starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-02-09 11:19:38 +03:00
Code Issues 784 Packages Projects Releases 10 Wiki Activity

SAML Metadata Not Available from Metadata URL #5041

New Issue
Closed
opened 2026-02-05 09:36:01 +03:00 by OVERLORD · 3 comments
OVERLORD commented 2026-02-05 09:36:01 +03:00
Owner
Copy Link

Originally created by @eramnes on GitHub (Nov 5, 2024).

Attempted Debugging

  • I have read the debugging page

Searched GitHub Issues

  • I have searched GitHub for the issue.

Describe the Scenario

We are trying to set up SAML authentication for BookStack, but trying to access the metadata URL results in a blank page if SAML is enabled in the .env file, or redirects to the login page if SAML is not enabled. The BookStack instance appears to work normally if SAML is not configured in the .env (I am able to sign in with a local account, navigate, configure items, etc.), but once SAML is enabled all URLs only load a blank page.

I have enabled APP_DEBUG in the .env file, but there is no laravel.log written to storage/logs, despite the fact I am fairly certain that the nginx user/group has write permissions to that directory:

# ls -alZ
total 4
drwxrwxr-x.  9 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0  106 Nov  1 15:48 .
drwxr-xr-x. 16 gfdcadmin nginx unconfined_u:object_r:httpd_sys_content_t:s0    4096 Nov  5 13:28 ..
drwxrwxr-x.  2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   24 Nov  1 15:48 app
drwxrwxr-x.  2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   24 Nov  1 15:48 backups
drwxrwxr-x.  2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   24 Nov  1 15:48 clockwork
drwxrwxr-x.  2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   24 Nov  1 15:48 fonts
drwxrwxr-x.  5 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   66 Nov  1 15:48 framework
drwxrwxr-x.  2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   24 Nov  1 15:48 logs
drwxrwxr-x.  4 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0   33 Nov  1 15:48 uploads

The only "error" I can see when SAML is enabled is in the nginx access.log, which is a 500 error:

10.133.0.45 - - [05/Nov/2024:13:18:20 +0000] "GET /saml2/metadata HTTP/1.1" 500 5 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-"

If SAML is not enabled, access.log shows a 302 redirect to the login page:

10.133.0.45 - - [05/Nov/2024:13:54:37 +0000] "GET /saml2/metadata HTTP/1.1" 302 378 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-"
10.133.0.45 - - [05/Nov/2024:13:54:38 +0000] "GET / HTTP/1.1" 302 402 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-"
10.133.0.45 - - [05/Nov/2024:13:54:38 +0000] "GET /login HTTP/1.1" 200 8830 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-"

I followed the permissions configuration documentation for the BookStack root directory including the SELinux configuration, and given it seems to be working OK without SAML configured I don't think it's a permission issue but I could be missing something. I did tail the audit.log when attempting to access the metadata URL and didn't see any SELinux denies.

I'm not sure where to go from here as without the metadata XML file we can't get our IDP configured properly, and I can't see any error messages that show me what's going on.

Any assistance that someone can offer would be appreciated.

Exact BookStack Version

v24.10

Log Content

No response

Hosting Environment

# php -version
PHP 8.3.13 (cli) (built: Oct 22 2024 18:39:14) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.3.13, Copyright (c) Zend Technologies

# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.4 (Plow)

# nginx -version
nginx version: nginx/1.20.1

# mysql --version
mysql  Ver 15.1 Distrib 10.5.22-MariaDB, for Linux (x86_64) using  EditLine wrapper

BookStack was installed using the manual install method from the documentation to /var/www/bookstack. File permissions were assigned based on the filesystems permission documentation. There is no proxy used on this machine. It is a "Standard B2s" VM hosted in Azure. BookStack/nginx is using HTTPS.

