0

Simplesamlphp used to work on the site. Something changed and now it does not.

  • The IDP remote config has been verified, including the cert
  • The SP cert and pem in the simplesamlphp/config folder have been verified
  • All the required settings show green on the admin page
  • When the ACS URL is entered as a test, a JSON file with the metadata is downloaded

All there seems correct. But when a user attempts to login, the following is thrown into the log file. I note that despite the entry about the candidate having :443, the URL with or without the port results in identical json.

This is Drupal 8.9.6, PHP 7.3.21, simplesamlphp_auth 8.x-3.2, simplesamlphp 1.18.8

simplesamlphp ERROR [ffdf5e0102] SimpleSAML\Error\Error: UNHANDLEDEXCEPTION

simplesamlphp ERROR [ffdf5e0102] Backtrace:

simplesamlphp ERROR [ffdf5e0102] 1 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/www/_include.php:17 (SimpleSAML_exception_handler)

simplesamlphp ERROR [ffdf5e0102] 0 [builtin] (N/A)

simplesamlphp ERROR [ffdf5e0102] Caused by: SimpleSAML\Error\Exception: > This SP [https://admin.mysite.gov/simplesaml/module.php/saml/sp/metadata.php/default-sp] is not a valid audience for the assertion. Candidates were: [https://admin.mysite.gov:443/simplesaml/module.php/saml/sp/metadata.php/default-sp]

simplesamlphp ERROR [ffdf5e0102] Backtrace:

simplesamlphp ERROR [ffdf5e0102] 4 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/modules/saml/lib/Message.php:718 (SimpleSAML\Module\saml\Message::processAssertion)

simplesamlphp ERROR [ffdf5e0102] 3 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/modules/saml/lib/Message.php:640 (SimpleSAML\Module\saml\Message::processResponse)

simplesamlphp ERROR [ffdf5e0102] 2 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/modules/saml/www/sp/saml2-acs.php:141 (require)

simplesamlphp ERROR [ffdf5e0102] 1 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/lib/SimpleSAML/Module.php:260 (SimpleSAML\Module::process)

simplesamlphp ERROR [ffdf5e0102] 0 /mnt/www/html/mysite/vendor/simplesamlphp/simplesamlphp/www/module.php:10 (N/A)

simplesamlphp ERROR [ffdf5e0102] Error report with id 86f8550b generated.

Improve this question
4
  • Something changed – That's the key. So what changed? Have you double-checked Apache config?
    – leymannx
    Commented Oct 28, 2020 at 10:28
  • All you can do is a diff of what was there before and what is there now. groups.google.com/g/simplesamlphp/c/ga2enXsY3PA
    – Kevin
    Commented Oct 28, 2020 at 13:09
  • Last worked in Jan. The cloud hoster's been working this with us since, as has the authenticator. It's nginx. There doesn't seem to be anything nginx related. Drupal version has changed (all 8.x), as has php (from 7.2 to 7.3). If it were either of those, the problem should be well known and reported by now, I'd think. There is no access log error accompanying the simplesamlphp log error. I think the key is why it is highlighting that binding, why 443 makes a difference, since it doesn't when hitting both url's, and whether that url should result in a json download like it does.
    – JAyenGreen
    Commented Oct 28, 2020 at 13:15
  • Not possible. For a start, cannot diff cloud environment. I need to proceed as if it never worked and figure out why, what specifically it’s unhappy with.
    – JAyenGreen
    Commented Oct 28, 2020 at 13:33

1 Answer 1

Reset to default
1

It turns out that the issue was the entityID on the authenticator end containing the port number, and the default entityID provided by simplesamlphp not so. Having the authenticator change their config entries, dropping the explicit port reference, resolved the issue.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.