entrouvert
/
samlauth-elgg
Archived
17
0
Fork 0
Code Issues Pull Requests Releases Activity

Improve plugin and use identity hub by default

This commit is contained in:
Jérôme Schneider 2013-04-16 18:11:19 +02:00
parent 66f1d19193
commit 2045d15541
6 changed files with 1020 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
install_descartes.txt
View File

@ -19,7 +19,8 @@ Cette bibliothèque est intégrée directement dans le module pour des raisons p
Elle est installée dans saml_auth/simplesamlphp et son dossier de configuration est dans
saml_auth/simplesamlphp/config.
Le module saml_auth est pré-configuré pour utiliser le Shibboleth 2.0 RENATER de test.
Le module saml_auth est pré-configuré pour utiliser Identity hub mais il peut également utiliser
le Shibboleth de test de RENATER.
Il faudra tout de même ajouter l'alias Apache suivant dans la configuration
du vhost de votre Elgg :
@ -40,8 +41,5 @@ Il faut vous rendre dans l'administration de Elgg puis dans Plugins et choisir d
== Configuration du module ==
Dans l'administration de Elgg vous pouvez modifier le plugin qui est
pour le moment configurer pour utiliser le Shibboleth de test de la fédération RENATER et
qui permet l'authentification classique ou bien par Shibboleth.
Vous pouvez changer le mapping des attributs, le nom du sp SimpleSAMLphp ou bien permettre
ou non l'authentification classique de ELgg.
pour le moment configurer pour utiliser identy-hub.
Attention la modification des attributs peut casser le sso.

1
languages/en.php
View File

@ -21,6 +21,7 @@
'saml_auth:account:authentication:text' => "Please click on the button to connect with UnivCloud",
'saml_auth:account:authentication:button' => "Log In with UnivCloud",
'saml_auth:samlerror' => "The SAML plugin is misconfigured. It will not be used.",
'saml_auth:errorattrs' => "Username or / and email not transmited"
);
add_translation('en', $en);

1
languages/fr.php
View File

@ -21,6 +21,7 @@
'saml_auth:account:authentication:text' => "Cliquer sur le bouton pour vous connecter via UnivCloud",
'saml_auth:account:authentication:button' => "Se connecter avec UnivCloud",
'saml_auth:samlerror' => "Le plugin SAML n'est pas configuré correctement. Il n'est pas utilisé.",
'saml_auth:errorattrs' => "Nom d'utilisateur ou / et email inconnu"
);
add_translation('fr', $fr);

360
simplesamlphp/config/authsources.php Normal file
View File

@ -0,0 +1,360 @@
<?php
$config = array(
// This is a authentication source which handles admin authentication.
'admin' => array(
// The default is to use core:AdminPassword, but it can be replaced with
// any authentication source.
'core:AdminPassword',
),
// An authentication source which can authenticate against both SAML 2.0
// and Shibboleth 1.3 IdPs.
'default-sp' => array(
'saml:SP',
// The entity ID of this SP.
// Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.
'entityID' => NULL,
// The entity ID of the IdP this should SP should contact.
// Can be NULL/unset, in which case the user will be shown a list of available IdPs.
'idp' => 'http://www.identity-hub.net/idp/saml2/metadata',
// The URL to the discovery service.
// Can be NULL/unset, in which case a builtin discovery service will be used.
