Maintained by Picture of Sixto Martin GarciaSixto Martin Garcia
SAML Authentication plugin based on the simplesamlphp software. (Also install the SAML Enrolment plugin if you want auto-enrol based on SAML)
542 sites
21 fans
Current versions available: 4


Donations are welcome to support the development of the plugin.

Moodle's SAML PluginMoodle's SAML Plugin


  • Mark Stewart - Moodle Administrator in New Zealand

Info of the plugin

This plugin add SAML authentication support to Moodle.
If you need auto-enrol based on SAML you need to install the SAML Enrolment Plugin too.


Install in the same machine a simpleSAMLphp instance and configure it as a Service Provider

Install Instruction
1. Unpack this saml directory into the /auth/ directory as you would for any Moodle auth module (

2. Login to Moodle as an administrator, and activate the module by navigating
Site administration->Plugins->Manage authentication->SAML Authentication

3. Let priivileges to the server user to write over the auth/saml/saml_config.php file.

After the installation we must configure the saml plugin, so go to "Settings" if you are in
"Manage Authentication" page, or you can also go to Users > Authentication > SAML Authentication. These are the fields of this form:

  • simpleSAMLphp Path: it will not work unless you specify the saml library path. This refers to the library path for the simpleSAMLphp environment you want to use. For example: /var/simplesamlphp/lib
  • SimpleSAMLphp SP source. Select the SP source you want to connect to moodle. (Sources are at the SP of simpleSAMLphp in /config/authsources.php).
  • SAML username mapping: it is a SAML attribute that will be mapped to the Moodle username. By default, this attribute will be set to 'mail'.
  • Single Log out: Enable/disable the single logout. This will log out you from moodle, identity provider and all conected service providers 
  • SAML Image: when you enable the SAML authentication plugin, a new button will be shown in the login Moodle page that allows to authenticate via SAML. By default, the simpleSAMLphp image (something like a fish) will be shown, but you can specify another one you want to use. Note: this image needs to exist in the server as it is not possible to upload an image through the form right now. 
  • SAML login description: you can also specify a description text for the previous button. This description will be shown below the SAML image in the login Moodle page.
  • Log file path: this is the absolute path of a file where the plugin will log information about its actions. It is optional.
  • Hook file path: this is the absolute path of a file with php functions that will be called to alter the default behaviour of this plugin. See the file custom_hook.php for more information.
  • SAML support Courses: this select has three options:
    • No suport (default value): the plugin will not have support for enrolling the user into courses automatically
    • Internal: the plugin will use an internal database table to map the courses in the next field with Moodle courses 
    • External: the plugin will use a tabla in an external database to map the courses in the next field with Moodle courses.
  • SAML courses mapping: it is a SAML attribute that is mapped to Moodle courses data. By default, it is set to 'schacUserStatus'.
  • Field used to identify a course: this can be the Short Name or the Number ID and referes to the Moodle field used to identify a course during the matching phase of the plugin.
  • Ignore inactive courses: if this field is checked the user will stay in previous enrolled courses even if the status of the course is inactive in the SAML attribute. 
  • Data Mapping section:  The Identity Provider (IdP) provides some user's data such as the first name, surname, email address, etc. In this section, you can specify the correspondence with the same data in Moodle. By default, the configuration is set as is shown below: First name = cn Surname = sn Email Address = mail
  • Course Mapping section: The course mapping section allows the administrator to link saml courses and moodle courses. To make it working we need to create an intermediate database on where we can store this data. This database will have the following internal structure:
    Field Type  Null   Key  Default    Extra
    course_mapping_id int(11)   NO   PRI   NULL  auto_increment
    saml_course_id    varchar(20)  NO    NULL  
     saml_course_period  int(4)  NO    NULL  
     lms_course_id  text  NO    NULL  

