How to configure WAYF/EDS with Morpheus??

[Basharat]

Hi everyone,

We’re in the process of integrating Morpheus with our federated identity infrastructure using SAML 2.0. As part of this, we're using an external Discovery Service (EDS), also known as a WAYF (Where Are You From) service, hosted at https://eds.xxxx.xx. This service allows users to select their identity provider (IdP) before authentication.

Here’s the expected flow:

1. A user tries to access a protected Morpheus resource.

2. Morpheus redirects them to the Discovery Service (https://eds.xxxx.xx) with the appropriate entityID and return URL.

3. The user selects their home institution (IdP) from the list.

4. The Discovery Service redirects the user back to Morpheus using a URL like:

https://morpheus.xxxx.xx/externalLogin/callback/xxxxxx

5. At this point, Morpheus should initiate a SAML AuthnRequest and redirect the user to the selected IdP’s login page.

6. After successful login at the IdP, the SAML assertion should be sent back to Morpheus to complete authentication.

The issue we’re facing is at step 5 — after the user selects an IdP and is redirected back to Morpheus, there is no further redirection to the IdP login page. It seems Morpheus is not initiating the SAML AuthnRequest based on the selected IdP from the Discovery Service.

Here is the Error Log:

==> /var/log/morpheus/morpheus-ui/current <==
2025-05-26_05:16:03.82939 ''[2025-05-26 05:16:55,372] [http-nio-127.0.0.1-8080-exec-14] INFO  c.b.p.SamlUserService - authenticate
2025-05-26_05:16:55.37297 ''[2025-05-26 05:16:55,373] [http-nio-127.0.0.1-8080-exec-14] WARN  c.b.p.SamlUserService - An Account processing exception has occurred: com.bertramlabs.plugins.AccountsException: SAMLResponse missing in IDP response
2025-05-26_05:16:55.37344 'com.bertramlabs.plugins.AccountsException: SAMLResponse missing in IDP response
2025-05-26_05:16:55.37345       at jdk.internal.reflect.GeneratedConstructorAccessor793.newInstance(Unknown Source)
2025-05-26_05:16:55.37346       at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
2025-05-26_05:16:55.37346       at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Unknown Source)
2025-05-26_05:16:55.37347       at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
2025-05-26_05:16:55.37348       at org.codehaus.groovy.reflection.CachedConstructor.invoke(CachedConstructor.java:72)
2025-05-26_05:16:55.37349       at org.codehaus.groovy.runtime.callsite.ConstructorSite$ConstructorSiteNoUnwrapNoCoerce.callConstructor(ConstructorSite.java:105)
2025-05-26_05:16:55.37349       at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callConstructor(AbstractCallSite.java:277)
2025-05-26_05:16:55.37350       at com.bertramlabs.plugins.SamlUserService.authenticate(SamlUserService.groovy:509)
2025-05-26_05:16:55.37351       at com.bertramlabs.plugins.SamlUserService$authenticate$6.call(Unknown Source)
2025-05-26_05:16:55.37352       at com.bertramlabs.plugins.ExternalLoginController.callback(ExternalLoginController.groovy:177)
2025-05-26_05:16:55.37352       at org.grails.core.DefaultGrailsControllerClass$MethodHandleInvoker.invoke(DefaultGrailsControllerClass.java:223)
2025-05-26_05:16:55.37353       at org.grails.core.DefaultGrailsControllerClass.invoke(DefaultGrailsControllerClass.java:188)
2025-05-26_05:16:55.37354       at org.grails.web.mapping.mvc.UrlMappingsInfoHandlerAdapter.handle(UrlMappingsInfoHandlerAdapter.groovy:90)
2025-05-26_05:16:55.37354       at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1072)
2025-05-26_05:16:55.37355       at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:965)
2025-05-26_05:16:55.37355       at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
2025-05-26_05:16:55.37356       at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
2025-05-26_05:16:55.37356       at javax.servlet.http.HttpServlet.service(HttpServlet.java:529)
2025-05-26_05:16:55.37357       at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
2025-05-26_05:16:55.37358       at javax.servlet.http.HttpServlet.service(HttpServlet.java:623)
2025-05-26_05:16:55.37359       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:199)
2025-05-26_05:16:55.37359       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37360       at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
2025-05-26_05:16:55.37360       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37361       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37362       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:111)
2025-05-26_05:16:55.37362       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37363       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37363       at org.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:67)
2025-05-26_05:16:55.37364       at com.morpheus.remote.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:20)
2025-05-26_05:16:55.37367       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37367       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37368       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37368       at javax.servlet.FilterChain$doFilter.call(Unknown Source)
2025-05-26_05:16:55.37369       at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:47)
2025-05-26_05:16:55.37369       at javax.servlet.FilterChain$doFilter.call(Unknown Source)
2025-05-26_05:16:55.37370       at com.morpheus.StompAuthenticationFilter.doFilterInternal(StompAuthenticationFilter.groovy:144)
2025-05-26_05:16:55.37370       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37371       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37371       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37372       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:337)
2025-05-26_05:16:55.37373       at org.springframework.security.web.authentication.switchuser.SwitchUserFilter.doFilter(SwitchUserFilter.java:212)
2025-05-26_05:16:55.37373       at org.springframework.security.web.authentication.switchuser.SwitchUserFilter.doFilter(SwitchUserFilter.java:172)
2025-05-26_05:16:55.37378       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37379       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:102)
2025-05-26_05:16:55.37380       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37381       at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115)
2025-05-26_05:16:55.37381       at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81)
2025-05-26_05:16:55.37382       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37382       at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122)
2025-05-26_05:16:55.37383       at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:116)