'discoURL' => NULL,
'NameIDPolicy' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
'authproc' => array(
10 => array(
'class' => 'saml:NameIDAttribute',
'format' => '%V',
'attribute' => 'NameID',
)
),
'privatekey' => 'saml.pem',
'certificate' => 'saml.crt',
),
/*
'example-sql' => array(
'sqlauth:SQL',
'dsn' => 'pgsql:host=sql.example.org;port=5432;dbname=simplesaml',
'username' => 'simplesaml',
'password' => 'secretpassword',
'query' => 'SELECT "username", "name", "email" FROM "users" WHERE "username" = :username AND "password" = :password',
),
*/
/*
'example-static' => array(
'exampleauth:Static',
'uid' => array('testuser'),
'eduPersonAffiliation' => array('member', 'employee'),
'cn' => array('Test User'),
),
*/
/*
'example-userpass' => array(
'exampleauth:UserPass',
// Give the user an option to save their username for future login attempts
// And when enabled, what should the default be, to save the username or not
//'remember.username.enabled' => FALSE,
//'remember.username.checked' => FALSE,
'student:studentpass' => array(
'uid' => array('test'),
'eduPersonAffiliation' => array('member', 'student'),
),
'employee:employeepass' => array(
'uid' => array('employee'),
'eduPersonAffiliation' => array('member', 'employee'),
),
),
*/
/*
'crypto-hash' => array(
'authcrypt:Hash',
// hashed version of 'verysecret', made with bin/pwgen.php
'professor:{SSHA256}P6FDTEEIY2EnER9a6P2GwHhI5JDrwBgjQ913oVQjBngmCtrNBUMowA==' => array(
'uid' => array('prof_a'),
'eduPersonAffiliation' => array('member', 'employee', 'board'),
),
),
*/
/*
'htpasswd' => array(
'authcrypt:Htpasswd',
'htpasswd_file' => '/var/www/foo.edu/legacy_app/.htpasswd',
'static_attributes' => array(
'eduPersonAffiliation' => array('member', 'employee'),
'Organization' => array('University of Foo'),
),
),
*/
/*
// This authentication source serves as an example of integration with an
// external authentication engine. Take a look at the comment in the beginning
// of modules/exampleauth/lib/Auth/Source/External.php for a description of
// how to adjust it to your own site.
'example-external' => array(
'exampleauth:External',
),
*/
/*
'yubikey' => array(
'authYubiKey:YubiKey',
'id' => '000',
// 'key' => '012345678',
),
*/
/*
'openid' => array(
'openid:OpenIDConsumer',
'attributes.required' => array('nickname'),
'attributes.optional' => array('fullname', 'email',),
// 'sreg.validate' => FALSE,
'attributes.ax_required' => array('http://axschema.org/namePerson/friendly'),
'attributes.ax_optional' => array('http://axschema.org/namePerson','http://axschema.org/contact/email'),
// Prefer HTTP redirect over POST
// 'prefer_http_redirect' => FALSE,
),
*/
/*
// Example of an authsource that authenticates against Google.
// See: http://code.google.com/apis/accounts/docs/OpenID.html
'google' => array(
'openid:OpenIDConsumer',
// Googles OpenID endpoint.
'target' => 'https://www.google.com/accounts/o8/id',
// Custom realm
// 'realm' => 'http://*.example.org',
// Attributes that google can supply.
'attributes.ax_required' => array(
//'http://axschema.org/namePerson/first',
//'http://axschema.org/namePerson/last',
//'http://axschema.org/contact/email',
//'http://axschema.org/contact/country/home',
//'http://axschema.org/pref/language',
),
// custom extension arguments
'extension.args' => array(
//'http://specs.openid.net/extensions/ui/1.0' => array(
// 'mode' => 'popup',
// 'icon' => 'true',
//),
),
),
*/
/*
'papi' => array(
'authpapi:PAPI',
),
*/
/*
'facebook' => array(
'authfacebook:Facebook',
// Register your Facebook application on http://www.facebook.com/developers
// App ID or API key (requests with App ID should be faster; https://github.com/facebook/php-sdk/issues/214)
'api_key' => 'xxxxxxxxxxxxxxxx',
// App Secret
'secret' => 'xxxxxxxxxxxxxxxx',
// which additional data permissions to request from user
// see http://developers.facebook.com/docs/authentication/permissions/ for the full list
// 'req_perms' => 'email,user_birthday',
),
*/
/*
// LinkedIn OAuth Authentication API.
// Register your application to get an API key here:
// https://www.linkedin.com/secure/developer
'linkedin' => array(
'authlinkedin:LinkedIn',
'key' => 'xxxxxxxxxxxxxxxx',
'secret' => 'xxxxxxxxxxxxxxxx',
),
*/
/*
// Twitter OAuth Authentication API.
// Register your application to get an API key here:
// http://twitter.com/oauth_clients
'twitter' => array(
'authtwitter:Twitter',
'key' => 'xxxxxxxxxxxxxxxx',
'secret' => 'xxxxxxxxxxxxxxxx',
),
*/
/*
// MySpace OAuth Authentication API.
