How to use getLogoutService.php simplesamlphp 2.0.4

[Eric U]

I'm looking for guidance how to resolve the error below processing an
IdP logout request using this endpoint:

https://<my_simplesamlphp_host>/simplesaml/saml2/idp/SingleLogoutService.php

SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Backtrace:
3 public/_include.php:31 (SimpleSAML_exception_handler)
2 vendor/symfony/error-handler/ErrorHandler.php:607 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
1 vendor/symfony/error-handler/ErrorHandler.php:697 (Symfony\Component\ErrorHandler\ErrorHandler::handleFatalError)
0 [builtin] (N/A)
Caused by: Symfony\Component\ErrorHandler\Error\FatalError: Compile Error: require():
Failed opening required '/tmp/simplesaml/cache/core/ContainerGzRemJI/getLogoutService.php'
(include_path='.:/usr/share/pear:/usr/share/php')
Backtrace:
0 /tmp/simplesaml/cache/core/ContainerGzRemJI/SimpleSAML_KernelProdContainer.php:98 (N/A)

The entire login process between the SP to simplesamlphp works successfully using
this endpoint:

https://<my_simplesamlphp_host>/simplesaml/saml2/idp/SSOService.php

Although the UNHANDLEDEXCEPTION message is displayed, it does appear that
the user's simplesamlphp session is successfully terminated and the user is logged out.

This simplesamlphp doc link references IdP-initiated logout and provides an example:
https://simplesamlphp.org/docs/stable/simplesamlphp-idp-more.html#idp-initiated-logout

I am able to use the simplesamlphp admin interface to test my configured
authentication source and successfully login and logout.  So I think the issue
might be related to something that I have not configured or mis-configured
in simplesamlphp.

Here is the SP host entry configured in 'saml20-sp-remote.php':

$metadata['<sp_host>'] = array(
          'AssertionConsumerService' => 'https://<sp_host>/saml/acs',
          'SingleLogoutService' => 'https://<sp_host>/saml/logout',
          'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
          'saml20.sign.response' => TRUE,
          'saml20.sign.assertion' => TRUE,
          'validate.authnrequest' => FALSE,
          'simplesaml.nameidattribute' => 'email',
          'certificate' => 'saml.crt',
);

This option has been spcified in 'saml20-idp-hosted.php':
'validate.logout' => FALSE,

----------

I have also been following the conversation for "v2.0.4 integrated with Google Workspace"
Thus, I tried updating our SP host to use this link for logout:

https://<my_simplesamlphp_host>/simplesaml/saml2/idp/initSLO.php?RelayState=/simplesaml/saml2/idp/SingleLogoutService.php

However, the same error appears to still be encountered:

SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Backtrace:
3 public/_include.php:31 (SimpleSAML_exception_handler)
2 vendor/symfony/error-handler/ErrorHandler.php:607 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
1 vendor/symfony/error-handler/ErrorHandler.php:697 (Symfony\Component\ErrorHandler\ErrorHandler::handleFatalError)
0 [builtin] (N/A)
Caused by: Symfony\Component\ErrorHandler\Error\FatalError: Compile Error: require(): Failed opening required '/tmp/simplesaml/cache/core/ContainerGzRemJI/getLogoutService.php' (include_path='.:/usr/share/pear:/usr/share/php')
Backtrace:
0 /tmp/simplesaml/cache/core/ContainerGzRemJI/SimpleSAML_KernelProdContainer.php:98 (N/A)

[Tim van Dijen]

Hi Eric,

I've never seen anything like this...

Does the file `/tmp/simplesaml/cache/core/ContainerGzRemJI/getLogoutService.php` actually exist? If so, then maybe you're looking at a permissions issue.

- Tim

Op maandag 24 juli 2023 om 19:40:52 UTC+2 schreef eri...@gmail.com:

[Eric U]

Hi Tim,

I attempted to perform a login and logout again, and encountered the same
error again upon logout:

SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Backtrace:
3 public/_include.php:31 (SimpleSAML_exception_handler)
2 vendor/symfony/error-handler/ErrorHandler.php:607 (Symfony\Component\ErrorHandler\ErrorHandler::handleException)
1 vendor/symfony/error-handler/ErrorHandler.php:697 (Symfony\Component\ErrorHandler\ErrorHandler::handleFatalError)
0 [builtin] (N/A)
Caused by: Symfony\Component\ErrorHandler\Error\FatalError: Compile Error: require():
Failed opening required '/tmp/simplesaml/cache/core/ContainerGzRemJI/getLogoutService.php' (include_path='.:/usr/share/pear:/usr/share/php')
Backtrace:
0 /tmp/simplesaml/cache/core/ContainerGzRemJI/SimpleSAML_KernelProdContainer.php:98 (N/A)

