karolornoch / oneloginsaml-bundle
OneLogin SAML Bundle for Symfony2
Installs: 5
Dependents: 0
Suggesters: 0
Security: 0
Stars: 0
Watchers: 0
Forks: 95
Type:symfony-bundle
Requires
- onelogin/php-saml: ^3.0
- symfony/dependency-injection: ^5.4
- symfony/deprecation-contracts: ^2.1 | ^3
- symfony/event-dispatcher-contracts: ^2.4
- symfony/framework-bundle: ^5.4
- symfony/security-bundle: ^5.4
Requires (Dev)
- dms/phpunit-arraysubset-asserts: ^0.2.0
- doctrine/orm: ~2.3
- php-coveralls/php-coveralls: ^2.2
- phpunit/phpunit: ^9.0
- symfony/event-dispatcher: ^5.4
- symfony/phpunit-bridge: ^5.4
- dev-neuca
- 2.x-dev
- v2.10.0
- v2.9.0
- v2.8.0
- v2.7.0
- v2.6.1
- v2.6.0
- v2.5.0
- v2.4.2
- v2.4.1
- v2.4.0
- v2.3.3
- v2.3.2
- v2.3.1
- v2.3.0
- v2.2.2
- v2.2.1
- v2.2.0
- v2.1.4
- v2.1.3
- v2.1.2
- v2.1.1
- v2.1.0
- v2.0.0
- 1.x-dev
- v1.8.3
- v1.8.2
- v1.8.1
- v1.8.0
- v1.7.0
- v1.6.4
- v1.6.3
- v1.6.2
- v1.6.1
- v1.6.0
- v1.5.4
- v1.5.3
- v1.5.2
- v1.5.1
- v1.5.0
- v1.4.1
- v1.4.0
- v1.3.1
- v1.3.0
- v1.2.0
- v1.1.0
- v1.0.0
- v0.0.1
- dev-multipleidps
This package is auto-updated.
Last update: 2024-05-08 18:05:54 UTC
README
OneLogin SAML Bundle for Symfony2. (https://github.com/onelogin/php-saml)
Installation
Install with composer
"require": { "hslavich/oneloginsaml-bundle": "^1.0" }
Run composer update
composer update hslavich/oneloginsaml-bundle
Enable the bundle in app/AppKernel.php
$bundles = array( // ... new Hslavich\OneloginSamlBundle\HslavichOneloginSamlBundle(), )
Configuration
Configure SAML metadata in app/config/config.yml
. Check https://github.com/onelogin/php-saml#settings for more info.
hslavich_onelogin_saml: # Basic settings idp: entityId: 'http://id.example.com/saml2/idp/metadata.php' singleSignOnService: url: 'http://id.example.com/saml2/idp/SSOService.php' destinationUrl: 'http://id.example.com/saml2/idp/SSOService.php' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' singleLogoutService: url: 'http://id.example.com/saml2/idp/SingleLogoutService.php' destinationUrl: 'http://id.example.com/saml2/idp/SSOService.php' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' x509cert: '' sp: entityId: 'http://myapp.com/app_dev.php/saml/metadata' assertionConsumerService: url: 'http://myapp.com/app_dev.php/saml/acs' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' singleLogoutService: url: 'http://myapp.com/app_dev.php/saml/logout' binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' privateKey: '' # Optional settings baseurl: 'http://myapp.com' strict: true debug: true security: nameIdEncrypted: false authnRequestsSigned: false logoutRequestSigned: false logoutResponseSigned: false wantMessagesSigned: false wantAssertionsSigned: false wantNameIdEncrypted: false requestedAuthnContext: true signMetadata: false wantXMLValidation: true relaxDestinationValidation: false destinationStrictlyMatches: true rejectUnsolicitedResponsesWithInResponseTo: false signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256' contactPerson: technical: givenName: 'Tech User' emailAddress: 'techuser@example.com' support: givenName: 'Support User' emailAddress: 'supportuser@example.com' administrative: givenName: 'Administrative User' emailAddress: 'administrativeuser@example.com' organization: en: name: 'Example' displayname: 'Example' url: 'http://example.com'
If you don't want to set contactPerson or organization, don't add those parameters instead of leaving them blank.
