acquia_config.php for SimpleSAMLphp does not work on Acquia Cloud ODE.

[wu-edward]

In the acquia_config.php included in BLT, the database credentials are extracted in lines 95-97:

$creds_json = file_get_contents('/var/www/site-php/' . $_ENV['AH_SITE_GROUP'] . '.' . $_ENV['AH_SITE_ENVIRONMENT'] . '/creds.json');
$databases = json_decode($creds_json, TRUE);
$creds = $databases['databases'][$_ENV['AH_SITE_GROUP']];

The hostname of the database is then looked up on line 106-107:

$response = $resolver->query("cluster-{$creds['db_cluster_id']}.mysql", 'CNAME');
$creds['host'] = $response->answer[0]->cname;

On the ODE I want to run SSO tests on, $creds['db_cluster_id'] is null, so the host is empty, which causes an exception. I was able to fix this by hardcoding the database host for the specific ODE environment it was on.

But since https://support.acquia.com/hc/en-us/articles/360008830834 implies that ODEs should work, this code may need to be updated to get the DB host for ODEs.

[aweingarten]

@wu-edward, I am curious how would you test SSO without a constant domain name? Every-time that you spin up a new CDE wouldn't you need to exchange new metadata with the domain? I ask because if you have a clever solution I would LOVE to steal it!

[wu-edward]

@aweingarten We spun up a CDE specifically for a PoC we're building that requires SSO, so unfortunately no cleverness involved.

[danepowell]

Can you try replacing $creds['host'] = $response->answer[0]->cname; with $creds['host'] = key($creds['db_url_ha'])?

If that doesn't work, you may need to debug this a little more. Unfortunately I don't have access to an environment with SAML and CDEs to test this.

@lcatlett removed the code you are referring to in #2953, she might have insight as well

[lcatlett]

if you use a relative path for the saml config then it can work on any environment - it is when baseurl and other config is hardcoded (and there may be some valid reasons) that it appears to 'work' only on one environment / site / hosting provider. It is more likely that this is the same issue I called out in #3492 (comment)

[wu-edward]

@danepowell I took your suggestion and set $creds['host'] based on whether the environment is an ODE.