title: SSO for PHP webapp with WSO2 identity server. Authentication Request Failed
body: <p>I´m trying to configure a webapp in PHP for SSO with the WSO2 Identity Server. I can configure a webapp in java and it work ok but php.</p>
  
  <p>For PHP I use this: <a href="http://support.onelogin.com/entries/268420-saml-toolkit-for-php" rel="nofollow">http://support.onelogin.com/entries/268420-saml-toolkit-for-php</a></p>
  
  <p>I´m facing the followig error [IS console]:</p>
  
  <pre><code>[2014-03-04 14:58:26,891] DEBUG {org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet} -  Query string : SAMLRequest=fVPLbtswELznKwLeZVGyYieEJUB1%2BjDg2oKt9NAbQ
  65rARSpcqnG%2FftSDzdO0XgvBIazw9kHF8hr1bC8dUe9g58toLu59XGqlUbWX6aktZoZjhUyzWtA5gTb51%2FXLJ5Q1ljjjDCK%2FJN2PYsjgnWV0UPa6jEl283H9fbzaiPo7E7OHzg9zO%2BnMBPJLJJ0SiGR8TymQj7HCQcZw
  ZD5DSx6mZR41VELsYWVRse18zCNkoBOA5qU0QO7u2fx7PvAK0bjHyotK%2F3jut%2FngYTsS1kWQbHdl4NIfq5jaTS2Ndg92F%2BVgKfdOiVH5xoWhsoIro4GXdgcm6DrTSgG9sQDJOuFFh3Oeu82O%2FMW4SX6ymvYxjtcPRZGV
  eJ3j3fxydiau%2FcLiSZRj1QyOPRUBjWvVC6lBUTyVydXyrwsLXAHKXG2BZINTt6%2B%2B8bQuDsg%2B03y3XBwcrdLUzfcVtgNCE5cuLHa14ov6Uvl12IHh%2Bzq5ggmOp6HC3%2B8GCu7SYLwb5eWa2yMdWPj%2Fis%2BuA6v2
  M5uzteX3yL7Aw%3D%3D
  [2014-03-04 14:58:26,893] DEBUG {org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil} -  Request message &lt;samlp:AuthnRequest
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      ID="ONELOGINc065d79a0f783e6c461d030e4d2720cdb24aed1e"
      Version="2.0"
      IssueInstant="2014-03-04T19:58:26Z"
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      AssertionConsumerServiceURL="http://localhost/php-saml/consume.php"&gt;
      &lt;saml:Issuer&gt;php-saml&lt;/saml:Issuer&gt;
      &lt;samlp:NameIDPolicy
          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
          AllowCreate="true"&gt;&lt;/samlp:NameIDPolicy&gt;
      &lt;samlp:RequestedAuthnContext Comparison="exact"&gt;
          &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml:AuthnContextClassRef&gt;
      &lt;/samlp:RequestedAuthnContext&gt;
  &lt;/samlp:AuthnRequest&gt;
  [2014-03-04 14:58:26,898] DEBUG {org.wso2.carbon.identity.sso.saml.validators.SPInitSSOAuthnRequestValidator} -  Authentication Request Validation is successful..
  [2014-03-04 14:58:26,903] DEBUG {org.wso2.carbon.identity.application.authentication.framework.CommonApplicationAuthenticationServlet} -  CommonApplicationAuthenticationSer
  vlet sessionDataKey: a0eef9ff-73cc-4862-87f3-afe17c21c2fc
  [2014-03-04 14:58:26,905] DEBUG {org.wso2.carbon.identity.application.authentication.framework.CommonApplicationAuthenticationServlet} -  The query-string sent by the calli
  ng servlet is: SAMLRequest=fVPLbtswELznKwLeZVGyYieEJUB1+jDg2oKt9NAbQ65rARSpcqnG/ftSDzdO0XgvBIazw9kHF8hr1bC8dUe9g58toLu59XGqlUbWX6aktZoZjhUyzWtA5gTb51/XLJ5Q1ljjjDCK/JN2PYsjg
  nWV0UPa6jEl283H9fbzaiPo7E7OHzg9zO+nMBPJLJJ0SiGR8TymQj7HCQcZwZD5DSx6mZR41VELsYWVRse18zCNkoBOA5qU0QO7u2fx7PvAK0bjHyotK/3jut/ngYTsS1kWQbHdl4NIfq5jaTS2Ndg92F+VgKfdOiVH5xoWhsoIr
  o4GXdgcm6DrTSgG9sQDJOuFFh3Oeu82O/MW4SX6ymvYxjtcPRZGVeJ3j3fxydiau/cLiSZRj1QyOPRUBjWvVC6lBUTyVydXyrwsLXAHKXG2BZINTt6++8bQuDsg+03y3XBwcrdLUzfcVtgNCE5cuLHa14ov6Uvl12IHh+zq5ggmO
  p6HC3+8GCu7SYLwb5eWa2yMdWPj/is+uA6v2M5uzteX3yL7Aw==&amp;issuer=php-saml&amp;sessionDataKey=77a7f01b-1fd1-4637-a0d8-7ffdb8094163&amp;type=samlsso&amp;commonAuthCallerPath=..%2F..%2Fsamlsso&amp;
  forceAuthenticate=true
  [2014-03-04 14:58:26,908] DEBUG {org.wso2.carbon.identity.application.authentication.framework.CommonApplicationAuthenticationServlet} -  BasicAuthenticator has set custom
  status code: 11
  [2014-03-04 14:58:30,660] DEBUG {org.wso2.carbon.identity.application.authenticator.basicauth.BasicAuthenticator} -  User is successfully authenticated.
  [2014-03-04 14:58:30,663]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} -  'admin@carbon.super [-1234]' logged in at [2014-03-04 14:58:30,663-0500]
  [2014-03-04 14:58:30,665] DEBUG {org.wso2.carbon.identity.application.authentication.framework.CommonApplicationAuthenticationServlet} -  Authenticaticated by BasicAuthenti
  cator in single-factor mode
  [2014-03-04 14:58:30,666] DEBUG {org.wso2.carbon.identity.application.authentication.framework.CommonApplicationAuthenticationServlet} -  Sending response back to: ../../sa
  mlsso
  [2014-03-04 14:58:30,669] DEBUG {org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet} -  Query string : null
  [2014-03-04 14:58:30,672]  WARN {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} -  Destination validation for Authentication Request failed. R
  eceived: [null]. Expected: [https://localhost:9443/samlsso]
  </code></pre>
  
