Can't get request to use HTTP-POST Binding

The OneLogin SAML library does not support HTTP-POST binding. After seeing that it's just not there in the code, I came across https://github.com/onelogin/php-saml/issues/92 that says the same thing.

If you need to work with this IDP, you should probably use the simplesamlphp_auth module. SimpleSAMLphp is a bit more work to set up (since it's a standalone 'app' that needs to be reachable in your docroot / on another host)... but it + the 'wrapper' simplesamlphp_auth module support AuthnRequests over HTTP-POST.

@roderik wish I have seen this earlier... thanks

New versions of the Onelogin library seems to now support POST Bindings.
Scratch that.

It looks like as of OneLogin PHP-SAML v3.4.1 supports the POST bindings.

I don't see a sign of that.

For completeness:

• The SAMLRequests for login/logout to be sent by the SP/Drupal, must be sent trough the HTTP-Redirect binding / GET requests. POST is not supported.
• The SAMLResponses for both that come back from the IdP must be POST requests.
• A LogoutRequest from the IdP must be a GET request.

(Why? I think maybe because OneLogin had a reason to only want their IdP to consume GET requests, but responses must be POST according to the SAML standard and/or de facto established standard for SAML implementations. Is my guess.)

Well, I can absolutely say that using:

External Authentication and SAML Auth, it pulls in OneLogin v3.4.1 - and I have working eAuth/SAML implementations as per my work with USDA. So I have it working. I did have the HTTP_POST issue prior to using 3.4.1 so my report is experiential and not based on logs.

EDIT: I did have to use the 3.x-dev branch of SAML Auth.

We are currently working a project that require a SAML authentication and we choose this module (over SimpleSAMLphp) for simplicity.
We discovered a bit late that our IDP doesn't support HTTP-Redirect binding for sending login Authn Request. Also in our case, the request must be signed and with the certificate embeded.

So with @wengerk we worked on a patch.
It is not perfect but solve our issue.

I digged a bit in the OneLogin php-saml lib and it seems that HTTP-POST binding will not be implemented soon. One good reason avanced:

if you review Conformance Requirements for the OASIS Security Assertion Markup Language (SAML) V2.0 Page 9, you will see that all IdPs MUST support the HTTP-Redirect binding, so you should experience any issue with IdPs that follows the SAML standard rules.

— pitbulk, main contributor of OneLogin PHP-SAML lib, on 27 Oct 2017 (source)

I found some interresting discussions:

• The complete discussion of the quote below (and with a simple code example without signing request)
• PR 422 with a proposal to support HTTP-POST binding
• A previous feature request from 2015

Well, we have to deal with non fully standard IDP and I assume we are not alone :)

I understand that this kind of code (building and returning an HTML Form) doesn't fit well in a library and will increase the complexity (and support request). Still it "feel ok" in a component that use the lib as the work and changes was less than expected (see the patch).

Currently only Login is implemented under HTTP-POST binding but soon we will have to deal with the Logout too.
I'm really curious about your feedback on this!

Kind regards,
Gilles.

Wow, nice work. I'm going to set "Needs review" to indicate that there is a patch. (I could have set "needs work" but I don't have specific feedback.)

I'm unlikely to commit this though, before having some longer-term stability assurance in the form of functional tests that exercise test logins. (#3202137: Write tests) Otherwise this will break at some point, for lack of me testing it manually.
And the likelihood of those tests being written is... well, your guess is as good as mine...

I also need to deal with an IdP than only supports POST requests, so I've been trying out this patch, which seems to work.

This IdP requires the login requests to be signed too, so I was also very interested in the

$add_cert = $add_cert === 'FAKE' && !empty($library_config['httpPostBinding']) ? TRUE : $add_cert;

hunk ; can't figure out though how you can end up with $library_config['httpPostBinding'] being set as is though, I guess you have another custom patch to set it ? That's what I did, and with all that, the communication with the IdP seems to work fine.