Comments (4)
After setting requestedAuthnContext
to false
I was able to login.
Thanks.
from php-saml.
Based on the error that you posted
The status code of the Response was not Success, was Responder -> urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext
I can say that ADFS received an AuthNRequest with an AuthnContext that is not supported (maybe due a configuration problem).
The Status is the way how an IdP can provide to the SP that something went wrong, in this case
"status:NoAuthnContext" instead the "status:Success".
By default, OneLogin's SP is configured to send an AuthNRequest with
'PasswordProtectedTransport' as AuthnContext so ADFS should have this AuthContext enabled, otherwise you obtain an error.
In order to fix it you have 2 choices:
- Allow in ADFS the 'PasswordProtectedTransport' AuthnContext
- Review what AuthnContext is supported on ADFS and configure it on your SP. You can do it using the 'requestedAuthnContext' parameter on the advanced_settings.php:
// Authentication context.
// Set to false and no AuthContext will be sent in the AuthNRequest,
// Set true or don't present thi parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
// Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
'requestedAuthnContext' => true,
from php-saml.
We too notice this problem with many customers, especially the ones with kerberos, cert and other forms of authentication. This fails even if the PasswordProtectedTransport is enabled on IDP as we are using exact. The default set by onelogin libary should be requestedAuthnContext to false by default or all the contexts should be sent for selecting any. The default's should not be very restrictive. Can we have this changed in the next version, please?
from php-saml.
I agree that set "exact PasswordProtectedTransport" as default requestedAuthnContext was not the right decision.
from php-saml.
Related Issues (20)
- what steps required to create a IdP initated login with a magicLink in it and redirect to SP HOT 1
- The response was received at https://{site}/api/sso/acs instead of https://{site}/api/sso/acs HOT 4
- SubjectConfirmation validation not working HOT 2
- Can PHPSaml be used to implement the IdP? HOT 1
- AuthnRequest Subject MUST NOT contain SubjectConfirmation HOT 3
- Issue decrypting signed assertion under PHP 8.1 (7.4 is just fine) HOT 19
- mcrypt for php8 HOT 2
- Azure Error AADSTS75011. When not having a microsoft account, using a one time passcode. HOT 1
- validUntil updateable Metadata dependency breakage
- Unable to extract public key HOT 1
- Use let's encrypt certificates in Docker-setups HOT 8
- Add support for different certficate signing and encryption keys for SP HOT 1
- "&" characters in organization name result in an error when trying to build metadata
- Decrypted Assertion modified namespace results as assertion Signature not valid. HOT 5
- buildWithBaseURLPath return only last part of url HOT 1
- libxml_disable_entity_loader deprecated in PHP > 8.0 HOT 1
- Uncaught Error: Undefined constant "RobRichards\XMLSecLibs\OPENSSL_PKCS1_PADDING"
- Need to accept POST SLO SAML response HOT 2
- Error after upgrade: supplied parameter cannot be coerced into an X509 certificate HOT 4
- Signing algorithm http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from php-saml.