IDP First-flow query....

881 views
Skip to first unread message

Chetan Jain

unread,
Jan 31, 2012, 4:25:12 AM1/31/12
to simple...@googlegroups.com
Hi,
 
We have a requirement to implement a SSO with SAML 2.0 but the service provider wants us to initiate the first connection, authenticate and then relay the state results to them app.... I read about IDP First-flow and tried to implement it but unable to get it working. I'm pasting the files which i configured it and how i'm initiating the connection...
 
 
=============================================================================================================
 saml20-idp-hosted.php :
 
$metadata['__DYNAMIC:1__'] = array(
         * Can be '__DEFAULT__', to use this entry by default.
        'host' => '__DEFAULT__',
        'privatekey' => 'server.pem',
        'certificate' => 'server.crt',
        'privatekey_pass' => '123456',
        'auth' => 'Radius',
        'authority' => 'login'
        'AttributeNameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
        'authproc' => array(
            100 => array('class' => 'core:AttributeMap', 'name2oid'),
 
saml20-sp-remote.php :
 
$metadata['sp.com'] = array(
        'AssertionConsumerService' => 'https://pm.sp.com/saml2/SAMLAssertionConsumer?company=clientTest',
        'SingleLogoutService' => 'https://pm.sp.com/saml2/LogoutServiceHTTPRedirectResponse?company=clientTest',
        'RelayState' => 'https://pm.sp.com/xi/ui/home/pages/home.xhtml',
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:uri',  
        'simplesaml.nameidattribute' => 'uid',
        'simplesaml.attributes' => FALSE,
);
config/authsources.php :
 
'Radius' => array(
    'radius:Radius',
'RelayState' => 'https://pm.sp.com/xi/ui/home/pages/home.xhtml',
'hostname' => 'radius.client.com',
'port' => 1645,
'secret' => '123456',
'timeout' => 5,
'retries' => 3,
'username_attribute' => 'eduPersonPrincipalName',
=================================================================================================================
 
So when i put the url in my browser " http://saml.client.com/simplesaml/saml2/idp/SSOService.php?spentityid=sp.com ", I get the login page and I successfully get logged in and then rather than getting my homepage on the Service Provider side, I get their login page... When i spoke to them they said they are not getting the RelayState...
 
Now my question is, How do i configure simplesaml to RelayState and Also i think I have to get the correct NameID Format which service provider understands... Is there anything else which needs to be configured
 
 
Any help is greatly appreciated...
 
Chetan Jain.

Peter Schober

unread,
Jan 31, 2012, 9:32:25 AM1/31/12
to simple...@googlegroups.com
* Chetan Jain <chetan...@gmail.com> [2012-01-31 15:20]:

> So when i put the url in my browser "
> http://saml.client.com/simplesaml/saml2/idp/SSOService.php?spentityid=sp.com ",
> I get the login page and I successfully get logged in and then rather than
> getting my homepage on the Service Provider side, I get their login page...
> When i spoke to them they said they are not getting the RelayState...

In the RelayState an SP may keep state about which resource a user
agent accessed (or tried to access) before sending them off to an IdP
(or discovery service). So RelayState is set by the SP and only means
something to the SP. How could the IdP then send a RelayState
parameter in an IdP-first flow?
-peter

Chetan Jain

unread,
Jan 31, 2012, 9:52:04 AM1/31/12
to simple...@googlegroups.com
Hi,
 
Thanks for your reply, Then how do I achieve this
 
"Service provider has currently implemented IdP-initiated Web Browser SSO Profile (HTTP POST Binding) and the SP-initiated Global Logout (HTTP Redirect Binding)" .
Chetan Jain.
-peter

--
You received this message because you are subscribed to the Google Groups "simpleSAMLphp" group.
To post to this group, send email to simple...@googlegroups.com.
To unsubscribe from this group, send email to simplesamlph...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/simplesamlphp?hl=en.


Peter Schober

unread,
Jan 31, 2012, 10:31:45 AM1/31/12
to simple...@googlegroups.com
* Chetan Jain <chetan...@gmail.com> [2012-01-31 15:52]:

> Thanks for your reply, Then how do I achieve this
>
> "Service provider has currently implemented IdP-initiated Web Browser SSO
> Profile (HTTP POST Binding) and the SP-initiated Global Logout (HTTP
> Redirect Binding)" .

