1

We have been trying to implement SimpleSAML PHP in a Craft plugin to facilitate a SAML login for one of our sites. The problem we are running into is that we always get the NOSTATE error.

The response that gets logged does seem to be correct and the login does succeed, only the way it gets handled in the ACS callback seems to be wrong. That is the moment we get the NOSTATE error. The ACS code is copied from the default SimpleSAML PHP implementation.

We think it has something to do with the session. Something weird seems also to be going regarding the session id that's generated, SimpleSAML PHP generates a new session id regardless of an existing session from Craft. After debugging we located where the session id was generated and forced this to use the Craft session id. However this doesn't have any effect at all.

We've been debugging a lot but can't seem to figure where the State should be fixed. Does anyone have any clue or any idea how to fix this problem.

Improve this question
2
  • This is going to be hard to debug without some more information... what's the actual NOSTATE error? What's ACS stand for? Maybe try throwing and xDebug breakpoint in the callback and see what's going on?
    – Brad Bell
    Aug 10 '16 at 19:03
  • The NOSTATE error is a generic error that occurs when there is some problem regarding the state that should have been saved in the session. In our case: it doesn't exist. ACS stands for Assertion Consumer Service and this is the callback where the user is redirected after the SAML login has completed so the application that is requesting the authentication can verify the response and act upon the information(e.g. logging in the user in their own application). SimpleSAML PHP uses it's own settings for session management and herein probably lies the problem.
    – Frank Zwiers
    Aug 11 '16 at 11:35
4

We managed to circumvent the issue by using the sql session storage SimpleSAML PHP also provides. Not a real solution but a viable workaround.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.