catalyst / moodle-auth_saml2

SAML done 100% in Moodle, fast, simple, secure

https://moodle.org/plugins/auth_saml2

100% Moodle SAML fast, simple, secure

• What is this?
• Why is it better?
• How does it work?
• Features
• Branches
• Installation
• Configuration
• Testing
• Debugging
• Gotchas
• Other SAML plugins
• Support
• Warm thanks

What is this?

This plugin does SAML authentication and user auto creation with field mapping.

Why is it better?

• 100% configured in the Moodle GUI - no installation of a whole separate app, and no touching of config files or generating certificates.
• Minimal configuration needed, in most cases just copy the IdP metadata in and then give the SP metadata to your IdP admin and that's it.
• Fast! - 3 redirects instead of 7
• Supports Single Logout via the HTTP-Redirect binding which many organisations require

How does it work?

It completely embeds a SimpleSamlPHP instance as an internal dependency, which is dynamically configured the way it should be by inheriting almost all of its configuration from Moodle configuration. In the future we should be able to swap to a different internal SAML implementation and the plugin GUI shouldn't need to change at all.

Features

• Dual login vs. forced login for all as an option, with ?saml=off on the login page for manual accounts, and ?saml=on supported everywhere to deep link and force login via SAML if dual auth is on.
• SAML attributes to Moodle user field mapping
• Automatic certificate creation
• Optionally auto create users
• Support for multiple identity providers
• IdP initiated flow / IdP first flow / IdP unsolicited logins, eg: http://idp.local/simplesaml/saml2/idp/SSOService.php?spentityid=http://moodle.local/auth/saml2/sp/metadata.php&RelayState=http://moodle.local/course/view.php?id=2

Features not yet implemented:

• Enrolment - this should be an enrol plugin and not in an auth plugin
• Role mapping - not yet implemented

Branches

Moodle version	Branch	PHP	SimpleSAMLphp
Moodle 3.9+	MOODLE_39_STABLE	7.4+	v2.0.5
Totara 13+	TOTARA_13_STABLE	7.4+	v2.0.5
Totara 12	TOTARA_12_STABLE	7.1 - 7.2	v1.19.1
Moodle 3.5 to 3.8	MOODLE_35_STABLE	7.2+	v1.18.8
Moodle 2.7 to 3.4	27_34STABLE	5.5+	v1.15.4
Totara up to 11	27_34STABLE	5.5+	v1.15.4

Installation

1. Install the plugin the same as any standard Moodle plugin, either via the Moodle plugin directory, or you can use git to clone it into your source:

   git clone [email protected]:catalyst/moodle-auth_saml2.git auth/saml2

2. Then run the Moodle upgrade

3. If your IdP has a publicly available XML descriptor, copy its URL into the SAML2 auth config settings page. Otherwise copy the XML verbatim into the settings textarea instead.

4. If your IdP requires whitelisting each SP, use the links in the settings page to download the XML, or you can provide that URL to your IdP administrator.

For most simple setups, this is enough to get authentication working. There are many more settings to define how to handle new accounts, dual authentication, and to easily debug the plugin if things are not working.

Configuration

For setting up a new SAML integration, see the Quick Start Guide.

Most of the configuration is done in the Moodle admin GUI and should be self explanatory for someone familiar with SAML generally. There are a few extra configuration items which currently don't have a GUI and should be added to your Moodle config.php file:

$CFG->auth_saml2_disco_url = '';
$CFG->auth_saml2_store = '\\auth_saml2\\redis_store'; # Use an alternate store
$CFG->auth_saml2_redis_server = ''; # Required for the redis_store above

Testing

This plugin has been tested against:

• SimpleSamlPHP set up as an IdP
• openidp.feide.no
• testshib.org
• An AAF instance of Shibboleth
• OpenAM (Sun / Oracle)
• Microsoft ADFS
• NetIQ Access Manager

To configure this against testshib you will need a moodle which is publicly accessible over the internet. Turn on the SAML2 plugin and then configure it:

Home ► Site administration ► Plugins ► Authentication ► SAML2

1. Set the Idp URL to: https://www.testshib.org/metadata/testshib-providers.xml
2. Set dual auth to Yes
3. Set auto create users to Yes
4. Click on 'Download SP Metadata'
5. Save the settings
6. Upload that file to: https://www.testshib.org/register.html
7. Logout and login, you should see 'TestShib Test IdP' as an alternate login method and be able to login via the example credentials.