What is this "this", you want to achieve?
There is no RelayState (i.e., the user agent has no state at the
Service Provider) when you start at the IdP (i.e., IdP-initiated).
The SP decides where to route users to, after processing the SAML
assertion from the IdP.
-peter

Chetan Jain

unread,
Jan 31, 2012, 11:10:21 AM1/31/12
to simple...@googlegroups.com
Hi,
 
We have applied for a Online HR software with a firm... We donot want their systems to access our user/pass database or share with them. So we had asked them if they do SSO with SAML as we're already using it with Google Apps... For this they have to say that they currently implement a IdP-Initiated Web Browser SSO Profile ( HTTP Post Binding ) which is different from what Google does... They do support SAML2.0.
 
I need some help from the list as i'm a Network Guy and not a programmer... From the site i could figure out that i could do IdP First-flow to achieve this ( IdP initiated SSO)... 
 
I had emailed the list of files which i had configured the settings for IdP initiated SSO, I didn't knew that RelayState has to be configure on the SP side neither i know if i have to configure saml20-sp-hosted.php...
 
Can someone put some light on how to achieve this...
 
Chetan Jain.

-peter

Olav Morken

unread,
Feb 1, 2012, 8:36:49 AM2/1/12
to simple...@googlegroups.com
On Tue, Jan 31, 2012 at 21:40:21 +0530, Chetan Jain wrote:
> Hi,
>
> We have applied for a Online HR software with a firm... We donot want their
> systems to access our user/pass database or share with them. So we had
> asked them if they do SSO with SAML as we're already using it with Google
> Apps... For this they have to say that they currently implement a
> IdP-Initiated Web Browser SSO Profile ( HTTP Post Binding ) which is
> different from what Google does... They do support SAML2.0.
>
> I need some help from the list as i'm a Network Guy and not a programmer...
> From the site i could figure out that i could do IdP First-flow to achieve
> this ( IdP initiated SSO)...
>
> I had emailed the list of files which i had configured the settings for IdP
> initiated SSO, I didn't knew that RelayState has to be configure on the SP
> side neither i know if i have to configure saml20-sp-hosted.php...

The RelayState option that you can configure in a simpleSAMLphp SP is
only present as a default URL to use when the IdP does not include a
RelayState option in its response. But it is not relevant for your
case, since you are running an IdP.

> Can someone put some light on how to achieve this...

For information about how to to trigger IdP initiated SSO (with a
specific RelayState), see the documentation:

http://simplesamlphp.org/docs/1.8/simplesamlphp-idp-more#section_4

Best regards,
Olav Morken
UNINETT / Feide

Chetan Jain

unread,
Feb 2, 2012, 9:28:19 AM2/2/12
to simple...@googlegroups.com
Hi,
 
I had followed the instructions but after a successful login on the IdP, I'm still gettting the login page of the SP....
 
Does anyone of the group worked with SuccessFactors as the Service Provider and can put some light on the config...
 
 
I'm attaching the setup info doc from SuccessFactors and the decoded HTTP Post message from my saml instance...
 
saml20-sp-remote.php
 
<?php
 $metadata['successfactors.com'] = array(
'AssertionConsumerService' => 'https://pf.sf.com/saml2/SAMLAssertionConsumer?company=clientTest',
'SingleLogoutService' => 'https://pf.sf.com/saml2/LogoutServiceHTTPRedirectResponse?company=clientTest',
'RelayState' => 'https://pf.sf.com/xi/ui/home/pages/home.xhtml',
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:uid',

'simplesaml.nameidattribute' => 'uid',
'simplesaml.attributes' => FALSE,
);
 
Thanks in advance...
 
Chetan Jain.

