Kimai - Azure SAML configuration failing with 'An authentication exception error'

[marahman418]

I have configured the Azure SAML for the Kimai docker by injecting the local.yaml and then reloading the cache as per the official kimai documentation. I am able to see the Azure login Title as mentioned in the local.yaml file, upon clicking that it is redirecting to microsoft login page and then after providing the credentials again it is redirecting to a error page stating "An authentication exception error". Any help would be greatly apreciated. Thanks.

[mvlintho]

Most likely you are hitting the same problem as i am; azure SAML integration results in:

[2024-03-03T14:00:32.766771+00:00] deprecation.INFO: User Deprecated: PARTIAL syntax in DQL is deprecated. (Parser.php:1847 called by Parser.php:2281, doctrine/orm#8471, package doctrine/orm) {"exception":"[object] (ErrorException(code: 0): User Deprecated: PARTIAL syntax in DQL is deprecated. (Parser.php:1847 called by Parser.php:2281, doctrine/orm#8471, package doctrine/orm) at /opt/kimai/vendor/doctrine/deprecations/lib/Doctrine/Deprecations/Deprecation.php:210)"} {"channel":"deprecation"}

cfr:
#4383

[kevinpapst]

NO.

[marahman418]

Latest Error Message: Selected user account does not exist in tenant 'Default Directory' and cannot access the application 'https://domain-name/auth/saml/metadata' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.

[mastertIT]

can you elaborate?

[amitmadahar]

@marahman418 - Did you have to resolve the issue? I am facing the same issue. I note in Azure loging logs that the request was successful. Any pointer?

[marahman418]

Is Kimai based on PHP Sympony Framework, if yes, what would be the impact to the original codebase if any external plugin is installed for saml such as miniorange azure saml ?

[ccci-code]

I got the same error using a Helm chart and Keycloak. After clicking the Keycloak button and logging in, I got the error: An authentication exception occurred.

Setting the "baseurl" to https://[my hostname]/auth/saml/ in the saml section of local.yaml fixed the problem and I can log in now.