Debugging

If you are having any issues, turn on debugging inside the SAML2 auth plugin, as well as turning on the Moodle level debugging. This will give in depth debugging on the SAML XML and errors, as well as stack traces. Please include this in any GitHub issue you create if you are having trouble.

There is also a stand-alone test page which authenticates but isn't a 'Moodle' page. All this page does is echo the SAML attributes which have been provided by the IDP. This can be very handy for setting up the mappings, e.g. when the IDP might be providing the right attributes but under an unexpected key name.

/auth/saml2/test.php

If you can succesfully do a SAML login using this page then it narrows down where the issues lie. Some common issues are:

1. You received a valid set of SAML attributes, but the attribute(s) needed are not present. For example, often in ADFS configuration you may need to 'release' the username.

2. You have got a valid set of attributes, but the key for the username isn't what you expected. Cut and paste the correct key name into the Moodle auth saml2 config page to correctly map the 'idpattr' value.

3. The attribute key name might be a really crazy long looking string. This is common with ADFS. If that long string contains certain characters then Moodle will not accept it, and this is an issue in Moodle itself and applies to all auth plugins. You can add a custom claim in ADFS to rename this attribute to something nicer. See: GitHub issue #124.

4. If it is bringing across all the attributes properly, but you are getting: "You have logged in succesfully as 'xyz' but do not have an account in Moodle" then you either need to change your user provisioning process to ensure users are created ahead of time, or you need to enable the autocreate setting. If you do auto create then you need to be very careful that auto-created users, and users provisioned via other means, are set up consistently.

Gotchas

Bitnami Moodle

We get lots of complaints in many plugins that end up being issues with Bitnami. It does a very poor job and does not properly configure Moodle with some quite basic things and we strongly recommend you don't use it at all, not just for SAML issues. In particular it dynamically detects the domain that Moodle is on, which is not supported by Moodle. $CFG->wwwroot MUST be manually set to a static value in config.php.

Multiple IdPs

When using multiple IdPs the system will force enable the dual login setting. This is so that a list of possible identity providers will be presented to the user when logging in.

To enable multiple IdPs you can use the 'IdP metadata XML OR public XML URL' configuration field. An example might look like this:

Identity Provider Name https://ssp1.local/simplesaml/saml2/idp/metadata.php
https://ssp2.local/simplesaml/saml2/idp/metadata.php

If there is any text before the https scheme then it will be used as the override name.

It is not be recommended to use the 'IdP label override' configuration option with multiple IdPs.

Deep linking saml=on URL parameter

For most use cases, this parameter should work on all supported Moodle versions. However, to make this paramater force a SAML login redirect, even when users are already logged in as a guest, we use a Moodle hook that is only available in Moodle >= 3.8.

To make guest user redirecting work on moodle 3.7 and below, you will need to backport the changes from MDL-66340.

OpenAM

If you are getting signature issues with OpenAM then you may need to manually yank out the contents of the ds:X509Certificate element into a file and then import it into OpenAM's certificate store:

$ cat moodle.edu.crt
-----BEGIN CERTIFICATE-----
thesuperlongcertificatestringgoeshere=
-----END CERTIFICATE-----
$ keytool -import -trustcacerts -alias moodle.edu -file moodle.edu.crt -keystore keystore.jks

Then follow the prompts and restart OpenAM.

Certificate Locking

It is possible to lock the certificates in the admin UI which prevents inadvertent overwriting of them. They can also be unlocked in the UI. If you really want to protect them, chown the files so that your webserver user cannot modify them at all.

These certificates are located in the $CFG->dataroot/saml2 directory.

To manually unlock the certificates please restore the write permissions to the required files.

