Update: Oops. As noted below, I misread your post! :(

You said SSO/SAML auth - Not SASL! So much of this post is irrelevant! The logging bit might still be useful, but the SASL stuff not so much... After a quick check of the SuiteCRM docs, it seems that no additional PHP modules should be required.

I'll edit what I originally wrote below, strike out the irrelevant bits and try to make the rest more directly relevant.

Hi Colin, I've just double checked and it looks that we don't install the required php package by default. So the first thing is to install the package (and restart apache to load it). Like this:

apt update
apt install php-auth-sasl
systemctl restart apache2

Hopefully that might be enough? Regardless, please let me know how you go.

It might also be worth checking the SuiteCRM log? It should be: /var/www/suitecrm/suitecrm.log

If there isn't anything obvious there, try changing the log settings. You should be able to change them via Admin / System settings / Logger Settings. By default logging should be set to "error" or "fatal". To make the log more verbose, try changing it to "warn", or perhaps even "info".

If you're not sure what is relevant or not, "following" the log in realtime and retrying the thing that isn't working can make it easier to see the relevant errors. I.e. in a terminal (assuming the log location is right and it exists) run this:

tail -f /var/www/suitecrm/suitecrm.log

Then try to connect again, then look at what pops up in the log.

If you manage to work it out yourself, please share. It will no doubt be useful to others and will also help us to improve the appliance in the future.

If you continue to have issues, please share as much info as you can about the problem. It's useful to know the TurnKey version you are using ('turnkey-version'), where it's running and anything else you think might be relevant (you can never give too much info in cases like this). Feel free to share the log - or at least the last ~50 lines of it.

Step-by-step instructions on how to reproduce the problem is often the quickest way for me to be able to help out.

Good luck and I look forward to hearing how you go.

Oops! Sorry I misread your post! :(

You said SSO/SAML auth - Not SASL! So much of what I wrote above is irrelevant! Some - like the logging info - might still be useful, but the SASL specific stuff not so much...

I'll edit my previous post and strike out the irrelevant bits, but after looking through the SuiteCRM docs, it doesn't seem that SSO/SAML auth requires additional php modules. So that's a complete red herring.

So to help, I'll need more info from you. Please share more about your appliance (what TurnKey version it is, where it's running, etc) and what sort of things you have changed since install. Also I'm not familiar with SuiteCRM itself, so please share the exact steps required to configure SSO/SAML.

With that info I can recreate an environment very similar to yours and work out what's going wrong.