Keycloak SAML: Found an Attribute element with duplicated Name

[aanno]

Steps to reproduce

1. Enable SSO in nextcloud with user_saml using keycloak (4.0.0.Final) as idp like described at https://stackoverflow.com/questions/48400812/sso-with-saml-keycloak-and-nextcloud
2. Trying to Log-in with the SSO test user configured in keycloak.
3. After keycloak login and redirect to nextcloud, I get an 'Internal Server Error'.
   In the nextcloud log/protocol I found the following:

   OneLogin_Saml2_ValidationError: Found an Attribute element with duplicated Name
   
   /var/www/html/nextcloud/custom_apps/user_saml/3rdparty/vendor/onelogin/php-saml/lib/Saml2/Auth.php - line 177: OneLogin_Saml2_Response->getAttributes()
   /var/www/html/nextcloud/custom_apps/user_saml/lib/Controller/SAMLController.php - line 219: OneLogin_Saml2_Auth->processResponse('ONELOGIN_1111a8...')
   [internal function] OCA\User_SAML\Controller\SAMLController->assertionConsumerService()
   /var/www/html/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 161: call_user_func_array(Array, Array)
   /var/www/html/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 91: OC\AppFramework\Http\Dispatcher->executeController(Object(OCA\User_SAML\Controller\SAMLController), 'assertionConsum...')
   /var/www/html/nextcloud/lib/private/AppFramework/App.php - line 115: OC\AppFramework\Http\Dispatcher->dispatch(Object(OCA\User_SAML\Controller\SAMLController), 'assertionConsum...')
   /var/www/html/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php - line 47: OC\AppFramework\App main('OCA\\User_SAML\\C...', 'assertionConsum...', Object(OC\AppFramework\DependencyInjection\DIContainer), Array)
   [internal function] OC\AppFramework\Routing\RouteActionHandler->__invoke(Array)
   /var/www/html/nextcloud/lib/private/Route/Router.php - line 297: call_user_func(Object(OC\AppFramework\Routing\RouteActionHandler), Array)
   /var/www/html/nextcloud/lib/base.php - line 999: OC\Route\Router->match('/apps/user_saml...')
   /var/www/html/nextcloud/index.php - line 42: OC handleRequest()
   {main}
   

Expected behaviour

Well, I'not sure who is the culprit (keycloak or user_saml). However, the error message would be more helpful if it would tell us which attribute name(s) is/are duplicated.

Perhaps an setup option to allow duplicated attribute names could be considered.

Nextcloud version: (see Nextcloud admin page)
13.0.4

Where did you install Nextcloud from:
docker image

[aanno]

To also tackle the problem from the keycloak site, I posted a question at stackoverflow as well.

[yennor]

take a look at:

#152 (comment)

you just need to change a keycloak setting

[aanno]

Yes, you are all right. In keycloak 4.0.0.Final the option is a bit hidden under:
(Realm) -> Client Scopes -> role_list (saml) -> Mappers tab -> role list -> 'Single Role Attribute'.

[nelsg]

@aanno : With this change login works but exception still in sonar logs

[waza-ari]

I know this one is quite old, but its one of the pages you stumble across when looking for this problem. There is a better option than the proposed one! The proposed option changes the role_list for every Client within the Realm. It is better to override the setting on client level to make sure it only impacts the Nextcloud client.

For this. edit your client, go to Client Scopes and remove role_list from the Assigned Default Client Scopes.

Next, create a new Mapper to actually map the Role List:

• Name: anything you like
• Mapper Type: Role List
• Role Attribute name: Role
• Friendly Name: Anything you like
• SAML Attribute Name Format: Basic
• Single Role Attribute: ON

Hope this helps someone.

[ZoumZpp]

I know this one is quite old, but its one of the pages you stumble across when looking for this problem. There is a better option than the proposed one! The proposed option changes the role_list for every Client within the Realm. It is better to override the setting on client level to make sure it only impacts the Nextcloud client.

For this. edit your client, go to Client Scopes and remove role_list from the Assigned Default Client Scopes.

Next, create a new Mapper to actually map the Role List:

• Name: anything you like
• Mapper Type: Role List
• Role Attribute name: Role
• Friendly Name: Anything you like
• SAML Attribute Name Format: Basic
• Single Role Attribute: ON

Hope this helps someone.

Thank you very much for your answer. Zabbix encountered the same problem when integrating SAML single sign on with Keycloak, which has puzzled me for a day until I saw your answer.