<p>We managed to circumvent the issue by using the sql session storage SimpleSAML PHP also provides. Not a real solution but a viable workaround.</p>

CC BY-SA 3.0
2016-08-11T13:44:03.357Z
2016-08-11T13:44:03.357Z
Frank Zwiers
<p>We have been trying to implement <a href="https://simplesamlphp.org/" rel="nofollow">SimpleSAML PHP</a> in a Craft plugin to facilitate a SAML login for one of our sites. The problem we are running into is that we always get the NOSTATE error.</p>

<p>The response that gets logged does seem to be correct and the login does succeed, only the way it gets handled in the ACS callback seems to be wrong. That is the moment we get the NOSTATE error. The ACS code is copied from the default SimpleSAML PHP implementation.</p>

<p>We think it has something to do with the session. Something weird seems also to be going regarding the session id that's generated, SimpleSAML PHP generates a new session id regardless of an existing session from Craft. After debugging we located where the session id was generated and forced this to use the Craft session id. However this doesn't have any effect at all.</p>

<p>We've been debugging a lot but can't seem to figure where the State should be fixed. Does anyone have any clue or any idea how to fix this problem.</p>

CC BY-SA 3.0
2016-08-10T19:03:38.747Z
This is going to be hard to debug without some more information... what's the actual NOSTATE error? What's ACS stand for? Maybe try throwing and xDebug breakpoint in the callback and see what's going on?
Brad Bell
CC BY-SA 3.0
2016-08-11T11:35:38.150Z
The NOSTATE error is a generic error that occurs when there is some problem regarding the state that should have been saved in the session. In our case: it doesn't exist. ACS stands for Assertion Consumer Service and this is the callback where the user is redirected after the SAML login has completed so the application that is requesting the authentication can verify the response and act upon the information(e.g. logging in the user in their own application). SimpleSAML PHP uses it's own settings for session management and herein probably lies the problem.
Frank Zwiers
<plugin-development><session>
Implementing SimpleSAML PHP in Craft plugin
# Implementing SimpleSAML PHP in Craft plugin

(Asked by: username_0 on 2016-08-10)

We have been trying to implement [SimpleSAML PHP](https://simplesamlphp.org/) in a Craft plugin to facilitate a SAML login for one of our sites. The problem we are running into is that we always get the NOSTATE error.

The response that gets logged does seem to be correct and the login does succeed, only the way it gets handled in the ACS callback seems to be wrong. That is the moment we get the NOSTATE error. The ACS code is copied from the default SimpleSAML PHP implementation.

We think it has something to do with the session. Something weird seems also to be going regarding the session id that's generated, SimpleSAML PHP generates a new session id regardless of an existing session from Craft. After debugging we located where the session id was generated and forced this to use the Craft session id. However this doesn't have any effect at all.

We've been debugging a lot but can't seem to figure where the State should be fixed. Does anyone have any clue or any idea how to fix this problem.

**Tags:** plugin-development, session
> **Comments:**
> **username_1**: This is going to be hard to debug without some more information... what's the actual NOSTATE error? What's ACS stand for? Maybe try throwing and xDebug breakpoint in the callback and see what's going on?  
> **username_0**: The NOSTATE error is a generic error that occurs when there is some problem regarding the state that should have been saved in the session. In our case: it doesn't exist. ACS stands for Assertion Consumer Service and this is the callback where the user is redirected after the SAML login has completed so the application that is requesting the authentication can verify the response and act upon the information(e.g. logging in the user in their own application). SimpleSAML PHP uses it's own settings for session management and herein probably lies the problem.  

---

## 1 answers

### Answer by username_0 on 2016-08-11. Score: 4

We managed to circumvent the issue by using the sql session storage SimpleSAML PHP also provides. Not a real solution but a viable workaround.


---

