Help needed SAML authentification setup on tutor 18.1

Site Operators Tutor Help
,
1

Hello everyone,

I’m integrating SWITCH eduID as a SAML 2FA provider on my Tutor-hosted Open edX instance (openedx.example.com). Despite following the docs and enabling the SAML backend, I still get a 404 when browsing: https://openedx.example.com/auth/saml/metadata.xml

What I’ve done:

  • Generated key/cert pair

  • Wrote a small Tutor plugin to enable ENABLE_THIRD_PARTY_AUTHm add common.djangoapps.third_party_auth.saml.SAMLAuthBackend and the key/cert pair

In Django admin:

Yet the metadata endpoint never appears. I’ve confirmed inside the LMS container that the key/cert are in /tutor/config/, the SAML backend is in AUTHENTICATION_BACKENDS, and the feature flag is true.

My questions:

What am I missing to activate /auth/saml/metadata.xml on Redwood?
Are there any extra flags, migrations or URL patterns that need enabling?
Has anyone done this successfully with SWITCH eduID on Tutor 18?
Any tips or example snippets would be greatly appreciated. Thanks!

2

Hi @vandri and welcome to the community!

@tutor-maintainers any advice here?

1 Like
3

I think this might be a question that would be better directed to people who have a deep understanding of the SSO flow in edx-platform.

4

Unfortunately I don’t know who to tag for that :sweat_smile:

5

Hello @vandri
I’m facing the same challenge with Switch edu-ID and I was wondering if you could eventually get the SAML authentication working with this specific Identity Provider.
I followed the same steps as you described and the closest I got to a working state is having the Indentity Provider listed on the Sign In form (twice) but then when I click on it, I get an error:

Error: Unable to Respond

Thanks in advance for any pointer.

image
image555×537 39.6 KB

6

Hi @Alexandre-DSL , I ended up leaving the SAML authentication and made a plugin for tutor to use openID.

eduid.yml (970 Bytes)

installing and enabling this plugin gives you and entry in the backend field in the django admin panel when adding a Oauth provider.

I registered my instance with the callback url {URL to your instance }/auth/complete/eduid/ on SWITCH. Once you register you get a client id and a secret .

here is the admin setup on django side:

admin_scr
admin_scr998×1175 105 KB

I hope this helps!

1 Like
7

Thanks very much for sharing @vandri !
In the meantime, I got the SAML authentication to work but it is still flimsy as the metadata for the Identity Provider are not always ready.
I’m now contemplating switching to OpenID as well following your trace using your plugin. I might reach again if necessary. Thanks again for your reply!