Topic on Project:Support desk

I'm trying to migrate our mediawiki from 1.23.5 to 1.27.1. But the SimpleSAML extension is throwing a HTTP 500 error. I'm not able to rectify the error since am quite new to SimpleSAML. PFB configuration changes made in Localsettings.php. Is there any other config changes to be made other than the following.Thanks.

wfLoadExtension( 'PluggableAuth' ); 
$wgPluggableAuth_EnableAutoLogin = false;
$wgPluggableAuth_EnableLocalLogin = false; 
$wgPluggableAuth_Class = "SimpleSAMLphp"; 
wfLoadExtension( 'SimpleSAMLphp' ); 
$wgSimpleSAMLphp_InstallDir = 'C:\MediaWiki\mediawiki-1.27.1\extensions\SimpleSAMLphp';
$wgSimpleSAMLphp_AuthSourceId = 'default-sp';
$wgSimpleSAMLphp_RealNameAttribute = //cn;
$wgSimpleSAMLphp_EmailAttribute = //mail;
$wgSimpleSAMLphp_UsernameAttribute = //uid;

I'm confused about the last three lines. Why are you putting slashes in front of cn, mail, and uid instead of surrounding them with quotes?

1. What is the error you're seeing?
2. Could you replace the backslashes in $wgSimpleSAMLphp_InstallDir with forward slashes so that you have

$wgSimpleSAMLphp_InstallDir = 'C:/MediaWiki/mediawiki-1.27.1/extensions/SimpleSAMLphp';

Hi Mark,

Actually we already have put the entire address of CN,Mail and UID in quotes like you mentioned followed by those with slashes as a comment. I think that's not the issue. Now i also tried with forward slashes as you said. It's still throwing me the same 'HTTP 500' error.

After setting wgShowExceptionDetails, it's showing the following backtrace:

Thanks & Regards

Ashni

There should be a message before the first line of the backtrace. What does it say?

[f7e4f1c187b3bb5b5742b8c0] /mediawiki-1.27.1/index.php?title=PoP_Facilitation MWException from line 176 of C:\MediaWiki\mediawiki-1.27.1-downloaded\includes\Hooks.php: Invalid callback LocalisationUpdate::onRecacheFallback in hooks for LocalisationCacheRecacheFallback

Does it work if you disable the LocalisationUpdate extension?

Hi Mark. Thanks for the previous one. The HTTP 500 error is gone but still my SAML login is redirecting to the main page with the user as not logged after entering the credentials. I tried to backtrace with the simplesamlphp.log file. IT is showing me the following error.

simplesamlphp DEBUG [cb527bddb5] Session: 'default-sp' not valid because we are not authenticated.

Instead of pluggable auth we arre using SimpleSAMLAuth.

Please find below Setting in localsettings.php

require_once "$IP/extensions/SimpleSamlAuth/SimpleSamlAuth.php"; 

// SAML_OPTIONAL // SAML_LOGIN_ONLY // SAML_REQUIRED //
$wgSamlRequirement = SAML_OPTIONAL;

// Should users be created if they don't exist in the database yet?
$wgSamlCreateUser = true; 

// SAML attributes
$wgSamlUsernameAttr = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'; //uid
$wgSamlRealnameAttr = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'; //cn
$wgSamlMailAttr = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'; //mail 

// SimpleSamlPhp settings
$wgSamlSspRoot = 'C:\MediaWiki\mediawiki-1.27.1\extensions\SimpleSAMLphp';
$wgSamlAuthSource = 'default-sp';
$wgSamlPostLogoutRedirect = NULL;

//Extra parameter added as per this URL - https://groups.google.com/forum/#!topic/simplesamlphp/k9cPe5q8qbE
$wgSessionName = ini_get('session.name'); 

// Array: [MediaWiki group][SAML attribute name][SAML expected value]
// If the SAML assertion matches, the user is added to the MediaWiki group
$wgSamlGroupMap = array(
    'sysop' => array(
        'groups' => array('admin'),
    ),
);

I think I would really recommend that you use PluggableAuth. Cindy has done the work of making SAML work and is available to help if you need help getting PluggableAuth to work.

Otherwise, the only advice that I can offer is that you make sure SimpleSAMLphp itself is working and then work on MediaWiki.

That would be really nice Mark. Can you please help me get in touch with Cindy?

@Cindy.cicalese

Hi Cindy,

Can you please help us with this?

Thanks & Regards,

Ashni Rai

Ashi,

Sorry for the delayed reply. I have been on vacation. To me it looks like you are providing too much information in the attribute strings (assuming that the strings you show above for SimpleSAMLAuth are the same ones you were using for SimpleSAMLphp/PluggableAuth. Here, for example, is my configuration:

$wgSimpleSAMLphp_UsernameAttribute = 'uid';
$wgSimpleSAMLphp_RealNameAttribute = [
        'givenname',
        'sn'
];
$wgSimpleSAMLphp_EmailAttribute = 'mail';

You need to check to see what the attribute names being returned by your identity provider are. Perhaps they are the full URLs that you provided, but you might try just 'emailaddress'.

Also, have you checked your simplesamlphp installation itself to make sure that you can log into that directly with default-sp? If not, go to <url of your server>simplesaml/module.php/core/authenticate.php and click on detault-sp and attempt to authenticate.

Cindy

You can contact Cindy on her talk page or via EmailUser.

Before contacting her, though, try switching back to PluggableAuth and Extension:SimpleSAMLphp. It seems like you switched extensions before we were able to fully diagnose the problems.

$wgSimpleSAMLphp_RealNameAttribute = //cn;
$wgSimpleSAMLphp_EmailAttribute = //mail;
$wgSimpleSAMLphp_UsernameAttribute = //uid;

Because "//" starts a comment, these lines actually mean:

$wgSimpleSAMLphp_RealNameAttribute = $wgSimpleSAMLphp_EmailAttribute = $wgSimpleSAMLphp_UsernameAttribute =

Which is obviously a syntax error. They are probably meant to be strings.

Hi 101.160.137.82,

No i actually did have the entire 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' in quotes not like the one mentioned above. I just removed them since i was posting in a forum. The error message is shared above. Kindly go through it and let me know what might be the issue.

Thanks & Regards,

Ashni

After the installation PluggableAuth + SimpleSAMLphp for MW 1.27, the SAML authentication failed, here the debug logs:

...
[SQLBagOStuff] Connection 3450 will be used for SqlBagOStuff
Fully initialised
Authentication failure.
[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met:
query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
TransactionProfiler.php line 311 calls wfBacktrace()
TransactionProfiler.php line 200 calls TransactionProfiler->reportExpectationViolated()
Database.php line 856 calls TransactionProfiler->recordQueryCompletion()
...

The issue has been fixed after replacing:

$wgSimpleSAMLphp_RealNameAttribute = [
        'givenname',
        'sn'
];

with

 $wgSimpleSAMLphp_RealNameAttribute= 'cn';

The value used for $wgSimpleSAMLphp_RealNameAttribute depends upon what attributes your identity provider is configured to return. Either of the values above could be appropriate, depending upon the environment.

Indeed, the Idp returns 'givenName' and not 'givenname', therefore this will work:

$wgSimpleSAMLphp_RealNameAttribute = [
        'givenName',
        'sn'
];

The initial suspicion was that $wgSimpleSAMLphp_RealNameAttribute doesn't support the array format, but this is not the case. As well, the Authentication failure error didn't point out to the root cause of it. But now the issue is solved.

Thank you for this great extension(s)!