  <p>As you can see this is the issue:</p>
  
  <pre><code>[2014-03-04 14:58:30,672]  WARN {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} -  Destination validation for Authentication Request failed. R
  eceived: [null]. Expected: [https://localhost:9443/samlsso]
  </code></pre>
  
  <p>And in the Identity Server i see this message in the web console:</p>
  
  <p>SAML 2.0 based Single Sign-On
  Error when processing the authentication request!
  Please try login again.</p>
  
  <p>UPDATE 1: searching inside IS source code I found this fragment:</p>
  
  <pre><code> if (authnReqDTO.getCertAlias() != null) {
  
                  // Validate 'Destination'
                  String idpUrl = IdentityUtil.getProperty(IdentityConstants.ServerConfig.SSO_IDP_URL);
  
                  if (authnReqDTO.getDestination() == null
                          || !idpUrl.equals(authnReqDTO.getDestination())) {
                      String msg = "Destination validation for Authentication Request failed. " +
                              "Received: [" + authnReqDTO.getDestination() + "]." +
                              " Expected: [" + idpUrl + "]";
                      log.warn(msg);
                      return buildErrorResponse(authnReqDTO.getId(),
                              SAMLSSOConstants.StatusCodes.REQUESTOR_ERROR, msg);
                  }
  
                  // validate the signature
                  boolean isSignatureValid = SAMLSSOUtil.validateAuthnRequestSignature(authnReqDTO);
  
                  if (!isSignatureValid) {
                      String msg = "Signature validation for Authentication Request failed.";
                      log.warn(msg);
                      return buildErrorResponse(authnReqDTO.getId(),
                              SAMLSSOConstants.StatusCodes.REQUESTOR_ERROR, msg);
                  }
              }
  </code></pre>
  
  <p>UPDATE2:
  I start to compare the AuthnRequest send from the PHP app and from the JAVA app.
  PHP app:</p>
  
  <pre><code>&lt;samlp:AuthnRequest
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      ID="ONELOGIN7a1cbb4a8d17af21129b185b43801b84481658f9"
      Version="2.0"
      IssueInstant="2014-03-04T21:09:14Z"
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      AssertionConsumerServiceURL="http://localhost/php-saml/consume.php"&gt;
      &lt;saml:Issuer&gt;php-saml&lt;/saml:Issuer&gt;
      &lt;samlp:NameIDPolicy
          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
          AllowCreate="true"&gt;&lt;/samlp:NameIDPolicy&gt;
      &lt;samlp:RequestedAuthnContext Comparison="exact"&gt;
          &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml:AuthnContextClassRef&gt;
      &lt;/samlp:RequestedAuthnContext&gt;
  &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p>JAVA app:</p>
  
  <pre><code>&lt;samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
  AssertionConsumerServiceURL="http://localhost:8080/travelocity.com/samlsso-home.jsp" 
  AttributeConsumingServiceIndex="1701087467" 
  Destination="https://localhost:9443/samlsso" 
  ForceAuthn="false" 
  ID="0" 
  IsPassive="true" 
  IssueInstant="2014-03-04T21:10:49.696Z" 
  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"&gt;
  &lt;samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion"&gt;travelocity.com&lt;/samlp:Issuer&gt;
  &lt;saml2p:NameIDPolicy xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" SPNameQualifier="Issuer"/&gt;
  &lt;saml2p:RequestedAuthnContext xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact"&gt;
      &lt;saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
      &lt;/saml:AuthnContextClassRef&gt;
  &lt;/saml2p:RequestedAuthnContext&gt;
  &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p>As I see I need to configure the Destination parameter in my webapp in PHP.</p>