Cannot configure the site as SAML SP with simplesamlphp_auth I have a functioning SAML IdP, implemented with LemonLDAP::NG. I know it functions because it works with Nextcloud as an SP. I've also successfully configured a DokuWiki SP in the past.

The IdP, the Nextcloud SP and the Drupal 8 SP are all behind an Nginx reverse proxy. All of them are directly reachable from my IP, but I have restricted access from other IPs.

I have been trying on and off for a year to make SAML login work with Drupal 8, using simplesamlphp_auth, but without success. I have lost count of how many articles I have read on the net, which all suggest that configuring SAML is trivial. Sadly, not for me.

Currently, when I select the Drupal 8 SP under 'Test authentication sources' in the 'Authentication' tab, I get the following error:




  Too many redirects occurred trying to open “https://www.xxxx.tld/simplesaml/module.php/core/authenticate.php?as=wmh-www-sp&amp;%5CSimpleSAML%5CAuth%5CState.exceptionId=_568428306a7ad7ad7bf8f8f47a94940de364239c67%3Ahttps%3A%2F%2Fwww.xxx.tld%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dwmh-www-sp%26ReturnTo%3Dhttps%253A%252F%252Fwww.xxx.tld%252Fsimplesaml%252Fmodule.php%252Fcore%252Fauthenticate.php%253Fas%253Dwmh-www-sp”. This might occur if you open a page that is redirected to open another page, which then is redirected to open the original page.


The log file contains repeated occurrences of the following error messages:


  2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] Session: 'wmh-www-sp' not valid because we are not authenticated.
  
  PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')
  
  PHP message: simplesamlphp DEBUG [e54b9408f4] getIdpMetadata: METADATANOTFOUND('%' => '\'https://cloud.xxx.tld/saml/metadata\'')
  
  PHP message: simplesamlphp DEBUG [e54b9408f4] Saved state: '_f37c552249cf34b640de1dac7ad22b1481c763fc0f:https://www.xxx.tld/simplesaml/module.php/core/as_login.php?AuthId=wmh-www-sp&amp;ReturnTo=https.xxx.tld.php.php-www-sp'
  
  PHP message: simplesamlphp DEBUG [e54b9408f4] saving key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af to memcache" while reading response header from upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"
  
  2019/04/03 22:31:48 [error] 21251#21251: *982 FastCGI sent in stderr: "PHP message: simplesamlphp DEBUG [e54b9408f4] loading key SimpleSAMLphp.session.161a8f86a89cf6e93f36117cc21a26af from memcache" while reading upstream, client: NN.NNN.NNN.NNN, server: www.xxx.tld, request: "GET /simplesaml/module.php/core/authenticate.php?as=wmh-www-sp HTTP/2.0", upstream: "fastcgi://unix:/var/run/php-fpm-www.sock:", host: "www.xxx.tld", referrer: "https://www.xxx.tld/simplesaml/module.php/core/authenticate.php"


(www.xxx.tld is the SP, cloud.xxx.tldis the IdP, wmh-www-sp is the entityID of the SP.)

Specific things I do not understand:


we are not authenticated - I have logged into the simplesamlphp_auth interface
METADATANOTFOUND('%' =&gt; '\'https://cloud.xxx.tld/saml/metadata\'') - this is the address of the IdP's metadata and is correct as such


I created file metadata/saml20-idp-remote.php from the IdP's metadata URL, https://cloud.xxx.tld/saml/metadata using simplesamlphp_auth's metadata converter under the "Federation" tab.

Can anyone help me to make sense of all the above?

Steve
The problem was - as so often - between the keyboard and the chair. I had some subtle mistakes in a couple of file paths in config/config.php. Apparently simplesamlphp_auth doesn't do any validation of file names, so mistakes blow up without any apparent context at runtime.