php - simplesamlphp 中的重定向太多

Question

当添加新的应用访问saml时，我遇到了这个问题。

SSOService.php:1 GET https://saml.testing.net/www/saml2/idp/SSOService.php?spentityid=newapp&cookieTime=1459920375

net::ERR_TOO_MANY_REDIRECTS

在我的本地我没有遇到任何问题，但是当我将代码复制到登台服务器时，它会显示 ERR_TOO_MANY_REDIRECTS 错误，继续重定向，并且无法显示 saml 登录页面。带有负载平衡器的登台服务器，这会导致错误吗？

谢谢。

更新:

$config = array(
'baseurlpath'       => 'https://saml.testing.net/',
'certdir'       => '/etc/test/sslcerts/',
'tempdir'       => '/tmp',
'datadir'       => 'data/',
'auth.adminpassword'        => '1234567',
'admin.protectindexpage'    => TRUE,
'admin.protectmetadata'     => TRUE,
'secretsalt'        => 'xxxxxxxxx',
'timezone'      => NULL,

// logging related options
'loggingdir'        => '/var/log/simplesamlphp/',
'logging.level'     => LOG_WARNING,
'logging.logfile'   => 'simplesaml_' .date("Ymd") . '.log',
'debug'         => true,
'showerrors'        => true,
'logging.handler'   => 'file',
'logging.facility'  => LOG_USER,
'logging.processname'   => 'simplesaml',
'debug.validatexml' => FALSE,
'enable.saml20-idp' => TRUE,
'enable.shib13-idp' => FALSE,
'enable.adfs-idp'   => FALSE,
'enable.wsfed-sp'   => FALSE,
    'enable.authmemcookie'  => TRUE,
'session.duration'      => 2*(60*60),
'session.requestcache'      => 4*(60*60),
'session.cookie.lifetime'   => 0,
'session.cookie.path'       => '/',
'session.phpsession.cookiename' => 'SimpleSAMLSessionID',
'session.cookie.name'       => 'SimpleSAMLSessionID',
'session.cookie.domain'     => NULL,
'session.cookie.secure'     => FALSE,
'session.cookie.lifetime'   => 0,
'session.datastore.timeout' => 4*(60*60),
'session.state.timeout'     => (60*60),
'session.phpsession.savepath'   => NULL,
'session.phpsession.httponly'   => FALSE,
'session.disable_fallback'  => FALSE,
'session.authtoken.cookiename'  => 'SimpleSAMLAuthToken',
'session.rememberme.enable' => FALSE,
'session.rememberme.checked'    => FALSE,
'session.rememberme.lifetime'   => 1209600, // 14 days
'enable.http_post'      => FALSE,
'language.available'        => array('en'),
'language.default'      => 'en',
'attributes.extradictionary'    => NULL,
'theme.use'         => 'oldtheme:abcdef',
'attributes.extradictionary'    => NULL,
'default-wsfed-idp'     => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember'   => TRUE,
'idpdisco.rememberchecked'  => TRUE,
'idpdisco.validate'     => TRUE,
'idpdisco.extDiscoveryStorage'  => NULL,
'idpdisco.layout'       => 'dropdown',
'shib13.signresponse'       => TRUE,
'authproc.idp'      => array(
    10 => "frogauth:LogHandler",
    30 => 'core:LanguageAdaptor',
    45 => array('class' => 'core:StatisticsWithAttribute', 'attributename' => 'realm', 'type' => 'saml20-idp-SSO'),
    50 => 'core:AttributeLimit',
    99 => 'core:LanguageAdaptor',
    100 => "newauth:ToLogin",
    101 => "newauth:VerifyLogin",
    99 => 'core:LanguageAdaptor',
),

'authproc.sp'       => array(
    99 => 'core:LanguageAdaptor',
),
'metadata.sources' => array(
    array('type' => 'flatfile'),
),

'store.type'    => 'memcache',
'memcache_store.servers' => array(
            array(
                    array('hostname' => '10.11.11.11'),
            ),
),
'memcache_store.expires' =>  36 * (60*60),
'metadata.sign.enable'      => FALSE,
'metadata.sign.privatekey'  => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy'         => null,
'xframe_options'=> array( 'enable' => TRUE, 'trusted_sites' => array()),
'session.duration'      => 2*(60*60),
'theme.use'     => "newtheme:multitheme",
);

saml20-sp-remote.php

$metadata['newapp'] = array(
    'AssertionConsumerService'      => 'https://www.newapp.com/mobile/saml',
    'SingleLogoutService'           => 'https://www.newapp.com/mobile/logout',
    'Theme'         => 'mobile',
);

Answer 1

在我的例子中，SameSite=None cookie 属性是罪魁祸首。 SameSite=None cookie 必须与 secure 属性一起使用!

解决方法:

'session.cookie.secure' => true // config.php

如果您的服务在反向代理后面运行，而不是在 https 上运行，您还需要定义 URL 模式:

'baseurlpath' => 'https://my.url.com/<path_to_simple_saml>' // indicating the https schema (config.php)