Issue with setup Google SAML

[scipe]

Describe the issue

Hey folks. I have an issue with setup my kimai instance with my Google SAML.

Here is my docker compose configuration:

version: '3'
services:
  kimai:
    image: kimai/kimai2:apache
    restart: unless-stopped
    container_name: kimai
    volumes:
      - ./config.yaml:/opt/kimai/config/packages/local.yaml
    ports:
      - "8001:8001"
    environment:
      - DATABASE_URL=mysql://usr:pwd@host:port/db
      - TRUSTED_HOSTS=nginx,localhost,127.0.0.1
      - DEBUG=true

I also have nginx as reverse proxy that proxing 127.0.0.1:8001 to my 443 ssl and etc. Follow config:

server {
    server_name                 time.acme.com;
    location / {
          proxy_pass http://127.0.0.1:8001/;

          proxy_set_header  Host $http_host;
          proxy_set_header  X-Real-IP $remote_addr;
          proxy_set_header  X-Forwarded-Host $host:$server_port;
          proxy_set_header  X-Forwarded-Server $host;
          proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header  X-Forwarded-Proto $scheme;
          proxy_set_header  X-Forwarded-Port $server_port;
      }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/time.acme.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/time.acme.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = time.acme.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name                 time.acme.com;
    return 404; # managed by Certbot
}

My config.yaml:

kimai:
    saml:
        provider: google
        activate: true
        title: Login with Google
        mapping:
            - { saml: $Email, kimai: email }
            - { saml: $FirstName $LastName, kimai: alias }
            - { saml: $Title, kimai: title }
            - { saml: $AccountNumber, kimai: accountNumber }
        roles:
            resetOnLogin: true
            attribute: Groups
            mapping:
                # Insert your role-mapping here (ROLE_USER is added automatically)
                - { saml: KimaiSuperAdminGroup, kimai: ROLE_SUPER_ADMIN }
                - { saml: KimaiAdminGroup, kimai: ROLE_ADMIN }
                - { saml: KimaiTeamleadGroup, kimai: ROLE_TEAMLEAD }
        connection:
            idp:
                entityId: 'https://accounts.google.com/o/saml2?idpid=hidden_id'
                singleSignOnService:
                    url: 'https://accounts.google.com/o/saml2/idp?idpid=hidden_id'
                    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                #singleLogoutService:
                #    url: 'https://www.example.com/logout'
                #    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                x509cert: |
                    -----BEGIN CERTIFICATE-----
                    ...
                    ...
                    ...
                    ...
                    ...
                    ...
                    ...
                    ...
                    ...
                    ...
                    -----END CERTIFICATE-----
            # Your Kimai: replace https://www.example.com with your base URL
            sp:
                entityId: 'https://time.acme.com/auth/saml/metadata'
                assertionConsumerService:
                    url: 'https://time.acme.com/auth/saml/acs'
                    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
                singleLogoutService:
                    url: 'https://time.acme.com/auth/saml/logout'
                    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                #privateKey: ''
            # only set baseurl, if auto-detection doesn't work
            #baseurl: ''
            strict: true
            debug: true
            security:
                nameIdEncrypted: false
                authnRequestsSigned: false
                logoutRequestSigned: false
                logoutResponseSigned: false
                wantMessagesSigned: false
                wantAssertionsSigned: false
                wantNameIdEncrypted: false
                requestedAuthnContext: true
                signMetadata: false
                wantXMLValidation: true
                signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
                digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256'
            contactPerson:
                technical:
                    givenName: 'PERSONA_NAME'
                    emailAddress: 'usr@acme.com'
                support:
                    givenName: 'PERSONA_NAME'
                    emailAddress: 'usr@acme.com'
            organization:
                en:
                    name: 'ACME'
                    displayname: 'ACME'
                    url: 'https://acme.com'

The error I see in UI just: An authentication exception occurred. I would like to understand how to enable the log file property and how to debug the SSO connection?

I already tried

• I've read and searched the documentation.
• I've searched for similar issues in this repository.
• I've searched for similar issues in the discussions.

Kimai version

2.5.0

How do you run Kimai?

Docker

Which PHP version are you using?

8.1

Logfile

Missing logfile. I spend some time to figure out how to turn on this and didn't really find the answer.

Screenshots

[fibbs]

Same problem here. Scratching my head for an entire day now. I use keycloak to log in via SAML. I have a plugin visualizing SAML requests and responses, looks great, but kimai's login just shows me "An authentication exception has occured." How can I get more details on what did actually go wrong?

[scipe]

I haven't found time to debug it yet 😮‍💨

[kevinpapst]

All of you should stop testing complex setups with docker and proxies in between. Start by setting up Kimai in one public location and setup SAML. ONLY when that works, you add more components into the mix.

[scipe]

Hi @kevinpapst. Thats sounds little bit weird for me... I left exact question:

I would like to understand how to enable the log file property and how to debug the SSO connection?

Thats all I want to know to continue debug. Why you talking about "docker/proxies" make me no any sense since it's infrastructure and not the application level.

[mastertIT]

i tried with ADFS and have similar issues, i tried testing with and without a proxy in-front of kimai.
the saml responses look good on my setup too.

i think there's a bug in the onelogin portion, the issue is i haven't found a way to troubleshoot this in a more verbose way.
even enabling logging here didn't add enough detail to troubleshoot. https://github.com/kimai/kimai/blob/main/src/Saml/SamlAuthenticator.php#L82

[kevinpapst]

ADFS

What is that?

i think there's a bug

You think there is a bug, while dozens of Companies use it successfully.
I onboarded two customers just last week personally (one Google Workspace, one Azure AD) and know about more.
No issue, both setups were done in under 30 minutes including chit-chat during the call.

Yes, there might be some issues in certain setups, but I don't believe that it doesn't work without proxy, when following the docs ... because I use it every day.

While this is written for Cloud customers, you could try to compare your setup with these details:
https://www.kimai.org/documentation/cloud-saml.html

[mastertIT]

ADFS is Microsoft's version of SSO saml onprem.

i specifically mentioned there may be a bug in the onelogin portion, but haven't been able to troubleshoot it https://github.com/SAML-Toolkits/php-saml?tab=readme-ov-file#settings

if the same error occurs with multiple idp's there should be a way to debug it more verbosely.

[kevinpapst]

This issue was about Google Workspace.
Anyway: lets assume the reason for the problems is the same, it is still necessary that someone with dev knowledge adds debug infos to the code to find the problem. I don't see a chance to find the reason without that.

[mastertIT]

@scipei for some reason your reply was deleted but I wholly agree with you.
It doesn't make sense that the onelogin framework and kimai won't have proper debug hooks or doc's to troubleshoot this, considering there are a few people with similar errors.

[scipe]

@mastertIT my reply wasn't deleted. It's in different thread. But again - I am not talking about bug. I am talking about bad configuration from my side and just searching the way to debug it.

[kevinpapst]

One issue I saw several times is the attribute mapping. You need to make sure to read the docs:

Attributes you have to define the User attribute mapping like this (correct case is important, and you need to configure all attributes, even if you do not use them)

Often you have e.g. email instead of Email, which failed before without a log message.
The latest release, which I created a few minutes ago, has more logs for failed login attempts.
Give it a try.

[scipe]

Hi @kevinpapst. In general I did triple check even with two Google Workspace organizations. Same thing. So is there any way to see some logs and enable debug mode?

[kevinpapst]

Did you upgrade to the latest version?