|
|
Were you running 5.0.1 on the same platform (Ubuntu 20.04)?
Are you using the nightly builds? Are you compiling sogod yourself? |
|
|
|
Yes I have production running on Ubuntu 20.04 and an upgrade to one of those server builds will break SAML auth.
I'm using the production builds. I did try with the nightly build to see if that fixed it but it didn't. It's not obvious to me which of the updates from 5.0.1 to 5.1.0 would have broken SAML auth but it's reproducible. |
|
|
|
I am experiencing the same error with v5.1.0
I am compiling SOGo myself in the Dockerfile: https://gitlab.com/flap-box/sogo/-/blob/master/Dockerfile.
The configuration file used is with SAML properties turned off: https://gitlab.com/flap-box/sogo/-/blob/master/config/sogo.template.conf
With debug log enabled I have that:
|SOGo| starting method 'GET' on uri '/SOGo/saml2-metadata'
<0x0x556fbb137450[SOGoCache]> Cache cleanup interval set every 300.000000 seconds
<0x0x556fbb137450[SOGoCache]> Using host(s) 'memcached' as server(s)
|SOGo| traverse(acquire): SOGo => saml2-metadata
|SOGo| do traverse name: 'SOGo'
|SOGo| do traverse name: 'saml2-metadata'
[ERROR] [so-action 0x0x556fbb43fa50 SOGoSAML2Actions] did not find action class: SOGoSAML2Actions
[ERROR] [so-action 0x0x556fbb1102e0 SOGoSAML2Actions] did not find method 'SOGoSAML2Actions'
|SOGo| traverse miss: name=saml2-metadata, acquire: i=1,count=2
|SOGo| miss is last object.
|SOGo| handle miss error: <SoAuthRequiredException: 0x556fbb463dc0> NAME:SoAuthRequired REASON:authentication required
PG0x0x556fbb23f0c0 SQL: SELECT c_defaults FROM sogo_user_profile WHERE c_uid = 'anonymous'
|SOGo| request took 0.038368 seconds to execute
<0x0x556fbb1ad300[WOResponse]> Zipping of response disabled
sogo "GET /SOGo/saml2-metadata HTTP/1.1" 200 27984/0 0.040 - - 4M - 12 |
|
|
|
Can I provide any more info or do anything further to help troubleshoot this issue? |
|
|
|
Try to disable SOGoXSRFValidationEnabled in sogo.conf:
SOGoXSRFValidationEnabled = NO;
|
|
|
|
I'm afraid that on our SOGo installs SOGoXSRFValidationEnabled is already set to 'NO'. |
|
|
|
SOGoXSRFValidationEnabled is enabled by default since 5.1.0. If it's not explicitly set to NO in sogo.conf than it is enabled.
|
|
|
|
Sorry I should have been clearer. We do explicitly set it to NO. |
|
|
|
There's an issue with Debian/Ubuntu packaging and SAML support. We will fix it. |
|