2025-05-26_05:16:55.37384       at grails.plugin.springsecurity.web.UpdateRequestContextHolderExceptionTranslationFilter.doFilter(UpdateRequestContextHolderExceptionTranslationFilter.groovy:64)
2025-05-26_05:16:55.37384       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37385       at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
2025-05-26_05:16:55.37385       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37386       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37386       at grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter.doFilter(GrailsAnonymousAuthenticationFilter.groovy:54)
2025-05-26_05:16:55.37387       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37387       at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:141)
2025-05-26_05:16:55.37388       at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:97)
2025-05-26_05:16:55.37389       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37391       at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149)
2025-05-26_05:16:55.37392       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37392       at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:164)
2025-05-26_05:16:55.37393       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37393       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37394       at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:223)
2025-05-26_05:16:55.37395       at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217)
2025-05-26_05:16:55.37395       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37396       at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groovy:64)
2025-05-26_05:16:55.37396       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37397       at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:112)
2025-05-26_05:16:55.37397       at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:82)
2025-05-26_05:16:55.37398       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37398       at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.groovy:58)
2025-05-26_05:16:55.37399       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37400       at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117)
2025-05-26_05:16:55.37400       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37401       at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
2025-05-26_05:16:55.37401       at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:221)
2025-05-26_05:16:55.37402       at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)
2025-05-26_05:16:55.37402       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37403       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37403       at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)
2025-05-26_05:16:55.37404       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37404       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37405       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37406       at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
2025-05-26_05:16:55.37406       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37407       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37407       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37408       at org.springframework.session.web.http.SessionRepositoryFilter.doFilterInternal(SessionRepositoryFilter.java:142)
2025-05-26_05:16:55.37409       at org.springframework.session.web.http.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:82)
2025-05-26_05:16:55.37409       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37410       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37410       at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:96)
2025-05-26_05:16:55.37411       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37412       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37412       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37413       at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:126)
2025-05-26_05:16:55.37413       at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:64)
2025-05-26_05:16:55.37414       at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:101)
2025-05-26_05:16:55.37414       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37415       at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:119)
2025-05-26_05:16:55.37415       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37416       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37417       at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:91)
2025-05-26_05:16:55.37417       at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
2025-05-26_05:16:55.37418       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
2025-05-26_05:16:55.37418       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
2025-05-26_05:16:55.37419       at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168)
2025-05-26_05:16:55.37419       at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
2025-05-26_05:16:55.37420       at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482)
2025-05-26_05:16:55.37420       at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
2025-05-26_05:16:55.37421       at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
2025-05-26_05:16:55.37421       at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:660)
2025-05-26_05:16:55.37422       at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
2025-05-26_05:16:55.37422       at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346)
2025-05-26_05:16:55.37423       at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:396)
2025-05-26_05:16:55.37424       at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
2025-05-26_05:16:55.37424       at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:937)
2025-05-26_05:16:55.37425       at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1793)
2025-05-26_05:16:55.37425       at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
2025-05-26_05:16:55.37426       at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
2025-05-26_05:16:55.37426       at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
2025-05-26_05:16:55.37427       at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
2025-05-26_05:16:55.37428       at java.base/java.lang.Thread.run(Unknown Source)

Has anyone successfully integrated a Discovery Service or WAYF component with Morpheus before? If so, how did you handle the callback and ensure Morpheus initiated the SAML request to the IdP?

Any insights or advice would be greatly appreciated.

Thank You,
Basharat Hussain.