askvortsov Really sorry for the delay on this, feel free to bump discussions like this.
No problem for the delay, we want to use saml but it's not a P1 objective.
I'm not sure what's going wrong here, it might be worth checking to ensure that the assertion being transmitted is actually being signed.
Yep, we are almost certain the assertion is actually signed (it works with other SP).
Out of curiosity, are you using the djangosaml2idp package? That one should work rather well with this extension.
We are using pysaml2
Regardless, in the most recent version I've added a setting to disable requiring a signed assertion
Wow, thank you very much for this, it works ! But we have a last little bug : our IdP does not provide avatar and your extension requires it regardless we have disable Attribute Sync :
Argument 1 passed to Flarum\Forum\Auth\Registration::provideAvatar() must be of the type string, null given, called in /var/www/flarum/vendor/askvortsov/flarum-saml/src/Controllers/ACSController.php on line 96
return $this->response->make(
'saml-sso',
$saml->getNameId(),
function (Registration $registration) use ($saml, $email) {
$registration
->provideTrustedEmail($email)
THIS LINE ->provideAvatar($saml->getAttribute('avatar')[0])
->suggestUsername('')
->setPayload([]);
}
when I remove this line, it's working perfectly so we are not far from a working SAML solution ! 🙂
