-
Notifications
You must be signed in to change notification settings - Fork 703
Description
The problem happens following the doc and testing the SP
Specifics of your environment
- Acting as SP
- SimpleSAMLphp: 2.3.2?
- PHP: 8.2
- Platform: ubuntu 22
- Webserver: Apache
Describe the bug
The documentation here
https://simplesamlphp.org/docs/stable/simplesamlphp-sp.html
describes the idp as
<?php
$metadata['https://example.org/saml-idp'] = [
'SingleSignOnService' => 'https://example.org/simplesaml/saml2/idp/SSOService.php',
'SingleLogoutService' => 'https://example.org/simplesaml/saml2/idp/SingleLogoutService.php',
'certificate' => 'example.pem',
];
but if you do this with a Shibboleth (and I guess others Idp), simplesaml is complaining about having a string and not an array for SingleSignOnService, SingleLogoutService.
In fact, when you go deeper on the doc
https://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-remote.html
You can see the SingleSignOnService entry that points on https://simplesamlphp.org/docs/stable/simplesamlphp-metadata-endpoints.html
and on endpoints format you have the proper format, ex :
'SingleLogoutService' => [
[
'Location' => 'https://sp.example.org/LogoutRequest',
'ResponseLocation' => 'https://sp.example.org/LogoutResponse',
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
],
],
So, in the first page, the doc is wrong but I don't know the format with simplesaml as i'm using shibboleth.
I solved it using the xml idp metadata converter which is the right tool to use. I suggest to suggest in the doc to use it first if the users already have a working IdP, it could save hours and debugging the error in sp testing that doesn't explain anything.
If you gimme the proper format i can pull request for you.
Thanks !