Decode.rtf
SuccessFactors Single Sign-On.doc

Chetan Jain

unread,
Feb 2, 2012, 10:07:38 PM2/2/12
to simple...@googlegroups.com
Hi,
 
I'm storing the username in attribute " username_attribute' => 'uid', " under authsources.php and specifying the same in saml20-sp-remote.php as
 
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:uid',

'simplesaml.nameidattribute' => 'uid',
'simplesaml.attributes' => FALSE,
Will this pass the username correctly to successfactors??? They require
 
Use Case 1 – Name Identifier
For this use case, the Name Identifier (<saml:NameID>) in the Subject (<saml:Subject>) will be the only attribute to identify a user in our PerformanceManager. No other attributes are required. The Name Identifier must match the username set up in our system (it is case sensitive). In the following sample SAML Response document, the Name Identifier “admin” is the user in our PerformanceManager with username “admin”. If the user does not exist in our PerformanceManager, the user will be redirected to an invalid login page set up in our PerformanceManager or our SF default login page. The Name Identifier will be the same as the username in the username column in the CSV for User Sync process.
If you are using this option, the password must be set to be the same as the username in the User Sync Process.
<saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        admin
</saml:NameID> …… </saml:Subject>
 
 
Chetan Jain.

Olav Morken

unread,
Feb 3, 2012, 7:08:26 AM2/3/12
to simple...@googlegroups.com
On Fri, Feb 03, 2012 at 08:37:38 +0530, Chetan Jain wrote:
> Hi,
>
> I'm storing the username in attribute " *username_attribute' => 'uid', *"

> under authsources.php and specifying the same in saml20-sp-remote.php as
>
> 'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:uid',

I do not think this is a real format for a NameID? You should probably
set it to "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", to
match the example they have provided.

> 'simplesaml.nameidattribute' => 'uid',
> 'simplesaml.attributes' => FALSE,
> Will this pass the username correctly to successfactors???

It should, if "uid" is available at that point. I suggest that you take
a look at the response your IdP sends. You can do that by setting
'logging.level' to LOG_DEBUG, and enabling the 'debug' option in
config.php. That should ensure that the complete response sent to the SP
is logged in the log files.

Chetan Jain

unread,
Feb 3, 2012, 7:19:17 AM2/3/12
to simple...@googlegroups.com
Hi,
 
I changed the NameID Format and enabled the debug.... This is what i get, no change...
 
Feb  3 07:11:15 saml simplesamlphp[2665]: 6 [6bf0bcc38b] SAML2.0 - IdP.SSOService: Accessing SAML 2.0 IdP endpoint SSOService
Feb  3 07:11:15 saml simplesamlphp[2665]: 6 [6bf0bcc38b] SAML2.0 - IdP.SSOService: IdP initiated authentication: 'successfactors.com'
Feb  3 07:11:37 saml simplesamlphp[14657]: 5 STAT [6bf0bcc38b] saml20-idp-SSO-first successfactors.com http://saml.client.com/simplesaml/saml2/idp/metadata.php NA
Feb  3 07:11:37 saml simplesamlphp[14657]: 5 STAT [6bf0bcc38b] saml20-idp-SSO successfactors.com http://saml.client.com/simplesaml/saml2/idp/metadata.php NA
Feb  3 07:11:37 saml simplesamlphp[14657]: 6 [6bf0bcc38b] Sending SAML 2.0 Response to 'successfactors.com'
 
Also how do set the Relay State paramater in the Idp First-flow... what is urn and someservice mentioned in this example mean.
 

 
My url would look like this...
 
 
Chetan Jain.

Olav Morken

unread,
Feb 3, 2012, 7:24:58 AM2/3/12
to simple...@googlegroups.com
On Fri, Feb 03, 2012 at 17:49:17 +0530, Chetan Jain wrote:
> Hi,
>
> I changed the NameID Format and enabled the debug.... This is what i get,
> no change...

Did you also adjust the log level?


