Topic on Extension talk:PluggableAuth

I badly need support because after a month of trial and errors I am out of resources.

I am working in a bank environment, trying to let bank users - properly logged in the bank intranet - to access an external Mediawiki hosted on Internet by SSO .

The situation is as follows:

1. I set up and configured simplesamlphp. If a bank employee calls <server>/simplesaml and uses the "test authentication sources" feature he/she retrieves properly the authentication data
2. however, if the person clicks on the button "Accedi with SSO" - that calls or should call PluggableAuth, nothing happens

I am quite sure the problem relies on Mediawiki configuration and perhaps I am not understanding properly how the system should work.

Both extensions are installed

PluggableAuth 5.6 (cdeff81)12:18, 11 ott 2018

SimpleSAMLphp 4.2 (72b213a)12:57, 11 ott 2018

In LocalSettings there are the following lines

$wgPluggableAuth_EnableAutoLogin = true;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = false;

$wgPluggableAuth_ButtonLabel = 'Accedi con SSO';

$wgPluggableAuth_ExtraLoginFields = [];

$wgSimpleSAMLphp_InstallDir = '/var/simplesamlphp';

$wgSimpleSAMLphp_AuthSourceId = 'url'; // this is the IP provider URL

$wgSimpleSAMLphp_RealNameAttribute = 'RealNameAttribute';

$wgSimpleSAMLphp_EmailAttribute ='EmailAttribute';

$wgSimpleSAMLphp_UsernameAttribute = 'UsernameAttribute';

The mediawiki log file lists the following errors

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[session] Session "a68mahldoabm6k6sh07lcoudfd8hm8dg" requested without UserID cookie

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[SQLBagOStuff] Connection 2998 will be used for SqlBagOStuff

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

// I have translated here the error message into Italian

[SimpleSAMLphp] Errore con la fonte di autenticazione URL

[PluggableAuth] Authentication failure.

[PluggableAuth] ERROR: Errore con la fonte di autenticazione URL

[CryptRand] 0 bytes of randomness leftover in the buffer.

[session] SessionBackend "a68mahldoabm6k6sh07lcoudfd8hm8dg" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "a68mahldoabm6k6sh07lcoudfd8hm8dg" save: dataDirty=1 metaDirty=0 forcePersist=0

[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 1):

query-m: REPLACE INTO `mw_objectcache` (keyname,value,exptime) VALUES ('X')

....

[error] [163ff528cec15b488ce720df] /dario/index.php/Speciale:PluggableAuthLogin   ErrorException from line 78 of /var/www/html/dario/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

Please help. Thanks in advance for your support

Here there are my contact info

Carlo Tognoni

Milano - ITALY

My guess is that there is something wrong with the form of $wgSimpleSAMLphp_AuthSourceId. As far as I can tell, the error message is returned from the simpleSAMLphp library when it tries to instantiate class SimpleSAML\\Auth\\Simple passing in the value of $wgSimpleSAMLphp_AuthSourceId.

Thank you very much for your support. I have checked $wgSimpleSAMLphp_AuthSourceId and it is configured exactly as the idp in the authsources.php file. Simplesaml works fine: if I try to login with SSO being outside the bank network it asks me for credentials, as I could expect. Inside the bank network, it sends back all the user attributes.

It seems that PluggableAuth doesn't call the authentication process or doesn't wait a time long enough to let the idp answer. Checking the network traffic, there is a delay of about 1 second before MediaWiki returns to the login page.

my email address is carlo.tognoni (at) ct2.it

I will appreciate if you could contact me privately for consultancy support - I need to solve this problem urgently

Thanks again Carlo

@osnard would you have availability to help @Carlo.tognoni?

Yes, he already contacted me. Thanks!