It appears that the directory path exists but the expected file 'getLogoutService.php' is
not found:

$ find /tmp/simplesaml
/tmp/simplesaml
/tmp/simplesaml/cache
/tmp/simplesaml/cache/core
/tmp/simplesaml/cache/core/ContainerGzRemJI
/tmp/simplesaml/cache/core/ContainerGzRemJI/getHttpKernelService.php
/tmp/simplesaml/cache/core/ContainerGzRemJI/getLoginService.php
/tmp/simplesaml/cache/core/ContainerGzRemJI/getConfigurationService.php
/tmp/simplesaml/cache/core/ContainerGzRemJI/SimpleSAML_KernelProdContainer.php
/tmp/simplesaml/cache/core/SimpleSAML_KernelProdContainer.php
/tmp/simplesaml/cache/admin
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/getHttpKernelService.php
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/getTestService.php
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/getSessionService.php
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/getConfigurationService.php
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/getConfigService.php
/tmp/simplesaml/cache/admin/ContainerWY3gXzZ/SimpleSAML_KernelProdContainer.php
/tmp/simplesaml/cache/admin/SimpleSAML_KernelProdContainer.php

I do notice that the file 'getLoginService.php' does exist. Here are the
file contents:

<?php

namespace ContainerGzRemJI;

use Symfony\Component\DependencyInjection\Argument\RewindableGenerator;
use Symfony\Component\DependencyInjection\Exception\RuntimeException;

/*
 * @internal This class has been auto-generated by the Symfony Dependency Injection Component.
 */
class getLoginService extends SimpleSAML_KernelProdContainer
{
    /*
     * Gets the public 'SimpleSAML\Module\core\Controller\Login' shared autowired service.
     *
     * @return \SimpleSAML\Module\core\Controller\Login
     */
    public static function do($container, $lazyLoad = true)
    {
        return $container->services['SimpleSAML\\Module\\core\\Controller\\Login'] = new \SimpleSAML\Module\core\Controller\Login(($container->privates['SimpleSAML\\Configuration'] ?? $container->load('getConfigurationService')));
    }
}

I don't know anything about Symfony. I performed some internet searches
and found a Symfony doc that described how to install/update Symfony.
I executed the command below, but nothing was found to update.

$ /var/simplesamlphp-2.0.4/vendor/bin/composer  require  symfony/finder  --update-no-dev
Info from https://repo.packagist.org: #StandWithUkraine
Cannot use symfony/finder's latest version v6.3.0 as it requires php >=8.1 which is not satisfied by your platform.
./composer.json has been updated
Running composer update symfony/finder
Loading composer repositories with package information
Updating dependencies
Nothing to modify in lock file
Writing lock file
Installing dependencies from lock file
Nothing to install, update or remove
Generating autoload files
49 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found
Using version ^5.4 for symfony/finder


Thanks,
Eric

[Tim van Dijen]

I'm a bit confused to see files in /tmp/simplesaml at all... The only thing we cache (if specifically enabled) is Twig templates.

Exactly how are you installing SimpleSAMLphp? And what version of PHP are you running?

- Tim

Op dinsdag 25 juli 2023 om 19:27:56 UTC+2 schreef eri...@gmail.com:

[Eric U]

This the version of php:

$ php --version
PHP 7.4.33 (cli) (built: Jun  6 2023 16:23:43) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.33, Copyright (c), by Zend Technologies

To install simplesamlphp, I downloaded the file 'simplesamlphp-2.0.4.tar.gz'

and extracted the files to /var/simplesamlphp-2.0.4

-Eric

[Eric U]

I've also installed and configured memcached to be used by simplesamlphp.

We are using 2 separate hosts, each installed with simplesamlphp and memcached,

but memcached is configured to share state between both hosts. I've been able to confirm

that memcached works by performing a login to host A, then stopping the memcached service

on host A, but verify that the user's session is still valid with subsequent access because

the session has been replicated to memcached on host B (if I understand how memcached should work

as configured in simplesamlphp).

