SAML does not work

diegoperez 2021-05-07 14:12:23 UTC #1

Hi,

I’m testing authentication via saml, make the configuration according to the doc:

EGroupware 20.1 Release Notes.

Installation:

VM Debian
Egroupware via package: egroupware-docker 20.1.20210125-1
Docker image: egroupware/egroupware tag 20.1 with php-fpm 7.4
This vm is a clone of one that is working with ldap authentication without problems.

When I want to test the config I get the following error:

curl -I http://127.0.0.1:8080/egroupware/saml/

[error] 22#22: *520 FastCGI sent in stderr: "PHP message: An error happened (Error): Call to a member function link() on null
PHP message: #0 /usr/share/egroupware/api/src/Auth/Saml.php(681): EGroupware\Api\Egw::link()
PHP message: #1 /usr/share/egroupware/saml/_egw_include.php(34): EGroupware\Api\Auth\Saml::checkDefaultConfig()
PHP message: #2 /usr/share/egroupware/saml/_include.php(4): require_once('/usr/share/egro...')
PHP message: #3 /usr/share/egroupware/saml/index.php(3): require_once('/usr/share/egro...')
PHP message: #4 {main}PHP message: # Instance=, User=, Request=HEAD http://127.0.0.1:8080/egroupware/saml/, User-agent=curl/7.64.0" while reading response header from upstream, client: 172.19.0.1, server: _, request: "HEAD /egroupware/saml/ HTTP/1.1", upstream: "fastcgi://172.19.0.5:9000", host: "127.0.0.1:8080"

Any suggestion?

Thanks
Diego

RalfBecker 2021-05-07 14:32:59 UTC #2

Not sure what do you want to accomplish by querying /egroupware/saml/ via Curl.

To configure SAML / Shibboleth authentication you have to log into Setup (https://example.org/egroupware/setup/ first and configure SAML there.

Our SAML authentication code has some points about the configuration:

github.com

EGroupware/egroupware/blob/master/api/src/Auth/Saml.php#L19


* @subpackage authentication
*/


namespace EGroupware\Api\Auth;


use EGroupware\Api;
use SimpleSAML;
use EGroupware\Api\Exception;


/**
* Authentication based on SAML, Shibboleth or everything supported by SimpleSAMLphp
*
* SimpleSAMLphp is installed together with EGroupware and a default configuration is created in EGroupware
* files subdirectory "saml" eg. when you first store it's configuration in Setup > Configuration > SAML/Shibboleth
*
* Storing setup configuration modifies the following files:
* a) $files_dir/saml/config.php
* b) $files_dir/saml/authsources.php (only "default-sp" is used currently)
* c) $files_dir/saml/metadata/*
* d) $files_dir/saml/cert/*
* Modification is only on certain values, everything else can be edited to suit your needs.

We’re offering commercial support for SAML for our customers.

Ralf

diegoperez 2021-05-07 15:05:32 UTC #3

Hi Ralf,

> To configure SAML / Shibboleth authentication you have to log into Setup (https://example.org/egroupware/setup/ first and configure SAML there.

Yes, I put all the configuration for our IDP (also simplesamlphp).

I am querying via curl locally just to avoid the different components: webserver - proxy container - app.
And /egroupware/saml/ is the path for testing:

github.com

EGroupware/egroupware/blob/master/api/src/Auth/Saml.php#L35


* a) $files_dir/saml/config.php
* b) $files_dir/saml/authsources.php (only "default-sp" is used currently)
* c) $files_dir/saml/metadata/*
* d) $files_dir/saml/cert/*
* Modification is only on certain values, everything else can be edited to suit your needs.
*
* Initially also a key-pair is generated as $files_dir/saml/cert/saml.{pem,crt}.
* If you want or have to use a different certificate, best replace these with your files (they are referenced multiple times!).
* They must stay in the files directory and can NOT be symlinks to eg. /etc, as only files dir is mounted into the container!
*
* Authentication / configuration can be tested independent of EGroupware by using https://example.org/egroupware/saml/
* with the "admin" user and password stored in cleartext in $files_dir/saml/config.php under 'auth.adminpassword'.
*
* There are basically three possible scenarios currently supported:
* a) a single IdP and SAML configured as authentication method
* --> gives full SSO (login page is never displayed, it directly redirects to the IdP)
* b) one or multiple IdP, a discovery label and an other authentication type eg. SQL configured
* --> uses the login page for local accounts plus a button or selectbox (depending on number of IdPs) to start SAML login
* c) multiple IdP and SAML configured as authentication method
* --> SimpleSAML discovery/selection page with a checkbox to remember the selection (SSO after first selection)
*/

Anyway if I querying the metadata url: https://my-server/egroupware/saml/module.php/saml/sp/metadata.php/default-sp

I get the same error.

Regards
Diego