SAML integration with JumpCloud

[galeido]

Describe the bug We have tried to do SAML integration against JumpCloud. Unfortunately, based on the configuration example in the documentation and GitHub. We have not made this integration work.

The app debug log gives the following error message

Exception Error on parseRemoteXML. Error parsing metadata. DOMDocument::loadXML(): Opening and ending tag mismatch: link line 1 and head in Entity, line: 1

Steps To Reproduce Steps to reproduce the behavior: 1) Create a JumpCloud user account 2) Create a new Custom SAML application in JumpCloud 3) Add the required information to the Custom SAML application based on the instructions in the BookStack wiki 4) Add the following lines to the BookStack configuration

SAML2_NAME = "JumpCloud SSO"
SAML2_ENABLED = true
SAML2_AUTO_REGISTER = true
SAML2_EMAIL_ATTRIBUTE = email
SAML2_DISPLAY_NAME_ATTRIBUTES = displayName
SAML2_EXTERNAL_ID_ATTRIBUTE = uid
SAML2_IDP_ENTITYID = https: //sso.jumpcloud.com/saml2/$example
SAML2_AUTOLOAD_METADATA = true

5) Enable app debug log APP_DEBUG=true

Expected behavior The purpose is to be directed to the login of the JumpCloud service

Screenshots N/A

Your Configuration (please complete the following information):

• Exact BookStack Version (Found in settings): v21.05.3
• PHP Version: 7.3.27
• Hosting Method (Nginx/Apache/Docker): Caddy reverse proxy + Docker (linuxserver.io)

Additional context N/A

[ssddanbrown]

Hi @galeido, Just had a play using a trial JumpCloud account. I was able to get things working as expected without too much of an issue.

One thing I noticed, You can directly access the metadata at the IDP URL which BookStack expects when autoloading metadata which may be what's producing that error. Instead I set SAML2_AUTOLOAD_METADATA to false and exported my metadata from within JumpCloud and then used the values in that file to set my SAML2_IDP_x509 and SAML2_IDP_SSO values directly.

So in the end my .env file looked something like this:

SAML2_NAME="JumpCloud"
SAML2_EMAIL_ATTRIBUTE="email"
SAML2_EXTERNAL_ID_ATTRIBUTE="email"
SAML2_DISPLAY_NAME_ATTRIBUTES="firstname|lastname"
SAML2_IDP_ENTITYID=https://sso.jumpcloud.com/saml2/bookstack
SAML2_IDP_SSO=https://sso.jumpcloud.com/saml2/bookstack
SAML2_AUTOLOAD_METADATA=false
SAML2_IDP_x509="<big long cert string here>"

[galeido]

@ssddanbrown

Thank you, great work! How about the settings for the custom SAML application on JumpCloud?

[ssddanbrown]

@galeido Details below, I didn't play around with the settings too much to be honest, Might be some improvements to be made.

[galeido]

I can confirm configuration works in our test environment in production mode.

The ticket can be closed as a completed.

Thank you very much for your help.

[ssddanbrown]

@galeido Happy to have helped, And thank you very much for the sponsorship.