// Register your application to get an API key here:
// http://developer.myspace.com/
'myspace' => array(
'authmyspace:MySpace',
'key' => 'xxxxxxxxxxxxxxxx',
'secret' => 'xxxxxxxxxxxxxxxx',
),
*/
/*
// Windows Live ID Authentication API.
// Register your application to get an API key here:
// https://manage.dev.live.com
'windowslive' => array(
'authwindowslive:LiveID',
'key' => 'xxxxxxxxxxxxxxxx',
'secret' => 'xxxxxxxxxxxxxxxx',
),
*/
/*
// Example of a LDAP authentication source.
'example-ldap' => array(
'ldap:LDAP',
// Give the user an option to save their username for future login attempts
// And when enabled, what should the default be, to save the username or not
//'remember.username.enabled' => FALSE,
//'remember.username.checked' => FALSE,
// The hostname of the LDAP server.
'hostname' => 'ldap.example.org',
// Whether SSL/TLS should be used when contacting the LDAP server.
'enable_tls' => FALSE,
// Whether debug output from the LDAP library should be enabled.
// Default is FALSE.
'debug' => FALSE,
// The timeout for accessing the LDAP server, in seconds.
// The default is 0, which means no timeout.
'timeout' => 0,
// Which attributes should be retrieved from the LDAP server.
// This can be an array of attribute names, or NULL, in which case
// all attributes are fetched.
'attributes' => NULL,
// The pattern which should be used to create the users DN given the username.
// %username% in this pattern will be replaced with the users username.
//
// This option is not used if the search.enable option is set to TRUE.
'dnpattern' => 'uid=%username%,ou=people,dc=example,dc=org',
// As an alternative to specifying a pattern for the users DN, it is possible to
// search for the username in a set of attributes. This is enabled by this option.
'search.enable' => FALSE,
// The DN which will be used as a base for the search.
// This can be a single string, in which case only that DN is searched, or an
// array of strings, in which case they will be searched in the order given.
'search.base' => 'ou=people,dc=example,dc=org',
// The attribute(s) the username should match against.
//
// This is an array with one or more attribute names. Any of the attributes in
// the array may match the value the username.
'search.attributes' => array('uid', 'mail'),
// The username & password the simpleSAMLphp should bind to before searching. If
// this is left as NULL, no bind will be performed before searching.
'search.username' => NULL,
'search.password' => NULL,
// If the directory uses privilege separation,
// the authenticated user may not be able to retrieve
// all required attribures, a privileged entity is required
// to get them. This is enabled with this option.
'priv.read' => FALSE,
// The DN & password the simpleSAMLphp should bind to before
// retrieving attributes. These options are required if
// 'priv.read' is set to TRUE.
'priv.username' => NULL,
'priv.password' => NULL,
),
*/
/*
// Example of an LDAPMulti authentication source.
'example-ldapmulti' => array(
'ldap:LDAPMulti',
// Give the user an option to save their username for future login attempts
// And when enabled, what should the default be, to save the username or not
//'remember.username.enabled' => FALSE,
//'remember.username.checked' => FALSE,
// The way the organization as part of the username should be handled.
// Three possible values:
// - 'none': No handling of the organization. Allows '@' to be part
// of the username.
// - 'allow': Will allow users to type 'username@organization'.
// - 'force': Force users to type 'username@organization'. The dropdown
// list will be hidden.
//
// The default is 'none'.
'username_organization_method' => 'none',
// Whether the organization should be included as part of the username
// when authenticating. If this is set to TRUE, the username will be on
// the form <username>@<organization identifier>. If this is FALSE, the
// username will be used as the user enters it.
//
// The default is FALSE.
'include_organization_in_username' => FALSE,
// A list of available LDAP servers.
//
// The index is an identifier for the organization/group. When
// 'username_organization_method' is set to something other than 'none',
// the organization-part of the username is matched against the index.
//
// The value of each element is an array in the same format as an LDAP
// authentication source.
'employees' => array(
// A short name/description for this group. Will be shown in a dropdown list
// when the user logs on.
//
// This option can be a string or an array with language => text mappings.
'description' => 'Employees',
// The rest of the options are the same as those available for
// the LDAP authentication source.
