file does the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.