Unable to use simple saml with openssl 3

[Andrew G]

We've built our own openssl with our PHP to use version 3.0.5. Now when we try to log in with SAML we get an error:

Uncaught Error: Call to undefined function SimpleSAML\openssl_random_pseudo_bytes()

If I put in a shim for that function, I then get this error:

[26-Aug-2022 20:58:12 UTC] %date{%b %d %H:%M:%S} simplesamlphp ERR [b0c7afebcf] Caused by: Error: Undefined constant "RobRichards\XMLSecLibs\OPENSSL_PKCS1_PADDING"
[26-Aug-2022 20:58:12 UTC] %date{%b %d %H:%M:%S} simplesamlphp ERR [b0c7afebcf] Backtrace:
[26-Aug-2022 20:58:12 UTC] %date{%b %d %H:%M:%S} simplesamlphp ERR [b0c7afebcf] 5 C:\Program Files (x86)\...\simplesamlphp\vendor\robrichards\xmlseclibs\src\XMLSecurityKey.php:223 (RobRichards\XMLSecLibs\XMLSecurityKey::__construct)

Would it be accurate to say SimpleSAML is only compatible with openssl 1? And thus can never be used in a FIPS environment? 

[Peter Brand]

* Andrew G <andrew...@gmail.com> [2022-08-26 23:20]:

> We've built our own openssl with our PHP to use version 3.0.5. Now when we
> try to log in with SAML we get an error:
>
> Uncaught Error: Call to undefined function
> SimpleSAML\openssl_random_pseudo_bytes()

Seems this code is being used by a dependency of SSP, xmlseclibs:
https://github.com/robrichards/xmlseclibs/search?q=openssl_random_pseudo_bytes

Judging from past expieriences (and commit frequency) I wouldn't
expect any xmlseclibs releases anytime soon. (You can of course help
to change this by submitting clear, tested PRs to the xmlseclibs
repo. If you depend on FIPS certification you're lilkely using this in
a regulated industry and as such should be in a position to help fund
the necessary changes.)

-peter

[pra...@gmail.com]

What version of PHP are you running? I was under the impression that openssl 3 only works with php 8.1

The two things you referenced are functions or constants provided by php openssl extension, so I think you may need to investigate

how well that works with openssl 3.

- Patrick

[Andrew G]

Correct we are using php 8.1. I'm struggling to find any information or documentation on what functions are in which dll. 

[Andrew G]

Hmm you may be right. It looks like the install isn't working with openssl correctly. It says curl is using openssl, and curl is working, but none of the other openssl stuff is.

[Tim van Dijen]

Could be that you just have to manually enable the openssl extension within PHP?

- Tim

Op maandag 29 augustus 2022 om 01:24:02 UTC+2 schreef Andrew G:

[Andrew G]

You're right. Something seems to have gone wrong with our PHP build.