'hostname' => 'ldap.employees.example.org',
'dnpattern' => 'uid=%username%,ou=employees,dc=example,dc=org',
),
'students' => array(
'description' => 'Students',
'hostname' => 'ldap.students.example.org',
'dnpattern' => 'uid=%username%,ou=students,dc=example,dc=org',
),
),
*/
);

638
simplesamlphp/config/config.php Normal file
View File

@ -0,0 +1,638 @@
<?php
/*
* The configuration of simpleSAMLphp
*
* $Id: config.php 3171 2012-09-25 08:54:06Z jaimepc@gmail.com $
*/
$config = array (
/**
* Setup the following parameters to match the directory of your installation.
* See the user manual for more details.
*
* Valid format for baseurlpath is:
* [(http|https)://(hostname|fqdn)[:port]]/[path/to/simplesaml/]
* (note that it must end with a '/')
*
* The full url format is useful if your simpleSAMLphp setup is hosted behind
* a reverse proxy. In that case you can specify the external url here.
*
* Please note that simpleSAMLphp will then redirect all queries to the
* external url, no matter where you come from (direct access or via the
* reverse proxy).
*/
'baseurlpath' => 'simplesamlphp/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
/*
* A directory where simpleSAMLphp can save temporary files.
*
* SimpleSAMLphp will attempt to create this directory if it doesn't exist.
*/
'tempdir' => '/tmp/simplesaml',
/*
* If you enable this option, simpleSAMLphp will log all sent and received messages
* to the log file.
*
* This option also enables logging of the messages that are encrypted and decrypted.
*
* Note: The messages are logged with the DEBUG log level, so you also need to set
* the 'logging.level' option to LOG_DEBUG.
*/
'debug' => FALSE,
'showerrors' => TRUE,
/**
* Custom error show function called from SimpleSAML_Error_Error::show.
* See docs/simplesamlphp-errorhandling.txt for function code example.
*
* Example:
* 'errors.show_function' => array('sspmod_example_Error_Show', 'show'),
*/
/**
* This option allows you to enable validation of XML data against its
* schemas. A warning will be written to the log if validation fails.
*/
'debug.validatexml' => FALSE,
/**
* This password must be kept secret, and modified from the default value 123.
* This password will give access to the installation page of simpleSAMLphp with
* metadata listing and diagnostics pages.
* You can also put a hash here; run "bin/pwgen.php" to generate one.
*/
'auth.adminpassword' => '123',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
/**
* This is a secret salt used by simpleSAMLphp when it needs to generate a secure hash
* of a value. It must be changed from its default value to a secret value. The value of
* 'secretsalt' can be any valid string of any length.
*
* A possible way to generate a random salt is by running the following command from a unix shell:
* tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz' </dev/urandom | dd bs=32 count=1 2>/dev/null;echo
*/
'secretsalt' => 'defaultsecretsalt',
/*
* Some information about the technical persons running this installation.
* The email address will be used as the recipient address for error reports, and
* also as the technical contact in generated metadata.
*/
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.org',
/*
* The timezone of the server. This option should be set to the timezone you want
* simpleSAMLphp to report the time in. The default is to guess the timezone based
* on your system timezone.
*
* See this page for a list of valid timezones: http://php.net/manual/en/timezones.php
*/
'timezone' => NULL,
/*
* Logging.
*
* define the minimum log level to log
* SimpleSAML_Logger::ERR No statistics, only errors
* SimpleSAML_Logger::WARNING No statistics, only warnings/errors
* SimpleSAML_Logger::NOTICE Statistics and errors
* SimpleSAML_Logger::INFO Verbose logs
* SimpleSAML_Logger::DEBUG Full debug logs - not reccomended for production
*
* Choose logging handler.
*
* Options: [syslog,file,errorlog]
*
*/
'logging.level' => SimpleSAML_Logger::NOTICE,
'logging.handler' => 'syslog',
/*
* Choose which facility should be used when logging with syslog.
*
* These can be used for filtering the syslog output from simpleSAMLphp into its
* own file by configuring the syslog daemon.
*
* See the documentation for openlog (http://php.net/manual/en/function.openlog.php) for available
* facilities. Note that only LOG_USER is valid on windows.
*
* The default is to use LOG_LOCAL5 if available, and fall back to LOG_USER if not.
*/
'logging.facility' => defined('LOG_LOCAL5') ? constant('LOG_LOCAL5') : LOG_USER,
/*
* The process name that should be used when logging to syslog.
* The value is also written out by the other logging handlers.
