mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 03:09:39 +03:00
Try to use saml authentication with AD FS #1513
Closed
opened 2026-02-05 01:06:37 +03:00 by OVERLORD
·
7 comments
No Branch/Tag Specified
development
further_theme_development
l10n_development
release
llm_only
vectors
v25-11
docker_env
drawio_rendering
user_permissions
ldap_host_failover
svg_image
prosemirror
captcha_example
fix/video-export
v25.12.3
v25.12.2
v25.12.1
v25.12
v25.11.6
v25.11.5
v25.11.4
v24.11.4
v25.11.3
v25.11.2
v25.11.1
v25.11
v25.07.3
v25.07.2
v25.07.1
v25.07
v25.05.2
v25.05.1
v25.05
v25.02.5
v25.02.4
v25.02.3
v25.02.2
v25.02.1
v25.02
v24.12.1
v24.12
v24.10.3
v24.10.2
v24.10.1
v24.10
v24.05.4
v24.05.3
v24.05.2
v24.05.1
v24.05
v24.02.3
v24.02.2
v24.02.1
v24.02
v23.12.3
v23.12.2
v23.12.1
v23.12
v23.10.4
v23.10.3
v23.10.2
v23.10.1
v23.10
v23.08.3
v23.08.2
v23.08.1
v23.08
v23.06.2
v23.06.1
v23.06
v23.05.2
v23.05.1
v23.05
v23.02.3
v23.02.2
v23.02.1
v23.02
v23.01.1
v23.01
v22.11.1
v22.11
v22.10.2
v22.10.1
v22.10
v22.09.1
v22.09
v22.07.3
v22.07.2
v22.07.1
v22.07
v22.06.2
v22.06.1
v22.06
v22.04.2
v22.04.1
v22.04
v22.03.1
v22.03
v22.02.3
v22.02.2
v22.02.1
v22.02
v21.12.5
v21.12.4
v21.12.3
v21.12.2
v21.12.1
v21.12
v21.11.3
v21.11.2
v21.11.1
v21.11
v21.10.3
v21.10.2
v21.10.1
v21.10
v21.08.6
v21.08.5
v21.08.4
v21.08.3
v21.08.2
v21.08.1
v21.08
v21.05.4
v21.05.3
v21.05.2
v21.05.1
v21.05
v21.04.6
v21.04.5
v21.04.4
v21.04.3
v21.04.2
v21.04.1
v21.04
v0.31.8
v0.31.7
v0.31.6
v0.31.5
v0.31.4
v0.31.3
v0.31.2
v0.31.1
v0.31.0
v0.30.7
v0.30.6
v0.30.5
v0.30.4
v0.30.3
v0.30.2
v0.30.1
v0.30.0
v0.29.3
v0.29.2
v0.29.1
v0.29.0
v0.28.3
v0.28.2
v0.28.1
v0.28.0
v0.27.5
v0.27.4
v0.27.3
v0.27.2
v0.27.1
v0.27
v0.26.4
v0.26.3
v0.26.2
v0.26.1
v0.26.0
v0.25.5
v0.25.4
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.2
v0.23.1
v0.23.0
v0.22.0
v0.21.0
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.0
v0.18.5
v0.18.4
v0.18.3
v0.18.2
v0.18.1
v0.18.0
v0.17.4
v0.17.3
v0.17.2
v0.17.1
v0.17.0
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.3
v0.14.2
v0.14.1
v0.14.0
v0.13.1
v0.13.0
v0.12.2
v0.12.1
v0.12.0
v0.11.2
v0.11.1
v0.11.0
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.2
v0.8.1
v0.8.0
v0.7.6
v0.7.5
v0.7.4
v0.7.3
0.7.2
v.0.7.1
v0.7.0
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.0
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/BookStack#1513
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @amelie-excent on GitHub (Feb 4, 2020).
Hello,
I try to configure SAML with AD FS.
