Snipe-IT LDAP and SAML support

[localzuk]

I am in the middle of setting up Snipe-IT for use here to track our Chromebooks and have hit a brick wall with LDAP and SAML.

 

With LDAP, I've got it all set up as it should be, and sync works fine. However, user validation consistently fails and LDAP users cannot log in.

 

With SAML, I've set it up to use Google as the IdP, but when you try and use it either by clicking the app icon in the Google Waffle, or by using the Login via SAML link on the Snipe-IT login form, I always get "There was a problem while trying to log you in, please try again."

 

Does anyone have one or both of these working?

[bald_pig]

Here are my LDAP settings:

 

[localzuk]

Great, thanks. Got it working via LDAP now.

 

So that leaves SAML (which is my preferred auth method, as it will allow easy login for kids to sign their agreements etc...)

[bald_pig]

What are your current SAML settings?

[bald_pig]

Actually, looking at the documentation, you'll need the account in snipe-it before you can log in using SAML, so unless you manually imported the users, you'll need to do an LDAP sync first.

[localzuk]

So, LDAP sync has all run fine. All my users are in the system now.

 

SAML is set up against Google. I followed the instructions for creating a SAML app in Google Workspace, downloaded the metadata file and uploaded it into Snipe-IT. Then set the Entity ID, ACS URL and SLS URL per the info on the Snipe-IT SAML page.

 

I have also added debug=true to the SAML Custom Settings so I can try and figure out what's going on. The laravel.log in storage/logs on the server is showing me this:

 

[2021-11-11 16:04:09] production.ERROR: SAML Response not found, Only supported HTTP_POST Binding {"exception":"[object] (OneLogin\\Saml2\\Error(code: 8): SAML Response not found, Only supported HTTP_POST Binding at /var/www/snipe-it/vendor/onelogin/php-saml/src/Saml2/Auth.php:257)

[PeteMoss007]

Are you using the LDAP sync to pull users from Google and into Snipe-IT?

[whartomt01]

Just struggling with LDAP sync from Google. Anyone using from Google rather than AD. If so are you willing to share your settings (LDAP Filter or even Base bind DN)