*/
'logging.processname' => 'simplesamlphp',
/* Logging: file - Logfilename in the loggingdir from above.
*/
'logging.logfile' => 'simplesamlphp.log',
/* (New) statistics output configuration.
*
* This is an array of outputs. Each output has at least a 'class' option, which
* selects the output.
*/
'statistics.out' => array(
// Log statistics to the normal log.
/*
array(
'class' => 'core:Log',
'level' => 'notice',
),
*/
// Log statistics to files in a directory. One file per day.
/*
array(
'class' => 'core:File',
'directory' => '/var/log/stats',
),
*/
),
/*
* Enable
*
* Which functionality in simpleSAMLphp do you want to enable. Normally you would enable only
* one of the functionalities below, but in some cases you could run multiple functionalities.
* In example when you are setting up a federation bridge.
*/
'enable.saml20-idp' => false,
'enable.shib13-idp' => false,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
/*
* This value is the duration of the session in seconds. Make sure that the time duration of
* cookies both at the SP and the IdP exceeds this duration.
*/
'session.duration' => 8 * (60*60), // 8 hours.
'session.requestcache' => 4 * (60*60), // 4 hours
/*
* Sets the duration, in seconds, data should be stored in the datastore. As the datastore is used for
* login and logout requests, thid option will control the maximum time these operations can take.
* The default is 4 hours (4*60*60) seconds, which should be more than enough for these operations.
*/
'session.datastore.timeout' => (4*60*60), // 4 hours
/*
* Sets the duration, in seconds, auth state should be stored.
*/
'session.state.timeout' => (60*60), // 1 hour
/*
* Option to override the default settings for the session cookie name
*/
'session.cookie.name' => 'SimpleSAMLSessionID',
/*
* Expiration time for the session cookie, in seconds.
*
* Defaults to 0, which means that the cookie expires when the browser is closed.
*
* Example:
* 'session.cookie.lifetime' => 30*60,
*/
'session.cookie.lifetime' => 0,
/*
* Limit the path of the cookies.
*
* Can be used to limit the path of the cookies to a specific subdirectory.
*
* Example:
* 'session.cookie.path' => '/simplesaml/',
*/
'session.cookie.path' => '/',
/*
* Cookie domain.
*
* Can be used to make the session cookie available to several domains.
*
* Example:
* 'session.cookie.domain' => '.example.org',
*/
'session.cookie.domain' => NULL,
/*
* Set the secure flag in the cookie.
*
* Set this to TRUE if the user only accesses your service
* through https. If the user can access the service through
* both http and https, this must be set to FALSE.
*/
'session.cookie.secure' => FALSE,
/*
* When set to FALSE fallback to transient session on session initialization
* failure, throw exception otherwise.
*/
'session.disable_fallback' => FALSE,
/*
* Enable secure POST from HTTPS to HTTP.
*
* If you have some SP's on HTTP and IdP is normally on HTTPS, this option
* enables secure POSTing to HTTP endpoint without warning from browser.
*
* For this to work, module.php/core/postredirect.php must be accessible
* also via HTTP on IdP, e.g. if your IdP is on
* https://idp.example.org/ssp/, then
* http://idp.example.org/ssp/module.php/core/postredirect.php must be accessible.
*/
'enable.http_post' => FALSE,
/*
* Options to override the default settings for php sessions.
*/
'session.phpsession.cookiename' => null,
'session.phpsession.savepath' => null,
'session.phpsession.httponly' => FALSE,
/*
* Option to override the default settings for the auth token cookie
*/
'session.authtoken.cookiename' => 'SimpleSAMLAuthToken',
/*
* Languages available, RTL languages, and what language is default
*/
'language.available' => array('en', 'no', 'nn', 'se', 'da', 'de', 'sv', 'fi', 'es', 'fr', 'it', 'nl', 'lb', 'cs', 'sl', 'lt', 'hr', 'hu', 'pl', 'pt', 'pt-br', 'tr', 'ja', 'zh', 'zh-tw', 'ru', 'et', 'he', 'id', 'sr'),
'language.rtl' => array('ar','dv','fa','ur','he'),
'language.default' => 'en',
/**
* Custom getLanguage function called from SimpleSAML_XHTML_Template::getLanguage().
* Function should return language code of one of the available languages or NULL.
* See SimpleSAML_XHTML_Template::getLanguage() source code for more info.
