netresearch / nr-saml-auth

10.0.11 2026-10-06 16:23 UTC

Requires

• php: >=7.1.0
• onelogin/php-saml: ^3.0.0 || ^4.0.0
• typo3/cms-core: ^10.4
• typo3/cms-frontend: ^10.4

GPL-2.0+

Published on Packagist.org on 2026-10-06 16:23 UTC

README

SAML Frontend Authentication for TYPO3

TYPO3 extension for SAML SSO authentication of frontend users using the onelogin/php-saml library.

Requirements

Version	TYPO3	PHP
12.x	12.4, 13.4	8.1 - 8.5
10.x	10.4, 11.5	7.4 - 8.1

Installation

Install via Composer:

composer require netresearch/nr-saml-auth

Configuration

Backend Setup

1. Create a new SAML Auth Settings record on the root page in the TYPO3 backend
2. Configure the Service Provider (SP) and Identity Provider (IdP) settings

Example Configuration

# Service Provider Settings
Entity ID: https://your-domain.tld
Customer service URL: https://your-domain.tld/?logintype=login
Customer service binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
Name ID format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient

Certificate: -----BEGIN CERTIFICATE-----
MIIFYDCCA0igAwIBAgIJAMWkGz7F5peWMA0GCSqGSIb3DQEB...
-----END CERTIFICATE-----

Private key: [SP private key, PEM]

# Identity Provider Settings
Entity ID: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
SSO URL: https://idp.example.com/sso
Binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
Certificate: [IDP Certificate]

# User Settings
Username prefix: sso-
User folder: [Select frontend user folder]
User groups: [Select default frontend user groups]

Testing with SimpleSAMLphp

For development/testing, you can use SimpleSAMLphp or online SAML testing tools like samling.

Features

Auto Discovery

The login service automatically detects the SAML configuration for the current request based on the sp_entity_id matching your domain.

Deep Link Support (Middleware)

The extension includes middleware for redirecting users to their original destination after login/logout:

• The RelayState parameter should contain the target URL
• Transmitted via POST (login) or GET (logout) from SAML server to the configured ACS URLs

Backend Module

Access SAML metadata via the Admin Tools > SAML Auth backend module to configure your IdP.

Upgrading

From 10.x to 12.x

Version 12.x includes breaking changes:

• PHP 8.1+ required: Upgrade your PHP version
• TYPO3 12.4+ required: Upgrade your TYPO3 installation
• onelogin/php-saml 4.0: Library upgraded with security improvements
• PSR-14 Events: Legacy hooks replaced with modern event system
• Dependency Injection: Services now use TYPO3 DI container
• Username prefix: the username prefix of a settings record is applied to the username from the SAML response. Users created by 10.x carry no prefix; with a prefix configured, their next login creates a new, prefixed user.
• Database: run the database compare after updating. The extension adds the table tx_nrsamlauth_assertion, which records the assertions that logged a user in.

Development

Quality Tools

# Install dependencies
composer install

# Run all CI checks
composer ci

# Individual checks
composer ci:test:php:phpstan  # Static analysis
composer ci:test:php:cgl     # Code style check
composer ci:cgl              # Code style fix
composer ci:test:php:unit    # Unit tests

Security

What the extension protects and what it does not, its trust boundaries and the checks behind them: docs/SECURITY-ASSURANCE.md. Report vulnerabilities as described in SECURITY.md, not in public issues.

License

GPL-2.0-or-later. See LICENSE for details.

Support

For issues and feature requests, please use the GitHub issue tracker.