$ cd $CFG->dataroot/saml2
$ chmod 0660 site.example.crt
$ chmod 0660 site.example.pem

Windows configuration for OpenSSL

Some environments, particularly Windows-based, may not provide an OpenSSL configuration file at the default location, producing errors like the following when regenerating certificates:

error:02001003:system library:fopen:No such process
error:2006D080:BIO routines:BIO_new_file:no such file
error:0E064002:configuration file routines:CONF_load:system lib

You may also see OpenSSL errors in various Moodle screens (including the admin page) related to the auth_saml2 plugin. For example:

Warning: openssl_csr_sign(): cannot get CSR from parameter 1 in
C:\path\to\moodle\auth\saml2\setuplib.php

There are two ways to resolve this problem (you only need to do one of these, the first is probably more sensible):

1. Set the OPENSSL_CONF environment variable to point to the full path and location of an openssl.cnf file (e.g. C:\tools\php73\extras\ssl\openssl.cnf) and restart Apache.

2. (for PHP versions <= 7.3) Make a copy of that openssl.cnf file in the location C:\usr\local\ssl\openssl.cnf.

OKTA configuration

Okta has some weird names for settings which are confusing, this may help decipher them:

Okta name	Sane name	Value
Single sign on URL	ACS URL	https://example.com/auth/saml2/sp/saml2-acs.php/example.com
Audience URI	Entity ID	https://example.com/auth/saml2/sp/metadata.php
Enable Single Log Out	Enable Single Log Out	True
Single Logout URL	Single Logout URL	https://example.com/auth/saml2/sp/saml2-logout.php/example.com
Assertion Encryption	Assertion Encryption	Encrypted

Suggested attribute mappings:

Name	Value
Login	user.login
FirstName	user.firstName
LastName	user.lastName
Email	user.email

Auth Proc Filter Hooks

Other plugins may hook into SAML2 and create custom Auth Proc Filters. Auth Proc Filters allow you to mutate the attributes passed back from the IdP before Moodle handles them and maps them to profile fields.

Steps to implement the hook:

1. Create a plugin that will implement the hook (e.g local_hookimplement)
2. Define the hook function local_hookimplement_extend_auth_saml2_proc in the plugin's lib.php file.
3. The function should return an array of SimpleSaml Auth Proc Filters.

Examples:

function local_hookimplement_extend_auth_saml2_proc() {
   return [
      52 => array(
         'class' => 'core:AttributeMap',
         'oid2name'
      )
   ]
}

Custom code:

function local_hookimplement_extend_auth_saml2_proc() {
   return [
      51 => array(
         'class' => 'core:PHP',
         'code' => '$attributes = update_attributes($attributes)'
      )
   ]
}

function update_attributes($attributes) {
   if (isset($attributes["uid"])) {
      $attributes["uid"] => $attributes["username"];
   }
   return $attributes;
}

Multiple IdP filter:

function local_hookimplement_extend_auth_saml2_proc() {
   return [
      51 => array(
         'class' => 'core:PHP',
         'code' => '$attributes = update_attributes($attributes)'
      ),
   ]
}

function update_attributes($attributes) {
   global $SESSION, $saml2auth;
    $idps = $saml2auth->metadataentities;
    foreach ($idps as $idp) {
        foreach ($idp as $key => $value) {
            if ($SESSION->saml2idp == $key) {
                $alias = $idp[$key]->alias;
            }

            if ($alias == 'idp_alias') {
                $attributes["uid"] = $attributes['username'];
            }
        }
    }
}

Other SAML plugins

The diversity and variable quality and features of SAML moodle plugins is a reflection of a great need for a solid SAML plugin, but the neglect to do it properly in core. SAML2 is by far the most robust and supported protocol across the internet and should be fully integrated into Moodle core as both a Service Provider and as an Identity Provider, and without any external dependencies to manage.

Here is a quick run down of the alternatives:

Moodle Core

• auth/shibboleth - This requires a separately installed and configured Shibboleth install.

  One big issue with this, and the category below, is the extra application between Moodle and the IdP, so the login and logout processes have more latency due to extra redirects. Latency on potentially slow mobile networks is by far the biggest bottleneck for login speed, and the biggest complaint by end users in our experience.

• auth/oauth2

  OAuth2 has direct support in Moodle.

Plugins that require SimpleSamlPHP

These are all forks of each other, and unfortunately have diverged quite early or have no common git history, making it difficult to cross port features or fixes between them.

• moodle.org/plugins/auth_saml

• moodle.org/plugins/auth_zilink_saml

• github.com/piersharding/moodle-auth_saml

Plugins which embed a SAML client library

These are generally much easier to manage and configure as they are standalone.