*
* This option can be used to implement a custom function for determining
* the default language for the user.
*
* Example:
* 'language.get_language_function' => array('sspmod_example_Template', 'getLanguage'),
*/
/*
* Extra dictionary for attribute names.
* This can be used to define local attributes.
*
* The format of the parameter is a string with <module>:<dictionary>.
*
* Specifying this option will cause us to look for modules/<module>/dictionaries/<dictionary>.definition.json
* The dictionary should look something like:
*
* {
* "firstattribute": {
* "en": "English name",
* "no": "Norwegian name"
* },
* "secondattribute": {
* "en": "English name",
* "no": "Norwegian name"
* }
* }
*
* Note that all attribute names in the dictionary must in lowercase.
*
* Example: 'attributes.extradictionary' => 'ourmodule:ourattributes',
*/
'attributes.extradictionary' => NULL,
/*
* Which theme directory should be used?
*/
'theme.use' => 'default',
/*
* Default IdP for WS-Fed.
*/
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
/*
* Whether the discovery service should allow the user to save his choice of IdP.
*/
'idpdisco.enableremember' => TRUE,
'idpdisco.rememberchecked' => TRUE,
// Disco service only accepts entities it knows.
'idpdisco.validate' => TRUE,
'idpdisco.extDiscoveryStorage' => NULL,
/*
* IdP Discovery service look configuration.
* Wether to display a list of idp or to display a dropdown box. For many IdP' a dropdown box
* gives the best use experience.
*
* When using dropdown box a cookie is used to highlight the previously chosen IdP in the dropdown.
* This makes it easier for the user to choose the IdP
*
* Options: [links,dropdown]
*
*/
'idpdisco.layout' => 'dropdown',
/*
* Whether simpleSAMLphp should sign the response or the assertion in SAML 1.1 authentication
* responses.
*
* The default is to sign the assertion element, but that can be overridden by setting this
* option to TRUE. It can also be overridden on a pr. SP basis by adding an option with the
* same name to the metadata of the SP.
*/
'shib13.signresponse' => TRUE,
/*
* Authentication processing filters that will be executed for all IdPs
* Both Shibboleth and SAML 2.0
*/
'authproc.idp' => array(
/* Enable the authproc filter below to add URN Prefixces to all attributes
10 => array(
'class' => 'core:AttributeMap', 'addurnprefix'
), */
/* Enable the authproc filter below to automatically generated eduPersonTargetedID.
20 => 'core:TargetedID',
*/
// Adopts language from attribute to use in UI
30 => 'core:LanguageAdaptor',
/* Add a realm attribute from edupersonprincipalname
40 => 'core:AttributeRealm',
*/
45 => array(
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
),
/* When called without parameters, it will fallback to filter attributes ‹the old way›
* by checking the 'attributes' parameter in metadata on IdP hosted and SP remote.
*/
50 => 'core:AttributeLimit',
/*
* Search attribute "distinguishedName" for pattern and replaces if found
60 => array(
'class' => 'core:AttributeAlter',
'pattern' => '/OU=studerende/',
'replacement' => 'Student',
'subject' => 'distinguishedName',
'%replace',
),
*/
/*
* Consent module is enabled (with no permanent storage, using cookies).
90 => array(
'class' => 'consent:Consent',
'store' => 'consent:Cookie',
'focus' => 'yes',
'checked' => TRUE
),
*/
// If language is set in Consent module it will be added as an attribute.
99 => 'core:LanguageAdaptor',
),
/*
* Authentication processing filters that will be executed for all SPs
* Both Shibboleth and SAML 2.0
*/
'authproc.sp' => array(
/*
10 => array(
'class' => 'core:AttributeMap', 'removeurnprefix'
),
*/
/*
* Generate the 'group' attribute populated from other variables, including eduPersonAffiliation.
*/
60 => array('class' => 'core:GenerateGroups', 'eduPersonAffiliation'),
// All users will be members of 'users' and 'members'
61 => array('class' => 'core:AttributeAdd', 'groups' => array('users', 'members')),
// Adopts language from attribute to use in UI
90 => 'core:LanguageAdaptor',
),
/*
* This option configures the metadata sources. The metadata sources is given as an array with
* different metadata sources. When searching for metadata, simpleSAMPphp will search through
* the array from start to end.
