CODEWITHSUNDEEP
phpsingle-sign-onsamlsimplesamlphp
Joey
Joey

Reputation: 401

SimpleSMLphp Custom Module Authentication Triggering Twice

Background: I am trying to set up single sign on (SSO) for users such that they can authenticate to my website and not have to authenticate a second time to our third-party MSP's website. Ideally, the user clicks a link on our website and is taken to the third-party site already logged in and landing on the dashboard (if the account doesn't exist, it is created during this step). We are not using SAML for authentication as a security feature, so all that we need the SAML code for is just producing cookies that prevent the user from having to log in again when he/she gets to our vendor's site. This third party MSP does not support authentication via API or web service and therefore I have been tasked with implementing SAML, their only supported SSO method. I am new to SAML (but not PHP or development) and have been learning as I go. I am told it will support the goals described above.

I initially tried using LDAP as the authentication source as this is what I use for authentication to my website, but this resulted in me getting directed to a login page with no discernible way to instead just pass parameters to SimpleSAMLphp to tell it "the user is already authenticated, all I need you to do is give me valid cookies so I can get past the third party website's authentication checks".

So I switched to writing a custom authentication module. I opened up the GitHub for SimpleSAMLphp and used the "UserPassBase" class as an example to create my own authentication module that inherits from the "Source" class. Because I don't need to re-authenticate the user against LDAP a second time since they're already logged in to our website, I created a simple "authenticate" function that just sets the $state['Attributes'] array.

Here is the code for my custom module:

<?php
namespace SimpleSAML\Module\productauth\Auth\Source;
use SimpleSAML\Auth;

/**
        Author: Joey
        Class developed to be used as a custom authentication module for simpleSAMLphp. This class will take an existing session from a product website and use it to create a SAML session and redirect to a website.
**/
class ProductAuth extends \SimpleSAML\Auth\Source {
        const STAGEID = '\SimpleSAML\Module\productauth\Auth\ProductAuth.state';
        const AUTHID = '\SimpleSAML\Module\productauth\Auth\ProductAuth.AuthId';

        private $user;

        public function __construct($info, $config) { // parameters aren't used, just filler from base class
                $info = array("AuthId" => "productauth");
                parent::__construct($info, $config);
        }

        public function login($user, $redirectURL) {
                $this->user = $user; // normally I'd set this in the constructor, but the overload has my hands tied as far as function definitions go
                $this->initLogin($redirectURL); // calls authenticate function and then, if no exceptions, parent::loginCompleted which redirects to the given URL
        }

        public function authenticate(&$state) { // called by parent::initLogin
                $state[self::AUTHID] = $this->authId;
                $state['Attributes'] = [
                        'uid' => [$this->user->uid],
                        'givenName' => [$this->user->givenName],
                        'sn' => [$this->user->sn],
                        'mail' => [$this->user->mail]
                ];
                $id = Auth\State::saveState($state, self::STAGEID);
        }
}
?>

I am calling it from a controller class on my website:

private function goToTrainingSite() {
                require_once("../third-party-libs/simplesamlphp/_include.php");
                global $TRAINING_URL;
                $user = $_SESSION['subject']->user;
                $samlObj = new SimpleSAML\Module\productauth\Auth\Source\ProductAuth(array(), array());
                $samlObj->login($user, $TRAINING_URL);
        }

I mimicked the flow of the "UserPassBase" class (https://github.com/simplesamlphp/simplesamlphp/blob/master/modules/core/lib/Auth/UserPassBase.php), but it seems that despite all of my authentication working and setting a SimpleSAMLAuth cookie, when the parent::loginCompleted function in the "Source" class (https://github.com/simplesamlphp/simplesamlphp/blob/master/lib/SimpleSAML/Auth/Source.php) runs, it redirected me to the third party site. I then see the following in the logs:

SAML2.0 - IdP.SSOService: incoming authentication request: [REDACTED DATA]

Session: 'productauth' not valid because we are not authenticated.

I have been trying for 3 days to figure out why it seems as though despite setting SimpleSAML session cookies with a completed, successful authentication, that upon receiving the auth request from the SP, my SimpleSAMLphp code just pretends to not know about the completed auth and tries to authenticate again... but because it is not being called from my code, it doesn't have access to the $user variable which contains all of the attributes I need to place on the user when he/she authenticates to this third party website. It seems that when it receives an authentication request, my SimpleSAMLphp installation starts a new session and tries a brand new authentication.

I have delved into a lot of the code of SimpleSAMLphp and tried to understand what is going on, but it seems that there is just no reasonable way to authenticate by calling an authentication source from PHP code and being able to skip the SP-initiated authentication. I have tried:

Upvotes: 1

Views: 848

Answers (1)

Joey
Joey

Reputation: 401

I decided to stop focusing on trying to get the $user variable and the data I needed to the second authentication, and instead focus on WHY the second authentication was even happening. I looked at the cookies and thought about how the data was being retrieved, and made a correct hunch that our application's custom session handler might be at fault for SimpleSAMLphp's inability to recognize the first authentication. Our custom session handler stores our sessions in the database, but SimpleSAMLphp expects to use the default PHP session handler to manage its session. Therefore, my first authentication was being sent to the database and when SimpleSAMLphp started looking for it where PHP sessions are usually stored, it didn't see it and assumed it needed to kick off another authentication session from scratch.

Using SimpleSAMLphp's documentation for service providers and a lot of my own debugging, I changed the function in my controller like so:

private function goToTrainingSite() {
        require_once ("../third-party-libs/simplesamlphp/_include.php");
        global $TRAINING_URL;
        $joeySiteSession = $_SESSION;
        $user = $_SESSION ['subject']->user;  // save user to variable before the Joey's Site session is closed
        session_write_close (); // close Joey's Site session to allow SimpleSAMLphp session to open
        session_set_save_handler ( new SessionHandler (), true ); // stop using SessionHandlerJoey and use default PHP handler for SimpleSAMLphp
        $samlObj = new SimpleSAML\Module\joeysiteauth\Auth\Source\JoeySiteAuth ( array (), array () );
        $samlObj->login ( $user, function () { return;} ); // use custom authentication module to set atttributes and everything SimpleSAMLphp needs in the auth session/cookie         
        $session = \SimpleSAML\Session::getSessionFromRequest (); 
        $session->cleanup (); // must call this function when we are done with SimpleSAMLphp session and intend to use our Joey's Site session again
        session_write_close (); 
        $_SESSION = $joeySiteSession; // restore Joey's Site session
        header ( "Location: {$TRAINING_URL}" );
    }

Upvotes: 2

Related Questions