SAML2.0 error

somogyi 2020-12-08 15:37:51 UTC #1

Hi,

Im try to connect Egroupware to Keycloak SAML SSO server. After set IdP and metadata, i get an error:

An error happened!
authsources[‘default-sp’]: Could not find PEM encoded certificate in “/var/lib/egroupware/default/files/saml/cert/saml.crt”.

Can you help with this?

Thanks,
Z

RalfBecker 2020-12-09 06:52:34 UTC #2

The certificate / key-pair get’s automatic generated, when you first save the SAML configuration:

github.com

EGroupware/egroupware/blob/master/api/src/Auth/Saml.php#L619


		// check if all necessary directories exist, if not create them
		foreach(['cert', 'log', 'data', 'metadata', 'tmp'] as $dir)
		{
			if (!file_exists($config_dir.'/'.$dir) && !mkdir($config_dir.'/'.$dir, 0700, true))
			{
				throw new Exception("Can't create $dir-directory '$config_dir/$dir'!");
			}
		}


		// create a default configuration
		if (!file_exists($config_dir.'/config.php') || filesize($config_dir.'/config.php') < 1000)
		{
			// create a key-pair
			$cert_dir = $config_dir.'/cert';
			$private_key_path = $cert_dir.'/saml.pem';
			$public_key_path = $cert_dir.'/saml.crt';


			if (!file_exists($private_key_path) || !file_exists($public_key_path))
			{
				// Create the private and public key
				$res = openssl_pkey_new([

So on easy way to fix that would be to delete the config file, store the config in our setup again to recreate the config file and the certificate / key-pair.

Ralf

somogyi 2020-12-09 08:08:41 UTC #3

Hi,

A tired this, but the issue is persist. I deleted saml.crt, saml.pem, config.php.
After the error is same.

somogyi 2020-12-09 10:21:02 UTC #5

The generated saml.crt is not seems to be valid.
openssl x509 -in saml.crt -text -noout
unable to load certificate
140368604874048:error:0909006C:PEM routines:get_name:no start line:…/crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE

I think in the .crt need to be start with " -----BEGIN CERTIFICATE----- " and end with " -----END CERTIFICATE-----" instead " -----BEGIN PUBLIC KEY----- " and " -----END PUBLIC KEY-----"

somogyi 2020-12-09 11:18:03 UTC #6

Okay,

After generate the correkt keys (saml.pem,saml.crt), it seems to be working on the simplesamlphp side.
The SSO buttoon is appear on the login screen, but when i push and authenticate, it drop back to the login screen, so i cant login with.

somogyi 2020-12-09 14:46:39 UTC #8

Okay, SSO is working now for login.

But i gave an error on logout:

SimpleSAML\Error\NoState: NOSTATE

Backtrace:
3 lib/SimpleSAML/Auth/State.php:287 (SimpleSAML\Auth\State::loadState)
2 modules/saml/www/sp/saml2-logout.php:76 (require)
1 lib/SimpleSAML/Module.php:260 (SimpleSAML\Module::process)
0 /usr/share/egroupware/saml/module.php:10 (N/A)