> Feb 3 07:11:15 saml simplesamlphp[2665]: 6 [6bf0bcc38b] SAML2.0 -
> IdP.SSOService: Accessing SAML 2.0 IdP endpoint SSOService
> Feb 3 07:11:15 saml simplesamlphp[2665]: 6 [6bf0bcc38b] SAML2.0 -
> IdP.SSOService: IdP initiated authentication: 'successfactors.com'
> Feb 3 07:11:37 saml simplesamlphp[14657]: 5 STAT [6bf0bcc38b]
> saml20-idp-SSO-first successfactors.com
> http://saml.client.com/simplesaml/saml2/idp/metadata.php NA
> Feb 3 07:11:37 saml simplesamlphp[14657]: 5 STAT [6bf0bcc38b]
> saml20-idp-SSO successfactors.com
> http://saml.client.com/simplesaml/saml2/idp/metadata.php NA
> Feb 3 07:11:37 saml simplesamlphp[14657]: 6 [6bf0bcc38b] Sending SAML 2.0
> Response to 'successfactors.com'
>
> Also how do set the Relay State paramater in the Idp First-flow... what is
> urn and someservice mentioned in this example mean.
>
>
> https://idp.example.org/simplesaml/saml2/idp/SSOService.php?spentityid=urn:mace:feide.no:someservice&RelayState=https://sp.example.org/somepage
>
>
>
> My url would look like this...
>
> https://saml.client.com/simplesaml/saml2/idp/SSOService.php?spentityid=urn:successfactors.com:someservice&RelayState=https://succesfactors.com/login


The "spentityid" parameter specifies the SP entityID. This appears to
be "successfactors.com" for you, based on the log you pasted.

The value of the RelayState depends on what your SP expects. It _may_
be an URL, but it can also be something else, or nothing at all. It is
up to the SP software to decide what value it wants to be passed in the
RelayState parameter.

Chetan Jain

unread,
Feb 3, 2012, 7:27:21 AM2/3/12
to simple...@googlegroups.com
Yes,
 
 
        'debug' => TRUE,
        'logging.level'         => LOG_DEBUG,

Chetan Jain

Olav Morken

unread,
Feb 3, 2012, 7:42:29 AM2/3/12
to simple...@googlegroups.com
On Fri, Feb 03, 2012 at 17:57:21 +0530, Chetan Jain wrote:
> Yes,
>
>
> 'debug' => TRUE,
> 'logging.level' => LOG_DEBUG,

Maybe your syslog configuration is set up to store debug information in
a different file or to not log it at all?

Chetan Jain

unread,
Feb 3, 2012, 8:14:19 AM2/3/12
to simple...@googlegroups.com
I changed the syslog config and have the debug... I see that the username "samluser" has been sent in the response to SP... If you can have a look at the debug...
 
 
Chetan Jain

debug.txt

Olav Morken

unread,
Feb 3, 2012, 8:51:58 AM2/3/12
to simple...@googlegroups.com
On Fri, Feb 03, 2012 at 18:44:19 +0530, Chetan Jain wrote:
> I changed the syslog config and have the debug... I see that the username
> "samluser" has been sent in the response to SP... If you can have a look at
> the debug...

As you have seen, the username is sent as the name identifier in the
response. It appears to be a valid SAML 2.0 response. There isn't really
very much else to say about it.

If your SP has specific requirements for the response, you should check
it against those requirements.

Chetan Jain

unread,
Feb 3, 2012, 11:40:06 PM2/3/12
to simple...@googlegroups.com
Hi Olav,
 
I seems successfactors are now getting the saml response. Now we're not even getting the successfactors login page, but some simplesaml error.. This is what i see after the saml response sent to successfactors in the /var/log/messages...
Also, I have sent them the issuer  as  http://saml.client.com/simplesaml/saml2/idp/metadata.php is this correct?.
 
 
:19:04 saml simplesamlphp[2665]: 6 [ab4d77ad3f] SAML2.0 - IdP.SSOService: Accessing SAML 2.0 IdP endpoint SSOService
:19:04 saml simplesamlphp[2665]: 6 [ab4d77ad3f] SAML2.0 - IdP.SSOService: Accessing SAML 2.0 IdP endpoint SSOService
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Backtrace:
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Backtrace:
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 1 /var/www/html/simplesamlphp/www/_include.php:37 (SimpleSAML_exception_handler)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 1 /var/www/html/simplesamlphp/www/_include.php:37 (SimpleSAML_exception_handler)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 0 [builtin] (N/A)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 0 [builtin] (N/A)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Caused by: Exception: Unable to find the current binding.
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Caused by: Exception: Unable to find the current binding.
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Backtrace:
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Backtrace:
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 2 /var/www/html/simplesamlphp/lib/SAML2/Binding.php:79 (SAML2_Binding::getCurrentBinding)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 2 /var/www/html/simplesamlphp/lib/SAML2/Binding.php:79 (SAML2_Binding::getCurrentBinding)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 1 /var/www/html/simplesamlphp/modules/saml/lib/IdP/SAML2.php:265 (sspmod_saml_IdP_SAML2::receiveAuthnRequest)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 1 /var/www/html/simplesamlphp/modules/saml/lib/IdP/SAML2.php:265 (sspmod_saml_IdP_SAML2::receiveAuthnRequest)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 0 /var/www/html/simplesamlphp/www/saml2/idp/SSOService.php:19 (N/A)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] 0 /var/www/html/simplesamlphp/www/saml2/idp/SSOService.php:19 (N/A)
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Error report with id 76efaac7 generated.
:19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Error report with id 76efaac7 generated.
 