I followed the instruction here to configure env file with saml but I always get this error :
Invalid issuer in the Assertion/Response (expected 'https://adfs-server/adfs/services/trust/artifactresolution', got 'http://adfs-server/adfs/services/trust')
here is part of my .env config :
AUTH_METHOD=saml2 SAML2_NAME=SSO SAML2_EMAIL_ATTRIBUTE=email SAML2_EXTERNAL_ID_ATTRIBUTE=uid SAML2_DISPLAY_NAME_ATTRIBUTES=firstName|lastName SAML2_IDP_ENTITYID=https://adfs-server/adfs/services/trust/artifactresolution SAML2_AUTOLOAD_METADATA=false SAML2_IDP_SSO=https://adfs-server/adfs/ls/IdpInitiatedSignOn.aspx SAML2_IDP_x509=<cert x509>I don't understand how I got this url http://adfs-server/adfs/services/trust
Thanks
@finnwessel commented on GitHub (Feb 4, 2020):
Did you try to use
SAML2_AUTOLOAD_METADATA=true? Had a similar issue with Keycloak as IDP and with enabling the autoload function this problem was solved@amelie-excent commented on GitHub (Feb 4, 2020):
Yes I tried and I get this error :
Error on parseRemoteXML. The requested URL returned error: 400 Bad Request
@amelie-excent commented on GitHub (Feb 4, 2020):
https://flareapp.io/share/VmeXpq5Q#F49
@finnwessel commented on GitHub (Feb 4, 2020):
Does this url
https://adfs-server/adfs/services/trust/artifactresolutionprovide the endpoint configuration in xml format ?@amelie-excent commented on GitHub (Feb 4, 2020):
No didn't, I replaced it with /FederationMetadata/2007-06/FederationMetadata.xml url and put SAML2_AUTOLOAD_METADATA=true and it's OK now :)
Thanks for your help
@ssddanbrown commented on GitHub (Feb 5, 2020):
Thank you @finnwessel for helping out on this one!
@Kol8bok commented on GitHub (Sep 19, 2022):
Hello,
I try to configure SAML with AD FS.
Tell me how to solve the problem
I set everything up, but the error keeps popping up
My config .env:
AUTH_METHOD=saml2
AUTH_AUTO_INITIATE=false
SAML2_NAME=BOOKSTACK
SAML2_EMAIL_ATTRIBUTE=email
SAML2_EXTERNAL_ID_ATTRIBUTE=id
SAML2_DISPLAY_NAME_ATTRIBUTES=firstName|lastName
SAML2_IDP_ENTITYID=https://data-centre.siecom.pro/FederationMetadata/2007-06/Fe$
SAML2_AUTOLOAD_METADATA=true
SAML2_IDP_SSO=https://data-centre.siecom.pro/adfs/ls/
#SAML2_IDP_SLO=https://data-centre.siecom.pro/adfs/ls/
SAML2_IDP_x509="-----BEGIN CERTIFICATE-----
MIIFZTCCBE2gAwIBAgITFgAAAA/znQbmfG8ocwABAAAADzANBgkqhkiG9w0BAQsF
ADA8MRMwEQYKCZImiZPyLGQBGRYDcHJvMRgwFgYKCZImiZPyLGQBGRYIdXNlcmdh
dGUxCzAJBgNVBAMTAkNBMB4XDTIyMDkxNjA2Mzg1N1oXDTIzMDkxNjA2Mzg1N1ow
ADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKrSC+w1KKqIjKRqqB+O
..........................................................."
SAML2_IDP_AUTHNCONTEXT=true
On the AD FS:
The file with metadata https://wiki.siecom.pro/saml2/metadata in AD FS was installed well, there were no problems with this
Set up the attributes as follows:
LDAP | Party trust wizard
E-Mail-Addresses | email
Given-Name | lastName
User-Principal-Name | id
Surname | firstName
Gives error on debug:
Invalid ACS Response: invalid_response
Debug:
Tell me what I'm doing wrong?