• moodle.org/plugins/auth_onelogin_saml - This one uses its own embedded SAML library which is great and promising, however it doesn't support 'back channel logout' which is critical for security in any large organisation.

• This auth_saml2 plugin, with an embedded and dynamically configured SimpleSamlPHP instance under the hood.

Support

If you have issues please log them in GitHub.

Please note our time is limited, so if you need urgent support or want to sponsor a new feature then please contact Catalyst IT Australia.

Warm thanks

Thanks to the various authors and contributors to the other plugins above.

Thanks to La Trobe University in Melbourne for sponsoring the initial creation of this plugin.

Thanks to Centre de gestion informatique de l’éducation (CGIE) in Luxembourg for sponsoring the user autocreation and field mapping work.

This plugin was developed by Catalyst IT Australia.

moodle-auth_saml2's Issues

Deprecate sha1 and move to sha256

'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'

Specifying saml=on lands you to the standard login page

Hello,

I'm playing around with this plugin and I did notice that specifying

https://moodlesite.org/login/index.php?saml=on

doesn't bring you to the IdP page but on the standard moodle login form.

I think the issue is here why is return called at the end instead of triggering the saml authentication?

If saml is not configured, don't show link to idp

ie if the idp.xml file isn't made

Custom Login page

Hi @brendanheywood ,

I have implemented a custom login page, like the to one moodle uses for CAS authentication.
I have done that because we are using both IdP users and local moodle users and I find that unskilled users are confused by the standard login page:

I'm quit sure that in this case 99% of my users would punch their credentials directly in the login/password box instead of using our idp (ScientificNet).

So I added this intermediate page:

Where it's possible to explain the different possibilities.

Let me know if you are interested in this code.

Cristiano

Potential for multiple IdPs?

I'm just wondering if it's either currently possible, but not documented, or easily implementable, to have more than one IdP set up with this plugin.

certificate creation fails

I'm trying to configure SAML2 . I would like to regenerate a certificate but this seems fails without specific information, error message is:

Creation of Private Certificate failed.

I place a .crt file in the \sitedata\saml2 folder on the server. This is read correctly in the Regenerate Private Key form and in View SP Certificate it also shows the correct certificate information.

I need to create an xml for our SSO system. At this point it fails due to the missing .pem file (even though I also copied this to the same \saml2 folder. It gives an odd path in the error message after I click 'View Service Provider Metadata':

Exception - Could not find private key file [[dataroot]/saml2/[dataroot]/saml2/myserver.mydomain.nl.pem], which is needed to sign the metadata

Server: Windows 2012 R2
PHP 5.6
Moodle 3.0
The php open ssl plugin is installed

Users not auto creating despite successful test and login

Good Day,
I have successfully installed and configured the module and tested successfully using both Test using isPassive and Test isAuthenticated and login, but when I login using SAML2, I receive the following message: You have logged in succesfully but we could not find your 'uid' attribute to associate you to an account in Moodle. I have verified that create users is enabled in the config and that Prevent Account Creation when authenticating is not check under manage authentication.

I'm hoping it is just something that I have overlooked, but I cannot seem to find what it might be.

I am running Moodle 3 on Ubuntu 14.04 and MySQL 5.5.50 if that has any impact.

Thanks in advance,
Jeff

Support isPassive SAML mode

Ie if anon, then bounce to the IdP always but just to check and then come back even if they aren't logged in.

Otherwise know in CAS as 'gateway'

https://wiki.jasig.org/display/CAS/gateway

or in shibboleth as 'lazy session'

or 'is passive' in SAML

https://wiki.shibboleth.net/confluence/display/SHIB2/isPassive

• change the dual login checkbox to a drop down with 'Dual auth' / 'Force to IdP' and 'Dual auth with isPassive mode'

Warning message displayed with file_get_contents when HTTP request failed.

When configuring the SAML2 authentication setting,

• IdP metadata xml OR public xml URL

If a URL has been specified and cannot be reached then a warning will be displayed. There will be a simple fix to suppress the message.

set securecookie setting

Inherit from Moodle setting

session.cookie.secure = true if $CFG->cookiesecure

Fallback to other authentication method (e.g. LDAP)

Hello,

I don't know if it would be feasible, but it would be nice for some fallback method in case an IDP is somehow unreachable.
Perhaps allow LDAP authentication if SSO is unavailable.

sigh I think the problem might rather be Moodle itself, as it allows only one auth method per user.

