pdmfc / laravel-saml2idp-php-8-support
Make your Laravel application an Identification Provider using SAML 2.0.
Installs: 2 058
Dependents: 0
Suggesters: 0
Security: 0
Stars: 0
Watchers: 1
Forks: 0
Open Issues: 0
Requires
- php: ^7.3 | ^8.0 | ^8.1
- illuminate/routing: ^7.0 | ^8.0 | ^9.0
- illuminate/support: ^7.0 | ^8.0 | ^9.0
- litesaml/lightsaml: ^4.0
This package is not auto-updated.
Last update: 2024-10-28 20:24:56 UTC
README
Fork of laravel SAMLIDP PHP library
FOR LARAVEL 7
use the 2.0.0 version
FOR LARAVEL 6
use the 1.0.0 version
Installation
Add this on composer repositories section:
{ "type": "vcs", "url": "https://github.com/pdmfc/laravel-saml2idp-php-8-support.git" }
Require this package with composer:
composer require pdmfc/laravel-saml2idp-php-8-support:*
Configuration
php artisan vendor:publish --tag="samlidp_config"
FileSystem configuration
// config/filesystem.php 'disks' => [ ... 'samlidp' => [ 'driver' => 'local', 'root' => storage_path() . '/samlidp', ] ],
Use the following command to create a self signed certificate for your IdP. If you change the certname or keyname to anything other than the default names, you will need to update your config/samlidp.php
config file to reflect those new file names.
php artisan samlidp:cert [--days <days> --keyname <name> --certname <name>]
Options: --days=<days> Days to add for the expiration date [default: 7800] --keyname=<name> Name of the certificate key file [default: key.pem] --certname=<name> Name of the certificate file [default: cert.pem]
Usage
Within your login view, probably resources/views/auth/login.blade.php
add the SAMLRequest directive beneath the CSRF directive:
@csrf @samlidp
The SAMLRequest directive will fill out the hidden input automatically when a SAMLRequest is sent by an HTTP request and therefore initiate a SAML authentication attempt. To initiate the SAML auth, the login and redirect processes need to be intervened. This is done using the Laravel events fired upon authentication.
Config
After you publish the config file, you will need to set up your Service Providers. The key for the Service Provider is a base 64 encoded Consumer Service (ACS) URL. You can get this information from your Service Provider, but you will need to base 64 encode the URL and place it in your config. This is due to config dot notation.
You may use this command to help generate a new SAML Service Provider:
php artisan samlidp:sp
Example SP in config/samlidp.php
file:
<?php return [ // The URI to your login page 'login_uri' => 'login', // The URI to the saml metadata file, this describes your idP 'issuer_uri' => 'saml/metadata', // List of all Service Providers 'sp' => [ // Base64 encoded ACS URL 'aHR0cHM6Ly9teWZhY2Vib29rd29ya3BsYWNlLmZhY2Vib29rLmNvbS93b3JrL3NhbWwucGhw' => [ // ACS URL of the Service Provider 'destination' => 'https://example.com/saml/acs', // Simple Logout URL of the Service Provider 'logout' => 'https://example.com/saml/sls', ] ] ];
Log out of IdP after SLO
If you wish to log out of the IdP after SLO has completed, set LOGOUT_AFTER_SLO
to true
in your .env
perform the logout action on the Idp.
// .env
LOGOUT_AFTER_SLO=true
Redirect to SLO initiator after logout
If you wish to return the user back to the SP by which SLO was initiated, you may provide an additional query parameter to the /saml/logout
route, for example:
https://idp.com/saml/logout?redirect_to=mysp.com
After all SP's have been logged out of, the user will be redirected to mysp.com
. For this to work properly you need to add the sp_slo_redirects
option to your config/samlidp.php
config file, for example:
<?php // config/samlidp.php return [ // If you need to redirect after SLO depending on SLO initiator // key is beginning of HTTP_REFERER value from SERVER, value is redirect path 'sp_slo_redirects' => [ 'mysp.com' => 'https://mysp.com', ], ];
Attributes (optional)
Service providers may require more additional attributes to be sent via assertion. Its even possible that they require the same information but as a different Claim Type.
By Default this package will send the following Claim Types:
ClaimTypes::EMAIL_ADDRESS
as auth()->user()->email
ClaimTypes::GIVEN_NAME
as auth()->user()->name
This is because Laravel migrations, by default, only supply email and name fields that are usable by SAML 2.0.
To add additional Claim Types, you can subscribe to the Assertion event:
PDMFC\Saml2Idp\Events\Assertion
Subscribing to the Event:
In your App\Providers\EventServiceProvider
class, add to the already existing $listen
property...
protected $listen = [ 'App\Events\Event' => [ 'App\Listeners\EventListener', ], 'PDMFC\Saml2Idp\Events\Assertion' => [ 'App\Listeners\SamlAssertionAttributes' ] ];
Sample Listener:
<?php namespace App\Listeners; use LightSaml\ClaimTypes; use LightSaml\Model\Assertion\Attribute; use PDMFC\Saml2Idp\Events\Assertion; class SamlAssertionAttributes { public function handle(Assertion $event) { $event->attribute_statement ->addAttribute(new Attribute(ClaimTypes::PPID, auth()->user()->id)) ->addAttribute(new Attribute(ClaimTypes::NAME, auth()->user()->name)); } }