Originally created by @eramnes on GitHub (Nov 5, 2024). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario We are trying to set up SAML authentication for BookStack, but trying to access the metadata URL results in a blank page if SAML is enabled in the .env file, or redirects to the login page if SAML is not enabled. The BookStack instance appears to work normally if SAML is not configured in the .env (I am able to sign in with a local account, navigate, configure items, etc.), but once SAML is enabled all URLs only load a blank page. I have enabled APP_DEBUG in the .env file, but there is no laravel.log written to storage/logs, despite the fact I am fairly certain that the nginx user/group has write permissions to that directory: ``` # ls -alZ total 4 drwxrwxr-x. 9 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 106 Nov 1 15:48 . drwxr-xr-x. 16 gfdcadmin nginx unconfined_u:object_r:httpd_sys_content_t:s0 4096 Nov 5 13:28 .. drwxrwxr-x. 2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 24 Nov 1 15:48 app drwxrwxr-x. 2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 24 Nov 1 15:48 backups drwxrwxr-x. 2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 24 Nov 1 15:48 clockwork drwxrwxr-x. 2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 24 Nov 1 15:48 fonts drwxrwxr-x. 5 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 66 Nov 1 15:48 framework drwxrwxr-x. 2 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 24 Nov 1 15:48 logs drwxrwxr-x. 4 gfdcadmin nginx unconfined_u:object_r:httpd_sys_rw_content_t:s0 33 Nov 1 15:48 uploads ``` The only "error" I can see when SAML is enabled is in the nginx access.log, which is a 500 error: ``` 10.133.0.45 - - [05/Nov/2024:13:18:20 +0000] "GET /saml2/metadata HTTP/1.1" 500 5 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-" ``` If SAML is not enabled, access.log shows a 302 redirect to the login page: ``` 10.133.0.45 - - [05/Nov/2024:13:54:37 +0000] "GET /saml2/metadata HTTP/1.1" 302 378 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-" 10.133.0.45 - - [05/Nov/2024:13:54:38 +0000] "GET / HTTP/1.1" 302 402 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-" 10.133.0.45 - - [05/Nov/2024:13:54:38 +0000] "GET /login HTTP/1.1" 200 8830 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0" "-" ``` I followed the permissions configuration documentation for the BookStack root directory including the SELinux configuration, and given it seems to be working OK without SAML configured I don't think it's a permission issue but I could be missing something. I did tail the audit.log when attempting to access the metadata URL and didn't see any SELinux denies. I'm not sure where to go from here as without the metadata XML file we can't get our IDP configured properly, and I can't see any error messages that show me what's going on. Any assistance that someone can offer would be appreciated. ### Exact BookStack Version v24.10 ### Log Content _No response_ ### Hosting Environment ``` # php -version PHP 8.3.13 (cli) (built: Oct 22 2024 18:39:14) (NTS gcc x86_64) Copyright (c) The PHP Group Zend Engine v4.3.13, Copyright (c) Zend Technologies ``` ``` # cat /etc/redhat-release Red Hat Enterprise Linux release 9.4 (Plow) ``` ``` # nginx -version nginx version: nginx/1.20.1 ``` ``` # mysql --version mysql Ver 15.1 Distrib 10.5.22-MariaDB, for Linux (x86_64) using EditLine wrapper ``` BookStack was installed using the [manual install](https://www.bookstackapp.com/docs/admin/installation/#manual) method from the documentation to /var/www/bookstack. File permissions were assigned based on the filesystems permission documentation. There is no proxy used on this machine. It is a "Standard B2s" VM hosted in Azure. BookStack/nginx is using HTTPS.
OVERLORD added the 🐕 Support label 2026-02-05 09:36:01 +03:00
OVERLORD commented 2026-02-05 09:36:07 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Nov 5, 2024):

Hi @eramnes

but once SAML is enabled all URLs only load a blank page.

That generally indicates an issue with option formatting in the .env file.
Ensure options are formatted properly, ensuring any value which contain spaces or hashes are wrapped in quotes, for example:

SAML2_NAME="My login option"
@ssddanbrown commented on GitHub (Nov 5, 2024): Hi @eramnes > but once SAML is enabled all URLs only load a blank page. That generally indicates an issue with option formatting in the `.env` file. Ensure options are formatted properly, ensuring any value which contain spaces or hashes are wrapped in quotes, for example: ```bash SAML2_NAME="My login option" ```
OVERLORD commented 2026-02-05 09:36:09 +03:00
Author
Owner
Copy Link

@eramnes commented on GitHub (Nov 5, 2024):

@ssddanbrown

Thank you for the info. You were correct on this, there was a space in the SAML2_NAME field which after quoting has resolved the issue. Sorry to have taken up your time for such a simple misconfiguration, I should have double-checked that to begin with.

Have a good rest of your day and thanks for the assistance!

@eramnes commented on GitHub (Nov 5, 2024): @ssddanbrown Thank you for the info. You were correct on this, there was a space in the SAML2_NAME field which after quoting has resolved the issue. Sorry to have taken up your time for such a simple misconfiguration, I should have double-checked that to begin with. Have a good rest of your day and thanks for the assistance!
OVERLORD commented 2026-02-05 09:36:11 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Nov 5, 2024):

No worries, happy you found the problem!

@ssddanbrown commented on GitHub (Nov 5, 2024): No worries, happy you found the problem!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label 🐕 Support
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#5041
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?