# Authentication\_saml stuck with "Cannot\_match\_source\_hash"
**URL:** https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389
**Category:** System Administrator
**Tags:** authentication
**Created:** [September 18, 2026, 9:18am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389 "2026-09-18T09:18:38Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 9:18am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/1 "2026-09-18T09:18:38Z")
I have entityID = [https://erp.mydomain.com/tryton\_db\_yeqqcrtbickz/authentication/saml/keycloak/metadata](https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata) in trytond.conf and also set my keycloak saml client’s clientId to the same value. I just can’t overcome “invalid request” message in browser with keycloak log showing “Cannot\_match\_source\_hash”. My keycloak xml is gotten from curl -k -L -o /etc/tryton/keycloak-metadata.xml “[https://keycloak.mydomain.com/realms/mydomain.com/protocol/saml/descriptor](https://keycloak.mydomain.com/realms/mydomain.com/protocol/saml/descriptor)”. I just cannot figure out what I am doing wrong. Meanwhile, regular password login to tryton works for the same service.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 18, 2026, 9:33am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/2 "2026-09-18T09:33:10Z")
> [@piosystems](#):
>
> I have entityID = [https://erp.mydomain.com/tryton\_db\_yeqqcrtbickz/authentication/saml/keycloak/metadata](https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata) in trytond.conf
Not sure what you mean but `authentication_saml` configuration accept only local file for `metadata` and `config` keys.
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 11:35am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/3 "2026-09-18T11:35:14Z")
I am referring to the use of authentication\_saml module ( [Authentication SAML Module — SAML authentication for Tryton](https://docs.tryton.org/latest/modules-authentication-saml/index.html)) for SSO with keycloak
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 18, 2026, 11:38am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/4 "2026-09-18T11:38:22Z")
I understood that but not the sentence I quoted.
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 11:45am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/5 "2026-09-18T11:45:33Z")
I am referring to the part of trytond.conf file, viz:
```auto
[authentication_saml]
keycloak = Keycloak Single Sign On
[authentication_saml keycloak]
entityID = https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata
Location = https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/acs
metadata = /etc/tryton/keycloak-metadata.xml
login = username
```
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 12:28pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/6 "2026-09-18T12:28:17Z")
Any issue with the above configuration?
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 18, 2026, 12:57pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/7 "2026-09-18T12:57:52Z")
> [@piosystems](#):
>
> ```auto
> entityID = https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata
>
> Location = https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/acs
>
> ```
Those are not part of the standard configuration.
And you are missing the [`config` key](https://docs.tryton.org/latest/modules-authentication-saml/configuration.html#config).
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 2:22pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/8 "2026-09-18T14:22:45Z")
I am not using config key which is specified as optional in the documentation at [Configuration — SAML authentication for Tryton](https://docs.tryton.org/latest/modules-authentication-saml/configuration.html#config).
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 18, 2026, 2:46pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/9 "2026-09-18T14:46:51Z")
Well, maybe the default configuration of PySAML does not work with your service.
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 18, 2026, 4:44pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/10 "2026-09-18T16:44:38Z")
I have taken a closer look by decoding the SAML Request sent. E.g.