Configure firewall and user provider in app/config/security.yml
security: # ... providers: saml_provider: # Basic provider instantiates a user with default roles saml: user_class: 'AppBundle\Entity\User' default_roles: ['ROLE_USER'] firewalls: app: pattern: ^/ anonymous: true saml: # Match SAML attribute 'uid' with username. # Uses getNameId() method by default. username_attribute: uid # Use the attribute's friendlyName instead of the name use_attribute_friendly_name: true check_path: /saml/acs login_path: /saml/login logout: path: /saml/logout access_control: - { path: ^/saml/login, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/saml/metadata, roles: IS_AUTHENTICATED_ANONYMOUSLY } - { path: ^/, roles: ROLE_USER }
Edit your app/config/routing
hslavich_saml_sp: resource: "@HslavichOneloginSamlBundle/Resources/config/routing.yml"
Inject SAML attributes into User object (Optional)
Your user class must implement SamlUserInterface
<?php namespace AppBundle\Entity; use Hslavich\OneloginSamlBundle\Security\User\SamlUserInterface; class User implements SamlUserInterface { protected $username; protected $email; // ... public function setSamlAttributes(array $attributes) { $this->email = $attributes['mail'][0]; } }
Then you can get attributes from user object
$email = $this->getUser()->getEmail();
Integration with classic login form
You can integrate SAML authentication with traditional login form by editing your security.yml
:
security: providers: user_provider: # Loads user from user repository entity: class: AppBundle:User property: username firewalls: default: anonymous: ~ saml: username_attribute: uid check_path: /saml/acs login_path: /saml/login failure_path: /login always_use_default_target_path: true # Traditional login form form_login: login_path: /login check_path: /login_check always_use_default_target_path: true logout: path: /saml/logout
Then you can add a link to route saml_login
in your login page in order to start SAML sign on.
<a href="{{ path('saml_login') }}">SAML Login</a>
Just-in-time user provisioning (optional)
When user is not found by user provider, you can set a user factory to create a new user mapping SAML attributes.
Edit firewall settings in security.yml
:
firewalls: default: anonymous: ~ saml: username_attribute: uid # User factory service user_factory: my_user_factory logout: path: /saml/logout
Create the user factory service editing services.yml
:
services: my_user_factory: class: Hslavich\OneloginSamlBundle\Security\User\SamlUserFactory arguments: # User class - AppBundle\Entity\User # Attribute mapping. - password: 'notused' email: $mail name: $cn lastname: $sn roles: ['ROLE_USER']
Fields with '$' references to SAML attribute value.
Or you can create your own User Factory that implements SamlUserFactoryInterface
<?php namespace AppBundle\Security; use AppBundle\Entity\User; use Hslavich\OneloginSamlBundle\Security\Authentication\Token\SamlTokenInterface; use Hslavich\OneloginSamlBundle\Security\User\SamlUserFactoryInterface; class UserFactory implements SamlUserFactoryInterface { public function createUser(SamlTokenInterface $token) { $attributes = $token->getAttributes(); $user = new User(); $user->setRoles(array('ROLE_USER')); $user->setUsername($token->getUsername()); $user->setPassword('notused'); $user->setEmail($attributes['mail'][0]); $user->setName($attributes['cn'][0]); return $user; } }
services: my_user_factory: class: AppBundle\Security\UserFactory
Persist user on creation and SAML attributes injection (Optional)
Symfony EventDispatcher component and Doctrine ORM are required.
Edit firewall settings in security.yaml
:
security: # ... firewalls: # ... default: saml: # ... persist_user: true
To use non-default entity manager specify it name by hslavich_onelogin_saml.security.entityManagerName
config option.
User persistence is performing by event listeners Hslavich\OneloginSamlBundle\EventListener\User\UserCreatedListener
and Hslavich\OneloginSamlBundle\EventListener\User\UserModifiedListener
that can be decorated if necessary to override
the default behavior. Also, you can make your own listeners for saml_user.created
and saml_user.modified
events.