2 years ago

#48121

test-img

juan

Infinite loop redirects when I do login with saml

after I've readed all the theads with possible solutions, no one has worked for me.

I have installed the simplesamlphp library with composer and I have configured the vhost of this application in this way:

<VirtualHost *:80>
    ServerName local.myapp.domain.org
    Redirect permanent / https://local.myapp.domain.org/
</VirtualHost>
<VirtualHost *:443>
    DocumentRoot "C:\xampp\htdocs\local.myapp.domain.org"
    ServerName local.myapp.domain.org
    SSLEngine on 
    SSLCertificateFile "conf/ssl.crt/server.crt" 
    SSLCertificateKeyFile "conf/ssl.key/server.key"
    # URL del backend web
    SetEnv BACKEND_URL https://local.myapp.domain.org/
    SetEnv SIMPLESAMLPHP_CONFIG_DIR "C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\config"
    Alias /simplesamlphp C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\www
    <Directory C:\xampp\htdocs\local.myapp.domain.org\vendor\simplesamlphp\simplesamlphp\www>
        Require all granted
    </Directory>

</VirtualHost>

Domain local.myapp.domain.org is configured as a hosts in my computer.

I've downloaded the metadata of my Idp (SAP successfactors), I've converted with the tool of simplesamlphp and I've pasted the resultant array in the file saml20-idp-remote.php.

Later, I have asked the administrator of my Idp to record my metadata in his Idp, obtained from here

ldp obtained

When I test the authentication source from simplesamlphp,It asks me for the credentials in the login screen of the Idp and it works perfect.

auth test

Then, I've implemented a simple login test in my app like this.

$as = new \SimpleSAML\Auth\Simple('default-sp');
$as->requireAuth();
$attributes = $as->getAttributes();
print_r($attributes);

Then when I execute that code, I am redirected to the login screen of my Idp, asking for my credentials, I enter them, and it constantly loops on the screen of my Idp saml.

login loop

My config.php of simplesamlphp

<?php

$config = [

    'baseurlpath' => 'simplesamlphp/',
    'certdir' => 'cert/',
    'loggingdir' => 'log/',
    'datadir' => 'data/',
    'tempdir' => '/tmp/simplesaml',
    'technicalcontact_name' => 'Administrator',
    'technicalcontact_email' => 'na@example.org',
    'timezone' => 'Europe/Madrid',
    'secretsalt' => 'f343434535',
    'auth.adminpassword' => '123',
    'admin.protectindexpage' => false,
    'admin.protectmetadata' => false,
    'admin.checkforupdates' => true,
    'trusted.url.domains' => [],
    'trusted.url.regex' => false,
    'enable.http_post' => false,
    'assertion.allowed_clock_skew' => 180,
    'debug' => [
        'saml' => false,
        'backtraces' => true,
        'validatexml' => false,
    ],
    'showerrors' => true,
    'errorreporting' => true,
    'logging.level' => SimpleSAML\Logger::NOTICE,
    'logging.handler' => 'syslog',
    'logging.facility' => defined('LOG_LOCAL5') ? constant('LOG_LOCAL5') : LOG_USER,
    'logging.processname' => 'simplesamlphp',
    'logging.logfile' => 'simplesamlphp.log',
    'statistics.out' => [
    ],
    'proxy' => null,

    'database.dsn' => 'mysql:host=localhost;dbname=saml',

    
    'database.username' => 'simplesamlphp',
    'database.password' => 'secret',
    'database.options' => [],

