SAML2 Single sign on

Authentication ::: auth_saml2
Maintained by Catalyst IT, Brendan Heywood, Rossco Hellmans
SAML done 100% in moodle, fast, simple, secure
Latest release:
1798 sites
1k downloads
67 fans
Moodle 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5

What is this?

This plugin does authentication, user auto creation with field mapping.

Why is it better?

  • 100% configured in the Moodle GUI - no installation of a whole separate app, and no touching of config files or generating certificates.
  • Minimal configuration needed, in most cases just copy the IdP metadata in and then give the SP metadata to your IdP admin and that's it.
  • Fast! - 3 redirects instead of 7
  • Supports back channel Single Logout which most big organisations require (unlike OneLogin)

How does it work?

It completely embeds a SimpleSamlPHP instance as an internal dependancy which is dynamically configured the way it should be and inherits almost all of it's configuration from Moodle configuration. In the future we should be able to swap to a different internal SAML implementation and the plugin GUI shouldn't need to change at all.

Features

  • Dual login VS forced login for all as an option, with ?saml=off on the login page for manual accounts, and ?saml=on supported everywhere to deep link and force login via saml if dual auth is on.
  • SAML attributes to Moodle user field mapping
  • Automatic certificate creation
  • Optionally auto create users

Features not yet implemented:

  • Enrolment - this should be an enrol plugin and not in an auth plugin
  • Role mapping - not yet implemented

Installation

1) Install the plugin the same as any standard moodle plugin either via the Moodle plugin directory, or you can use git to clone it into your source:

git clone git@github.com:catalyst/moodle-auth_saml2.git auth/saml2

2) Then run the Moodle upgrade 3) If your IdP has a publicly available XML descriptor, copy this url into the SAML2 auth config settings page 4) If your IdP requires whitelisting each SP then in the settings page is links to download the XML, or you can provide that url to your IdP administrator.

For most simple setups this is enough to get authentication working, there are many more settings to define how to handle new accounts, dual authentication, and to easily debug the plugin if things are not working.

If you have issues please log them in github here:

https://github.com/catalyst/moodle-auth_saml2/issues

Or if you want paid support please contact Catalyst IT Australia:

https://www.catalyst-au.net/contact-us

Testing

This plugin has been tested against:

  • SimpleSamlPHP set up as an IdP
  • openidp.feide.no
  • testshib.org
  • An AAF instance of Shibboleth

Other SAML plugins

The diversity and variable quality and features of SAML Moodle plugins is a reflection of a great need for a solid SAML plugin, but the neglect to do it properly in core. SAML2 is by far the most robust and supported protocol across the internet and should be fully integrated into moodle core as both a Service Provider and as an Identity Provider, and without any external dependencies to manage.

Here is a quick run down of the alternatives:

Core:

  • /auth/shibboleth - This requires a separately installed and configured Shibbolleth install

One big issue with this, and the category below, is as there is a whole extra application between moodle and the IdP, so the login and logout processes have more latency due to extra redirects. Latency on potentially slow mobile networks is by far the biggest bottle neck for login speed and the biggest complaint by end users in our experience.

Plugins that require SimpleSamlPHP

These are all forks of each other, and unfortunately have diverged quite early or have no common git history making it difficult to cross port features or fixes between them.

Plugins which embed a SAML client lib:

These are generally much easier to manage and configure as they are standalone.

  • https://moodle.org/plugins/view/auth_onelogin_saml - This one uses it's own embedded saml library which is great and promising, however it doesn't support 'back channel logout' which is critical for security in any large organisation.

  • This plugin, with an embedded and dynamically configured SimpleSamlPHP instance under the hood

Warm thanks

Thanks to the various authors and contributors to the other plugins above.