    Once we already have created the database, we need to specify the DSN (Data Source Name) that has the following syntax: 
    • MySQL
    • SQLite
    • PostgresSQL
  • Below the database DSN field we can start introducing course mappings between Moodle and SAML courses. No field can be null, if you try to introduce a null course mapping, this data will be ignored and it will not be saved in the database. If you try to introduce a duplicate course mapping this data will not be saved in the database and you will be redirected to the form showing an error. If you want to delete a course mapping you must only check the corresponding checkbox to the left and clicking to 'delete' button. Also, you can update the previous introduced course mappings in every moment if the new data doesn't conflicts with none of the previous course mappings. Is possible to introduce several course mappings at the same time, you can add a new row by clicking in '+' button to the right. It no errors happen while introducing the course mappings, you will be redirected to the 'Manage Authentication' page as with any other field of the form.
In order to support course enrolling you must install the SAML Enrolment plugin, otherwise set SAML support Courses to 'no support'. 

Internal Changes
The 'config.html' file was renamed to 'config.php' because it now has PHP code. - Two new files was created in SAML plugin directory: - 'courses.php': this file contains the needed PHP code for showing the new 'Course mapping' table. - 'DBNewDatabase.php': this file contains a tiny function for creating a database connection, because it seems there is a bug when you try to open a SQLite database connection using a DSN.

In 'auth.php' we have used 'validate_form' for validating the form and store the errors, and 'process_config' for saving the data into the database if there are no errors. Also, 'sync_roles' function have been modified for mapping roles and courses.

These changes are tested and valid for simpleSAMLphp >= 1.7

Important for enrollment!!

This plugin suppose that the IdP send the courses data of the user in a attribute that can be configured but the pattern of the expected data is always

You can change this pattern editing the file auth/saml/course_mapping.php

Default pattern is:  <country> : <domain> : <courseId> : <period> : <role> : <status>
status could be 'active' or 'inactive',
courseId, period and role depends on the configuration of the mapping.

And you may prefix it with the urn of your attribute. The default vaulue for carry course data is shacUserStatus so you may prefix the prevous string with the related urn

If you use other attribute than shacUserStatus or you want to change the fortmat of the course data you may edit the course_mapping.php file



Problems with the login view

SAML auth plugin rewirte the login view I had to copy some code of the login/index.php view and made some changes. If you find problems on the login view, you can disable the "login view replacement". Edit the auth/saml/auth.php, at the the loginpage_hoook funcion, disable the following code:
        if (empty($CFG->alternateloginurl)) {
            $CFG->alternateloginurl = $CFG->wwwroot.'/auth/saml/login.php';

Then edit the login/index_form.html and insert before:


<h2><?php print_string("returningtosite") ?></h2> 


the following code

Who is using SAML plugin?


Screenshot #0
Screenshot #1
Screenshot #2
Screenshot #3


Picture of Sixto Martin Garcia
Sixto Martin Garcia (Lead maintainer)
Please login to view contributors details and/or to contact them

Comments RSS


  • Picture of Stephen Harvey
    Mon, Jan 25, 2016, 10:36 PM

    Has anyone tried the current version (2.9) with Moodle 3.0+ ?

    Also do we know if this plugin will be updated to work with Moodle 3:0+, if so is there a timescale?
  • Picture of Sixto Martin Garcia
    Wed, Jan 27, 2016, 1:06 AM
    Currently I'm not able to maintain properly this plugin, so a new release compatible with Moodle 3.0+ is not expected.

    Understand that I'm the unique contributor of that plugin since 2011 and maintain it take a lot of my spare time. I receive 5-10 messages per month requesting SAML support. There are at least 660 sites using this Moodle's SAML extension, but no one donated, kinda sad.

