# Does Shinyproxy work with Azure AD with different groups

**URL:** <https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599>\
**Category:** ShinyProxy\
**Created:** [August 8, 2023, 8:11pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599 "2023-08-08T20:11:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![techc](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/techc/32/768_2.png) [@techc](https://support.openanalytics.eu/u/techc)\
**Post date:** [August 8, 2023, 8:11pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/1 "2023-08-08T20:11:25Z")

</div>

HI All

Does Shinyproxy work with Azure AD with different groups has anyone gotten SAML or openid to work

I was hoping to get some step by step guide of a sample yml config. getting Azure AD to work.

Thanks

---

<div class="post-metadata">

**Author:** ![Philip\_Wu](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/philip_wu/32/880_2.png) [@Philip\_Wu](https://support.openanalytics.eu/u/Philip_Wu)\
**Post date:** [August 10, 2023, 2:36am UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/2 "2023-08-10T02:36:55Z")

</div>

Yes, i have Azure AD working via SAML:

Not sure what you mean by groups, but role based information does come through as:

```auto
username <- Sys.getenv("SHINYPROXY_USERNAME")
usergroup<-Sys.getenv("SHINYPROXY_USERGROUPS")

```

you’ll have to replace the entity ID with your own in the below YAML file.  
Most of the work is probably on the Azure side, setting up roles in the enterprise app.

 ![image](https://support.openanalytics.eu/uploads/default/original/1X/4005ac56d880327b27c7a488a1e31d63466ed751.png)

---

<div class="post-metadata">

**Author:** ![techc](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/techc/32/768_2.png) [@techc](https://support.openanalytics.eu/u/techc)\
**Post date:** [August 29, 2023, 9:43pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/3 "2023-08-29T21:43:01Z")

</div>

Im getting this error Below after login

Here is my sample part of yml .

server:  
forward-headers-strategy: native  
secure-cookies: true

authentication: saml  
saml:  
idp-metadata-url: [https://login.microsoftonline.com/i](https://login.microsoftonline.com/i) have addedthe tenant ID/FederationMetadata/2007-06/FederationMetadata.xml  
app-entity-id: Using the saml application ID (azure)  
app-base-url: main website url  
roles-attribute: [http://schemas.microsoft.com/ws/2008/06/identity/claims/role](http://schemas.microsoft.com/ws/2008/06/identity/claims/role)

# Error

**Status code:** 200

**Message:** Incoming SAML message is invalid

**Stack Trace:**  
org.springframework.security.authentication.AuthenticationServiceException: Incoming SAML message is invalid  
at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:105)  
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at eu.openanalytics.containerproxy.auth.impl.saml.AlreadyLoggedInFilter.doFilter(AlreadyLoggedInFilter.java:50)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)  
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:155)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92)  
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.saml.metadata.MetadataDisplayFilter.doFilter(MetadataDisplayFilter.java:84)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:87)  
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)  
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)  
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)  
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)  
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)  
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)  
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)  
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)  
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)  
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:93)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)  
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)  
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)  
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)  
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)  
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)  
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)  
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)  
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)  
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)  
at io.undertow.server.handlers.PathHandler.handleRequest(PathHandler.java:91)  
at eu.openanalytics.containerproxy.util.ProxyMappingManager$ProxyPathHandler.handleRequest(ProxyMappingManager.java:160)  
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)  
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)  
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)  
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)  
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)  
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)  
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)  
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)  
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)  
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)  
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)  
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:269)  
at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:78)  
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:133)  
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:130)  
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)  
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)  
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:249)  
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:78)  
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:99)  
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:370)  
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:836)  
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)  
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:2019)  
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1558)  
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1449)  
at java.lang.Thread.run(Thread.java:748)  
Caused by: org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint  
at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)  
at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)  
at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:105)  
at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:172)  
at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:85)  
… 81 more

---

<div class="post-metadata">

**Author:** ![techc](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/techc/32/768_2.png) [@techc](https://support.openanalytics.eu/u/techc)\
**Post date:** [August 29, 2023, 10:02pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/4 "2023-08-29T22:02:27Z")

</div>

can anyone shed some light on this ?

---

<div class="post-metadata">

**Author:** ![techc](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/techc/32/768_2.png) [@techc](https://support.openanalytics.eu/u/techc)\
**Post date:** [August 29, 2023, 10:15pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/5 "2023-08-29T22:15:34Z")

</div>

@Philip_Wu would be possible to connect with you ?

---

<div class="post-metadata">

**Author:** ![techc](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/techc/32/768_2.png) [@techc](https://support.openanalytics.eu/u/techc)\
**Post date:** [August 29, 2023, 10:29pm UTC](https://support.openanalytics.eu/t/does-shinyproxy-work-with-azure-ad-with-different-groups/2599/6 "2023-08-29T22:29:27Z")

</div>

@Philip_Wu for Azure side Enterprise app

 ![image](https://support.openanalytics.eu/uploads/default/original/1X/b83d52cdc474e9278ac4948b46b3f848593bca19.png)