Exception - Could not find the metadata of an IdP with entity ID ''

This has appeared a couple times on different env's for no apparent reason, need to find the root cause, and avoid workarounds like renew certs and exchange metadata

Exception - Could not find the metadata of an IdP with entity ID ''

More information about this error

×Debug info:
Error code: generalexceptionmessage
×Stack trace:
line 134 of /auth/saml2/extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php: SimpleSAML_Error_Exception thrown
line 317 of /auth/saml2/extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php: call to sspmod_saml_Auth_Source_SP->getIdPMetadata()
line 399 of /auth/saml2/extlib/simplesamlphp/modules/saml/lib/Auth/Source/SP.php: call to sspmod_saml_Auth_Source_SP->startSSO()
line 193 of /auth/saml2/extlib/simplesamlphp/lib/SimpleSAML/Auth/Source.php: call to sspmod_saml_Auth_Source_SP->authenticate()
line 141 of /auth/saml2/extlib/simplesamlphp/lib/SimpleSAML/Auth/Simple.php: call to SimpleSAML_Auth_Source->initLogin()
line 83 of /auth/saml2/extlib/simplesamlphp/lib/SimpleSAML/Auth/Simple.php: call to SimpleSAML_Auth_Simple->login()
line 219 of /auth/saml2/auth.php: call to SimpleSAML_Auth_Simple->requireAuth()
line 30 of /auth/saml2/login.php: call to auth_plugin_saml2->saml_login()

Detect if mcrypt isn't installed and give a useful warning

• add instructions to read for installing
• add gui warning if not available HOOK into core server checks api somehow??
• add readme section on debugging, tell people to turn on debugging and try against testshib

https://docs.moodle.org/dev/Environment_checking#PHP_extensions

• check other simplesaml php extension dependancies and add them too if any more

auto-create users fails when mapped attribute is null

I have an ADFS 2.0 IDP and have an Active Directory (AD) attribute mapped to the Department Moodle profile field.

It appears that if the AD attribute is not set the claim is not passed at all (needs confirmation). When user auto creation is on a blank profile is created but the profile fields fail to become set because the key in the auth.php $attributes var does not exist.

Therefore Moodle sql error is given stating that Department cannot be NULL.

Two parameters to include in the configuration

Hi,
we have the Moodle behind a reverse proxy and we have to modify de baseurlpath in the config in the file config.php in the folder config.

We add this:

'baseurlpath' => 'https://mydomain.com/auth/saml2/',

Maybe, you can include this parameter in the Moodle config interface.

Thanks
Alejandro

Cannot login manually when Dual login = no

I have Moodle with SAML2 ( 2016041300) and Drupal as IdP.
All works as expected with Dual login = yes.
I was trying to avoid the 'extra click' needed in Moodle (on SAML link login page to enact login).
Setting Dual login = no achieves this, but if I try to login as admin - ie /login/index.php?saml=off (or saml=0), I see the login box, on Moodle, but after credentials are entered I get sent to Drupal login.
Loading Moodle page shows I'm still logged out.

Missing idp.xml/cert files on database restore to staging/dev will prevent viewing the login.

When refreshing a production database to a new development or staging server and the sitedata has not been copied over, the sitedata/saml2 directory will not be present.

During the loginpage_hook() function it will try to instantiate the saml2 auth and promptly error out. It could not read the idp.xml or associated certificate files.

Extra debugging has been added to function is_configured().

During loginpage_hook() it will now check for is_configured() and return if it is not setup correctly.

Configure Signing of Logout request

Hello,

our ADFS IdP service requires that the logout request are signed. Where can I configure this?

"Data Mapping" values not saving

Hello,

Once again, thank you for your hard work on this amazing plugin. This is all working great and authenticating existing users while creating new users in my Moodle environment.

One thing I have noticed is that when filling in the "Data Mapping" fields (I have specifically tried email address and first name) and then clicking "Save" that the values do not persist. The page refreshes with the values blank.

I do notice that there is mention of the mapping in your "To Do" area - is this feature still pending? If so, could you contact me regarding sponsoring the completion?

Again, thank you for posting this project and sharing with the world!!!

