The response from the list on my initial mails was : After content filtering, the message was empty So I try to send the same mail without CC and without attached =========== Hello, We are trying to configure a SAML authentication system in a keycloak cluster. First, with only one node , we are currently managing to authenticate in SAML way. The architecture : --> we have one apache reverse proxy with a public and unique endpoint for saml authentication. We can call the pubic url : security.lu<http://security.lu> --> the reverse proxy will load-balance all calls that come on security.lu<http://security.lu> to two keycloak nodes : security1.lu<http://security1.lu> and security2.lu<http://security2.lu> ( the private urls) . The issue that we have : --> The client that integrates saml has a tomcat and integrates a keycloak-saml.xml file. Of course, in this file the configuration is refering to security1.lu<http://security1.lu> ( the private address as the keycloak node only knows its private address). --> If we arrive during the load-balancing on the security1.lu<http://security1.lu> node, it will work. If I arrive on the second security2.lu<http://security2.lu> node, it will fail. When I dig a little bit more, it's because in fact, the SAMLRequest that is generated looks like this : <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://security1.lu<http://security1.lu>:8080/realms/xxx/protocol/saml" ForceAuthn="false" ID="ID_e563f50b-4ed8-454c-b938-0727d18ec08e" IsPassive="false" IssueInstant="2016-10-11T12:52:09.865Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">xxxxx</saml:Issuer><samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"></samlp:NameIDPolicy></samlp:AuthnRequest> The error that I get is an invalid_destination because we receive this SAMLRequest on the security2.lu<http://security2.lu> node : 2016-10-11 14:52:10,152 WARN [org.keycloak.events] (default task-2) type=LOGIN_ERROR, realmId=xxx, clientId=null, userId=null, ipAddress=xxxx, error=invalid_authn_request, reason=invalid_destination Or is there any way to define both security1.lu<http://security1.lu> and security2.lu on the Saml XML configuration that the client integrates? We have set proxy-address-forwarding=true Thank you for your help. Kr, Br Dimitrios Gkazgkas IT Solutions Architect ________________________________ **** DISCLAIMER **** http://www.tango.lu/maildisclaimer