2 years ago
#48121
juan
Infinite loop redirects when I do login with saml
after I've readed all the theads with possible solutions, no one has worked for me.
I have installed the simplesamlphp library with composer and I have configured the vhost of this application in this way:
<VirtualHost *:80>
ServerName local.myapp.domain.org
Redirect permanent / https://local.myapp.domain.org/
</VirtualHost>
<VirtualHost *:443>
DocumentRoot "C:\xampp\htdocs\local.myapp.domain.org"
ServerName local.myapp.domain.org
SSLEngine on
SSLCertificateFile "conf/ssl.crt/server.crt"
SSLCertificateKeyFile "conf/ssl.key/server.key"
# URL del backend web
SetEnv BACKEND_URL https://local.myapp.domain.org/
SetEnv SIMPLESAMLPHP_CONFIG_DIR "C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\config"
Alias /simplesamlphp C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\www
<Directory C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\www>
Require all granted
</Directory>
</VirtualHost>
Domain local.myapp.domain.org is configured as a hosts in my computer.
I've downloaded the metadata of my Idp (SAP successfactors), I've converted with the tool of simplesamlphp and I've pasted the resultant array in the file saml20-idp-remote.php.
Later, I have asked the administrator of my Idp to record my metadata in his Idp, obtained from here
When I test the authentication source from simplesamlphp,It asks me for the credentials in the login screen of the Idp and it works perfect.
Then, I've implemented a simple login test in my app like this.
$as = new \SimpleSAML\Auth\Simple('default-sp');
$as->requireAuth();
$attributes = $as->getAttributes();
print_r($attributes);
Then when I execute that code, I am redirected to the login screen of my Idp, asking for my credentials, I enter them, and it constantly loops on the screen of my Idp saml.
My config.php of simplesamlphp
<?php
$config = [
'baseurlpath' => 'simplesamlphp/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.org',
'timezone' => 'Europe/Madrid',
'secretsalt' => 'f343434535',
'auth.adminpassword' => '123',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'admin.checkforupdates' => true,
'trusted.url.domains' => [],
'trusted.url.regex' => false,
'enable.http_post' => false,
'assertion.allowed_clock_skew' => 180,
'debug' => [
'saml' => false,
'backtraces' => true,
'validatexml' => false,
],
'showerrors' => true,
'errorreporting' => true,
'logging.level' => SimpleSAML\Logger::NOTICE,
'logging.handler' => 'syslog',
'logging.facility' => defined('LOG_LOCAL5') ? constant('LOG_LOCAL5') : LOG_USER,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [
],
'proxy' => null,
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.options' => [],
'database.prefix' => '',
'database.driver_options' => [],
'database.persistent' => false,
'database.slaves' => [
],
'enable.saml20-idp' => false,
'enable.shib13-idp' => false,
'enable.adfs-idp' => false,
'shib13.signresponse' => true,
'module.enable' => [
'exampleauth' => false,
'core' => true,
'saml' => true
],
'session.duration' => 8 * (60 * 60), // 8 hours.
'session.datastore.timeout' => (4 * 60 * 60), // 4 hours
'session.state.timeout' => (60 * 60), // 1 hour
'session.cookie.name' => 'SimpleSAMLSessionID',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => null,
'session.cookie.secure' => true,
'session.cookie.samesite' => \SimpleSAML\Utils\HTTP::canSetSameSiteNone() ? 'None' : null,
'session.phpsession.cookiename' => 'SimpleSAML',
'session.phpsession.savepath' => null,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthToken',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => (14 * 86400),
'memcache_store.servers' => [
[
['hostname' => 'localhost'],
],
],
'memcache_store.prefix' => '',
'memcache_store.expires' => 36 * (60 * 60), // 36 hours.
'language' => [
'priorities' => [
'no' => ['nb', 'nn', 'en', 'se'],
'nb' => ['no', 'nn', 'en', 'se'],
'nn' => ['no', 'nb', 'en', 'se'],
'se' => ['nb', 'no', 'nn', 'en'],
'nr' => ['zu', 'en'],
'nd' => ['zu', 'en'],
'tw' => ['st', 'en'],
'nso' => ['st', 'en'],
],
],
'language.available' => [
'en', 'no', 'nn', 'se', 'da', 'de', 'sv', 'fi', 'es', 'ca', 'fr', 'it', 'nl', 'lb',
'cs', 'sl', 'lt', 'hr', 'hu', 'pl', 'pt', 'pt-br', 'tr', 'ja', 'zh', 'zh-tw', 'ru',
'et', 'he', 'id', 'sr', 'lv', 'ro', 'eu', 'el', 'af', 'zu', 'xh', 'st',
],
'language.rtl' => ['ar', 'dv', 'fa', 'ur', 'he'],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => null,
'language.cookie.path' => '/',
'language.cookie.secure' => true,
'language.cookie.httponly' => false,
'language.cookie.lifetime' => (60 * 60 * 24 * 900),
'language.cookie.samesite' => \SimpleSAML\Utils\HTTP::canSetSameSiteNone() ? 'None' : null,
'attributes.extradictionary' => null,
'theme.use' => 'default',
'template.auto_reload' => false,
'production' => true,
'assets' => [
'caching' => [
'max_age' => 86400,
'etag' => false,
],
],
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => null,
'idpdisco.layout' => 'dropdown',
'authproc.idp' => [
30 => 'core:LanguageAdaptor',
45 => [
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' => [
90 => 'core:LanguageAdaptor',
],
'metadatadir' => 'metadata',
'metadata.sources' => [
['type' => 'flatfile'],
],
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => null,
'metadata.sign.privatekey_pass' => null,
'metadata.sign.certificate' => null,
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => null,
'store.sql.password' => null,
'store.sql.prefix' => 'SimpleSAMLphp',
'store.redis.host' => 'localhost',
'store.redis.port' => 6379,
'store.redis.prefix' => 'SimpleSAMLphp',
];
On the simpleamlphp test screen it works fine, but when I try to integrate it into a controller of my application with codeigniter, it doesn't work, it starts a redirect loop.
I've been reading multiple possible solutions, it seems like it is a cookie setting problem in simplesaml, but I'm not sure.
Update: I've tried to change the store type from phpsession to sql, as explained here https://koas.dev/simplesamlphp-como-resolver-el-error-could-not-load-state-specified-by-inresponseto-nostate-processing-response-as-unsolicited/ and it has worked perfect, but with php session still no working.
php
saml
simplesamlphp
0 Answers
Your Answer