Add support for password changes, email confirmation etc

In theory should determine this based on info from the idp, but failing that may be manual extra config

Have a 'Lock metadata' button

We need a way to really protect the SP metadata and certs from accidental changes. Pressing the regen button means that your moodle login is now broken and a pita to get working again

• have a button next to regen which is 'Lock certificates'. this will chmod a-w on all the files in that dir
• if the write bit is not set, then grey out the regenerate button and don't show the lock button, and add help docs on how to unlock manually from cli

Data Mapping settings are not saved

Hello,

the data mapping setting are not saved. It seems that a a

return true;

is missing here

simplesamlphp out-of-the-box admin page

I had installed your saml2 plugin in Moodle. All works fine there. I saw the saml2/config/config.php saml configuration file even though if one were to use saml out-of-the-box instead of integrated it would be saml2/extlib/simplesamlphp/config/config.php.

But last night, I tried to find the version number for the simplesamlphp that you embed in your plugin (without luck btw). So I tried to browse the out-of-the-box simplesamlphp admin page. (I have set up simpelsamlphp with Moodle and other web apps by installing saml traditionally. So I knew it existed and I know the directory structure somewhate.) While the page didn't work, it output errors. I do not have error messaging turned on in Moodle. So this is good and bad.

It is good that there isn't an unmanned configuration page for simplesamlphp associated with your plugin available to someone with knowledge and bad intent. But it is bad as the errors output were fatal php errors that exposed directory URLs.

Still needing the simplesamlphp version number you used and seeing the errors I tried to troubleshoot the error messages. It all had to do with the _include.php file and the _autoload.php file. THey could not find the config.php file.

So I changed the following two lines in auth/saml2/extlib/simplesamlphp/www/_include.php:
1)
require_once(dirname(dirname(FILE)).'/lib/_autoload.php') by pointing it to the auth/saml2/_autoload.php

and

//$configdir = SimpleSAML\Utils\Config::getConfigDir(); initially by hardcoding the path to the correct cofig.php file (auth/saml2/config/config.php) and then by creating a Linux environment variable named SIMPLESAMLPHP_CONFIG_DIR

These errors went away and the auth/saml2/extlib/simplesamlphp/www/index.php page loaded but it, too, had errors. This time it came from auth/saml2/extlib/simplesamlphp/lib/SimpleSAML/Configuration.php line 106. Again, the configuration file could not be found. So, just to test, I hardcoded $filename there as auth/saml2/config/config.php. It threw en error on the Moodle API call to get_site_identifier();

So I just stopped trying to figure it out.

Is there a more graceful way to hide or disable the out-of-the-box saml admin page (instead of showing errors in preventing people from accessing it)?

And where do you expose the version of simplesamlphp you are using?

Orrrrrr have I missed some nuance/detail of the installation that would have fixed all of this/prevented all of this?

Thanks.

500 error on return from ADFS

Please see attached headers, using the user test functions.

When the login is successful with ADFS a post is made back to https://moodle.plc.nsw.edu.au/auth/saml2/sp/saml2-acs.php/moodle.plc.nsw.edu.au

This generates a 500 error
headers.txt

I cant see anything obvious in the config which would cause moodle not to respond... any ideas?

idp url not appearing on fresh installs

The test is dependant on the .xml file which is generated on demand which creates a sort of chicken and egg situation. Relaxed the test to just whether the certs exist and the setting to show is on.

SAML1 (shib13) not implemented properly

One of my clients uses a SAML1 IdP and thus returns shib13 in their metadata. I analysed a problem and found what I can change to make it work. It needs a rework of two files. I will fork the repository and do a pull request.

Support for custom user profile fields

Is it possible to add support for custom profile fields?

Specify a url to end up at after logout

• Create a new optional config item for a url

• It should redirect to that url (or default to '/') here:
  https://github.com/catalyst/moodle-auth_saml2/blob/master/logout.php#L34

• and here it should just set the global $redirect and let core do the redirect:
  https://github.com/catalyst/moodle-auth_saml2/blob/master/auth.php#L405

Exception - ACSPARAMS (OneLogin IDP)

Hello, thank you very much for sharing this awesome plugin with the community!

I apologize in advance for what might be a very simple user-error situation - I am the Moodle training administrator but not a developer, so am quite possibly overlooking something obvious.

