283 lines
15 KiB
HTML
283 lines
15 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>documentation:2.0:applications:simplesamlphp</title>
|
|
<meta name="generator" content="DokuWiki"/>
|
|
<meta name="robots" content="index,follow"/>
|
|
<meta name="keywords" content="documentation,2.0,applications,simplesamlphp"/>
|
|
<link rel="search" type="application/opensearchdescription+xml" href="../lib/exe/opensearch.html" title="LemonLDAP::NG"/>
|
|
<link rel="start" href="simplesamlphp.html"/>
|
|
<link rel="contents" href="simplesamlphp.html" title="Sitemap"/>
|
|
<link rel="stylesheet" type="text/css" href="../lib/exe/css.php.t.bootstrap3.css"/>
|
|
<!-- //if:usedebianlibs
|
|
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
|
|
//elsif:useexternallibs
|
|
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
|
|
//elsif:cssminified
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
|
|
//else -->
|
|
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
|
|
<!-- //endif -->
|
|
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:2.0:applications';var JSINFO = {"id":"documentation:2.0:applications:simplesamlphp","namespace":"documentation:2.0:applications"};
|
|
/*!]]>*/</script>
|
|
<script type="text/javascript" charset="utf-8" src="../lib/exe/js.php.t.bootstrap3.js"></script>
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script>
|
|
<!-- //endif -->
|
|
<!-- //if:usedebianlibs
|
|
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
|
|
//elsif:useexternallibs
|
|
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
|
|
//elsif:jsminified
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.min.js"></script>
|
|
//else -->
|
|
<script type="text/javascript" src="/static/bwr/jquery-ui/jquery-ui.js"></script>
|
|
<!-- //endif -->
|
|
</head>
|
|
<body>
|
|
<div class="dokuwiki export container">
|
|
<!-- TOC START -->
|
|
<div id="dw__toc">
|
|
<h3 class="toggle">Table of Contents</h3>
|
|
<div>
|
|
|
|
<ul class="toc">
|
|
<li class="level1"><div class="li"><a href="#presentation">Presentation</a></div></li>
|
|
<li class="level1"><div class="li"><a href="#pre-requisites">Pre-requisites</a></div>
|
|
<ul class="toc">
|
|
<li class="level2"><div class="li"><a href="#simplesamlphp1">simpleSAMLphp</a></div></li>
|
|
<li class="level2"><div class="li"><a href="#lemonldapng">LemonLDAP::NG</a></div></li>
|
|
</ul>
|
|
</li>
|
|
<li class="level1"><div class="li"><a href="#simplesamlphp_as_service_provider">simpleSAMLphp as Service Provider</a></div></li>
|
|
<li class="level1"><div class="li"><a href="#simplesamlphp_as_identity_provider">simpleSAMLphp as Identity Provider</a></div></li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<!-- TOC END -->
|
|
|
|
<h1 class="sectionedit1" id="simplesamlphp">simpleSAMLphp</h1>
|
|
<div class="level1">
|
|
|
|
<p>
|
|
<img src="simplesamlphp_logo.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT1 SECTION "simpleSAMLphp" [1-81] -->
|
|
<h2 class="sectionedit2" id="presentation">Presentation</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
<a href="https://simplesamlphp.org/" class="urlextern" title="https://simplesamlphp.org/" rel="nofollow">simpleSAMLphp</a> is an identity/service provider written in PHP. It supports a lot of protocols like <abbr title="Central Authentication Service">CAS</abbr>, OpenID and <abbr title="Security Assertion Markup Language">SAML</abbr>.
