Hello! At the moment, we are setting up SAML authentication in gitlab (sp) using Gluu (IDP). Between gitlab and Gluu TR has been configured. Gluu IDP settings used the official documentation. This manual was used to set up [Gitlab SP ](https://docs.gitlab.com/ee/integration/saml.html) Gitlab is currently sending a request above: ``` <samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://gitlab.example.com:8443/users/auth/saml/callback" Destination="https://gluu.test.com/idp/profile/SAML2/Redirect/SSO" ID="_26f953a2-c631-468f-8a21-c70233689dc8" IssueInstant="2022-12-07T09:43:57Z" Version="2.0"> <saml:Issuer>https://gitlab.example.com</saml:Issuer> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"></samlp:NameIDPolicy> </samlp:AuthnRequest> ``` and we get an response: ``` <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://gitlab.example.com:8443/users/auth/saml/callback" ID="_b83e3c2c8c96a03871d608035c536d45" InResponseTo="_26f953a2-c631-468f-8a21-c70233689dc8" IssueInstant="2022-12-07T09:44:00.927Z" Version="2.0"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://gluu.test.com/idp/shibboleth</saml2:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod> <ds:Reference URI="#_b83e3c2c8c96a03871d608035c536d45"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod> <ds:DigestValue>********</ds:DigestValue> </ds:Reference> <ds:SignatureValue>********</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>********</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <saml2p:Status> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:**InvalidNameIDPolicy**"></saml2p:StatusCode> </saml2p:StatusCode> <saml2p:StatusMessage>**An error occurred**.</saml2p:StatusMessage> </saml2p:Status> </saml2p:Response> ``` Apparently we are doing something wrong. It looks like we missed most of the guide. Please help if you find the time. gitlab.rb: ``` gitlab_rails['omniauth_allow_single_sign_on'] = ['saml'] gitlab_rails['omniauth_block_auto_created_users'] = false gitlab_rails['omniauth_auto_link_saml_user'] = true gitlab_rails['omniauth_providers'] = [ { "name" => "saml", "label" => "SSO Gluu", "args" => { "assertion_consumer_service_url": "https://gitlab.example.com:8443/users/auth/saml/callback", "idp_cert_fingerprint": "11:D0:B6:A9:A5:AA:65:5C:41:EC:5C:3D:27:70:C8:27:A9:CF:D5:0B", #"idp_sso_target_url": "https://gluu.test.com/idp/shibboleth", "idp_sso_target_url": "https://gluu.test.com/idp/profile/SAML2/Redirect/SSO", "issuer": "https://gitlab.example.com", "name_identifier_format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", "attribute_statements": { email: ['emailAddress'] } } } ] ``` and saml-nameid.xml ``` <beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context" xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd" default-init-method="initialize" default-destroy-method="destroy"> <util:list id="shibboleth.SAML2NameIDGenerators"> <ref bean="shibboleth.SAML2TransientGenerator" /> <ref bean="shibboleth.SAML2PersistentGenerator" /> <bean parent="shibboleth.SAML2AttributeSourcedGenerator" p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:attributeSourceIds="#{ {'email'} }"/> <bean parent="shibboleth.SAML2AttributeSourcedGenerator" p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/> </util:list> <util:list id="shibboleth.SAML1NameIdentifierGenerators"> <ref bean="shibboleth.SAML1TransientGenerator" /> <ref bean="shibboleth.SAML1PersistentGenerator" /> <bean parent="shibboleth.SAML2AttributeSourcedGenerator" p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:attributeSourceIds="#{ {'email'} }"/> <bean parent="shibboleth.SAML1AttributeSourcedGenerator" p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:attributeSourceIds="#{ {'email'} }" /> </util:list> </beans> ```