# SAML Identity Broker - invalid\_saml\_response invalid\_destination

**URL:** <https://forum.keycloak.org/t/saml-identity-broker-invalid-saml-response-invalid-destination/5163>\
**Category:** Miscellanaeous\
**Created:** [October 2, 2020, 7:02pm UTC](https://forum.keycloak.org/t/saml-identity-broker-invalid-saml-response-invalid-destination/5163 "2020-10-02T19:02:35Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![brad.king](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@brad.king](https://forum.keycloak.org/u/brad.king)\
**Post date:** [October 2, 2020, 7:02pm UTC](https://forum.keycloak.org/t/saml-identity-broker-invalid-saml-response-invalid-destination/5163/1 "2020-10-02T19:02:35Z")

</div>

I have a SAML identity provider configured. When I attempt to log with the provider from the keycloak login page I get the provider login page, log in, then an error in the keycloak logs after the redirect back to keycloak:

[org.keycloak.events] (default task-13) type=IDENTITY\_PROVIDER\_RESPONSE\_ERROR, realmId=aerograph, clientId=null, userId=null, ipAddress=156.68.42.239, error=invalid\_saml\_response, reason=invalid\_destination

When I look at the SAML payload it has a Destination element that looks valid for an external address:

```
<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol"
          Destination="https://aerograph.arc.nasa.gov/saml-sp/auth/realms/aerograph/broker/saml/endpoint"

```

I am running behind nginx, and set up the proxy as recommended. My proxy adds a path element /saml-sp, which I’ve configured in my standalone.xml as:

```
<property name="frontendUrl" value="https://aerograph.arc.nasa.gov/saml-sp/auth"/>
<property name="forceBackendUrlToFrontendUrl" value="true"/>

```

I also followed the guidance in the docs here for setting up a proxy:

> **[Server Installation and Configuration Guide](https://www.keycloak.org/docs/latest/server_installation/index.html#_setting-up-a-load-balancer-or-proxy)**

Please help, I’m not sure what I need to try next.