Support SimpleSAMLphp 2.1 release

I think we just need to update the dependency on the SSP library, right? We don't need to change the drupal version support, since it already includes 10: "drupal/core": "^9.4 || ^10".

I don't think a patch will cut it here since if the module gets downloaded by Composer then Composer will lock dependencies to the pre-patched version. I'm not sure how much of a PITA it would be to get it working.

That last patch does look correct though. I'll open an MR with the patch applied.

I suggest we keep the scope of this issue narrowly focused to just getting the new simplesamlphp release incorporated into the current 4.x alpha and not necessarily require that the update be fully working. Just being able to easily and directly install an updated Drupal module without working off an MR would be very helpful for testing. But I'll leave instructions once I confirm they work for just installing the module.

The dev prefix is required

I was able to attempt to install the module with updated dependencies, however the simplesamlphp library seems to have a dependency conflict with Drupal core.

For installation, I added the following as the first item in the repositories list in composer.json:

    "repositories": [
        {
            "name": "drupal/simplesamlphp_auth",
            "type": "vcs",
            "url": "https://git.drupalcode.org/issue/simplesamlphp_auth-3380262.git"
        },

I then ran this command:
composer require -W drupal/simplesamlphp_auth:dev-3380262-support-simplesamlphp-2.1

But there seems to be a conflict re: the version of Twig.

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires drupal/core-recommended * -> satisfiable by drupal/core-recommended[10.0.x-dev].
    - simplesamlphp/simplesamlphp dev-simplesamlphp-2.1 requires twig/twig ^3.7 -> satisfiable by twig/twig[v3.7.0, 3.x-dev].
    - You can only install one version of a package, so only one of these can be installed: twig/twig[v2.14.0, ..., 2.x-dev, v3.0.4, ..., 3.x-dev].
    - drupal/simplesamlphp_auth dev-3380262-support-simplesamlphp-2.1 requires simplesamlphp/simplesamlphp ^2.1 | dev-simplesamlphp-2.1 -> satisfiable by simplesamlphp/simplesamlphp[dev-simplesamlphp-2.1].
    - drupal/core-recommended 10.0.x-dev requires twig/twig ~v3.5.0 -> satisfiable by twig/twig[v3.5.0, v3.5.1].
    - Root composer.json requires drupal/simplesamlphp_auth dev-3380262-support-simplesamlphp-2.1 -> satisfiable by drupal/simplesamlphp_auth[dev-3380262-support-simplesamlphp-2.1].

Looks like Drupal 10 requires Twig v3.5.x while simplesamlphp-2.1 requires v3.7+

Actually I think the Twig version constraint is coming from core-recommended rather than Drupal core itself. Obviously this still presents a big problem...

Yeah, 10.1 is the same, just with 3.6. I'm not too fond of core-recommended and don't use it, but testbot is broken too for a different reason. We could ask them if they really need that specific version, this seems quite new

I just ran into it too! Adding "twig/twig": "3.7.0 as 3.6", fixed it. I just used that in my main composer.json. This hacky approach will at least work for testing.

The maintainer just now lowered the Twig version requirement, so that issue should be resolved.

I've confirmed that I was able to composer require the module using the instructions I posted on a Drupal 10.1.x sandbox install. I was also able to enable the module and have not seen any white screens on the homepage or module configuration pages.

Unfortunately I'm not able to test the actual module functionality since I don't have a project using SSO that is ready to be upgraded to Drupal 10 yet.

Could the MR be merged into 4.x and a new alpha released to simplify installing and testing the module?

Updated the IS to note incompatibility with Drupal 9 when using SimpleSAMLphp 2.1.

I believe the scope of this ticket should be constrained solely to updating the SimpleSAMLphp library requirement to 2.1 and verifying that it works. Any other updates to composer requirements should be done in the parent ticket at some later time, IMO.

Yes, I plan to do that, started a rerun of the tests.

And yes, requiring an SAML IdP makes testing this quite challenging. I did a quick google search and found https://hub.docker.com/r/kristophjunge/test-saml-idp/, which seems to be pretty much what I was looking for, will need to try that. Hasn't been updated in ages, but might still work. Could even be used to set up end to end automated tests with GitlabCI I suppose.

DrupalCI almost works now, 10.0 complains about the composer version, 10.1 is then again stuck on the composer plugin. I've tried to solve that already a while ago in #3334914: Testing is broken because simplesamlphp/composer-module-installer contains a Composer plugin which is blocked → , that MR should IMHO resolve that.

Why the change in composer.json to not allow 1.x? D9 EOL is just a few months out and I did create a 4.x branch on purpose to break D9 compatibility if we have to, but I haven't actually seen anything yet that would require that?

I didn't consider that we'd be able to retain BC with 9.x, but if the module 4.x version was just branched off 3.x then sure, we can support both D9 with SSP 1.x and D10 with SSP 2.x unless/until that's unworkable.

Merging this, improvements are happening on DrupalCI to allow testing but at least here didn't apply yet for some reason.

This will break existing sites that use rely on dev-master and patches, but those constantly break anyway, can't do anything about that.

So, I realize this does not constitute a test suite, but I just upgraded the simplesamlphp_auth module in my Drupal 9.5.9 site, and in a testing environment the SAML authentication process is working.

Ok it is installed, and everything seems to be working. Once we get the IdP configured we can test. I will update this thread once we can confirm either way.

Just want to say thank you @Berdir and all involved!

This has been committed, lets continue in the parent issue.

Automatically closed - issue fixed for 2 weeks with no activity.