Chetan Jain.
samlresponse2.rtf

Olav Morken

unread,
Feb 6, 2012, 1:44:45 AM2/6/12
to simple...@googlegroups.com
On Sat, Feb 04, 2012 at 10:10:06 +0530, Chetan Jain wrote:
> Hi Olav,
>
> I seems successfactors are now getting the saml response. Now we're not
> even getting the successfactors login page, but some simplesaml error..
> This is what i see after the saml response sent to successfactors in the
> /var/log/messages...

> Also, I have sent them the issuer as
> http://saml.client.com/simplesaml/saml2/idp/metadata.php is this correct?.

It depends on your configuration. It is correct in the default
configuration.

> :19:04 saml simplesamlphp[2665]: 6 [ab4d77ad3f] SAML2.0 - IdP.SSOService:
> Accessing SAML 2.0 IdP endpoint SSOService
> :19:04 saml simplesamlphp[2665]: 6 [ab4d77ad3f] SAML2.0 - IdP.SSOService:
> Accessing SAML 2.0 IdP endpoint SSOService

You appear to have something strange in your configuration, since
everything is logged twice.

[...]


> :19:04 saml simplesamlphp[2665]: 3 [ab4d77ad3f] Caused by: Exception:
> Unable to find the current binding.

The IdP was unable to determine the "binding" used when accessing the
SSOService endpoint. Probably a missing query parameter or something
like that.

Chetan Jain

unread,
Feb 6, 2012, 4:13:14 AM2/6/12
to simple...@googlegroups.com
This is the configuration i changed in default install...
 
 
 cat saml20-idp-hosted.php

<?php
$metadata['__DYNAMIC:1__'] = array(
'host' => '__DEFAULT__',
'privatekey' => 'SFactorsidp.key',
'certificate' => 'SFactoridp.crt',

'privatekey_pass' => '123456',
'auth' => 'Radius',
'RelayState' => 'https://pm.sf.com/xi/ui/home/pages/home.xhtml',
'authority' => 'login'
);
 cat saml20-sp-remote.php
<?php
 $metadata['successfactors.com'] = array(
'AssertionConsumerService' => 'https://pm.sfcom/saml2/SAMLAssertionConsumer?company=clientTest',
'SingleLogoutService' => 'https://pm.sf.com/saml2/LogoutServiceHTTPRedirectResponse?company=clientTest',
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',

'simplesaml.nameidattribute' => 'uid',
'simplesaml.attributes' => FALSE,
);
 
cat authsources.php
 
<?php
'Radius' => array(
    'radius:Radius',
'hostname' => 'radiusserver',
'port' => 1645,
'secret' => 'secret',
'username_attribute' => 'uid',
),
);
cat config.php
 
 
<?php
$config = array (
        'baseurlpath'           => 'simplesaml/',
        'certdir'               => 'cert/',
        'loggingdir'            => 'log/',
        'datadir'               => 'data/',
        'tempdir'               => '/tmp/simplesaml',

