SAML2 SSO Auth
Authentication using exists SimpleSAMLphp Service Provider
Comments
Comments are no longer open for new posts. Existing comments remain available to read.
which version of the plugin are you using? The method has been update since June 2018 at least.
I'm using your plugin for a little POC and saw a message in the error_log of my webserver:
[Fri Dec 21 16:04:17.688211 2018] [proxy_fcgi:error] [pid 19253] [client ::1:39528] AH01071: Got error 'PHP message: simplesamlphp WARNING [9d864cbda7] The class or interface 'SimpleSAML_Auth_Simple' is now using namespaces, please use 'SimpleSAML\\Auth\\Simple'.\n'
In your auth.php I changed this and then the warning disappeared from my error_log:
79 /**
80 * Load SimpleSAMLphp library autoloader
81 */
82 private function getSSPauth() {
83 require_once $this->config->sp_path . DIRECTORY_SEPARATOR . 'lib' . DIRECTORY_SEPARATOR . '_autoload.php';
84
85 //return new SimpleSAML_Auth_Simple($this->config->entityid);
86 return new \SimpleSAML\Auth\Simple($this->config->entityid);
87 }
I have debugged version 3.0 R12 and i found out during several test why there is a no state error.
The moment you to the https://mymoodlesite.com it creates a Session ID 123456 and redirects you to the SSO. Afterwards you log in and you will get a No state error, but the reason why this happens is that the session ID after you logged in through the SSO deviates with the Session ID before.
So i was wondering am i missing a configuration in Simplesaml to complete the authentication process or is this a bug in the plugin?
I have some issue with version 3.0 r12.
The installation and configuration of the plugin went good until i test the SSO login.
The moment i log in get from simplesaml (version 1.14.4) a state information lost error (SimpleSAML_Error_NoState: NOSTATE).
When i test the authentication in Simplesaml the authentication and all works just fine.
Is there a configuration i am missing to find the session when i log in?
I am on moodle 3.5 and SimpleSAMLphp 1.15.4
I am new to moodle and i am trying to implement SSO to my website.
so I have setup moodle on my server and installed plugin "SAML2 SSO Auth"
and then I have setup "SimpleSAMLphp Service Provider" on my server, all great till now.
But when i enabled plugin and setup things which plugin requires, i wont able to access moodle at all even i can not able to login to moodle admin? also moodle login screen look messy. it was all correct before plugin activated.
when i try to login in moodle it redirect me to "SimpleSAMLphp" (setup on server) login screen and I am not sure which username/password it accepts.
I have tried my website user login details but it says "Incorrect username or password" not sure what to do.
since i am new to this, am i doing something wrong? or missing to add some settings?
Please guide as i am not able to access moodle as a user or admin.
what I am expecting is to setup that when user login to my website and when click on Moodle link placed on my website it should not ask any login details and directly login to Moodle. is it possible with this plugin? please give some details how to achieve my goal.
Thank you,
Yes, the SimpleSAMLphp Service Provider is at the same host as Moodle.
My Moodle: https://moodle.mydomain/moodle34/
My SimpleSAMLphp: https://moodle.mydomain/simplesaml/
My Identity Provider: https://websso.subdomain.mydomain/adfs/
I try to change session.cookiename but it does not work. If any way to further check?
Thank you very much!
Do you have a proper SimpleSAMLphp Service Provider in the same host name as Moodle? (https://xxx/moodle)
In my understood you are trying to redirect users from Moodle directly to Identity Provider.
In my environment I have a SimpleSAMLphp Service Provider in the same host name as Moodle.
Ex.:
My Moodle is hosting in https://moodle.dev
My Service Provider is hosting in https://moodle.dev/sso/
and my Identity Provider is hosting in https://idp.dev/sso
when users try to access Moodle, the auth_saml2sso plugin require authentication from my Service Provider and then users are redirected to IdP.
About the session.cookiename I leave as default 'SimpleSAML'
My environment:
Moodle 3.4.2
SimpleSAMLphp 1.15.4
saml2sso: Release v3.4-r02
My IdP is ADFS. I get the same error which continually sending 6 requests to ADFS and then blocked by ADFS. I read the article in https://www.marcus-povey.co.uk/2016/02/09/exception-the-post-data-we-should-restore-was-lost/ but no idea to change it. Actually, I can find the setting 'session.phpsession.cookiename' in config file but what is the value should I change?
My ADFS administrator had checked and said their setting is correct. I can successfully get the response from "Test authentication sources" of simplesamlphp (https://xxx/simplesaml/module.php/core/authenticate.php?as=mysp). Moreover, the mapping of attributes username, lastname, firstname ane email are copy from this test page and so I sure they are correct. If any settings are wrong in my Moodle?
Thank your for attention and help!
You must configure Moodle to redirect users to IdP and get response from it.
Do you have a Identity Provider and a Service Provider working together?
I've ordered the current user flow:
1. The user logs into the IdP and selects the moodle button
2. The user is redirected to: https://MyMoodle.com/simplesaml/module.php/saml/sp/saml2-acs.php/myMoodle.comSpName along with some POST data and successfully authenticates.
3. The relay state then sends the user back to Moodle (this works up to this point)
4. The user then is redirected to the following URL: https://MyMoodle.com.com/simplesaml/module.php/saml/sp/discoresp.php?AuthID=_fksandfknsdfk;lnasdf;klnaskdlfna;sfdknsdfhttps%3A%2F%2FMyMoodle.com%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Ddefault-sp%26ReturnTo%3Dhttps%253A%252F%252FMyMoodle.com%252Flogin%252Findex.php&idpentityid=EntityIDName
4. When the user hits the Moodle page they are redirected to the "SingleSignOnService Location = 'http://doesnotexist.com' " which is contained in the IdP metadata.
I can see that the user is successfully getting authenticated with simplesamlphp but is not getting redirected and logged in to moodle, they are instead getting redirected to http://doesnotexist.com The SingleSignOnService should be ignored as the user has already been authenticated (as this is IdP initiated) and they should be logged into moodle. So the set up with SimpleSaml is working correctly however Moodle/the plugin is not handling this as expected.
I'm currently trying to implement this plugin using an IdP initiated SSO. When i click the link from the IdP I am getting sent to the following URL:
https://MYMoodle.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp
Should I be going to this above URL with the POST data from the IdP or should I be going to just https://MYMoodle.com ?
When I reach this URL I get the following error from simplesaml:
############
SimpleSAML_Error_Error: ACSPARAMS
Backtrace:
1 modules/saml/www/sp/saml2-acs.php:21 (require)
0 www/module.php:135 (N/A)
Caused by: Exception: Unable to find the current binding.
Backtrace:
2 vendor/simplesamlphp/saml2/src/SAML2/Binding.php:104 (SAML2\Binding::getCurrentBinding)
1 modules/saml/www/sp/saml2-acs.php:16 (require)
0 www/module.php:135 (N/A)
############
The process stops here and I am not redirected to https://MYMoodle.com
However, after this is I go onto https://MYMoodle.com/simplesaml/ and test my authentication sources it is showing that I am authenticated and displays my SAML Subject and 1 attribute which is sent from the POST data.
Thanks in advance for your help.
Please, try again.
Downloading auth_saml2sso ... OK
Validating auth_saml2sso ... Error
[Error] Required Moodle version [2017111301]
Installation aborted due to validation failure
I'm running Moodle version Moodle 3.4+ (Build: 20180112)