redash: [saml] Signature missing for assertion
Issue Summary
I want to config redash use keycloak as SAML backend, now I can redirect to keycloak login page and can login success, but when keycloak redirect back to redash, I got error message below:
[2018-10-17 11:49:22,787][PID:21][INFO][saml2.response] status: <?xml version='1.0' encoding='UTF-8'?>
<ns0:Status xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol"><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status>
[2018-10-17 11:49:22,788][PID:21][ERROR][saml2.client_base] XML parse error: Signature missing for assertion
[2018-10-17 11:49:22,788][PID:21][ERROR][saml_auth] Failed to parse SAML response
Traceback (most recent call last):
File "/app/redash/authentication/saml_auth.py", line 73, in idp_initiated
entity.BINDING_HTTP_POST)
File "/usr/local/lib/python2.7/dist-packages/saml2/client_base.py", line 702, in parse_authn_request_response
binding, **kwargs)
File "/usr/local/lib/python2.7/dist-packages/saml2/entity.py", line 1170, in _parse_response
response = response.verify(keys)
File "/usr/local/lib/python2.7/dist-packages/saml2/response.py", line 1018, in verify
if self.parse_assertion(keys):
File "/usr/local/lib/python2.7/dist-packages/saml2/response.py", line 930, in parse_assertion
if not self._assertion(assertion, False):
File "/usr/local/lib/python2.7/dist-packages/saml2/response.py", line 781, in _assertion
raise SignatureError("Signature missing for assertion")
SignatureError: Signature missing for assertion
My SAML config is something look like this: SAML Metadata URL
http://xxx.xxx.xxx.xxx/auth/realms/somerelm/protocol/saml/descriptor
SAML Entity ID
redash
SAML NameID Format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Steps to Reproduce
- first install latest redash from docker compose
- config like the config above
Technical details:
- Redash Version:5.0.0+b4754
- Browser/OS:chrome
- How did you install Redash:docker compose
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 15 (2 by maintainers)
@thiagodiogo Of course!
FIrst, you should make sure keep your SAML enabled, and fill with these values:
SAML Metadata URL http://your.domain.com/auth/realms/${realmid}/protocol/saml/descriptor
SAML Entity ID redash
SAML NameID Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Second, add a client named redash in keycloak with below configure:

That’s all!
@arikfr I’ve submitted PR with this documentation improvement https://github.com/getredash/website/pull/567 and I restyle the doc that was specified by Restyled.io bot Could you please take a look? Thanks in advance