|
|
</p>
|
|
|
|
<p>
|
|
This documentation explains how to interconnect LemonLDAP::NG and simpleSAMLphp using <abbr title="Security Assertion Markup Language">SAML</abbr> 2.0 protocol.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT2 SECTION "Presentation" [82-365] -->
|
|
<h2 class="sectionedit3" id="pre-requisites">Pre-requisites</h2>
|
|
<div class="level2">
|
|
|
|
</div>
|
|
<!-- EDIT3 SECTION "Pre-requisites" [366-393] -->
|
|
<h3 class="sectionedit4" id="simplesamlphp1">simpleSAMLphp</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
You need to <a href="https://simplesamlphp.org/docs/stable/simplesamlphp-install" class="urlextern" title="https://simplesamlphp.org/docs/stable/simplesamlphp-install" rel="nofollow">install the software</a>. If using Debian, just do:
|
|
</p>
|
|
<pre class="code">apt-get install simplesamlphp</pre>
|
|
|
|
<p>
|
|
We suppose that configuration is done in <code>/etc/simplesamlphp</code> and that simpleSAMLphp is accessible at <a href="http://localhost/simplesamlphp" class="urlextern" title="http://localhost/simplesamlphp" rel="nofollow">http://localhost/simplesamlphp</a>.
|
|
</p>
|
|
|
|
<p>
|
|
To be able to sign <abbr title="Security Assertion Markup Language">SAML</abbr> messages, you need to create a certificate. First set where certificates are stored:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/config.php</pre>
|
|
<pre class="code file php"> <span class="st_h">'certdir'</span> <span class="sy0">=></span> <span class="st_h">'/etc/simplesamlphp/certs/'</span><span class="sy0">,</span></pre>
|
|
|
|
<p>
|
|
Create directory and generate the certificate
|
|
</p>
|
|
<pre class="code">mkdir /etc/simplesamlphp/certs/
|
|
cd /etc/simplesamlphp/certs/
|
|
openssl req -newkey rsa:2048 -new -x509 -days 3652 -nodes -out saml.crt -keyout saml.pem</pre>
|
|
|
|
<p>
|
|
Then associate this certificate to the default SP:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/authsources.php</pre>
|
|
<pre class="code file php"> <span class="st_h">'default-sp'</span> <span class="sy0">=></span> <a href="http://www.php.net/array"><span class="kw3">array</span></a><span class="br0">(</span>
|
|
<span class="st_h">'saml:SP'</span><span class="sy0">,</span>
|
|
<span class="st_h">'privatekey'</span> <span class="sy0">=></span> <span class="st_h">'saml.pem'</span><span class="sy0">,</span>
|
|
<span class="st_h">'certificate'</span> <span class="sy0">=></span> <span class="st_h">'saml.crt'</span><span class="sy0">,</span></pre>
|
|
|
|
</div>
|
|
<!-- EDIT4 SECTION "simpleSAMLphp" [394-1396] -->
|
|
<h3 class="sectionedit5" id="lemonldapng">LemonLDAP::NG</h3>
|
|
<div class="level3">
|
|
|
|
<p>
|
|
You need to configure <a href="../samlservice.html" class="wikilink1" title="documentation:2.0:samlservice">SAML Service</a>. Be sure to convert public key in a certificate, as described in the <a href="../samlservice.html#security_parameters" class="wikilink1" title="documentation:2.0:samlservice">security chapter</a> as simpleSAMLphp can't use the public key.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT5 SECTION "LemonLDAP::NG" [1397-1648] -->
|
|
<h2 class="sectionedit6" id="simplesamlphp_as_service_provider">simpleSAMLphp as Service Provider</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
We suppose you configured LemonLDAP::NG as <a href="../idpsaml.html" class="wikilink1" title="documentation:2.0:idpsaml">SAML Identity Provider</a> and want to use simpleSAMLphp as Service Provider.
|
|
</p>
|
|
|
|
<p>
|
|
In <abbr title="LemonLDAP::NG">LL::NG</abbr> Manager, create an new SP and load simpleSAMLphp metadata trough <abbr title="Uniform Resource Locator">URL</abbr> (by default: <a href="http://localhost/simplesamlphp/module.php/saml/sp/metadata.php/default-sp" class="urlextern" title="http://localhost/simplesamlphp/module.php/saml/sp/metadata.php/default-sp" rel="nofollow">http://localhost/simplesamlphp/module.php/saml/sp/metadata.php/default-sp</a>):
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_sp_metadata.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
Then set some attributes that will be sent to simpleSAMLphp:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_sp_attributes.png" class="mediacenter" alt="" />
|
|
</p>
|
|
<div class="notetip">Set <code>Mandatory</code> to <code>On</code> to force attributes in authentication response.
