Problem: SSO login don't work because no identity provider are set up for use

[MiracErde]

Problem

If the SSO login don’t work because you get the following failure:

And in /var/log/univention/management-console-web-server.log you get this message

( WARN ) : 2043: SamlError: 500 There is a configuration error in the service provider: No identity provider are set up for use

Solution

Check if you have an entry in this path
ls -l /usr/share/univention-management-console/saml/idp/

total 8
-rw-r–r-- 1 root root 5209 Apr 6 12:11 ucs-sso.your_domain.intranet.xml

If you get an zero output like

total 0

So you have to force run the following join-scrip

univention-run-join-scripts --force --run-scripts 92univention-management-console-web-server.inst

Now check the path before and the login should work again.

Information

Here are some information about SSO in UCS

Reconfigure UCS Single Sign On

Reconfigure UCS Single Sign On By default, UCS Single Sign On uses a shared DNS record to provide a failover for the Login. The SAML Identity Provider is available at ucs-sso.domain.name, where domain.name is chosen during UCS installation. Administrators often want to configure Single Sign On to be available from the internet. As the UCS domain name is often chosen for an intranet scenario, service configuration has to be adapted to match the target domain- and hostnames. Involved service…

Q&A: How does the SAML workflow look like

Question: How does the saml workflow looks like, and which certificates are used. Answer: We want to have a look into the service provider initiated login. This can be separated in 3 steps The SP (servcie provider) is the UMC in this case. Memory hook: SP is the one, where you can do much more then login Step 1. The SP (e.g. UMC) contacts the IdP (simpleSAMLphp) with a SAML message: “Please login in this $user for me” This message is signed with http://$SP_FQDN/univention/saml/metadat…