# Customise SamlService - external IDP - Destination field is missing **URL:** \ **Category:** Getting advice\ **Created:** [November 4, 2021, 4:14pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894 "2021-11-04T16:14:53Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 4, 2021, 4:14pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/1 "2021-11-04T16:14:53Z")
Hey, I am struggling with the integration of an external SAML IDP in keycloak. The saml2p:Response does not contain the Destionation field which leads to this error: 13:14:29,382 WARN [org.keycloak.events] (default task-119) type=IDENTITY\_PROVIDER\_RESPONSE\_ERROR, realmId=GK, clientId=null, userId=null, ipAddress=x, error=invalid\_logout\_response, reason=missing\_required\_destination Checking the Source Code leads to: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/8c43515196830cb09654093ceb5ecc9d37f03086.png) > We have no control over the external IDP. Is there a way to prevent the required customising? Thanks ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 5, 2021, 3:30pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/2 "2021-11-05T15:30:48Z")
As an alternative: how is it possible to create a custom identity provider module based on the existing SAML one? ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [November 5, 2021, 4:29pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/3 "2021-11-05T16:29:52Z")
You can implement your own `IdentityProvider` and `IdentityProviderFactory`. In your case, you can just extend (or copy) the `org.keycloak.broker.saml.SAMLIdentityProvider`. It’s not SAML, but I’ve got a roughly equivalent project for a social identity provider. It might help you get set up with the project and package structure: [GitHub - xgp/keycloak-moneybird-idp: Moneybird IdP extension for Keycloak](https://github.com/xgp/keycloak-moneybird-idp) ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 8, 2021, 1:57pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/4 "2021-11-08T13:57:38Z")
Hey, your link helped but I still struggle with the SAML part. Is it required to mark them as SocialIdentityProvider? Tried that: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/22ca6701c3f4862a1f138995a6b119da6c6e68a4.png) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/7b01f2dd4ba6dfc79dd485959ca2bce6d87787e5.png) The issue is, that my custom SAML IDP broker will not be displayed in the UI. ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [November 8, 2021, 2:57pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/5 "2021-11-08T14:57:38Z")
In your case, you’ll want to implement `IdentityProviderFactory` and put that in your services folder (or use the `AutoService` annotation, as I did in the example above, which does it for you). Also, if you’re just making a few changes to the `SAMLIdentityProviderFactory`, why not just extend that class and override the methods you need to? ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 8, 2021, 3:42pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/6 "2021-11-08T15:42:22Z")
If you have a better idea, I am completely open and very thankful for your input: The IDP is not providing a destination attribute in the sampResponse. Therefore I need to add it / disable the validation. We can not change the IDP in any way. The current approach is just copying the default SAML broker and add it customised. The issue I have right now is, that the module can not get some core classes: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/7c4b2d36174f7ccff376e60345810bf3bcef1bab.png) Anything I need to add besides the pom dependencies? ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [November 8, 2021, 3:45pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/7 "2021-11-08T15:45:02Z")
Thy `Dependencies` section in the jar manifest will need to have the modules you’re depending on also. You can change those in the jar plugin [keycloak-moneybird-idp/pom.xml at main · xgp/keycloak-moneybird-idp · GitHub](https://github.com/xgp/keycloak-moneybird-idp/blob/main/pom.xml#L38) You’ll probably need to add `org.keycloak.keycloak-saml-core,org.keycloak.keycloak-saml-core-public` and maybe some others. ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 8, 2021, 5:03pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/8 "2021-11-08T17:03:12Z")
that did the trick! thank you! ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/4816a49d442888d957c3e3ba200b8dc2f0b6e95b.png) Only thing is that the config page is not there yet. Need to check where i lost it: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/6/6764634fa2c7aa4cabeb474d8154604adb724bd5.png) ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 12, 2021, 12:35pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/9 "2021-11-12T12:35:06Z")
Hey, maybe you can have another look. Tested my “custom” SAML Broker Plugin locally in a comparable setup and it worked just as the default plugin. Logfile: > 11:24:58,926 INFO [saml.PGKSAMLIdentityProvider] (default task-2) authnRequest: ID\_b6f63ad8-511d-4653-ac84-42d7418e59d5 OIDC-Liferay > 11:24:59,014 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-2) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:24:59,034 WARN [org.keycloak.saml.common] (default task-2) XML External Entity switches are not supported. You may get XML injection vulnerabilities. > 11:25:18,178 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-1) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:25:18,180 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-1) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:25:18,181 INFO [saml.PGKSAMLEndpoint] (default task-1) clientId: OIDC-Liferay, tabId: cg-8Rc-c024, code: vpC2Qd\_fe0zN49GPZLV5pl6tNpe\_H0dDsvfu0bdTmCA > 11:25:18,206 WARN [org.keycloak.events] (default task-1) type=IDENTITY\_PROVIDER\_LOGIN\_ERROR, realmId=GK, clientId=null, userId=null, ipAddress=194.158.158.201, error=invalid\_code > 11:34:17,692 INFO [saml.PGKSAMLIdentityProvider] (default task-2) authnRequest: ID\_5d41c6df-0f0c-45a5-851a-1bd731b0bd95 OIDC-Liferay > 11:34:17,694 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-2) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:35:25,968 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-1) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:35:25,969 WARN [org.apache.jcp.xml.dsig.internal.dom.DOMReference] (default task-1) The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms. > 11:35:25,969 INFO [saml.PGKSAMLEndpoint] (default task-1) clientId: OIDC-Liferay, tabId: wZq0Bu\_uwCw, code: ZXv383hqmkeifpyvLTtNw-sbdCMADY8zqyO\_ZYuMV9I > 11:35:25,972 WARN [org.keycloak.events] (default task-1) type=IDENTITY\_PROVIDER\_LOGIN\_ERROR, realmId=GK, clientId=null, userId=null, ipAddress=194.158.158.201, error=invalid\_code The problem: > IdentityBrokerService → parseSessionCode → checks (line 1047) → results in an invalid auth session. The relay state looks fine: > client\_id: OIDC-Liferay > tab\_id: wZq0Bu\_uwCw > session\_code: 672K1W7o7YCbQpJGT9o3tdHrKm2k63o96WIyTGzfS0w > > relay: ZXv383hqmkeifpyvLTtNw-sbdCMADY8zqyO\_ZYuMV9I.wZq0Bu\_uwCw.OIDC-Liferay > > #### response > > ZXv383hqmkeifpyvLTtNw-sbdCMADY8zqyO\_ZYuMV9I.wZq0Bu\_uwCw.OIDC-Liferay any idea? ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [November 12, 2021, 2:45pm UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/10 "2021-11-12T14:45:12Z")
Without seeing the code you have modified, it would be difficult to help debug. Is this available in a repo somewhere? ---
**Author:** ![jrel](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrel/32/4098_2.png) [@jrel](https://forum.keycloak.org/u/jrel)\ **Post date:** [November 15, 2021, 8:19am UTC](https://forum.keycloak.org/t/customise-samlservice-external-idp-destination-field-is-missing/11894/11 "2021-11-15T08:19:29Z")
no not really available. I spent some time to setup a local test environment with one app, one IDP, one SP and used my custom broker. In this scenario everything worked. I found out that the IDP is using an unsecure connection to keycloak, which caused Chrome to prevent creating the sessionAuthCookie. Heavy debugging it was 😃 Thanks!