|
|
</div>
|
|
<p>
|
|
You can also force all signatures:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_sp_signature.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
On simpleSAMLphp side, use the metadata converter (by default: <a href="http://localhost/simplesamlphp/admin/metadata-converter.php" class="urlextern" title="http://localhost/simplesamlphp/admin/metadata-converter.php" rel="nofollow">http://localhost/simplesamlphp/admin/metadata-converter.php</a>) to convert <abbr title="LemonLDAP::NG">LL::NG</abbr> metadata (by default: <a href="http://auth.example.com/saml/metadata" class="urlextern" title="http://auth.example.com/saml/metadata" rel="nofollow">http://auth.example.com/saml/metadata</a>) into internal PHP representation. Copy the <code>saml20-idp-remote</code> content:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/metadata/saml20-idp-remote.php</pre>
|
|
<pre class="code file php"><span class="kw2"><?php</span>
|
|
<span class="re0">$metadata</span><span class="br0">[</span><span class="st_h">'http://auth.example.com/saml/metadata'</span><span class="br0">]</span> <span class="sy0">=</span> <a href="http://www.php.net/array"><span class="kw3">array</span></a> <span class="br0">(</span>
|
|
<span class="st_h">'entityid'</span> <span class="sy0">=></span> <span class="st_h">'http://auth.example.com/saml/metadata'</span><span class="sy0">,</span>
|
|
<span class="sy0">...</span>
|
|
<span class="co1">// Add this option to force SLO requests signature</span>
|
|
<span class="st_h">'sign.logout'</span> <span class="sy0">=></span> <span class="kw4">true</span><span class="sy0">,</span>
|
|
<span class="br0">)</span><span class="sy0">;</span>
|
|
<span class="sy1">?></span></pre>
|
|
<div class="notetip">Don't forget PHP start and end tag to have a valid PHP file.
|
|
</div>
|
|
<p>
|
|
All is ready, you can now test the authentication (by default: <a href="http://localhost/simplesamlphp/module.php/core/authenticate.php" class="urlextern" title="http://localhost/simplesamlphp/module.php/core/authenticate.php" rel="nofollow">http://localhost/simplesamlphp/module.php/core/authenticate.php</a>). You should see something like that:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_sp_authentication.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT6 SECTION "simpleSAMLphp as Service Provider" [1649-3258] -->
|
|
<h2 class="sectionedit7" id="simplesamlphp_as_identity_provider">simpleSAMLphp as Identity Provider</h2>
|
|
<div class="level2">
|
|
|
|
<p>
|
|
We suppose you configured LemonLDAP::NG as <a href="../authsaml.html" class="wikilink1" title="documentation:2.0:authsaml">SAML Service Provider</a> and want to use simpleSAMLphp as Identity Provider.
|
|
</p>
|
|
|
|
<p>
|
|
First, you need to activate IDP feature in simpleSAMLphp:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/config.php</pre>
|
|
<pre class="code file php"> <span class="st_h">'enable.saml20-idp'</span> <span class="sy0">=></span> <span class="kw4">true</span><span class="sy0">,</span></pre>
|
|
|
|
<p>
|
|
And create a default IDP configuration:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/metadata/saml20-idp-hosted.php</pre>
|
|
<pre class="code file php"><span class="kw2"><?php</span>
|
|
<span class="re0">$metadata</span><span class="br0">[</span><span class="st_h">'__DYNAMIC:1__'</span><span class="br0">]</span> <span class="sy0">=</span> <a href="http://www.php.net/array"><span class="kw3">array</span></a><span class="br0">(</span>
|
|
<span class="coMULTI">/*
|
|
* The hostname for this IdP. This makes it possible to run multiple
|
|
* IdPs from the same configuration. '__DEFAULT__' means that this one
|
|
* should be used by default.
|
|
*/</span>
|
|
<span class="st_h">'host'</span> <span class="sy0">=></span> <span class="st_h">'__DEFAULT__'</span><span class="sy0">,</span>
|
|
|
|
<span class="coMULTI">/*
|
|
* The private key and certificate to use when signing responses.
|
|
* These are stored in the cert-directory.
