> After seeing a very interesting presentation for simplasamlphp a
> couple of weeks ago at Athens, I decided to take a look at
> simplesamlphp. At this point I am trying to get it to work as a SAML2
> SP and communicate with an Internet2 Shibboleth IdP (version 2.1 -
> As you can probably guess from the subject, I am getting the despised
> "Could not find the NameID node in a Subject node" error when
> returning to the SP after authenticating. From previous messages on
> the list, I can see that php>=5.2 is required, but I already have
> php5-5.2.6_2 (on FreeBSD). So it shouldn't be that.
I would suggest that we try to take a look at the Authentication
Response sent from Shibboleth to simplesAMLphp, to see if there is
something strange in there. (in example if the NameID is missing)
If you use Firefox, try to install the LiveHttpHeaders plugin, and
watch the HTTP headers. Then you will see the POST data sent to the
SP. Copy the message into a base64 decoder...
Then show us the message :)
Alternatively, give us an URL and a test login account, and we may do
the liveheaders things.
Sure, this works just fine. Like Janusz said (and can be found in this
lists' archives), you'd need to disable encryption of NameIDs at the
Shib IdP, since simpleSAMLphp doesn't yet support encrypted NameIDs
(which is the default with Shib2).
If you don't want to disable this for all relying parties just add
another RelyingParty element to your conf/relying-party.xml, overrding
the SAML2SSOProfile configuration for this given SP:
provider="<entityId of your IdP>"
Note that unless you enabled automagic reloading of relying party
config in the Shib IdP this change will require you to restart the IdP
application (or the container).
It was recently suggested on the shibboleth-users list to change
Shib's default to not encrypt NameIDs inside encrypted assertions, so
even this small config change at the IdP might not be necessary in
Also note that simplesamlphp can generate metadata for
saml20-idp-remote.php from the IdP's SAML2 metadata (XML), this way
you'll also get the certFingerprint calculated automagically (and
don't need to fiddle with idp.crt and openssl.
Very interesting to keep it simple ! But how ? I don't see any
configuration variable on the official doc.
Assess your simpleSAMLphp install via the web (possibly providing the
auth.adminpassword set in config/config.php), there's you'll find a
link entitled "XML to simpleSAMLphp metadata converter" (depending on
the language setting), leading to simething like
peter....@univie.ac.at - vienna university computer center
Universitaetsstrasse 7, A-1010 Wien, Austria/Europe
Tel. +43-1-4277-14155, Fax. +43-1-4277-9140