title: simpleSAMLphp and Azure gives me "AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application"
body: <p>I am a novice for Azure SSO so I might have missed some obvious things here - please have that in mind ;-)</p>
  
  <p>I need to integrate my application to Azure Active Directory. There is not much help to get in our organisation for that so I am left for myself to find the problem here :-/ My exact problem is that when I login then I get this error from Azure:</p>
  
  <pre><code>AADSTS50011: The reply URL specified in the request does not match the 
  reply URLs configured for the application: 'https://192.168.0.1/secure/'.
  </code></pre>
  
  <p>I have of course searched for how to solve this myself but I didn't find anything that could get me any closer.</p>
  
  <p>I have this setup:</p>
  
  <ul>
  <li>IIS</li>
  <li>PHP</li>
  <li>simpleSAMLphp</li>
  <li>Azure AD</li>
  </ul>
  
  <p>I have not setup nor access to the Azure part as this is setup by our IT guys but they have setup this:</p>
  
  <pre><code>Basic SAML Configuration
  
  Identifier (Entity ID)                      : https://192.168.0.1/secure/
  Reply URL (Assertion Consumer Service URL)  : https://192.168.0.1/secure/
  Sign on URL                                 : Optional
  Relay State                                 : Optional
  Logout URL                                  : Optional
  </code></pre>
  
  <p>I have recived a federation XML file from Azure and have converted/populated that in to the simpleSAMLphp file <strong>\metadata\saml20-idp-remote.php</strong></p>
  
  <p>I have setup the <strong>\config\authsources.php</strong> file:</p>
  
  <pre><code>'entityID'                   =&gt; "https://192.168.0.1/secure/",
  'idp'                        =&gt; "https://sts.windows.net/06dg12k9-1wl2-4mue-79gh-40ff1a8dnd4a/",
  'NameIDFormat'               =&gt; 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
  'simplesaml.nameidattribute' =&gt; 'eduPersonTargetedID',
  </code></pre>
  
  <p>Everything has been configured with this guide in mind, <a href="https://www.lewisroberts.com/2015/09/05/single-sign-on-to-azure-ad-using-simplesamlphp/" rel="nofollow noreferrer">https://www.lewisroberts.com/2015/09/05/single-sign-on-to-azure-ad-using-simplesamlphp/</a></p>
  
  <p>When I launch <a href="https://192.168.0.1/simpleSAMLphp/www/" rel="nofollow noreferrer">https://192.168.0.1/simpleSAMLphp/www/</a> and go to <strong>Authentication</strong> and <strong>Test configured authentication sources</strong> and I test with <strong>default-sp</strong> then I do get an Azure login screen. If I view the URL for that then it looks like this:</p>
  
  <pre><code>https://login.microsoftonline.com/0ad94219-6af5-474e-99d0-60f9188f3fce/saml2
      ?SAMLRequest=f[CUT]2Fy%2Fi%2Bjc%3D
      &amp;RelayState=https%3A%2F%2F192.168.0.1%2FsimpleSAMLphp%2Fwww%2Fmodule.php%2Fcore%2Fauthenticate.php%3Fas%3Ddefault-sp
  </code></pre>
  
  <p>I assume the <strong>RelayState</strong> is where the request comes from on my server. I have tried to setup the <strong>Entity ID</strong> and <strong>Reply URL</strong> in Azure to be <a href="https://192.168.0.1/simpleSAMLphp/www/module.php/core/authenticate.php?as=default-sp" rel="nofollow noreferrer">https://192.168.0.1/simpleSAMLphp/www/module.php/core/authenticate.php?as=default-sp</a> but with the same result.</p>
  
  <p>So I have provided everything I know here but I am really blank on how to fix this problem? Do I need to configure a <strong>Reply URL</strong> in simpleSAMLphp so it is passed as an URL parameter?</p>
  
  <p>Any help would really be appreciated.</p>
  
  <hr>
  
  <p><strong>### UPDATE 1 - another problem ###</strong></p>
  
  <p>After revising the logfile from simpleSAMLphp then it showed what was sent to Azure:</p>
  
  <pre><code>&lt;samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_25e3fb2" Version="2.0"  Destination="https://login.microsoftonline.com/088f3fce/saml2" AssertionConsumerServiceURL="https://192.168.0.1/simpleSAMLphp/www/module.php/saml/sp/saml2-acs.php/default-sp" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"&gt;
  &lt;saml:Issuer&gt;https://192.168.0.1/simpleSAMLphp/www/module.php/saml/sp/metadata.php/default-sp&lt;/saml:Issuer&gt;
  &lt;samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" AllowCreate="true"/&gt;
  &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p>I then took the <code>AssertionConsumerServiceURL</code> from there and used that as <strong>Reply URL</strong> in Azure. Also I took the <strong>Entity ID</strong> from the simpleSAMLphp Federation page and <strong>now the simpleSAMLphp demo page works</strong> :-)</p>
  
  <p>So my Azure setup now looks like this:</p>
  
  <p>Basic SAML Configuration</p>
  
  <pre><code>Identifier (Entity ID)                      : https://192.168.0.1/simpleSAMLphp/www/module.php/saml/sp/metadata.php/default-sp
  Reply URL (Assertion Consumer Service URL)  : https://192.168.0.1/simpleSAMLphp/www/module.php/saml/sp/saml2-acs.php/default-sp
  Sign on URL                                 : Optional
  Relay State                                 : Optional
  Logout URL                                  : Optional
  </code></pre>
  
  <p>(note the difference in the URL)</p>
  
  <p>However I sadly still have problems. When I have a PHP file in my web scope with this content:</p>
  
  <pre><code>&lt;?PHP
  require_once ("../../simpleSAMLphp/lib/_autoload.php");
  $as = new SimpleSAML_Auth_Simple('default-sp');
  $as-&gt;requireAuth();
  
  $attributes = $as-&gt;getAttributes();
  
  echo '&lt;pre&gt;';
  print_r($attributes);
  echo '&lt;/pre&gt;';
  
  // Get a logout URL
  $url = $as-&gt;getLogoutURL();
  echo '&lt;a href="' . htmlspecialchars($url) . '"&gt;Logout&lt;/a&gt;';
  
  ?&gt;
  </code></pre>
  
  <p>Then it ends up in an <strong>infinite loop</strong> redirecting between my server and Azure!? Viewing the log provide no major insight for me. It seems that I do receive data from Azure and that I am authenticated as I can see the user attributes in the debug log but ... if I am authenticated then why am I redirected back to Azure!?</p>
  
  <hr>
  
  <p><strong>### UPDATE 2 - solution ###</strong></p>
  
  <p>After a few more hours of looking in the simpleSAMLphp logfile and cleaning out the WARNINGS (they are actually important) then I found out that my infinite redirection was caused by a mismatch between the PHP sessions and simpleSAMLphp sessions.</p>
  
  <p>My solution was to align the two and have the exact same settings all places. Make sure to check the <code>php.ini</code> session settings and the <code>\config\config.php</code> session settings and make them identical.</p>
  
  <p>Also I found out that the PHP source code I have used is for an older version of simpleSAMLphp though I don't think it was a problem.</p>
  
  <p>Instead of this old method:
  <code>$as = new SimpleSAML_Auth_Simple('default-sp');</code></p>
  
  <p>Then it should be this new method:
  <code>$as = new \SimpleSAML\Auth\Simple('default-sp');</code></p>