I have a functioning SAML IdP, implemented with LemonLDAP::NG. I know it functions because it works with Nextcloud as an SP. I've also successfully configured a DokuWiki SP in the past.
The IdP, the Nextcloud SP and the Drupal 8 SP are all behind an Nginx reverse proxy. All of them are directly reachable from my IP, but I have restricted access from other IPs.
I have been trying on and off for a year to make SAML login work with Drupal 8, using simplesamlphp_auth, but without success. I have lost count of how many articles I have read on the net, which all suggest that configuring SAML is trivial. Sadly, not for me.
Currently, when I select the Drupal 8 SP under 'Test authentication sources' in the 'Authentication' tab, I get the following error:
Too many redirects occurred trying to open “https://www.xxxx.tld/simplesaml/module.php/core/authenticate.php?as=wmh-www-sp&%5CSimpleSAML%5CAuth%5CState.exceptionId=_568428306a7ad7ad7bf8f8f47a94940de364239c67%3Ahttps%3A%2F%2Fwww.xxx.tld%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dwmh-www-sp%26ReturnTo%3Dhttps%253A%252F%252Fwww.xxx.tld%252Fsimplesaml%252Fmodule.php%252Fcore%252Fauthenticate.php%253Fas%253Dwmh-www-sp”. This might occur if you open a page that is redirected to open another page, which then is redirected to open the original page.
The log file contains repeated occurrences of the following error messages:
2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] Session: 'wmh-www-sp' not valid because we are not authenticated.
PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')
PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')
PHP message: simplesamlphp DEBUG [e54b9408f4] Saved state: '_f37c552249cf34b640de1dac7ad22b1481c763fc0f:https://www.xxx.tld/simplesaml/module.php/core/as_login.php?AuthId=wmh-www-sp&ReturnTo=https.xxx.tld.php.php-www-sp'
PHP message: simplesamlphp DEBUG [e54b9408f4] saving key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af to memcache" while reading response header from upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"
2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] loading key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af from memcache" while reading upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"
(www.xxx.tld is the SP, cloud.xxx.tldis the IdP, wmh-www-sp is the entityID of the SP.)
Specific things I do not understand:
we are not authenticated- I have logged into thesimplesamlphp_authinterfaceMETADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')- this is the address of the IdP's metadata and is correct as such
I created file metadata/saml20-idp-remote.php from the IdP's metadata URL, https://cloud.xxx.tld/saml/metadata using simplesamlphp_auth's metadata converter under the "Federation" tab.
Can anyone help me to make sense of all the above?
Steve
we are not authenticated. This refers to the SAML authentication on the Idp, not your authentication into the SimpleSAMLphp dashboard. The screenshot does indeed show you are logged into the dashboard.