*
* Each element in the array is an associative array which configures the metadata source.
* The type of the metadata source is given by the 'type' element. For each type we have
* different configuration options.
*
* Flat file metadata handler:
* - 'type': This is always 'flatfile'.
* - 'directory': The directory we will load the metadata files from. The default value for
* this option is the value of the 'metadatadir' configuration option, or
* 'metadata/' if that option is unset.
*
* XML metadata handler:
* This metadata handler parses an XML file with either an EntityDescriptor element or an
* EntitiesDescriptor element. The XML file may be stored locally, or (for debugging) on a remote
* web server.
* The XML hetadata handler defines the following options:
* - 'type': This is always 'xml'.
* - 'file': Path to the XML file with the metadata.
* - 'url': The url to fetch metadata from. THIS IS ONLY FOR DEBUGGING - THERE IS NO CACHING OF THE RESPONSE.
*
*
* Examples:
*
* This example defines two flatfile sources. One is the default metadata directory, the other
* is a metadata directory with autogenerated metadata files.
*
* 'metadata.sources' => array(
* array('type' => 'flatfile'),
* array('type' => 'flatfile', 'directory' => 'metadata-generated'),
* ),
*
* This example defines a flatfile source and an XML source.
* 'metadata.sources' => array(
* array('type' => 'flatfile'),
* array('type' => 'xml', 'file' => 'idp.example.org-idpMeta.xml'),
* ),
*
*
* Default:
* 'metadata.sources' => array(
* array('type' => 'flatfile')
* ),
*/
'metadata.sources' => array(
array('type' => 'flatfile'),
),
/*
* Configure the datastore for simpleSAMLphp.
*
* - 'phpsession': Limited datastore, which uses the PHP session.
* - 'memcache': Key-value datastore, based on memcache.
* - 'sql': SQL datastore, using PDO.
*
* The default datastore is 'phpsession'.
*
* (This option replaces the old 'session.handler'-option.)
*/
'store.type' => 'memcache',
/*
* The DSN the sql datastore should connect to.
*
* See http://www.php.net/manual/en/pdo.drivers.php for the various
* syntaxes.
*/
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
/*
* The username and password to use when connecting to the database.
*/
'store.sql.username' => NULL,
'store.sql.password' => NULL,
/*
* The prefix we should use on our tables.
*/
'store.sql.prefix' => 'simpleSAMLphp',
/*
* Configuration for the MemcacheStore class. This allows you to store
* multiple redudant copies of sessions on different memcache servers.
*
* 'memcache_store.servers' is an array of server groups. Every data
* item will be mirrored in every server group.
*
* Each server group is an array of servers. The data items will be
* load-balanced between all servers in each server group.
*
* Each server is an array of parameters for the server. The following
* options are available:
* - 'hostname': This is the hostname or ip address where the
* memcache server runs. This is the only required option.
* - 'port': This is the port number of the memcache server. If this
* option isn't set, then we will use the 'memcache.default_port'
* ini setting. This is 11211 by default.
* - 'weight': This sets the weight of this server in this server
* group. http://php.net/manual/en/function.Memcache-addServer.php
* contains more information about the weight option.
* - 'timeout': The timeout for this server. By default, the timeout
* is 3 seconds.
*
* Example of redudant configuration with load balancing:
* This configuration makes it possible to lose both servers in the
* a-group or both servers in the b-group without losing any sessions.
* Note that sessions will be lost if one server is lost from both the
* a-group and the b-group.
*
* 'memcache_store.servers' => array(
* array(
* array('hostname' => 'mc_a1'),
* array('hostname' => 'mc_a2'),
* ),
* array(
* array('hostname' => 'mc_b1'),
* array('hostname' => 'mc_b2'),
* ),
* ),
*
* Example of simple configuration with only one memcache server,
* running on the same computer as the web server:
* Note that all sessions will be lost if the memcache server crashes.
*
* 'memcache_store.servers' => array(
* array(
* array('hostname' => 'localhost'),
* ),
* ),
*
*/
'memcache_store.servers' => array(
array(
array('hostname' => 'localhost'),
),
),
/*
* This value is the duration data should be stored in memcache. Data
* will be dropped from the memcache servers when this time expires.
* The time will be reset every time the data is written to the
* memcache servers.