        'debug' => TRUE,
        'showerrors'            =>      TRUE,
        'debug.validatexml' => FALSE,
        'auth.adminpassword'            => '123456789',
        'admin.protectindexpage'        => FALSE,
        'admin.protectmetadata'         => FALSE,
        'secretsalt' => 'thisismysecretsalt',
        'technicalcontact_name'     => 'Saml-Admin',
        'technicalcontact_email'    => 'ad...@client.com',
        'timezone' => NULL,
        'logging.level'         => LOG_DEBUG,
        'logging.handler'       => 'syslog',
        'logging.facility' => defined('LOG_LOCAL5') ? constant('LOG_LOCAL5') : LOG_USER,
        'logging.processname' => 'simplesamlphp',
        'logging.logfile'               => 'simplesamlphp.log',

        'enable.saml20-idp'             => true,
        'enable.shib13-idp'             => false,
        'enable.adfs-idp'               => false,
        'enable.wsfed-sp'               => false,
        'enable.authmemcookie' => false,
 
        'session.cookie.lifetime' => 0,
        'session.cookie.path' => '/',
        'session.cookie.domain' => NULL,
        'session.cookie.secure' => FALSE,
        'session.phpsession.cookiename'  => null,
        'session.phpsession.savepath'    => null,
        'session.phpsession.httponly'    => FALSE,
        'language.default'              => 'en',
        'attributes.extradictionary' => NULL,
        'theme.use'             => 'default',

        'default-wsfed-idp'     => 'urn:federation:pingfederate:localhost',
        'idpdisco.enableremember' => TRUE,
        'idpdisco.rememberchecked' => TRUE,
        // Disco service only accepts entities it knows.
        'idpdisco.validate' => TRUE,
        'idpdisco.extDiscoveryStorage' => NULL,
        'idpdisco.layout' => 'dropdown',
        'shib13.signresponse' => TRUE,
        'authproc.idp' => array(
                10 => array(
                        'class' => 'core:AttributeMap', 'addurnprefix'
                20 => 'core:TargetedID',
                // Adopts language from attribute to use in UI
                30 => 'core:LanguageAdaptor',
                40 => 'core:AttributeRealm',
                45 => array(
                        'class' => 'core:StatisticsWithAttribute',
                        'attributename' => 'realm',
                        'type' => 'saml20-idp-SSO',
                ),
                50 => 'core:AttributeLimit',
                60 => array(
                        'class'         => 'core:AttributeAlter',
                        'pattern'       => '/OU=studerende/',
                        'replacement'   => 'Student',
                        'subject'       => 'distinguishedName',
                        '%replace',
                ),
                90 => array(
                        'class'         => 'consent:Consent',
                        'store'         => 'consent:Cookie',
                        'focus'         => 'yes',
                        'checked'       => TRUE
                ),
                // If language is set in Consent module it will be added as an attribute.
                99 => 'core:LanguageAdaptor',
        ),
        'authproc.sp' => array(
                10 => array(
                        'class' => 'core:AttributeMap', 'removeurnprefix'
                ),
                50 => 'core:AttributeLimit',
                60 => array('class' => 'core:GenerateGroups', 'eduPersonAffiliation'),
                // All users will be members of 'users' and 'members'
                61 => array('class' => 'core:AttributeAdd', 'groups' => array('users', 'members')),
                // Adopts language from attribute to use in UI
                90 => 'core:LanguageAdaptor',
        ),

        'metadata.sources' => array(
                array('type' => 'flatfile'),
        ),
        'store.type' => 'phpsession',
        'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
        'store.sql.username' => NULL,
        'store.sql.password' => NULL,
        'store.sql.prefix' => 'simpleSAMLphp',
        'memcache_store.servers' => array(
                array(
                        array('hostname' => 'localhost'),
                ),
        ),
        'metadata.sign.enable' => FALSE,
        'metadata.sign.privatekey' => NULL,
        'metadata.sign.privatekey_pass' => NULL,
        'metadata.sign.certificate' => NULL,
        'proxy' => NULL,
);
 
Do you see any issues with the configuration...
 
Chetan Jain.
 

