# SSO configuration **URL:** \ **Category:** Pritunl VPN\ **Tags:** pritunl\ **Created:** [March 17, 2025, 4:32pm UTC](https://forum.pritunl.com/t/sso-configuration/3126 "2025-03-17T16:32:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![valis](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/v/e274bd/32.png) [@valis](https://forum.pritunl.com/u/valis)\ **Post date:** [March 17, 2025, 4:32pm UTC](https://forum.pritunl.com/t/sso-configuration/3126/1 "2025-03-17T16:32:24Z")
Hello, Hope you are doing good. Recently I’ve activated the trial version for vpn server in order to evaluate it as a replacement for our current vpn solution. One of AC is the SSO integration with our IDP - keycloak. I know that you are not supporting integration officially however other people experience here makes me think that it is possible. It looks like after initial SAML configuration the auth request is not reaching the IDP server i.e. it fails on the Pritunl server side: # ========================= [autumn-skies-2901][2025-03-17 15:48:59,195][ERROR] Saml auth server error status\_code = 500 content = “b’'” Traceback (most recent call last): File “/usr/lib/pritunl/usr/lib/python3.9/threading.py”, line 937, in \_bootstrap self.\_bootstrap\_inner() File “/usr/lib/pritunl/usr/lib/python3.9/threading.py”, line 980, in \_bootstrap\_inner self.run() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/cheroot/workers/threadpool.py”, line 120, in run keep\_conn\_open = conn.communicate() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/cheroot/server.py”, line 1287, in communicate req.respond() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/cheroot/server.py”, line 1077, in respond self.server.gateway(self).respond() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/cheroot/wsgi.py”, line 136, in respond response = self.req.server.wsgi\_app(self.env, self.start\_response) File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/flask/app.py”, line 2213, in **call** return self.wsgi\_app(environ, start\_response) File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/flask/app.py”, line 2190, in wsgi\_app response = self.full\_dispatch\_request() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/flask/app.py”, line 1484, in full\_dispatch\_request rv = self.dispatch\_request() File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/flask/app.py”, line 1469, in dispatch\_request return self.ensure\_sync(self.view\_functions[rule.endpoint])(\*\*view\_args) File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/pritunl/auth/app.py”, line 26, in \_wrapped return call(\*args, \*\*kwargs) File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/pritunl/handlers/sso.py”, line 447, in sso\_request\_get logger.error(‘Saml auth server error’, ‘sso’, File “/usr/lib/pritunl/usr/lib/python3.9/site-packages/pritunl/logger/ **init**.py”, line 55, in error kwargs[‘traceback’] = traceback.format\_stack() The os is: amazon linux 2023(with SELinux support). Enabling / disabling SELinux makes no difference. My knowledge is not enough to understand the problem or I overlooked something. Could you please point the direction for the troubleshooting or maybe give a hint about the possible solution of this problem? Thank you. ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [March 18, 2025, 3:02pm UTC](https://forum.pritunl.com/t/sso-configuration/3126/2 "2025-03-18T15:02:02Z")
Currently only the listed SAML providers are tested and supported. Each SAML provider typically has a different implementation that requires specific changes to support. ---
**Author:** ![valis](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/v/e274bd/32.png) [@valis](https://forum.pritunl.com/u/valis)\ **Post date:** [March 18, 2025, 5:19pm UTC](https://forum.pritunl.com/t/sso-configuration/3126/3 "2025-03-18T17:19:33Z")
Hello Zach, Thank you for the reply. I understand that it requires specific implementation, but for me this error looks like the Pritunl server itself fails to build the saml request. This error: # status\_code = 500 content = “b’'” Does not give any extra information where the exact error is. From the configuration point of view: I chose SAML from the Single sign on dropdown menu and filled all required fields for this option ![image](https://forum-static.pritunl.com/original/2X/e/e23d30e9183501df9fc08d9b3ec77a0c4d05cc7a.png) Should not it at least do the auth request attempt to the IDP server and fail there? (at least it looks logical for me. But it fails on the Pritunl side) That what I want to understand. Why it trows the error instead making the request ?..