SAML SSO authentication doesn't work as SimpleSAMLphp generates non-existent AssertionConsumerServiceURL

[Yaju Mahida]

Wrong AssertionConsumerServiceURL is genereated in SAML2-AuthRequest.

Mahara 16.10.3 and CentOS Linux release 7.2

Since 16.10.x release, the SimpleSAMLphp library is included as a managed dependency with the Mahara codebase.

We noticed that before sending an AuthRequest to an IDP, it generates wrong AssertionConsumerServiceURL behaving like it is hosted separately with Mahara which ends up in SSO failure.

In our case, it generates https://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp
instead of https://localhost/auth/saml/sp/saml2-acs.php/default-sp.

We tracked down that it is generated using 'baseurlpath' => 'simplesaml/' defined in htdocs/auth/saml/config/config.php
and
$ar->setAssertionConsumerServiceURL(SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/' . $this->authId)); defined in htdocs/auth/saml/extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php line 189.

As a workaround, we have hacked the SimpleSAMLphp library for generating correct AssertionConsumerServiceURL which solves this issue.

[Kristina Hoeppner (kris-hoeppner)]

Hi Yaju,

Thanks for that info. Our 16.10 sites do work with the new SAML setup. We'll need to investigate this further.

Cheers
Kristina

[shane (54an3)]

@Yaju Can you share what changes you made to get it working?

[Yaju Mahida (yvm)]

Hi Shane,

We had to fix this on SimpleSAMLphp library (1.14.7) mahara/htdocs/auth/saml/extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php line 189

From
$ar->setAssertionConsumerServiceURL(SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/' . $this->authId));
To
$ar->setAssertionConsumerServiceURL(get_config('wwwroot') . 'auth/saml/sp/saml2-acs.php/' . $this->authId);

We also had log out issues e.g. once a user is logged out from another application (part of SSO) Mahara should also log out but that wasn't the case. SAML session was terminated but not the Mahara session!

And for this issue we had to put $USERlogout(); to mahara/htdocs/auth/saml/sp/saml2-logout.php just before calling SAML logout page require('../extlib/simplesamlphp/modules/saml/www/sp/saml2-logout.php');

Are you experiencing similar issues?

Regards,
Yaju Mahida

[Kristina Hoeppner (kris-hoeppner)]

Tagged it to 17.10 so it stays on our radar to look at since we can't verify it immediately.

[Robert Lyon (robertl-9)]

Looking at the code I suspect its worked for some but not others is due to

public function startSSO($idp, array $state)

in

extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php

where startSSO1 doesn't call the setAssertionConsumerServiceURL() but startSSO2 does

The problem with fixing this is we can't patch the files in extlib/simplesamlphp/ subdir as they are fetched/installed via the make ssphp in the core code

I'll have to check with our saml guru to see if we can workaround this via the saml config file

[shane (54an3)]

@Yaju Yeah, we're having a similar issue on 17.04. Mahara sends the user to our idp to login, but then the idp can't send the user back to mahara because the assertion consumer service URL (simplesaml/module.php/saml/sp/saml2-acs.php/default-sp) is not registered in the metadata.

Thanks for the workaround. I'm trying it out now.

[shane (54an3)]

@Yaju It works! Thanks again!

[Kevin Rickis (rdx565)]

@Yaju Thank you for the workaround. I hit the problem a couple of weeks ago and I wasn't sure where the problem was. Cheers.

[Kristina Hoeppner (kris-hoeppner)]

Hi Yaju,

We made some improvements for Mahara 17.10 in that area, which also allow for ADFS to work. Can you please check the 17.10 code and see if that resolves your problem?

Thank you
Kristina

[Launchpad Janitor (janitor)]

[Expired for Mahara because there has been no activity for 60 days.]

[Yaju Mahida (yvm)]

Hi Kristina,

Just found your message now! We will be working on this next year so not able to confirm this now.

Noticed that this job's status has changed to expired!

Regards,
Yaju Mahida

[Kristina Hoeppner (kris-hoeppner)]

Hi Yaju,

I put it back onto "Incomplete". If you could test the latest 17.10 code please when you get the chance that would be great.

Cheers
Kristina

[Launchpad Janitor (janitor)]

[Expired for Mahara because there has been no activity for 60 days.]

[Yaju Mahida (yvm)]

Hi Kristina,

We are working on the Mahara 18.10.0 upgrade and this is still an issue. We are still using the workaround.

Please, re-open this issue.

Sorry, forgot to comment after the 17.10 testing.

Kind regards,
Yaju Mahida

[Kristina Hoeppner (kris-hoeppner)]

Hi Yaju. Thanks for checking. We'll need to look into it again as I suspect that we still can't change the actual SAML library and need to find a different way of dealing with this issue.