title: Onelogin SAML with AWS load balancer
body: <p>I am trying to get OneLogin Saml authentication working on my live servers and am running into a problem with my AWS load balancer setup. I think the problem is that I have a classic load balancer which is listening on both port 80 and 443 with a AWS wildcard HTTPS certificate. The load balancer forwards both ports to port 80 on my servers and adds the HTTP_X_FORWARDED_PROTO headers. </p>
  
  <p>When I use my normal dev server (not behind load balancer) the SAML authentication works fine. I am getting a proper response back. But when I push to live the SAML response returns an empty POST dictionary without RELAY STATE. </p>
  
  <p>Any idea why the POST would be empty?</p>
  
  <p>My setup is:</p>
  
  <ul>
  <li>Python social auth with the SAML connector </li>
  <li>Works fine on Dev server</li>
  <li>When I use my live servers behind the firewall, the response is empty</li>
  </ul>
  
  <p>I suspect it has something to do with my SSL certificate or my load balancer forwarding the 443 to the server on port 80 with the additional header. I tried fixing this by creating the auth request by analyzing the forwarded headers:</p>
  
  <pre><code>def _create_saml_auth(self, idp):
      """Get an instance of OneLogin_Saml2_Auth"""
  
      config = self.generate_saml_config(idp)
      request_info = {
          'https': 'on' if self.strategy.request_is_secure() else 'off',
          'http_host': self.strategy.request_host(),
          'script_name': self.strategy.request_path(),
          'server_port': self.strategy.request_port(),
          'get_data': self.strategy.request_get(),
          'post_data': self.strategy.request_post(),
      }
  
      if 'HTTP_X_FORWARDED_PROTO' in self.strategy.request.META:
          request_info['https'] = 'on' if self.strategy.request.META.get('HTTP_X_FORWARDED_PROTO') == 'https' else 'off'
          request_info['server_port'] = self.strategy.request.META.get('HTTP_X_FORWARDED_PORT')
  </code></pre>
  
  <p>But that still does return the empyy POST dictionary on the SAML response from Onelogin. The intial url is generated properly with HTTPS on though. </p>
  
  <p>Has anyone had a similar issue. I am stuck and would love to get Onelogin to work. </p>
  
  <p>Thanks so much for your time. </p>
  
  <p>Cheers,</p>
  
  <p>Phil</p>