I am using OneLogin as an IDP and have installed your SAML2 plugin into my Moodle 3.1 environment. OneLogin created an app based on the SP metadata file and all seems to flow properly.

URL for public XML file at OneLogin: https://app.onelogin.com/saml/metadata/560319

Errors generated in debug logs on my Moodle server:

[Tue Jul 05 13:25:08 2016] [error] [client 49.177.179.211] simpleSAMLphp WARNING [0398cc6049] Unable to find the SAML 2 binding used for this request.array (\n), referer: https://scality.onelogin.com/client/apps/
[Tue Jul 05 13:25:08 2016] [error] [client 49.177.179.211] simpleSAMLphp WARNING [0398cc6049] Request method: 'GET'array (\n), referer: https://scality.onelogin.com/client/apps/

Thank you for your hard work on this plugin!!!

Issue with redirect after /login/index.php?saml=off

I have a site running moodle 3.0 on a MariaDB(MySQL) database and am having an issue with the redirect. It looks like it is an absolute path and is stripping away the path from the URL. Example. http://localhost/moodle/login/index.php?saml=off gets me to the login page, but when I put in the correct login, I get redirected to this. http://localhost/simplesaml/module.php/core/postredirect.php?RedirId=[{Long Key Value }] as you can see the /moodle/ gets stripped and causes the server to dead end. Saml2 works fine for dual login and SSO. It's when I try to do the bypass, that everything goes sideways. Any idea what could be causing this?

Locking user fields not working

It seems that setting fields to Lock value Locked under the data mapping has no affect and user are still able to update these details

Local IDP XML file doesn't get automatically updated from public xml URL

If we use URL as "IdP metadata xml OR public xml URL" when when IDP data has been updated we don't get changes in locally saved idp xml file.

We can probably run cron task to update this data in back end to keep it up to dated.

In some cases getting Exception - Destination in response doesn't match the current URL.

We had this before with drupal SAML plugin. And we could replicate it again with this one.
After migrating staging to nginx getting

Exception - Destination in response doesn't match the current URL. Destination is "https://URL/auth/saml2/sp/saml2-acs.php/SPNAME", current URL is "https://URL:80/auth/saml2/sp/saml2-acs.php/SPNAME"

Fixed by adding following to config array:

'baseurlpath' => $CFG->wwwroot . '/auth/saml2/sp/',

SAML2 plugin not working with ADFS 3.0?

We have not managed to get the SAML2 plugin working with our ADFS 3.0 implementation running on Windows2012 R2 server. We are currently getting the error:

Exception - Requester/InvalidNameIDPolicy

Okta setup with SAML2

Hi,

We are trying to set SAML2 and trying to use okta at the same time. In our set up we are using the single sing on url witch we are getting from the metadata.php file http://www.example.com/moodle/auth/saml2/sp/metadata.php.

In the binding in the xml file I get this url created. We are trying to configure the url that we should add to the field and we are using the one below. Which path is usually used for the single sing on url.

http://www.example.com/moodle/auth/saml2/sp/saml1-acs.php/www.example.com

Thank you for your help.

Simple saml lib is on unstable trunk and should be on a stable eg 1.14

• upgrade to 1.14
• update the docs to make this cleaner ongoing
• show the SSP version number somewhere in the config settings

https://github.com/simplesamlphp/simplesamlphp/blob/simplesamlphp-1.14/lib/SimpleSAML/Configuration.php#L328

Ensure deep links with #anchors are retained across login process

I'm not sure this is even possible

Errors in saml-acs.php

Installed plugin on Moodle 3.1. Configured my SAML2 connection (to auth0). Tried testing settings and I am always getting these two errors:

line 21 of /auth/saml2/extlib/simplesamlphp/modules/saml/www/sp/saml2-acs.php: SimpleSAML_Error_Error thrown
line 35 of /auth/saml2/sp/saml2-acs.php: call to require()

What am I missing?

Drag and Drop fails if session has ended (core bug?)

Drag and Drop a PDF into a topic gives this error "An error occurred whilst communicating with the server"

Logs:
[Tue Jan 31 09:26:21.654345 2017] [ssl:error] [pid 19773] [client 192.168.201.78:57593] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://adfs.plc.nsw.edu.au/adfs/ls/?

