lightSAML / SpBundle

SAML2 SP Symfony Bundle based on LightSAML
https://www.lightsaml.com/SP-Bundle/
MIT License
66 stars 70 forks source link

Looping login redirect when previously authenticated #70

Open coblefred opened 6 years ago

coblefred commented 6 years ago

I have a Symfony application serving as a small content management system. I am able to log into the application perfectly when I have not previously signed into via another application. However, when I sign into another application first and then go into the symfony application I get the looping redirect which dies with a 500 error at /saml/login_check. I have tried many configurations and am aware of the various discussion threads and have also updated to the latest version of the bundle. Assistance with the issue is appreciated.

request.CRITICAL: Uncaught PHP Exception LightSaml\Error\LightSamlAuthenticationException: "Unsuccessful SAML response: urn:oasis:names:tc:SAML:2.0:status:Responder " at /var/www/faculty/vendor/lightsaml/lightsaml/src/LightSaml/Action/Profile/Inbound/StatusResponse/StatusAction.php line 48 {"exception":"[object] (LightSaml\Error\LightSamlAuthenticationException(code: 0): Unsuccessful SAML response: urn:oasis:names:tc:SAML:2.0:status:Responder\n at /var/www/faculty/vendor/lightsaml/lightsaml/src/LightSaml/Action/Profile/Inbound/StatusResponse/StatusAction.php:48)"} []

168.30.- - [31/May/2018:17:27:57 -0400] "POST /saml/login_check HTTP/1.1" 500 495

I have tried many variations of the security config. This just happens to be one currently in place:

    main:
        anonymous: ~
        light_saml_sp:
            provider: db_provider       # user provider name configured in step 9
            user_creator: user_creator  # name of the user creator service created in step 10
            login_path: /saml/login
            check_path: /saml/login_check
            default_target_path: /dashboard
            force: true
        logout:
            path: /logout

I am happy to post other config or class information.

Fredrick

coblefred commented 6 years ago

I resolved this to only happening when you login via an isolated specific service provider first. We should be able to isolate the problem.