[https://keycloak.mydomain.com/realms/mydomain.com/protocol/saml?SAMLRequest=rZJRS8MwFIX%2FSsl7126D4sJWqE7ZZLJiq4gvI02jC22SLvdWrL%2FerHMTFfbk4z2cE75zb6YaQpq0uNX3YtcKQO9d1Rqok2ektZoaBtKNTAmgyGmW3K3oaBDSxho03NTkFBieDzAAYVEaTbzlfEZk6dunIkvWk8U1zvM0wtuIeI%2FCgrPMiEs4H0ArlhqQaXRSOIr8cOIPL%2FJhREcRHY%2BfiTd3zFIz7FNbxAZoEFSi47Vh1aARrNoyq4zuBtyowApWKwh%2By8cyATDlGqVf46XUpdSv53sVBxPQRZ6nfrrOcuIlx65XRkOrhM2EfZNcPNyvDpCOUdjmDx7aDo3elMWmE7sdt1hIXn0EzN1HaJS8r9lDnioGjAOJp279tF%2BX9W6MVQzPQ%2B8Vd4GX3kr3b2NH4n8mUwJZyZBNg2%2B6eD%2F8%2FHHxJw%3D%3D&RelayState=http%3A%2F%2Ferp.mydomain.com.com](https://keycloak.mydomain.com/realms/mydomain.com/protocol/saml?SAMLRequest=rZJRS8MwFIX%2FSsl7126D4sJWqE7ZZLJiq4gvI02jC22SLvdWrL%2FerHMTFfbk4z2cE75zb6YaQpq0uNX3YtcKQO9d1Rqok2ektZoaBtKNTAmgyGmW3K3oaBDSxho03NTkFBieDzAAYVEaTbzlfEZk6dunIkvWk8U1zvM0wtuIeI%2FCgrPMiEs4H0ArlhqQaXRSOIr8cOIPL%2FJhREcRHY%2BfiTd3zFIz7FNbxAZoEFSi47Vh1aARrNoyq4zuBtyowApWKwh%2By8cyATDlGqVf46XUpdSv53sVBxPQRZ6nfrrOcuIlx65XRkOrhM2EfZNcPNyvDpCOUdjmDx7aDo3elMWmE7sdt1hIXn0EzN1HaJS8r9lDnioGjAOJp279tF%2BX9W6MVQzPQ%2B8Vd4GX3kr3b2NH4n8mUwJZyZBNg2%2B6eD%2F8%2FHHxJw%3D%3D&RelayState=http%3A%2F%2Ferp.mydomain.com.com)
The https is unexpectedly replaced by http as shown in the decoded equivalent below …
` ``http://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata`` `
If I then set the clientId in the keycloak saml service to
`http://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata`
and set redirect uri to
`http://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/acs`
keycloak login appears correctly. Unfortunately after login, it will redirect to the http and not https. The real issue is thus why https is replaced by http in the SAML Request, that leads to the mismatch. I am yet to experiment with the optional [config](https://docs.tryton.org/latest/modules-authentication-saml/configuration.html#config)key involving PySAML.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 18, 2026, 5:41pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/11 "2026-09-18T17:41:01Z")
It is because you did not set the tryton configuration [`[ssl] certificate`](https://docs.tryton.org/latest/server/topics/configuration.html#certificate).
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 19, 2026, 10:08am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/12 "2026-09-19T10:08:14Z")
Adding the following to trytond.conf fixed the https issue. Thank you.
```auto
[ssl]
certificate = /usr/local/share/ca-certificates/ca.mydomain.com.crt
privatekey = true
```
The following are not required in trytond.conf.
entityID = [https://erp.mydomain.com/tryton\_db\_yeqqcrtbickz/authentication/saml/keycloak/metadata](https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/metadata)
Location = [https://erp.mydomain.com/tryton\_db\_yeqqcrtbickz/authentication/saml/keycloak/acs](https://erp.mydomain.com/tryton_db_yeqqcrtbickz/authentication/saml/keycloak/acs)
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 19, 2026, 10:10am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/13 "2026-09-19T10:10:29Z")
> [@piosystems](#):
>
> `certificate = /usr/local/share/ca-certificates/ca.mydomain.com.crt`
You do not need to set to any path, just true or unset it (only one of `certificate` or `privatekey` needs to be `true`).
---
### Author:  [@piosystems](https://discuss.tryton.org/u/piosystems)
#### Post date: [September 19, 2026, 10:13am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/14 "2026-09-19T10:13:14Z")
I first set only `certificate = true` and the problem was not solved.
---
### Author:  [@system](https://discuss.tryton.org/u/system)
#### Post date: [September 20, 2026, 10:14am UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/15 "2026-09-20T10:14:01Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.
---
### Author:  [@nicoe](https://discuss.tryton.org/u/nicoe)
#### Post date: [September 20, 2026, 8:07pm UTC](https://discuss.tryton.org/t/authentication-saml-stuck-with-cannot-match-source-hash/9389/16 "2026-09-20T20:07:48Z")
What made you believe that those keys exists in `trytond.conf` ?
I think that if people want to customize this (I don’t know why they would but I am not very knowledgeable about SAML) they need to use a specific configuration file specified in `config` as it allows to override the settings used by the SAML client.