0

I have a functioning SAML IdP, implemented with LemonLDAP::NG. I know it functions because it works with Nextcloud as an SP. I've also successfully configured a DokuWiki SP in the past.

The IdP, the Nextcloud SP and the Drupal 8 SP are all behind an Nginx reverse proxy. All of them are directly reachable from my IP, but I have restricted access from other IPs.

I have been trying on and off for a year to make SAML login work with Drupal 8, using simplesamlphp_auth, but without success. I have lost count of how many articles I have read on the net, which all suggest that configuring SAML is trivial. Sadly, not for me.

Currently, when I select the Drupal 8 SP under 'Test authentication sources' in the 'Authentication' tab, I get the following error:

enter image description here

Too many redirects occurred trying to open “https://www.xxxx.tld/simplesaml/module.php/core/authenticate.php?as=wmh-www-sp&%5CSimpleSAML%5CAuth%5CState.exceptionId=_568428306a7ad7ad7bf8f8f47a94940de364239c67%3Ahttps%3A%2F%2Fwww.xxx.tld%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dwmh-www-sp%26ReturnTo%3Dhttps%253A%252F%252Fwww.xxx.tld%252Fsimplesaml%252Fmodule.php%252Fcore%252Fauthenticate.php%253Fas%253Dwmh-www-sp”. This might occur if you open a page that is redirected to open another page, which then is redirected to open the original page.

The log file contains repeated occurrences of the following error messages:

2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] Session: 'wmh-www-sp' not valid because we are not authenticated.

PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')

PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')

PHP message: simplesamlphp DEBUG [e54b9408f4] Saved state: '_f37c552249cf34b640de1dac7ad22b1481c763fc0f:https://www.xxx.tld/simplesaml/module.php/core/as_login.php?AuthId=wmh-www-sp&ReturnTo=https.xxx.tld.php.php-www-sp'

PHP message: simplesamlphp DEBUG [e54b9408f4] saving key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af to memcache" while reading response header from upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"

2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] loading key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af from memcache" while reading upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"

(www.xxx.tld is the SP, cloud.xxx.tldis the IdP, wmh-www-sp is the entityID of the SP.)

Specific things I do not understand:

  • we are not authenticated - I have logged into the simplesamlphp_auth interface
  • METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'') - this is the address of the IdP's metadata and is correct as such

I created file metadata/saml20-idp-remote.php from the IdP's metadata URL, https://cloud.xxx.tld/saml/metadata using simplesamlphp_auth's metadata converter under the "Federation" tab.

Can anyone help me to make sense of all the above?

Steve

  • I recently set up an integration with this module - very tricky, so I feel your pain. I can't tell you why it's not working, but I can shed light on we are not authenticated. This refers to the SAML authentication on the Idp, not your authentication into the SimpleSAMLphp dashboard. The screenshot does indeed show you are logged into the dashboard. – Jaypan Apr 5 at 11:02
  • @Jaypan You gave me hope for a minute there, but logging in to the IdP makes no difference. – Stephen Winnall Apr 5 at 17:04
0

The problem was - as so often - between the keyboard and the chair. I had some subtle mistakes in a couple of file paths in config/config.php. Apparently simplesamlphp_auth doesn't do any validation of file names, so mistakes blow up without any apparent context at runtime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.