    'database.prefix' => '',

    
    'database.driver_options' => [],

    'database.persistent' => false,

    'database.slaves' => [
        
    ],


    'enable.saml20-idp' => false,
    'enable.shib13-idp' => false,
    'enable.adfs-idp' => false,
    'shib13.signresponse' => true,
     'module.enable' => [
         'exampleauth' => false,
         'core' => true,
         'saml' => true
     ],
    'session.duration' => 8 * (60 * 60), // 8 hours.
    'session.datastore.timeout' => (4 * 60 * 60), // 4 hours
    'session.state.timeout' => (60 * 60), // 1 hour
    'session.cookie.name' => 'SimpleSAMLSessionID',
    'session.cookie.lifetime' => 0,
    'session.cookie.path' => '/',
    'session.cookie.domain' => null,
    'session.cookie.secure' => true,
    'session.cookie.samesite' => \SimpleSAML\Utils\HTTP::canSetSameSiteNone() ? 'None' : null,
    'session.phpsession.cookiename' => 'SimpleSAML',
    'session.phpsession.savepath' => null,
    'session.phpsession.httponly' => true,
    'session.authtoken.cookiename' => 'SimpleSAMLAuthToken',
    'session.rememberme.enable' => false,
    'session.rememberme.checked' => false,
    'session.rememberme.lifetime' => (14 * 86400),
    'memcache_store.servers' => [
        [
            ['hostname' => 'localhost'],
        ],
    ],
    'memcache_store.prefix' => '',
    'memcache_store.expires' => 36 * (60 * 60), // 36 hours.
    'language' => [
        'priorities' => [
            'no' => ['nb', 'nn', 'en', 'se'],
            'nb' => ['no', 'nn', 'en', 'se'],
            'nn' => ['no', 'nb', 'en', 'se'],
            'se' => ['nb', 'no', 'nn', 'en'],
            'nr' => ['zu', 'en'],
            'nd' => ['zu', 'en'],
            'tw' => ['st', 'en'],
            'nso' => ['st', 'en'],
        ],
    ],
    'language.available' => [
        'en', 'no', 'nn', 'se', 'da', 'de', 'sv', 'fi', 'es', 'ca', 'fr', 'it', 'nl', 'lb',
        'cs', 'sl', 'lt', 'hr', 'hu', 'pl', 'pt', 'pt-br', 'tr', 'ja', 'zh', 'zh-tw', 'ru',
        'et', 'he', 'id', 'sr', 'lv', 'ro', 'eu', 'el', 'af', 'zu', 'xh', 'st',
    ],
    'language.rtl' => ['ar', 'dv', 'fa', 'ur', 'he'],
    'language.default' => 'en',
    'language.parameter.name' => 'language',
    'language.parameter.setcookie' => true,
    'language.cookie.name' => 'language',
    'language.cookie.domain' => null,
    'language.cookie.path' => '/',
    'language.cookie.secure' => true,
    'language.cookie.httponly' => false,
    'language.cookie.lifetime' => (60 * 60 * 24 * 900),
    'language.cookie.samesite' => \SimpleSAML\Utils\HTTP::canSetSameSiteNone() ? 'None' : null,
    'attributes.extradictionary' => null,
    'theme.use' => 'default',
    'template.auto_reload' => false,
    'production' => true,
    'assets' => [
        'caching' => [
            'max_age' => 86400,
            'etag' => false,
        ],
    ],
    'idpdisco.enableremember' => true,
    'idpdisco.rememberchecked' => true,
    'idpdisco.validate' => true,
    'idpdisco.extDiscoveryStorage' => null,
    'idpdisco.layout' => 'dropdown',
    'authproc.idp' => [
        30 => 'core:LanguageAdaptor',

        45 => [
            'class'         => 'core:StatisticsWithAttribute',
            'attributename' => 'realm',
            'type'          => 'saml20-idp-SSO',
        ],
        50 => 'core:AttributeLimit',
        99 => 'core:LanguageAdaptor',
    ],

    'authproc.sp' => [
        90 => 'core:LanguageAdaptor',
    ],
    'metadatadir' => 'metadata',
    'metadata.sources' => [
        ['type' => 'flatfile'],
    ],
    'metadata.sign.enable' => false,
    'metadata.sign.privatekey' => null,
    'metadata.sign.privatekey_pass' => null,
    'metadata.sign.certificate' => null,
    'store.type'                    => 'phpsession',
    'store.sql.dsn'                 => 'sqlite:/path/to/sqlitedatabase.sq3',
    'store.sql.username' => null,
    'store.sql.password' => null,
    'store.sql.prefix' => 'SimpleSAMLphp',
    'store.redis.host' => 'localhost',
    'store.redis.port' => 6379,
    'store.redis.prefix' => 'SimpleSAMLphp',
];

On the simpleamlphp test screen it works fine, but when I try to integrate it into a controller of my application with codeigniter, it doesn't work, it starts a redirect loop.

I've been reading multiple possible solutions, it seems like it is a cookie setting problem in simplesaml, but I'm not sure.

Update: I've tried to change the store type from phpsession to sql, as explained here https://koas.dev/simplesamlphp-como-resolver-el-error-could-not-load-state-specified-by-inresponseto-nostate-processing-response-as-unsolicited/ and it has worked perfect, but with php session still no working.

php

saml

simplesamlphp

0 Answers

Your Answer

Accepted video resources