Suitecrm: 7.8.2 SAML Login Issue

[rdebattista]

Logging in using SAML with GSuite no longer works after upgrading suitecrm from 7.8.1 to 7.8.2.

Issue

SAML worked fine with SuiteCRM 7.8.1.

After upgrading to 7.8.2 it is trying to login but I am receiving an error 400 (Error parsing the request, Encountered error parsing message into its DOM representation) from Google Suite.

The request never continues beyond that point and as far as I could see there are no related errors on log files.

Expected Behavior

SuiteCRM logs in the user using his Google Suite credentials via SAML 2.

Actual Behavior

Google Suite experienced an error 400 as stated above.

Possible Fix

N/A

Steps to Reproduce

1. Set up Google Suite with a SugarCRM SAML App.
2. Set up SuiteCRM to use SAML.
3. Try to log in.

Context

The bug effected the entire domain and prevented users from logging on to their respective profiles.

Your Environment

• SuiteCRM Version used: 7.8.2
• Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): Chrome 56.0.2924.87 (64-bit)
• Environment name and version (e.g. MySQL, PHP 7): PHP5.6.28 and MySQL 5.7.16
• Operating System and version (e.g Ubuntu 16.04): Ubuntu 14.04 LTS

[rdebattista]

Any news with regards to this bug. Anyone knows a workaround? This is completely stopping our ability to upgrade to newer versions.

[chris001]

I posted a solution in #3270 12 days ago. Also, @swamikevala posted an alternate solution. @gymad needs to make a PR to fix this bug.

[JarrettGoetz]

Has there been an update to the SAML/Google integration issue? It's a complete blocker for us deploying SuiteCRM.

Thanks!

[rdebattista]

Same here still waiting for this to be fixed in order to properly update suitecrm to the latest version.

[JarrettGoetz]

@rdebattista Have you heard or learned anything about this, at all? It's really killing us right now, and we're simply investigating other solutions. Which version are you running that you're trying to upgrade from? Thanks.

[JarrettGoetz]

@salesagility Any updates on this? Much appreciated.

[rdebattista]

I am currently using SuiteCRM 7.8.1 since it is the latest one to properly work with SAML.

[ebogaard]

Have a look at the issue I created a while ago: #3270 and which I have referred to earlier in this issue.
There you can find a fix for this issue.

[JarrettGoetz]

Any updates on this?

And, @ebogaard , that didn't fix it for us, on either the LTS version or the cutting edge version.

[sandrotassa]

Hi all,
we are using the suiteCRM version 7.8.6 and, after some fix, now the SAML authentication with GSuite works fine!
In particular, how suggested by @ebogaard in #3270, we had to update to the newest php-saml library.

we downloaded it here:
https://github.com/onelogin/php-saml/releases
(in our case we have used the version v2.11.0)

and substituted it in the following path
"

Moreover it is needed to be careful with the "Entity id" field in the Service Provider Details window. ( see https://support.google.com/a/answer/6087519): "ACS URL" and "Entity ID" must be the same value with the following format.

"ACS URL" = "https:// "Entity ID" = "https://

At the last, after the activation of SAML authentication. you could needed to logged in with first administration user.
Try adding the parameter no_saml in the suitecrm url .
https://

Sandro

[rdebattista]

This solution did not work. The error is gone, however I am simply being redirected to a new saml request and the login process starts over and over.

[sandrotassa]

@rdebattista I think that the update of the php-saml library have fixed the issue described #3270. So the problem could depend on some wrong configuration.
Could you use a SAML tracer plugin on your browser? It helped us to understand the out issue on "Entity ID". If you want you can share the tracing (hidden private info of course).

[JarrettGoetz]

Over the months I've watched release after release, bug fix after bug fix... Yet, this critical SAML bug that will not allow us to deploy SuiteCRM still hasn't been fixed. Can anyone help me better understand what the delay is? Is it that complex? Remember, this was previously working prior to 7.8.2. I appreciate any insight. (And, no, the mentioned fixes above don't appear to work for us and some others.)

Thanks.

[rdebattista]

None of the workarounds worked for me and honestly I do not have the time to keep attempting workarounds. The only decent fix for production would be a fixed version we can easily deploy/update.

[JBrace1990]

@rdebattista - we finally just rebuilt it ourselves and overrode the default login.

These are the files you'll need to make/edit. We went with an OAuth 2.0 implementation using Google.

./custom/login.tpl (Override the login.tpl file used)
./custom/oauth_login.php (AJAX call script that handles login/registration)
./custom/application/Ext/EntryPointRegistry/entry_point_registry.ext.php (Made an entry point for it in order to access SuiteCRM code from withinn the AJAX call)
./custom/modules/Users/Login.php (calls the login.tpl above instead of core/theme templates, arguably not needed)

[nevis2us]

FYI Short notes on migration and SLO patch: http://ipros24.ru/suitecrm-broken-saml-authentication/.

[ebogaard]

This issue has been fixed in later versions of 7.8, 7.10 and 7.11.
You should probably close this.