Check possibility for using REQUEST_URI or similar variables instead of PATH_INFO about simplesamlphp HOT 10 CLOSED

This is just a note for anyone using simple php with nginx. Ran into some issues around path info, and here is my nginx config and the changes I made to the latest stable simplephp (1.13):

NGINX:

server {
    ...
    location ^~ /simplesaml {
        alias /var/simplesamlphp/www;
        location ~ ^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
            include fastcgi_params;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$phpfile;
            fastcgi_param PATH_INFO $pathinfo if_not_empty;
        }
    }
}

And the above - even after setting baseurl in configs caused some destination in response doesn't match the current url errors.

The first was of the form:

destination http://www.something.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp
current (shown wrong the current is actually matched the dest) http://www.something.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp/saml/sp/saml2-acs.php/default-sp

To fix the above

www/module.php line ~130

        if (preg_match('#\.php$#D', $path)) {
                /* PHP file - attempt to run it. */
-               $_SERVER['SCRIPT_NAME'] .= '/' . $module . '/' . $url;
+               //$_SERVER['SCRIPT_NAME'] .= '/' . $module . '/' . $url;
                require($path);
                exit();
        }

At this point the error became:

destination: http://www.something.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp
current (again wrong) : http://www.something.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp/default-sp

to fix this:

lib/SimpleSAML/Utilities.php line ~156

                $selfURLhost = self::selfURLhost();
                $selfURLhost .= $_SERVER['SCRIPT_NAME'];
                if (isset($_SERVER['PATH_INFO'])) {
-                       $selfURLhost .= $_SERVER['PATH_INFO'];
+                       //$selfURLhost .= $_SERVER['PATH_INFO'];
                }
                return $selfURLhost;

And with the above two changes I am able to log in to the test OpenIdp Account.

I'm sure the fixes could be done in the NGINX config, but the above seems to work.

from simplesamlphp.

Hi Olav, Yep, it's feasible, I already did it with a little raw patch to SSP 1.11 and all works well under nginx.

Check the changes here:

https://github.com/creativeprogramming/simplesamlphp-samlogin/commit/1abbdc691f24a1374442024629101a4d7b837176

and here:

https://github.com/creativeprogramming/simplesamlphp-samlogin/commit/854e1116822d502fac8c4d636369f15f3eeb39bf

(In my raw workaround I overrided the $_SERVER['PATH_INFO'] variable to create it if not exists, but obviously this can be done in a cleaner way, i post it just to give you some inspiration)

Best Regards,
Stefano Gargiulo

from simplesamlphp.

Thanks! it solved my issue
(After a loooog internet search and trying to follow different advices that did not help)

btw, I am using latest master (14-8-2015), so I moved the above suggested code fix from
simplesamlphp/lib/SimpleSAML/Utilities.php
To:
simplesamlphp/lib/SimpleSAML/Utils/HTTP.php
As class SimpleSAML_Utilities @deprecated This entire class will be removed in SimpleSAMLphp 2.0.

from simplesamlphp.

Thank you for feedback i'm glad to have helped you a bit, and thanks for the info about deprecated class, I still have to upgrade I'm using 1.12 now.

from simplesamlphp.

Hi!

I might be missing something, but the two links provided by @creativeprogramming are broken.

Could someone provide a PR with the suggested changes on top of master, so that we can take a look into it and evaluate including it as the final solution to this issue?

Thanks!

from simplesamlphp.

Here is what I added to:
simplesamlphp/lib/SimpleSAML/Utils/HTTP.php

public static function __fixPathInfoForNginx() {
        $matches = array();
        if (preg_match("/^(.+\/module\.php)(\?)?(\/.+)$/", $_SERVER['REQUEST_URI'], $matches)) {
            $pathinfo = $matches[3];

            $m = array();
            if (preg_match("/(.*)\?(.*)/", $pathinfo, $m)) {
                $pathinfo = substr($pathinfo, 0, strripos($pathinfo, "?"));
            }
            $_SERVER['PATH_INFO'] = $pathinfo;
        //   $scriptname = str_ireplace($pathinfo, "", $matches[0]);
            $scriptname = substr($_SERVER['REQUEST_URI'], 0,  stripos($_SERVER['REQUEST_URI'], "module.php/")+strlen("module.php"));
            $_SERVER['SCRIPT_NAME'] = $scriptname;
        }
    }

    /**
     * Retrieve the current URL without the query parameters.
     *
     * @return string The current URL, not including query parameters.
     *
     * @author Andreas Solberg, UNINETT AS <[email protected]>
     */
    public static function getSelfURLNoQuery()
    {

    self::__fixPathInfoForNginx(); // fix PATH_INFO for NGINX // nadavkav

        $url = self::getSelfURLHost();
        $url .= $_SERVER['SCRIPT_NAME'];
        if (isset($_SERVER['PATH_INFO'])) {
            $url .= $_SERVER['PATH_INFO'];
        }
        return $url;
    }

And called it from:
module.php

try {

    SimpleSAML_Utilities::__fixPathInfoForNginx();

    if (empty($_SERVER['PATH_INFO'])) {
        throw new SimpleSAML_Error_NotFound('No PATH_INFO to module.php');
    }

from simplesamlphp.

I ran into the same Issue on lighttpd with Rewrite-Rules on.
I centralized $_SERVER['PATH_INFO'] as HTTP::getPathInfo(). At the moment I am running some Tests for rewriting $_SERVER['REQUEST_URI'] to $_SERVER['PATH_INFO'] in a more general way as @nadavkav did.
When I am ready, I will provide a PR.

from simplesamlphp.

That sounds promising @gfaust-qb, thanks a lot!

Please remember to add some unit tests too so that we can make sure that your new method continues to work over time as expected.

from simplesamlphp.

Hello!

Running v1.14.3 with php-fpm behind apache 2.4 in proxy pass mode is also affected by this issue. The patch linked by @didoda (when updated to use the new functions in Utils/HTTP.php) works.

It seems like $_SERVER['SCRIPT_NAME'] is populated differently when running with FastCGI, or php-fpm (common with nginx), as opposed to whatever the environment is where the code is written.

It is behaving as if $_SERVER['SCRIPT_NAME'] is already populated with the appropriate URL path in the former case, so the code is currently needlessly appending more to it.

Perhaps a better fix will be to test $_SERVER['SCRIPT_NAME'] before appending to it. I'll try and get a pull request set up today.

from simplesamlphp.

This issue should be fixed now thanks to @travishegner contribution. Thanks also to all who shared their feedback!

from simplesamlphp.