|
|
*/</span>
|
|
<span class="st_h">'privatekey'</span> <span class="sy0">=></span> <span class="st_h">'saml.pem'</span><span class="sy0">,</span>
|
|
<span class="st_h">'certificate'</span> <span class="sy0">=></span> <span class="st_h">'saml.crt'</span><span class="sy0">,</span>
|
|
|
|
<span class="coMULTI">/*
|
|
* The authentication source which should be used to authenticate the
|
|
* user. This must match one of the entries in config/authsources.php.
|
|
*/</span>
|
|
<span class="st_h">'auth'</span> <span class="sy0">=></span> <span class="st_h">'admin'</span><span class="sy0">,</span>
|
|
<span class="co1">// Sign SLO messages</span>
|
|
<span class="st_h">'sign.logout'</span> <span class="sy0">=></span> <span class="kw4">true</span><span class="sy0">,</span>
|
|
<span class="br0">)</span><span class="sy0">;</span>
|
|
<span class="sy1">?></span></pre>
|
|
<div class="noteimportant">You need to configure your own certificates and authentication scheme
|
|
</div>
|
|
<p>
|
|
Now in <abbr title="LemonLDAP::NG">LL::NG</abbr> Manager, create a new IDP and import metadata with <abbr title="Uniform Resource Locator">URL</abbr> (by default: <a href="http://localhost/simplesamlphp/saml2/idp/metadata.php" class="urlextern" title="http://localhost/simplesamlphp/saml2/idp/metadata.php" rel="nofollow">http://localhost/simplesamlphp/saml2/idp/metadata.php</a>):
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_idp_metadata.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
List attributes you want to collect:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_idp_attributes.png" class="mediacenter" alt="" />
|
|
</p>
|
|
<div class="notetip">You can keep <code>Mandatory</code> to <code>Off</code> to not fail if attribute is not sent by IDP
|
|
</div>
|
|
<p>
|
|
And activate all signatures:
|
|
</p>
|
|
|
|
<p>
|
|
<img src="simplesamlphp_idp_signature.png" class="mediacenter" alt="" />
|
|
</p>
|
|
|
|
<p>
|
|
To finish, you need to declare <abbr title="LemonLDAP::NG">LL::NG</abbr> SP in simpleSAMLphp. Use the metadata converter (by default: <a href="http://localhost/simplesamlphp/admin/metadata-converter.php" class="urlextern" title="http://localhost/simplesamlphp/admin/metadata-converter.php" rel="nofollow">http://localhost/simplesamlphp/admin/metadata-converter.php</a>) to convert <abbr title="LemonLDAP::NG">LL::NG</abbr> metadata (by default: <a href="http://auth.example.com/saml/metadata" class="urlextern" title="http://auth.example.com/saml/metadata" rel="nofollow">http://auth.example.com/saml/metadata</a>) into internal PHP representation. Copy the <code>saml20-sp-remote</code> content:
|
|
</p>
|
|
<pre class="code">vi /etc/simplesamlphp/metadata/saml20-sp-remote.php</pre>
|
|
<pre class="code file php"><span class="kw2"><?php</span>
|
|
<span class="re0">$metadata</span><span class="br0">[</span><span class="st_h">'http://auth.example.com/saml/metadata'</span><span class="br0">]</span> <span class="sy0">=</span> <a href="http://www.php.net/array"><span class="kw3">array</span></a> <span class="br0">(</span>
|
|
<span class="st_h">'entityid'</span> <span class="sy0">=></span> <span class="st_h">'http://auth.example.com/saml/metadata'</span><span class="sy0">,</span>
|
|
<span class="sy0">...</span>
|
|
<span class="br0">)</span><span class="sy0">;</span>
|
|
<span class="sy1">?></span></pre>
|
|
<div class="notetip">Don't forget PHP start and end tag to have a valid PHP file.
|
|
</div>
|
|
<p>
|
|
All is ready, you can now test the authentication from <abbr title="LemonLDAP::NG">LL::NG</abbr> portal.
|
|
</p>
|
|
|
|
</div>
|
|
<!-- EDIT7 SECTION "simpleSAMLphp as Identity Provider" [3259-] --></div>
|
|
</body>
|
|
</html>
|