Suggestions?

Dual login not working, redirects to sso login page

From Sunil via moodle plugin directory:

Great product but have a little problem. I'm using MySQL with Moodle and the SAML2 works great but if I try to login http://www.mydomain.com/login/index.php?saml=off and type in the admin username and pw it redirect me back to my SSO login page. Can someone please help so I can also login manually by turning off SAML via the URL. If I set "Dual Login" to YES it work but I want all users to use the SSO login and only for Administrator to use the manual login.

Rule out session age bug with cron cleanup

From plugin page comments:

We are using the setting Allow any auth types and importing our users into imap and ldap (for several reason) We also had these auth types disabled just to be sure all users must come in through saml

Discovered that the Moodle task Cleanup old sessions would then remove all sessions and we would get new sessions every cron which will cause you to get invalidsesskey if it runs while you are in the middle of forum post or another process

Its debatable if this is a bug as it should only affect saml2 under specific settings

httponly setting should inherit form moodle $CFG

$CFG->cookiehttponly should be ignored is the site isn't actually https

The common name in the cert cannot be longer than 64 chars

See also

https://tracker.moodle.org/browse/MDL-52766

and the spec

https://tools.ietf.org/html/rfc5280

ub-common-name-length INTEGER ::= 64

ADFS Endpoints not HTTPS

Not sure if it is something unique on our setup, but it is just defaults all around, but when trying to get ADFS to import the metadata file it errors as the URL are HTTP:// and not HTTPS://.

I have SSL setup and working for moodle auth.

I see that it should pull from the wwwroot in the main moodle config.php file but to try and keep the site as fast as possible it would be nice to just have authentication happen over HTTPS and not the full site.

But I made the change in the main moodle config.php but the metadata file does not update.

Any thoughts?

Thanks.

User profile field locking is not respected

When user profile fields are locked in the SAML2 auth configuration page, users are still able to edit the locked fields in their own profile. This is present in Moodle 2.9 (but looks like it would affect other versions)
Dirty test script:

• Install and configure SAML2 auth plugin
• Configure firstname to be locked in saml2 auth settings
• Configure a non admin user to have saml2 auth
• Login in as the saml2 user
• Edit user profile

Firstname field is still editable.
This looks to be an incarnation of this tracker issue: https://tracker.moodle.org/browse/MDL-36987. I have a patch in the works that I'll lodge as a pull request once it is tested

ADFS 2.1: Logout results in an error

Using ADFS 2.1 as our Idp sign in is working however logout does results in an error page from the ADFS server and the following in the ADFS event log:

An error occurred during processing of the SAML logout request.

Additional Data

Caller identity: https://[SP URL]/auth/saml2/sp/metadata.php
Logout initiator identity: http://[ADFS URL]/adfs/services/trust
Error message: MSIS1014: SAML LogoutRequest and LogoutResponse messages must be signed when using SAML HTTP Redirect or HTTP POST binding.
Exception details:
User Action
Ensure that the single logout service is configured properly for this relying party trust or claims provider trust in the AD FS configuration database.

I believe that while ADFS requires the logout requests and responses to be signed simplesamlphps default redirect.sign default is not to sign. Not sure how to confirm this?
(https://simplesamlphp.org/docs/1.8/simplesamlphp-reference-idp-remote)

if this is the case is there a way I can configure this?

variant mapping

Is it possible to map an attribute w.r.t. another one?

In particular, we should populate our Moodle database with students' external e-mail address and teachers' internal one (in this case, we discriminate between students and teachers by checking the presence of another field in the response from our IdP).

Best regards.

single logout not working with shibboleth

Is the single logout working properly. I tried the http://www.testshib.org example saml which includes the single logout. Login works fine however a logout does not really log me out. If I click login again then it logs me in without asking for credentials. Am I doing something wrong ? A'm using moodle 3.0 on IIS.

It would be nice to have an option for a logout property url in the configuration. I'm not sure if our saml supports the standard single logout. Usually web sites that support saml have a logout url option.

Make data mapping config section collapsible

It's too painful to scroll down to save settings :) Would be awesome to have Data mapping collapsible or move it to another page.

Add a new option to suppress the link to the idp

eg so we can test fully in prod and then turn on dual auth after