SimpleSamlPhP SSO

SimpleSamlPhP SSO

by callum Wood -
Number of replies: 3

I'm trying to implement the auth_saml2sso plugin using IdP initiated SSO.  (https://moodle.org/plugins/auth_saml2sso)

1. The user logs into the IdP and selects the moodle button

2. The user is redirected to: https://MyMoodle.com/simplesaml/module.php/saml/sp/saml2-acs.php/myMoodle.comSpName along with some POST data and successfully authenticates. 

3. The relay state then sends the user back to Moodle (this works up to this point)

4. The user then is redirected to the following URL: https://MyMoodle.com.com/simplesaml/module.php/saml/sp/discoresp.php?AuthID=_fksandfknsdfk;lnasdf;klnaskdlfna;sfdknsdfhttps%3A%2F%2FMyMoodle.com%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Ddefault-sp%26ReturnTo%3Dhttps%253A%252F%252FMyMoodle.com%252Flogin%252Findex.php&idpentityid=EntityIDName

4. When the user hits the Moodle page they are redirected to the "SingleSignOnService Location = 'http://doesnotexist.com' " which is contained in the IdP metadata.

I can see that the user is successfully getting authenticated with simplesamlphp but is not getting redirected and logged in to moodle, they are instead getting redirected to http://doesnotexist.com  The SingleSignOnService should be ignored as the user has already been authenticated and they should be logged into moodle. So the set up with SimpleSaml is working correctly however Moodle/the plugin is not handling this as expected.

Any help would be appreciated.

Thanks 




Average of ratings: -
In reply to callum Wood

Re: SimpleSamlPhP SSO

by Alain Raap -
Picture of Particularly helpful Moodlers

Hi Callum,

I experience the same problem, authentication succeeds (I see in Debug logging), but the redirect doesn't work. The SimpleSamlPHP login page is cleared and I see several errors after the login with this message: Session: 'session-name' not valid because we are not authenticated.
 Did you get it working in the meantime or anyone else who experienced the same problem?

Average of ratings: -
In reply to Alain Raap

Re: SimpleSamlPhP SSO

by Alain Raap -
Picture of Particularly helpful Moodlers

The redirect was not working because I didn't use redis as store.type. With 'phpsession' as store.type in config.php of SimpleSAMLPHP, my session was lost immediately after successful authentication. After installation of the predis client I managed to login into Moodle via the IDP (SimpleSAMLPHP with LDAP configured as provider).

Average of ratings: -
In reply to Alain Raap

Re: SimpleSamlPhP SSO

by Susan Mangan -

We are having similar issues with the logout piece.  We don't have Redis installed but we do use memcache.  I'm not a developer so I'm not sure if I can simply configure the saml2 store to use memcache instead?

Average of ratings: -