Thanks to LaTrobe university in Melbourne for sponsoring the initial creation of this plugin:

http://www.latrobe.edu.au

LaTrobe

Thanks to Centre de gestion informatique de l’éducation in Luxembourg for sponsoring the user autocreation and field mapping work:

http://www.cgie.lu

CGIE

This plugin was developed by Catalyst IT Australia:

https://www.catalyst-au.net/

Catalyst IT


Screenshots

Screenshot #0

Contributors

Catalyst IT (Lead maintainer)
Brendan Heywood: Solutions Architect
Rossco Hellmans: Developer
Adam Riddell: Developer
Daniel Thee Roperto: Developer
kristian r: Developer
Please login to view contributors details and/or to contact them

Comments RSS

Show comments
  • Tue, Jul 28, 2020, 2:36 AM
    Trying to install from the UI Gets stuck here:
    Install plugin from ZIP file
    Validating auth_saml2 ...
    We are running Moodle 3.9.1 (Build: 20200713)
  • Tue, Sep 15, 2020, 4:05 PM
    It seems this plugin destroys some of the features of the underlying SimpleSamlphp lib.
    Like changing the value of an attribute with the AttrubuteAlter filter.
    Where do you put extra authproc filters to change the value of an attribute?
  • Fri, Oct 30, 2020, 3:08 AM
    Still cannot get this installed. this gets stuck on validating during the install process.
  • Fri, Oct 30, 2020, 8:44 PM
    Solved my issue. for those who get stuck on validating. Try editing your PHP ini file to extend the execution time. it was set to 30 we set it to 120 which I realize is a lifetime, but that did the trick.
  • Fri, Nov 6, 2020, 9:03 AM
    Hello,
    I don't understand if this plugin makes Moodle an Identity Provider (use Moodle users database to connect to other websites) or Service Provider (connect to Moodle from another users database) ?
  • Fri, Nov 6, 2020, 10:06 PM
    In response to Ludo M 6 nov 2020, it makes Moodle as a Service Provider.
  • Wed, Nov 11, 2020, 7:56 PM
    Hello,
    Are there any plans to provide support for the newer moodle versions, since currently is available until 3.7?
    Thanks
  • Tue, Nov 17, 2020, 12:56 AM
    I would also like to know if this plug-in will work with versions' 3.8 and 3.9, specifically 3.9. We have been using SAML2 plug-in for a while but need to upgrade asap since 3.7 end-of-life is near. Thanks!
  • Fri, Nov 27, 2020, 4:40 AM
    I am also curious to see if this module will get official support for 3.8 and 3.9. We are on 3.5 which is approaching end of life and are looking to upgrade very soon.
  • Wazza
    Fri, Jan 29, 2021, 4:58 PM
    We currently have the problem that the URL is stripped after the sign #
    So if someone who is not yet logged in tries to go to https://school.moodledemo.net/course/view.php?id=62#section-3 he will end up at https://school.moodledemo.net/course/view.php?id=62

    Strangely, it does work with https://school.moodledemo.net/course/view.php?id=62%23section-3 so it has to do with the # sign. Did we miss a setting somewhere?
  • Sat, Mar 20, 2021, 8:57 PM
    hello,

    thanks for this plugin.

    user created with saml auth can't change moodle password in profil. how can I configure moodle to permit to user to add or change moodle password ?

    thanks.
  • Thu, Apr 29, 2021, 6:09 PM
    Hi,
    After an upgrade to Moodle 3.9.6, (also the SAML2 plugin upgraded) logging in via SAML is working fine but no new users are created, although it was working fine before the upgrade.
    Checked every settings, seems to be fine but it just not happening, new users get the message "You are logged in to your identity provider however, this account has limited access to Moodle, please contact your administrator for more details"
    Do you know what I should check?
    Thanks
    Csaba
  • Sat, May 22, 2021, 6:38 PM
    Thank you, Kyle Sellers, for your solution posted in October 2020. Increasing the max_execution value in php.ini did the trick.
  • Tue, Jun 8, 2021, 6:10 PM
    Hi,
    I have installed the SAML2 plugin in moodle and tried to integrate with the okta. But the IdP was not recognized on doing the test settings and an exception - "Exception - Could not find the metadata of an IdP with entity ID and some junk Id" is thrown. This was in https environment. In http environment the integration was successful.

    Kindly help with this issue.
    Thank you
  • Wed, Jun 9, 2021, 3:59 PM
    Re my question about user creation and the error message "You are logged in to your identity provider however, this account has limited access to Moodle, please contact your administrator for more details" as it turned out it was caused by an entry in the allowed domains field. Removing it solved the problem.
1 2 3 4 5 6 7 8 9 10 11 12 13 14
Please login to post comments