SAML2 SSO Auth
Authentication using exists SimpleSAMLphp Service Provider
Comments
Comments are no longer open for new posts. Existing comments remain available to read.
A SAML Identity Provider should be used to agregate more than one different authentication method.
If you can, set it up for example a SimpleSAMLphp Identity provider that authenticate your users on LDAP and then use this plugin to login Moodle users. In Confluence you can use any other SAML plugin. It is a bit confuse to start from scracth.
This plugin will only works with SimpleSAMLphp Service Provider.
I tested the last release with Moodle 3.2 and everything works fine.
It seems to be a simplesamlphp releated error. Generally a bad configuration.
You can add a issue in github tracker with error print.
Thank you.
simplesamlphp tests fine, but when I try to use this plug-in to authenticate, I get:
Dec 9 17:01:10 thgs-moodle3 simplesamlphp[46705]: 3 [a986d826db] SimpleSAML_Error_NoState: NOSTATE
Dec 9 17:01:10 thgs-moodle3 simplesamlphp[46705]: 3 [a986d826db] Backtrace:
Dec 9 17:01:10 thgs-moodle3 simplesamlphp[46705]: 3 [a986d826db] 2 /var/simplesamlphp/lib/SimpleSAML/Auth/State.php:232 (SimpleSAML_Auth_State::loadState)
Dec 9 17:01:10 thgs-moodle3 simplesamlphp[46705]: 3 [a986d826db] 1 /var/simplesamlphp/modules/saml/www/sp/saml2-acs.php:54 (require)
Dec 9 17:01:10 thgs-moodle3 simplesamlphp[46705]: 3 [a986d826db] 0 /var/simplesamlphp/www/module.php:135 (N/A)
Thank you guys so much for this excellent example of how a plugin approval peer-review can improve the plugin for everybody. I am happy to approve this now. You are cleared to land, welcome to the Plugins directory!
Great job, thanks a lot! I am happy to recommend this plugin to be approved
Best regards,
Ivan
Apologies, i do not have access to my test installation now. I should have feedback on Monday, sorry for that
Best regards,
Ivan
I have released a new version (v3.0-r8) which include all three issues corretions about config form validations.
In the next versions I'll change the dual login procedure to give users the option to choose IdP or local login.
Thank you for your support
The basic validation can be done in auth.php in process_config(), but i just checked and authentication plugins do not usually provide fine error reporting, so sending back to a form a list of fields that don't pass the validation would require some additional html in the form. This way I think it's ok to let the form to accept empty fields, but i still believe it would be wise to consider what happens if the field is empty
Thanks a lot for your effort so far. I am thinking about a fully functional replacement of auth_saml, capable to perform generic SAML authentication, that's why i'm trying to pay attention to details
Best regards,
Ivan
Concerning the issues on github, I'm already checking.
Can you help me to figure out how to validate the Data mapping form to avoid the empty fields that are required?
I'm very appreciated for your help and report and because it's my first contribution, I'm trying to make my best.
There is another thing. I can see that this plugin redirects to an IdP unconditionally, without an option to choose to enter manual credentials (like the auth_saml plugin does). Is there a special reason for that and actually, would it be possible to implement that choice? Keeping the option to redirect to IdP right away of course. I can see that the SAML users have the saml auth type, so this should be easy to achieve. Using the existing mechanism of appending "?saml=off " is not practical: an admin will have to manually create a login page with that string appended, so in other words, manually implement this choice, while it can be shipped with the plugin
I also left some bug reports in a tracker. It's not complete yet, i will need to continue working on the review
Best regards,
Ivan
Ok, let us wait for final word from Ivan here. Thanks for your patience.
Thanks to David Mudrák that has changed the plugin's name directly in database to maintain this discussion.
I hope it can be usefull to everyone that needs a single sign on solution.
I had to delete all the previously uploaded versions as they did not validate any more, having the different component name in the version.php. Please upload a new version ZIP with the plugin component set to the new name.
By the way, I noticed the version tagged as v3.0-r4 in your github repository still has the -r3 in the version.php and that was changed after tagging in additional commit. It seems it would be easiest to change the release name in version.php to v3.0-r5, tag the latest version as v3.0-r5 and upload it as a new ZIP here.
With regard to the previous comments, thanks both Dan and Ivan for useful feedback.The new component (frankenstyle) name looks better and has less chances for collisions (even though I would not expect multiple SAML auth plugins installed at once are something common).
Normally we would shut this plugin record down and would ask you to submit a new one (as technically they are two distinct plugins). I'll try to change the frankenstyle directly in the database and will let you know.