    If some php programmer/moodle guru interested, I can teach him how the plugin works and make him contributor.
  • Picture of Andreas Figge
    Thu, Feb 18, 2016, 9:01 PM
    This Plugin actually works with Moodle 3.0+ all you have to do is to add the line

    $plugin->component = 'auth_saml';

    to version.php
  • Picture of Olumuyiwa Taiwo
    Thu, Mar 3, 2016, 9:34 PM
    @Sixto, How do I become a contributor for this plugin? I've used it for a client so I have a fairly good idea how it works.
  • Picture of Sixto Martin Garcia
    Thu, Mar 3, 2016, 11:18 PM
    @Olumuyiwa There is a repository , you can contribute there.
  • Picture of Sam Lewis
    Fri, Apr 1, 2016, 12:42 AM
    How do I get Moodle to logout when SimpleSAMLphp receives a LogoutRequest from the IdP?
  • Picture of Simon Harbinson
    Wed, Jun 22, 2016, 10:58 PM
    Hi Can some one confirm this for me, we are running version = 2015072901, on a 3.0 Moodle I trying to get User Data mappings working. I see in the Auth.php following

    $fields = array("firstname", "lastname", "email", "phone1", "phone2",
    "department", "address", "city", "country", "description",
    "idnumber", "lang", "guid");

    I assume that these are these fields correspond to the User Data Mapping section in the SAML config in Moodle.

    I have set these but they are not working, is the function currently working. or.....

    Thanks SImon

  • Picture of Sixto Martin Garcia
    Mon, Dec 26, 2016, 10:51 PM
    The plugin is now compatible with Moodle 3.0
  • Picture of Sixto Martin Garcia
    Fri, Jan 20, 2017, 5:00 PM
    When upgrading to the last release (19-01-2017) you can experience an issue. The previous version had a wrong version number so moodle will think that the new version is old.

    In order to fix that, before install the new version you may make a change on your moodle's database. If your database prefix is mdl_ execute:
    UPDATE mdl_config_plugins SET value = '2016111801' WHERE name = 'version' AND plugin = 'auth_saml';

  • Picture of Malcolm Allison
    Tue, Feb 7, 2017, 10:52 AM
    Hi, I am having a problem that I'm not sure if it's this module or SimpleSAML that is causing the issue. I have the module installed and working with Firefox, Chrome and Edge, but in IE, instead of redirecting to the ADFS server's login page, I get a small popup window asking for credentials. This then fails to login properly. From poking around it seems I need to tell the application to use Forms Based Authentication rather than Windows Integrated Authentication. In other applications I have used there is a tickbox somewhere in the config to do this, but I can't find one for this module, or figure out where I could put a setting for this in the config.

    Is there a setting in the module I can change for this?
  • Picture of Olumuyiwa Taiwo
    Tue, Feb 7, 2017, 12:41 PM
    @Malcolm AllisonTue, 7 Feb 2017, 1:52 PM

    Based on your description, this would appear to be a Windows/IE issue. A quick Google search brought up the following links which may be helpful:
  • Picture of Hen Hohen
    Tue, Jun 6, 2017, 1:37 AM

    I want to install th plugin on my site but I have version 3.3.
    I want to ask if there is a release date for the plugin to this version, and when is it?

    Thanks in advance smile
  • Picture of Kitti Lai
    Tue, Jul 25, 2017, 11:32 PM
    Hi and thanks for maintaining the SAML Authentication plugin.
    We have been suggested to use this plugin for SSO implementation, but the issue is we are unsure whether of this plugin will support or work properly with 3.3 or not.
    May I ask if its known or anyone else is using this plugin with the latest version (3.3.)? Many thanks in advance!
  • Picture of Sixto Martin Garcia
    Tue, Jul 25, 2017, 11:51 PM
    Moodle 3.3 introduces a new way to manage settings, instead the old config.html now the new admin settings API need to be used.
    Will take time to adapt the SAML plugin to this new environment. I can't provide right now an ETA, but I will try to get something working at the end of August.
    Read more at:

    Now that a re-write is required, I also I plan to fix the code style errors detected by the code prechecks:
  • Picture of Bobby Siegfried
    Thu, Dec 21, 2017, 12:12 AM
    Hi! Thank you for maintaining this module! I'm just curious if there is any update regarding a 3.3 release. I'm happy to help test. Thank you!
Please login to post comments