Olav Morken

unread,
Feb 6, 2012, 7:44:53 AM2/6/12
to simple...@googlegroups.com
On Mon, Feb 06, 2012 at 14:43:14 +0530, Chetan Jain wrote:
> This is the configuration i changed in default install...
>
>
> *cat saml20-idp-hosted.php*
> *
> *<?php

> $metadata['__DYNAMIC:1__'] = array(
> 'host' => '__DEFAULT__',
> 'privatekey' => 'SFactorsidp.key',
> 'certificate' => 'SFactoridp.crt',
> 'privatekey_pass' => '123456',
> 'auth' => 'Radius',
> 'RelayState' => 'https://pm.sf.com/xi/ui/home/pages/home.xhtml',

This parameter is ignored for saml20-idp-hosted.

> 'authority' => 'login'

This one isn't used for IdPs configured with config/authsources.php.


> Do you see any issues with the configuration...

I'm not about to read through your entire configuration without
looking for a specific error :)

Are you experiencing any specific errors?

Chetan Jain

unread,
Feb 6, 2012, 10:58:55 AM2/6/12
to simple...@googlegroups.com
Hi Olav,
 
Binding???, Missing query parameter?? Any help... Is it at the Service Provider side or on  Idp side...
 
I didn't change any configuration on my side, earlier i used to get the successfactors login page but now after the POST, I get this error and not redirecting to the successfactors page...
 
Chetan Jain.


 

Olav Morken

unread,
Feb 7, 2012, 2:28:08 AM2/7/12
to simple...@googlegroups.com
On Mon, Feb 06, 2012 at 21:28:55 +0530, Chetan Jain wrote:
> Hi Olav,
>
> Binding???,

As in "SAML 2.0 binding", the method that is used to transport SAML 2.0
messages over various channels. See:

http://www.oasis-open.org/committees/download.php/35387/sstc-saml-bindings-errata-2.0-wd-05-diff.pdf

> Missing query parameter??

I should maybe have said "request parameter" here, as it is more
generic than "query parameter". The code that determines the current
binding looks at the request method and the request parameters to make
an educated guess as to which SAML 2.0 binding was used to send the
message.

(To support IdP initiated SSO, the SSOService endpoint also looks for a
"spentityid" parameter as an alternative. That is not standardized, and
isn't a part of the normal SAML 2.0 bindings.)

> Any help... Is it at the Service
> Provider side or on Idp side...

That depends :)

For some reason your web browser ends up sending a request to the
SingleSignOnService endpoint that simpleSAMLphp is unable to determine
what to do about. The question is why the web browser ends up doing
that.

> I didn't change any configuration on my side, earlier i used to get the
> successfactors login page but now after the POST

After which POST? The login form? The HTTP-POST binding used to send
authentication responses from the IdP to the SP? Some other POST?

>, I get this error and not
> redirecting to the successfactors page...

I suggest you look at the requests your browser make, and try to
determine what page is sending you to the SingleSignOnService endpoint,
and why that page makes that decision. If you are using Firefox, you
may want to test the SAML tracer add-on:

https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/

This is an add-on that we developed that also decodes SAML 2.0 messages
sent through the browser.

Chetan Jain

unread,
Feb 10, 2012, 11:01:46 PM2/10/12
to simple...@googlegroups.com
Hi,
 

> I didn't change any configuration on my side, earlier i used to get the
> successfactors login page but now after the POST

After which POST? The login form? The HTTP-POST binding used to send
authentication responses from the IdP to the SP? Some other POST?
The HTTP Post from IdP to SP.... Here's the output from samltracer...
 
 
 GET http://saml.client.com/simplesaml/saml2/idp/SSOService.php?spentityid=www.successfactors.com HTTP/1.1
POST http://saml.client.com/simplesaml/module.php/core/loginuserpass.php? HTTP/1.1
( Referer: http://saml.client.com/simplesaml/module.php/core/loginuserpass.php?AuthState=_2448c08a68f2d0e45c81441eeb3f73f57c137167f6%3Ahttp%3A%2F%2Fsaml.client.com%2Fsimplesaml%2Fsaml2%2Fidp%2FSSOService.php%3Fspentityid%3Dwww.successfactors.com%26cookieTime%3D1328930369


POST https://performancemanager4.successfactors.com/saml2/SAMLAssertionConsumer?company=clientTest HTTP/1.1
( Referer: http://saml.client.com/simplesaml/module.php/core/loginuserpass.php? )
GET http://saml.client.com/simplesaml/saml2/idp/SSOService.php HTTP/1.1


