Help needed on SSO between Moodle and Salesforce

by Tommy Nyholm.  

Hi,

I need help in getting SSO to work between Moodle 3.0 (SP) and Salesforce (IdP).
As fairly new to Moodle, Salesforce and SSO I cannot figure out what's failing. A basic test against shibtest.org was successful.

SAML2-plugin: "SAML2 Single sign on" version 2017021700

The Moodle SAML2-plugin configuration:

1. IdP metadata: Some config: entityID=https://..salesforce.com; WantAuthnRequestsSigned=false
2. Signing certificate is valid.
3. SP Metadata: entityID=https://moodle.com/auth/saml2/sp/metadata.php; AuthnRequestsSigned=true;
   AssertionConsumerService Location=https://..moodle.com/auth/saml2/sp/saml2-acs.php/..moodle.com
4. SP Metadata signature: Signing the SP Metadata is set to Yes.
5. IdP to Moodle mapping: "email" and "Email Address"
6. Data Mapping: is not configured at this stage.

The Moodle test account user@email.com is configured to use SAML2 as authent. method.
user@email.com also exists in Salesforce using the same password.

Part of the Salesforce configuration I have got from the other company.
SAML SP Settings:

1. Entity ID: https://..moodle.com/auth/saml2/sp/metadata.php;
2. ACS URL: https://..moodle.com/auth/saml2/sp/saml2-acs.php/..moodle.com
3. Issuer: https://..salesforce.com
4. Verify Request Signatures: no value set
5. Subject Type: Federation ID

Test logging in at the Salesforce site as user@email.com:

1. When logged in, clicking the MoodleApp opens a second tab in the web browser where the user is redirected to ..
2. https://..moodle.com/login/index.php as expected. But the "Username" field is empty. Shouldn't it contain user@email.com ?
3. Therefore, clicking on "Login via SAML2" results in an exception (NOSTATE), clicking "Continue" gives
   a second exception (ACSPARAMS), and third time ends in "Secure Connection Failed".

Debugging steps:

1. I have run both tests (using "isPassive" and "isAuthenticated and login") both with the same response from the IdP, see attached isPassive_isAuthenticated.txt file.
2. I also captured SAML2- and Moodle- debug data. Please, see the attached error.log

Tommy