*
* This value should always be larger than the 'session.duration'
* option. Not doing this may result in the session being deleted from
* the memcache servers while it is still in use.
*
* Set this value to 0 if you don't want data to expire.
*
* Note: The oldest data will always be deleted if the memcache server
* runs out of storage space.
*/
'memcache_store.expires' => 36 * (60*60), // 36 hours.
/*
* Should signing of generated metadata be enabled by default.
*
* Metadata signing can also be enabled for a individual SP or IdP by setting the
* same option in the metadata for the SP or IdP.
*/
'metadata.sign.enable' => FALSE,
/*
* The default key & certificate which should be used to sign generated metadata. These
* are files stored in the cert dir.
* These values can be overridden by the options with the same names in the SP or
* IdP metadata.
*
* If these aren't specified here or in the metadata for the SP or IdP, then
* the 'certificate' and 'privatekey' option in the metadata will be used.
* if those aren't set, signing of metadata will fail.
*/
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
/*
* Proxy to use for retrieving URLs.
*
* Example:
* 'proxy' => 'tcp://proxy.example.com:5100'
*/
'proxy' => NULL,
);

22
start.php
View File

@ -11,6 +11,7 @@
// Register the events
elgg_register_event_handler('init','system','saml_auth_init');
elgg_register_event_handler('logout','user','saml_logout');
/**
* SAML Authentication init
@ -25,7 +26,9 @@
$as = new SimpleSAML_Auth_Simple(elgg_get_plugin_setting('sp_name', 'saml_auth'));
$isAuth = $as->isAuthenticated();
$attributes = $as->getAttributes();
$elgg_user = saml_map_attributes($attributes);
$elgg_user = none;
if ($isAuth && ! elgg_is_logged_in())
$elgg_user = saml_map_attributes($attributes);
if ($isAuth && ! elgg_is_logged_in() && $elgg_user)
{
$user = get_user_by_username($elgg_user['username']);
@ -40,6 +43,7 @@
return 1;
} catch (RegistrationException $e) {
error_log('SAMLAuth cannot register username "' . $elgg_user['username'] . '", it exists already.');
register_error(elgg_echo('registration:dupeemail'));
return true;
}
$user = get_user_by_username($elgg_user['username']);
@ -56,7 +60,6 @@
// unlogged from simplesamlphp but not from elgg
return logout();
}
elgg_register_event_handler('logout','user','saml_logout');
}
function init_config()
@ -65,13 +68,13 @@
if (! $config->sp_name)
elgg_set_plugin_setting('sp_name', 'default-sp', 'saml_auth');
if (! $config->username)
elgg_set_plugin_setting('username', 'urn:oid:0.9.2342.19200300.100.1.1', 'saml_auth');
elgg_set_plugin_setting('username', 'NameID', 'saml_auth');
if (! $config->firstname)
elgg_set_plugin_setting('firstname', 'urn:oid:1.3.6.1.4.1.5923.1.1.1.2', 'saml_auth');
elgg_set_plugin_setting('firstname', 'gn', 'saml_auth');
if (! $config->surname)
elgg_set_plugin_setting('surname', 'urn:oid:2.5.4.4', 'saml_auth');
elgg_set_plugin_setting('surname', 'sn', 'saml_auth');
if (! $config->email)
elgg_set_plugin_setting('email', 'urn:oid:0.9.2342.19200300.100.1.3', 'saml_auth');
elgg_set_plugin_setting('email', 'email', 'saml_auth');
if (! $config->classical_auth)
elgg_set_plugin_setting('classical_auth', 'yes', 'saml_auth');
}
@ -104,8 +107,15 @@
$elgg_user = array();
$config = elgg_get_calling_plugin_entity('saml_auth');
# XXX: if not mail use mailForwardingAddress
if (! $attributes[$config->email] && $attributes['urn:oid:2.16.840.1.113730.3.1.17'])
$attributes[$config->email] = $attributes['urn:oid:2.16.840.1.113730.3.1.17'];
if (! $attributes[$config->username] or ! $attributes[$config->email])
{
error_log('SAMLAuth error : username or email not found');
register_error(elgg_echo('saml_auth:errorattrs'));
return false;
}
$elgg_user['username'] = $attributes[$config->username][0];
$elgg_user['password'] = gen_rand_pwd();
$elgg_user['name'] = '';