# SAML - SSO state Invalid : User IP missmatch

**URL:** https://community.passbolt.com/t/saml-sso-state-invalid-user-ip-missmatch/7055
**Category:** Installation Issues
**Created:** [April 12, 2023, 11:49am UTC](https://community.passbolt.com/t/saml-sso-state-invalid-user-ip-missmatch/7055 "2023-04-12T11:49:07Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Shas](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Shas](https://community.passbolt.com/u/Shas)
#### Post date: [April 12, 2023, 11:49am UTC](https://community.passbolt.com/t/saml-sso-state-invalid-user-ip-missmatch/7055/1 "2023-04-12T11:49:07Z")

</div>

Hello,

We are running Passbolt with SAML configuration since 2 weeks now and we are facing an issue sometimes with SAML.

The SAML popup prompt :

 ![Capture d’écran 2023-04-12 à 13.48.36](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/e/ee5a6590a7fbebe6463d50cc4ae99410ea53e14b.png)

Someone already sea this error ? And how can we solve it ?

Thanks !

---

<div class="post-metadata">

### Author: ![clayton](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@clayton](https://community.passbolt.com/u/clayton)
#### Post date: [April 12, 2023, 12:32pm UTC](https://community.passbolt.com/t/saml-sso-state-invalid-user-ip-missmatch/7055/2 "2023-04-12T12:32:11Z")

</div>

hey @Shas welcome to the forum!

Since this is SSO it is a pro feature and you can reach out to use at [contact@passbolt.com](mailto:contact@passbolt.com) if you’d like.

Usually this error is due to a configuration issue. Could you run the status-report and post the output?

On Debian the command is:  
`su -s /bin/bash -c "/usr/share/php/passbolt/bin/status-report" www-data`

---

<div class="post-metadata">

### Author: ![Shas](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Shas](https://community.passbolt.com/u/Shas)
#### Post date: [April 14, 2023, 8:27am UTC](https://community.passbolt.com/t/saml-sso-state-invalid-user-ip-missmatch/7055/3 "2023-04-14T08:27:51Z")

</div>

Hello,

After some investigation it seems the problem is :

We have 2 DNS public IP for our passbolt and each of these IP goes to different Loab Balancer who each have an internal IP for SNAT.

It seems sometimes the browser goes to the passbolt page with one of the DNS record and passbolt see the IP source of the first LB and the extension use the second public IP for the SSO auth and passbolt see the IP source of the second LB.

Passbolt seems to have User IP check feature who check if all the resquests from a same user session are from the same IP.

It seems it’s possible if I go to the passbolt php and modify the option :

‘userIp’ =\> filter\_var(env(‘PASSBOLT\_SECURITY\_USER\_IP’, true)

for :

‘userIp’ =\> filter\_var(env(‘PASSBOLT\_SECURITY\_USER\_IP’, false)

I will test this and back to the topic with the final answer if someone meet the same problem some day.

Maybe if someone already do it and can confirm it’s working it would be great :).

Regards.