title: SAML based SSO with Laravel
body: <p>I'm implementing SAML based SSO for one of the php web application. I'm using google as IDP. I've used <a href="https://github.com/aacotroneo/laravel-saml2" rel="noreferrer">Laravel 5 - Saml2</a> plugin and configured as per the steps given into it's documentation. I also added this app in google admin console as SAML app using the steps given <a href="https://support.google.com/a/answer/6087519?hl=en" rel="noreferrer">here</a> and configured entityId and acs url in saml2_settings.php. However I'm not able to configure the x509cert certificates. When I hit login url, user is being redirected to google for authentication however when I enters credentials it does not comes back to application and giving following error:</p>
  
  <blockquote>
    <ol start="403">
    <li>That’s an error.</li>
    </ol>
    
    <p>Error: app_not_configured_for_user</p>
    
    <p>Service is not configured for this user.</p>
  </blockquote>
  
  <p>Following is my saml2_settings file:</p>
  
  <pre><code>'sp' =&gt; array(
  
      // Specifies constraints on the name identifier to be used to
      // represent the requested subject.
      // Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
      'NameIDFormat' =&gt; 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
  
      // Usually x509cert and privateKey of the SP are provided by files placed at
      // the certs folder. But we can also provide them with the following parameters
      'x509cert' =&gt; 'I ADDED x509certs here which I downloaded from google',
      'privateKey' =&gt; '',
  
      //LARAVEL - You don't need to change anything else on the sp
      // Identifier of the SP entity  (must be a URI)
      'entityId' =&gt; 'snipeit', //LARAVEL: This would be set to saml_metadata route
      // Specifies info about where and how the &lt;AuthnResponse&gt; message MUST be
      // returned to the requester, in this case our SP.
      'assertionConsumerService' =&gt; array(
          // URL Location where the &lt;Response&gt; from the IdP will be returned
          'url' =&gt; 'http://dev.sb.com/snipeit/public/account/profile', //LARAVEL: This would be set to saml_acs route
          //SAML protocol binding to be used when returning the &lt;Response&gt;
          //message.  Onelogin Toolkit supports for this endpoint the
          //HTTP-Redirect binding only
          'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
      ),
      // Specifies info about where and how the &lt;Logout Response&gt; message MUST be
      // returned to the requester, in this case our SP.
      'singleLogoutService' =&gt; array(
          // URL Location where the &lt;Response&gt; from the IdP will be returned
          'url' =&gt; '', //LARAVEL: This would be set to saml_sls route
          // SAML protocol binding to be used when returning the &lt;Response&gt;
          // message.  Onelogin Toolkit supports for this endpoint the
          // HTTP-Redirect binding only
          'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
      ),
  ),
  
  // Identity Provider Data that we want connect with our SP
  'idp' =&gt; array(
      // Identifier of the IdP entity  (must be a URI)
      'entityId' =&gt; '',
      // SSO endpoint info of the IdP. (Authentication Request protocol)
      'singleSignOnService' =&gt; array(
          // URL Target of the IdP where the SP will send the Authentication Request Message
          'url' =&gt; $idp_host,
          // SAML protocol binding to be used when returning the &lt;Response&gt;
          // message.  Onelogin Toolkit supports for this endpoint the
          // HTTP-POST binding only
          'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
      ),
      // SLO endpoint info of the IdP.
      'singleLogoutService' =&gt; array(
          // URL Location of the IdP where the SP will send the SLO Request
          'url' =&gt; $idp_host . '/saml2/idp/SingleLogoutService.php',
          // SAML protocol binding to be used when returning the &lt;Response&gt;
          // message.  Onelogin Toolkit supports for this endpoint the
          // HTTP-Redirect binding only
          'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
      ),
      // Public x509 certificate of the IdP
      'x509cert' =&gt; 'SAME CERTIFICATES I ADDED HERE AS WELL',        /*
       *  Instead of use the whole x509cert you can use a fingerprint
       *  (openssl x509 -noout -fingerprint -in "idp.crt" to generate it)
       */
      // 'certFingerprint' =&gt; '',
  ),
  </code></pre>
  
  <p>Can someone please help me.</p>