Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
en:2.0:single_sign_on:saml_dokuwiki [2026/09/04 15:49] – [Caveats and Things to Consider] kainhoferen:2.0:single_sign_on:saml_dokuwiki [2026/09/04 16:04] (current) – [Caveats and Things to Consider] kainhofer
Line 101: Line 101:
 ==== Caveats and Things to Consider ==== ==== Caveats and Things to Consider ====
  
-  * Dokuwiki is picky about signatures. If a SAML response is not signed, login will not be possible, but no corresponding error message will be shown. After an apparent login, the user will arrive at dokuwiki with no user logged in (actually, DokuWiki even silently triggers a logout!). Make sure that in Admidio's client setting for the Dokuwiki SAML client the checkbox "Also sign SAML responses" is checked! +  * Dokuwiki is **picky about signatures**. If a SAML response is not signed, login will not be possible, but no corresponding error message will be shown. After an apparent login, the user will arrive at dokuwiki with no user logged in (actually, DokuWiki even silently triggers a logout!). Make sure that in Admidio's client setting for the Dokuwiki SAML client the checkbox "Also sign SAML responses" is checked! 
-  * DokuWiki's single log out mechanism for SAML is broken: +  * DokuWiki's **single log out mechanism for SAML is broken**: 
     * Instead of the logged-in user, DokuWiki sends its own client ID, so Admidio never knows, which user is supposed to be logged out. Only the browser session ID is available. As a workaround, Admidio looks up all logged-in users attached to that browser session and performs a single-log-out on them.     * Instead of the logged-in user, DokuWiki sends its own client ID, so Admidio never knows, which user is supposed to be logged out. Only the browser session ID is available. As a workaround, Admidio looks up all logged-in users attached to that browser session and performs a single-log-out on them.
     * Single-Log initiated from another SAML client does not log out DokuWiki. Dokuwiki's SAML plugin just clears its login, but misses the relevant cookie, so the next reload will appear logged-in in dokuwiki again locally.     * Single-Log initiated from another SAML client does not log out DokuWiki. Dokuwiki's SAML plugin just clears its login, but misses the relevant cookie, so the next reload will appear logged-in in dokuwiki again locally.
  • en/2.0/single_sign_on/saml_dokuwiki.txt
  • Last modified: 2026/09/04 16:04
  • by kainhofer