Getting a 403 forbidden error for simplesaml after Apache upgrade

Question

My simplesaml was working perfectly until I upgraded Apache to 2.4.6 on Ubuntu

The error I was getting :

Forbidden

You don't have permission to access /simplesaml/ on this server.

Answer 1

The instructions for installing simplesamlphp on Apache only require an alias for the simplesamlphp directory :

https://simplesamlphp.org/docs/stable/simplesamlphp-install#section_6

But for Apache 2.4.6+ the security has changed - it worked for me when I added a Directory directive. eg:

<VirtualHost *:80>
    ServerName mywebsite.dev
    DocumentRoot /home/myuser/www/mywebsite/

    <Directory /home/myuser/www/mywebsite/>
        Require all granted
    </Directory>

    Alias /simplesaml /var/simplesamlphp/www

    <Directory /var/simplesamlphp/www/>
        Require all granted
    </Directory>

</VirtualHost>

Answer 2

While the chosen answer is correct I would like to add that SELinux can also cause this error. It took me a couple hours to realize that was my problem after following tons of examples online.

If you are running SELinux make sure you run the following command:

chcon -R --reference=/var/www /var/simplesamlphp

This will place the /var/simplesamlphp directory in the same security context as /var/www. You can't just place the /var/simplesamlphp/www directory in the same context because _include.php accesses files in /var/simplesamlphp/lib.

I hope this prevents someone from spending as much time on this problem as I did.

Answer 3

If you installed simplesamlphp via compose, this can be more complex. In addition to @RusselEngland's answer of needing to add proper Apache config, if you are still getting a 403, you need to make sure that this file is not being prevented by a rule in .htaccess.

Apache config:

<VirtualHost *:80>
    DocumentRoot /var/www/html

    Alias /simplesaml /var/www/html/vendor/simplesamlphp/simplesamlphp/www

    <Directory /var/www/html/vendor/simplesamlphp/simplesamlphp/www/>
        Require all granted
    </Directory>
</VirtualHost>

.htaccess (in /var/www/html);

<IfModule mod_rewrite.c>
    #...
    RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
    RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php
    RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$
    RewriteCond %{REQUEST_URI} !^/simplesaml/*  # Add this condition
    RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]
</IfModule>