I had to update simplesamlphp on an old PHP server, the old version of the library was from 2010. Simplesamlphp is used as a Service Provider (SP) in a SP initiated enviroment.

I replaced it with the 09/'20 release and configured it the same. It's all working except one thing.

Simplesamlphp uses the PHPSESSION to store the session, by feature it replaces the php session with his and should set the old one again once the cleanup() method is called (on the session instance), after the authentication's complete.

This is not working, but I was fine with it because it didn't matter for the user.

Now I have to implement a button to test the SAML integration on a protected page. By protected I mean it requires to be authenticated (through Zend Auth) to view the page, otherwise it automatically redirects (server side) the user to the homepage.

This is the code of the Action of this button (to test the SAML integration), that is inside this protected controller:

require_once('simplesaml/lib/_autoload.php');
$as = new SimpleSAML_Auth_Simple('cie');
$as->requireAuth(array(
    'saml:idp' => $idp,
));

// --- user is redirected to the IDP and proceeds authenticating)...

$attributes = $as->getAttributes();
$session = \SimpleSAML\Session::getSessionFromRequest();
if($session){
    $session->cleanup();
}

What happens is:

requireAuth() is called, my current session is put away and replaced with SimpleSAML's one.
user is redirected to the IDP and authenticates
IDP redirects the user back to my page
Zend does its things before my code is run (everything after requireAuth() is never run) and before the cleanup() method is called, so the old PHP session isn't restored
Zend checks the user isn't authenticated (because it's still using SimpleSAML's session) and redirects the user back to the homepage.

Said so, this doesn't happen with the old library from 2010, the old PHP session is never lost, I have no idea why. I checked everything my colleagues changed in the old library back in the day, but there isn't anything that deals with this.

Do anyone have any idea or tip I could follow? Any workaround / idea to fix this issue?

I've been desperately googling stuff for weeks, but it's so hard to find something specific.

Thank you very much, just for reading this long question.