( Referer: http://saml.client.com/simplesaml/module.php/core/loginuserpass.php? )


 
--- Also, I see one of their requirement is 

They currently
require the AttributeStatement

<saml:AttributeStatement xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

              xmlns:xs="http://www.w3.org/2001/XMLSchema">


              <saml:Attribute
Name="password"
                   NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"


                   xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">


                   <saml:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

                        xsi:type="xs:string">
lhadley</saml:AttributeValue>

              </saml:Attribute>


          </saml:AttributeStatement>



How to specify this in sp-remote.php
------------------------------------------------
 Settings provided by Successfactors :


-------------------------------------------------
SuccessFactors Entity ID
https://www.successfactors.com <https://www.successfactors.com>

SuccessFactors Certificate for Optional Encryption of Assertion. Sent as separate attachment SFAdmin.txt
Consumer Service URL
https://performancemanager4.successfactors.com/saml2/SAMLAssertionConsumer?company=clientTest

Optional Global Logout Response Handler URL
https://performancemanager4.successfactors.com/saml2/LogoutServiceHTTPRedirectResponse?company=clientTest

RelayState
monitor is configured for Ultra
https://performancemanager4.successfactors.com/xi/ui/home/pages/home.xhtml


Chetan Jain.     





 
 
 
 
 
 
 
Chetan Jain
 
 

Olav Morken

unread,
Feb 13, 2012, 3:19:24 AM2/13/12
to simple...@googlegroups.com
On Sat, Feb 11, 2012 at 09:31:46 +0530, Chetan Jain wrote:
> Hi,
>
>
> > I didn't change any configuration on my side, earlier i used to get the
> > successfactors login page but now after the POST
>
> After which POST? The login form? The HTTP-POST binding used to send
> authentication responses from the IdP to the SP? Some other POST?
> The HTTP Post from IdP to SP.... Here's the output from samltracer...

[...]
> *POST https://performancemanager4.successfactors.com/saml2/SAMLAssertionConsumer?company=clientTest
> HTTP/1.1*
[...]
> *GET http://saml.client.com/simplesaml/saml2/idp/SSOService.php HTTP/1.1*

So, the SP redirects back to the IdP after receiving an authentication
response. You need to find out why it does that, as that is not part of
the normal IdP-initiated authentication flow.

> *--- Also, I see one of their requirement is *


>
>
> They currently
> require the AttributeStatement
> <saml:AttributeStatement xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
>
> xmlns:xs="http://www.w3.org/2001/XMLSchema">
>
> <saml:Attribute
> Name="password"

Hmmm.. The SP required to receive the user's password as an attribute?
Not supported directly by simpleSAMLphp. Depending on the
authentication source you are using, you may be able to add it to the
attributes that are sent, but it looks rather strange to me.

Chetan Jain

unread,
Feb 13, 2012, 8:01:20 AM2/13/12
to simple...@googlegroups.com
Hi,
 
Successfactors now see this...
 
[dc4vmsol06a/10.4.36.82][companyId:clientTest][issuer:http://saml.client.com/simplesaml/saml2/idp/metadata.php] The replayState '' [ ] is invalid. It must start with '/' or be a valid URL and from a safe domain
 
So, do i have to configure the instance at our end with SP support and provide the Relaystate parameter or just include it in the browser link..
 
 
 
The relay state parameter to be provided is
 
 
 
Chetan Jain.

Olav Morken

unread,
Feb 13, 2012, 8:13:43 AM2/13/12
to simple...@googlegroups.com
On Mon, Feb 13, 2012 at 18:31:20 +0530, Chetan Jain wrote:
> Hi,
>
> Successfactors now see this...
>
> [dc4vmsol06a/10.4.36.82][companyId:clientTest][issuer:
> http://saml.client.com/simplesaml/saml2/idp/metadata.php] The replayState
> '' [ ] is invalid. It must start with '/' or be a valid URL and from a safe
> domain
>
> So, do i have to configure the instance at our end with SP support and
> provide the Relaystate parameter or just include it in the browser link..

Including it in the link is the normal way to do it when you are using
IdP initiated authentication.

Reply all
Reply to author
Forward
0 new messages