Not sure if the details above are relevant, but just providing more information.

-Eric

[Tim van Dijen]

Are you somehow setting environment variables like APP_ENV or SYMFONY_ENV anywhere in an .env file or in your webserver or even your OS?

The only way I can see this happening is if you are running in developer-mode...

- Tim

Op woensdag 26 juli 2023 om 10:39:42 UTC+2 schreef eri...@gmail.com:

[Eric U]

I do not see APP_ENV or SYMFONY_ENV env variables.

I extracted the simplesamlphp files to a temp location.  I notice that the out-of-the-box file

'config.php.dist' includes this line:

'tempdir' => '/tmp/simplesaml',

$ grep -r '/tmp' /tmp/zzz/simplesamlphp-2.0.4/
/tmp/zzz/simplesamlphp-2.0.4/vendor/phpmailer/phpmailer/README.md:    $mail->addAttachment('/var/tmp/file.tar.gz');         //Add attachments
/tmp/zzz/simplesamlphp-2.0.4/vendor/phpmailer/phpmailer/README.md:    $mail->addAttachment('/tmp/image.jpg', 'new.jpg');    //Optional name
/tmp/zzz/simplesamlphp-2.0.4/vendor/composer/composer/src/Composer/Downloader/FileDownloader.php:        return rtrim($this->config->get('vendor-dir').'/composer/tmp-'.md5($package.spl_object_hash($package)).'.'.pathinfo(parse_url(strtr((string) $package->getDistUrl(), '\\', '/'), PHP_URL_PATH), PATHINFO_EXTENSION), '.');
/tmp/zzz/simplesamlphp-2.0.4/vendor/symfony/intl/Resources/bin/compile:[[ ! -d /tmp/symfony/icu ]] && mkdir -p /tmp/symfony/icu
/tmp/zzz/simplesamlphp-2.0.4/vendor/symfony/intl/Resources/bin/compile:    -v /tmp/symfony/icu:/tmp \
/tmp/zzz/simplesamlphp-2.0.4/vendor/symfony/http-foundation/Session/Storage/NativeSessionStorage.php:     *     ini_set('session.save_path', '/tmp');
/tmp/zzz/simplesamlphp-2.0.4/vendor/symfony/filesystem/Filesystem.php:     * Gets a 2-tuple of scheme (may be null) and hierarchical part of a filename (e.g. file:///tmp -> [file, tmp]).
/tmp/zzz/simplesamlphp-2.0.4/config/config.php.dist:    'tempdir' => '/tmp/simplesaml',
/tmp/zzz/simplesamlphp-2.0.4/docs/simplesamlphp-changelog-1.x.md:  * statistics: The logcleaner script outputs to a file in /tmp.
/tmp/zzz/simplesamlphp-2.0.4/docs/simplesamlphp-changelog-1.x.md:  * InfoCard: Saves state directly in /tmp. Changed to the SimpleSAMLphp temp directory.
/tmp/zzz/simplesamlphp-2.0.4/docs/simplesamlphp-changelog-1.x.md:  * openidProvider: Default configuration saves state information in /tmp.
/tmp/zzz/simplesamlphp-2.0.4/docs/simplesamlphp-changelog-1.x.md:  * SAML 1 artifact support: Saves certificates temporarily in '/tmp/simplesaml', but directory creation was insecure.

How can I enable/disable developer mode?

-Eric

[Tim van Dijen]

It's all really confusing Eric, but I think you're onto something..  My install also has tmpdir set to /tmp/simplesaml and it's working fine, however the directory does not exist, and is not created.
When I set it to something else, like /var/cache/simplesaml, it's starting to complain about not being able to create the dir.
It's definitely something we have to investigate, so would you please file an issue on Github for us?

Thanks,

- Tim

Op woensdag 26 juli 2023 om 18:40:26 UTC+2 schreef eri...@gmail.com:

[Eric U]

Hi Tim,

Update: This issue seems to have resolved itself.

I was away for a week. When I returned and attempted a SP login/logout,
the error was no longer encountered. My guess is that the error might
have originally been caused by my tests to confirm that memcached was
working correctly in a shared configuration between 2 hosts. However,
I don't have any data to confirm.

Thus, after 7 days of inactivity (with no changes made to simplesamlphp),
perhaps it was long enough for any transient files/directories to get
removed/refreshed.

Regards,
Eric