2017 © Pedro Peláez
 

symfony-bundle oneloginsaml-bundle

OneLogin SAML Bundle for Symfony2

image

hslavich/oneloginsaml-bundle

OneLogin SAML Bundle for Symfony2

  • Monday, July 2, 2018
  • by hslavich
  • Repository
  • 5 Watchers
  • 34 Stars
  • 40,850 Installations
  • PHP
  • 0 Dependents
  • 0 Suggesters
  • 22 Forks
  • 6 Open issues
  • 6 Versions
  • 18 % Grown

The README.md

OneloginSamlBundle

OneLogin SAML Bundle for Symfony2. (https://github.com/onelogin/php-saml), (*1)

Build Status Coverage Status Latest Stable Version Latest Unstable Version Total Downloads, (*2)

SensioLabsInsight, (*3)

Installation

Install with composer ``` json "require": { "hslavich/oneloginsaml-bundle": "dev-master" }, (*4)


Run composer update ``` bash composer update hslavich/oneloginsaml-bundle

Enable the bundle in app/AppKernel.php ``` php $bundles = array( // ... new Hslavich\OneloginSamlBundle\HslavichOneloginSamlBundle(), ), (*5)


Configuration ------------- Configure SAML metadata in `app/config/config.yml`. Check https://github.com/onelogin/php-saml#settings for more info. ``` yml hslavich_onelogin_saml: # Basic settings idp: entityId: 'http://id.example.com/saml2/idp/metadata.php' singleSignOnService: url: 'http://id.example.com/saml2/idp/SSOService.php' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' singleLogoutService: url: 'http://id.example.com/saml2/idp/SingleLogoutService.php' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' x509cert: '' sp: entityId: 'http://myapp.com/app_dev.php/saml/metadata' assertionConsumerService: url: 'http://myapp.com/app_dev.php/saml/acs' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' singleLogoutService: url: 'http://myapp.com/app_dev.php/saml/logout' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' # Optional settings strict: true debug: true security: nameIdEncrypted: false authnRequestsSigned: false logoutRequestSigned: false logoutResponseSigned: false wantMessagesSigned: false wantAssertionsSigned: false wantNameIdEncrypted: false requestedAuthnContext: true signMetadata: false wantXMLValidation: true signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256' contactPerson: technical: givenName: 'Tech User' emailAddress: 'techuser@example.com' support: givenName: 'Support User' emailAddress: 'supportuser@example.com' organization: en: name: 'Example' displayname: 'Example' url: 'http://example.com'

If you don't want to set contactPerson or organization, don't add those parameters instead of leaving them blank., (*6)

Configure firewall and user provider in app/config/security.yml ``` yml security: # ..., (*7)

providers:
    saml_provider:
        # Basic provider instantiates a user with default roles
        saml:
            user_class: 'AppBundle\Entity\User'
            default_roles: ['ROLE_USER']

firewalls:
    app:
        pattern:    ^/
        anonymous: true
        saml:
            # Match SAML attribute 'uid' with username.
            # Uses getNameId() method by default.
            username_attribute: uid
            # Use the attribute's friendlyName instead of the name 
            use_attribute_friendly_name: true
            check_path: /saml/acs
            login_path: /saml/login
        logout:
            path: /saml/logout

access_control:
    - { path: ^/saml/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/saml/metadata, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, roles: ROLE_USER }

Edit your `app/config/routing` ``` yml hslavich_saml_sp: resource: "@HslavichOneloginSamlBundle/Resources/config/routing.yml"

Inject SAML attributes into User object (Optional)

Your user class must implement SamlUserInterface, (*8)

``` php <?php, (*9)

namespace AppBundle\Entity;, (*10)

use Hslavich\OneloginSamlBundle\Security\User\SamlUserInterface;, (*11)

class User implements SamlUserInterface { protected $username; protected $email;, (*12)

// ...

public function setSamlAttributes(array $attributes)
{
    $this->email = $attributes['mail'][0];
}

}, (*13)


Then you can get attributes from user object ``` php $email = $this->getUser()->getEmail();

Integration with classic login form

You can integrate SAML authentication with traditional login form by editing your security.yml:, (*14)

``` yml security: providers: user_provider: # Loads user from user repository entity: class: AppBundle:User property: username, (*15)

firewalls:
    default:
        anonymous: ~
        saml:
            username_attribute: uid
            check_path: /saml/acs
            login_path: /saml/login
            failure_path: /login
            always_use_default_target_path: true

        # Traditional login form
        form_login:
            login_path: /login
            check_path: /login_check
            always_use_default_target_path: true

        logout:
            path: /saml/logout

Then you can add a link to route `saml_login` in your login page in order to start SAML sign on. ``` html <a href="{{ path('saml_login') }}">SAML Login</a>

Just-in-time user provisioning (optional)

When user is not found by user provider, you can set a user factory to create a new user mapping SAML attributes., (*16)

Edit firewall settings in security.yml:, (*17)

``` yml firewalls: default: anonymous: ~ saml: username_attribute: uid # User factory service user_factory: my_user_factory # Persist new user. Doctrine is required. persist_user: true logout: path: /saml/logout, (*18)


Create the user factory service editing `services.yml`: ``` yml services: my_user_factory: class: Hslavich\OneloginSamlBundle\Security\User\SamlUserFactory arguments: # User class - AppBundle\Entity\User # Attribute mapping. - password: 'notused' email: $mail name: $cn lastname: $sn roles: ['ROLE_USER']

Fields with '$' references to SAML attribute value., (*19)

Or you can create your own User Factory that implements SamlUserFactoryInterface, (*20)

``` php <?php, (*21)

namespace AppBundle\Security;, (*22)

use AppBundle\Entity\User; use Hslavich\OneloginSamlBundle\Security\Authentication\Token\SamlTokenInterface; use Hslavich\OneloginSamlBundle\Security\User\SamlUserFactoryInterface;, (*23)

class UserFactory implements SamlUserFactoryInterface { public function createUser(SamlTokenInterface $token) { $attributes = $token->getAttributes(); $user = new User(); $user->setRoles(array('ROLE_USER')); $user->setUsername($token->getUsername()); $user->setPassword('notused'); $user->setEmail($attributes['mail'][0]); $user->setName($attributes['cn'][0]);, (*24)

    return $user;
}

}, (*25)


``` yml services: my_user_factory: class: AppBundle\Security\UserFactory

The Versions

14/10 2016
17/03 2016
17/02 2016

v1.0.0

1.0.0.0

OneLogin SAML Bundle for Symfony2

  Sources   Download

MIT

The Requires

 

The Development Requires

by Avatar hslavich

saml sso onelogin

17/06 2015

v0.0.1

0.0.1.0

OneLogin SAML Bundle for Symfony2

  Sources   Download

MIT

The Requires

 

by Avatar hslavich

saml sso onelogin