# What is invalid destination keycloak error?

**URL:** <https://forum.keycloak.org/t/what-is-invalid-destination-keycloak-error/17088>\
**Category:** Configuring the server\
**Created:** [August 25, 2022, 10:19am UTC](https://forum.keycloak.org/t/what-is-invalid-destination-keycloak-error/17088 "2022-08-25T10:19:01Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![gsmith](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gsmith/32/294_2.png) [@gsmith](https://forum.keycloak.org/u/gsmith)\
**Post date:** [August 25, 2022, 10:28pm UTC](https://forum.keycloak.org/t/what-is-invalid-destination-keycloak-error/17088/2 "2022-08-25T22:28:46Z")

</div>

> [@husainr](#):
>
> `error=invalid_saml_response, reason=invalid_destination`

> [@Invalid SAML Response (Invalid Destination)](http://forum.keycloak.org/t/invalid-saml-response-invalid-destination/4754/3):
>
> Yes, it was because I have Keycloak in Kubernetes behind an Ingress service. I’m using Nginx Ingress. I needed to configure use\_forward\_headers to true. I also had to ensure that the incoming connection came into Nginx Ingress via HTTPS and port 443. This issue happens when Keycloak thinks that the URL it is being contacted on is different than the URL in the payload. You have to make sure that all the X-Forward-\* headers are being sent correctly and that Keycloak is configured to use them. Oth…

---

_[View the full topic](https://forum.keycloak.org/t/what-is-invalid-destination-keycloak-error/17088)._