SAML module

Greetings, I am testing out the SAML module by using a blank application, following this documentation. I applause the excellent configuration wizard that I could use without issue to configure the SP and exchange the federation metadata between IdP (Azure AD in my case) and SP.  There is a couple of incomplete security page access on MxModelReflection and SAML modules:   I am assuming that these errors (warning rather) could be ignored, could they? Now, and this is the core of the question, how can I get to the login page of the IdP, as launching the app as it still brings me to MendixSSO’s login page? Note that: I left the configuration of the  SAML20 module to their default values (BindingURI_Redirect false, DefaultLoginPage null, DefaultLogoutPage null, KeystorePassword = ***** and SSOLandingPage = index.html) When I run the app, the /SSO/ handler is correctly in place, as /SSO/metadata returns the correct SP metadata The IdP metadata has been interpreted by the SP as shown below. Note that ‘Is default’ is set to ‘No’ for all URLs     Thanks! JP
4 answers


The only successful request that I could get from the /SSO/ handler was /SSO/metadata. All other requests, inclusive of /SSO/login or /SSO/loin/SSO/ or /SSO/discovery, all yield the “Unable to validate the SAML message!” page:

Surely this is a symptom of something missing (again, /SSO/metadata is working). Any idea?





I was testing the app in the cloud (Free App sandbox), as I read somewhere that the SAML SSO works only from the cloud. Now in order to see some errors in the console log, I ran the app locally, and on the invocation of /SSO/ here is what I’ve got:


Unable to validate Response, see SAMLRequest overview for detailed response. Error: SAML hasn't been correctly initialize. Please restart the SAML handler.


org.opensaml.common.SAMLException: SAML hasn't been correctly initialize. Please restart the SAML handler.
	at saml20.implementation.LoginHandler.handleRequest(
	at saml20.implementation.SAMLRequestHandler.processRequest(
	at com.mendix.externalinterface.connector.RequestHandler.doProcessRequest(
	at com.mendix.external.connector.MxRuntimeConnector$1.execute(
	at com.mendix.external.connector.MxRuntimeConnector$1.execute(
	at com.mendix.util.classloading.Runner.doRunUsingClassLoaderOf(
	at com.mendix.external.connector.MxRuntimeConnector.processRequest(
	at com.mendix.basis.impl.MxRuntimeImpl.processRequest(
	at com.mendix.m2ee.appcontainer.server.handler.RuntimeHandler.service(
	at javax.servlet.http.HttpServlet.service(
	at org.eclipse.jetty.servlet.ServletHolder.handle(
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(
	at org.eclipse.jetty.servlet.ServletHandler.doScope(
	at org.eclipse.jetty.server.session.SessionHandler.doScope(
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(
	at org.eclipse.jetty.server.Server.handle(
	at org.eclipse.jetty.server.HttpChannel.handle(
	at org.eclipse.jetty.server.HttpConnection.onFillable(
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(
	at org.eclipse.jetty.util.thread.QueuedThreadPool$
	at java.base/



Indeed those Page access warnings can be looked at at a later time. Do note that your admin role needs to be able to configure MxModelreflection to adjust the synchronized modules of your app. And for the SAML module your admin needs to be able to get to the setup and log pages.

Now for the main questions. Mendix login is stil available. It needs to be because your admin should still be able to log iin even if SSO is not working. If you go to a slightly adjusted URL you will directly redirected to the login page of that IdP setting if you go to:

You could also put a button on your login page that directs to this page. This way your users do not need to remember this URL and just can press the SSO button. If you have a multi tenant setup like we do we first request the account of the user so we can retrieve the right IdP setting and redirect him to the right URL or give a message back that no SSO setting can be found for his account.
Hope this helps,




Did you set all the Path based access restrictions?






To get to the IDP login page, you usually go to /SSO/ . Does that work for you?

The documentation discusses this in more detail – see the bit specifically about the SSOLandingPage setting and configuring your index.html file to auto-redirect to the SSO process.