Authentication: SAML2 SSO Auth

Maintained by Picture of Daniel MirandaDaniel Miranda, Picture of AulaWeb Università di GenovaAulaWeb Università di Genova
Authentication using exists SimpleSAMLphp Service Provider
95 sites
9 fans
Current versions available: 4

SAML2 SSO Authentication using exists SimpleSAMLphp Service Provider

You'll need the following pre-requirement:

  • A working SimpleSAMLphp Service Provider (SP) installation ( working means that the metadata from SP must be registered in Identity Provider (IdP). Can be found in /config/authsources.php
  • The absolute path for the SimpleSAMLphp installation on server
  • The authsource name from SP in which your users will authenticate against

There are a couple of related SAML plugins for Moodle. Below are the main diferences between this plugin, named as saml2sso, and the others. 

The key for this plugin is that you can use your exists Service Provider (SP) without need to exchange the metadata with the Identity Provider (IdP) for every new Moodle instances. (for instances in the same host name)

The following options can be set in config:

  • SimpleSAMLphp installation path
  • Dual login (Yes/No) - Can login with manual accounts like admin
  • Single Sign Off (Yes/No) - Should we sign off users from Moodle and IdP?
  • Username mapping - Which attribute from IdP should be used for username
  • Username checking - Where to check if the username exists
  • Auto create users - (Allow create new users)
  • SP source name (generally default-sp in SimpleSAMLphp)
  • Logout URL to redirect users after logout
  • Allow users to edit or not the profile
  • Ability to break the full name from IdP into firstname and lastname

To bypass the authentication and login directly in Moodle (ex.: using admin account), add the saml=off parameter in the URL (ex.: https://my.moodle/login/index.php?saml=off)


Screenshot #0
Screenshot #1


Picture of Daniel Miranda
Daniel Miranda (Lead maintainer)
Picture of AulaWeb Università di Genova
AulaWeb Università di Genova
Please login to view contributors details and/or to contact them

Comments RSS

Show comments
  • Picture of Ketan Ajudiya
    Thu, Jun 7, 2018, 9:07 PM
    sorry forgot to mentioned versions.
    I am on moodle 3.5 and SimpleSAMLphp 1.15.4
  • Picture of Péter Lukács
    Tue, Aug 7, 2018, 2:15 PM
    Problems with the latest 3.5 release. It seems that the release v3.5-r00 is a renamed v3.4-r02 without any modifications. Can you fix it? Thanks.
  • Picture of Rodney Lanuzga
    Wed, Sep 26, 2018, 12:41 AM

    I have some issue with version 3.0 r12.

    The installation and configuration of the plugin went good until i test the SSO login.
    The moment i log in get from simplesaml (version 1.14.4) a state information lost error (SimpleSAML_Error_NoState: NOSTATE).

    When i test the authentication in Simplesaml the authentication and all works just fine.
    Is there a configuration i am missing to find the session when i log in?
  • Picture of Rodney Lanuzga
    Fri, Sep 28, 2018, 9:42 PM

    I have debugged version 3.0 R12 and i found out during several test why there is a no state error.
    The moment you to the it creates a Session ID 123456 and redirects you to the SSO. Afterwards you log in and you will get a No state error, but the reason why this happens is that the session ID after you logged in through the SSO deviates with the Session ID before.

    So i was wondering am i missing a configuration in Simplesaml to complete the authentication process or is this a bug in the plugin?
  • Picture of Alain Raap
    Fri, Dec 21, 2018, 11:13 PM
    Hi Daniel,

    I'm using your plugin for a little POC and saw a message in the error_log of my webserver:

    [Fri Dec 21 16:04:17.688211 2018] [proxy_fcgi:error] [pid 19253] [client ::1:39528] AH01071: Got error 'PHP message: simplesamlphp WARNING [9d864cbda7] The class or interface 'SimpleSAML_Auth_Simple' is now using namespaces, please use 'SimpleSAML\\Auth\\Simple'.\n'

    In your auth.php I changed this and then the warning disappeared from my error_log:

    79 /**
    80 * Load SimpleSAMLphp library autoloader
    81 */
    82 private function getSSPauth() {
    83 require_once $this->config->sp_path . DIRECTORY_SEPARATOR . 'lib' . DIRECTORY_SEPARATOR . '_autoload.php';
    85 //return new SimpleSAML_Auth_Simple($this->config->entityid);
    86 return new \SimpleSAML\Auth\Simple($this->config->entityid);
    87 }
  • Picture of AulaWeb Università di Genova
    Sat, Dec 22, 2018, 8:15 PM
    Hi Alain,
    which version of the plugin are you using? The method has been update since June 2018 at least.
  • Picture of Alain Raap
    Mon, Jan 7, 2019, 6:14 PM
    I used to version of may 2018, I see there's a new version, so I'll download the new version here
  • Picture of Alain Raap
    Mon, Jan 7, 2019, 8:27 PM
    I installed the latest version, but this broke my working SSO environment. What has changed in this latest version?
  • Picture of AulaWeb Università di Genova
    Tue, Jan 8, 2019, 2:45 AM
    Hi Alain,
    I need some clue... error messages, screenshoots, ecc... Could you move to GitHub and opening a a issue? It is easier to track than this forum.
  • Picture of Alain Raap
    Wed, Jan 9, 2019, 10:05 PM
    I sent you a PM about the issue
  • Picture of karthik Soundararajan
    Fri, Feb 22, 2019, 4:03 PM
    Plugin install was successful. However when I navigate to plugin overview to verify the plugin, then it displays a message "missing from disk" and settings link is invisible.

    Moodle ver. 3.6
    plugin version - 2018121500
    plugin release = '3.5.3'
  • Picture of AulaWeb Università di Genova
    Mon, Apr 1, 2019, 7:37 PM
    Hi Karthik,
    have you unzip the plugin files into the <$moodle_home>/auth/saml2sso/ folder?

    If you unzip as-is the file you downloaded from Github, it will create a directory named
    resulting the error you reported.
    You have to rename it saml2sso.
  • Picture of Anthony Radziszewski
    Sat, Aug 17, 2019, 2:02 AM
    Hi there,

    It looks like the saml login button is now added to the Moodle login/index.php page. Do you have a saml icon for that button? The current one looks like a narrow Microsoft image on that page.
  • Picture of AulaWeb Università di Genova
    Sun, Sep 1, 2019, 4:31 PM
    Thank you for the report Anthony.
    I changed the default icon with a neutral one. However, you can use any pics setting its url in the control panel of the plugin.
  • Picture of Alain Raap
    Fri, Oct 18, 2019, 5:08 PM
    What is the best way to migrate users from another auth plugin (f.e. manual) to the saml2sso auth plugin? What must be changed in the Moodle database?
    When I install the latest version of your plugin and I go to my Moodle site, the wrong login page is showed (not the login of my IDP). When I end my url with
    ?saml=on it shows my IDP login. What is the right way to configure this?
1 2 3 4 5
Please login to post comments