Flarum SAML

askvortsov

v2.3.0

Flarum 1.0 compatibility
Add SLO support ludup. I've only tried this with samltest.id, so it might be somewhat lacking
Add a bunch more knobs and options for signing logout requests/responses, signing authn requests, signinig metadata, wanting assertions encrypter, etc

javassh

I finally got around to testing this and installed this on a new server with Flarum 1.0.

It looks like the logout support is working fine with LogonBox Identity Manager.

Unfortuatley, there seems to be one regression 🙁 When I log in via the SAML popup window, whilst I get a successful login via the Identity Provider / SAML and the popup closes. It does not remove the "Log in" popup, and I have to close that manually and refresh the page before it shows me as logged in. Any ideas as to what's going on there?

ludup

Sorry, I was using the wrong account. To clarify that last reply is from @ludup

ludup

A little more information on that regression, maybe its not and has always been the case as it looks to be browser specific. I tried our older deployment and it does the same there.

It works on both versions of Flarum SAML but only when I'm using Chrome.

Firefox, Firefox Developer, Safari all leave the "Log In" dialog in place which has to be closed and a page refresh before the user shows as logged in.

ludup

Just wondered if @askvortsov had a comment here about this Browser behavior and has any pointers to help me fix it?

When the popup from the external identity provider closes, only in Chrome does the main page pick up the state and log the user in. In other browsers whatever is supposed to happen between the popup and main page doesn't and the login page remains. Is there some form of cross-page communication here?

The user is actually logged in, closing the login modal and refreshing the page shows the user logged in.

I'm trying to work out in the code where this happens but am lost, I have a working development setup, just need some direction.

ludup

I've tracked this down to a script that is created in the core in ResponseFactory.php. After editing the script to not close the current window, I was able to view the error which is.

Uncaught TypeError: can't access property "authenticationComplete", window.opener.app is undefined

This looks like a cross-domain issue. If anyone has any further insights please share, I'm going to try and workaround by doing the SAML inline without the script interaction between pages.

ludup

Finally reached a workable solution but I'm not sure it will be for everyone. nor that it would be a suitable PR. I've committed the source to my fork in case anyone is interested. https://github.com/ludup/flarum-saml

So the problem with window.opener is real in FF and I can't find any way around it. There were SO mumblings about using parent.window.opener but I won't waste any more time trying to explain it.

I've ended up with a solution where the main login page monitors the SAML popup and refreshes the page once the popup closes, I implemented this in the forum/index.js showSamlPopup function. This was perfect for any user that had previously logged in and provided a username but not for new users. For new users, the additional popup requesting the username gets cleared by the reload ☹️

I could not see any other way than to create the user in ACSController with a username supplied by my SAML attributes. Luckily our IDP allows us to define a new attribute and have it prompt the user to complete it during login.

cos003

I find it can't work well behind reverse proxy.
For exmaple, the flarum is behind my traefik proxy, the flarum docker port is 8888, and when I connect to IDP, it has error info :"https://www.example.com:8888/auth/saml/acs but flarum expecting to see https://www.example.com/auth/saml/acs"

How can i fix it ? thanks!

cos003

I use "mondediefr / docker-flarum" for docker. FYI.

« Previous Page