simplesamlphp/simplesamlphp-module-adfs

A module that implements the WS-federation IDP

v3.0.2 2025-10-23 14:07 UTC

Requires

• php: ^8.1
• ext-dom: *
• beste/clock: ^3.0
• psr/clock: ^1.0
• simplesamlphp/assert: ~1.8.0
• simplesamlphp/saml11: ~1.2.0
• simplesamlphp/saml2: ^5@dev
• simplesamlphp/simplesamlphp: ^2.4
• simplesamlphp/ws-security: ~1.9.0
• simplesamlphp/xml-common: ~1.24.0
• simplesamlphp/xml-security: ~1.13.0
• simplesamlphp/xml-soap: ~1.7.0
• simplesamlphp/xml-wsdl: ~1.2.1
• symfony/http-foundation: ^6.4

Requires (Dev)

• simplesamlphp/simplesamlphp-test-framework: ~1.8.0

LGPL-2.1-or-later

• Tim van Dijen

• simplesamlphp
• adfs

README

Install

Install with composer

    vendor/bin/composer require simplesamlphp/simplesamlphp-module-adfs

Configuration

Next thing you need to do is to enable the module: in config.php, search for the module.enable key and set adfs to true:

    'module.enable' => [
         'adfs' => true,
         …
    ],

View samples in metadata-templates for defining your idp and any relying parties/sps.

Tips for admins new to WS-Fed

• A realm is similar to an entityId from SAML. adfs-sp-remote.php metadata array is based on realm. An IP STS is similar to an IdP.

• Some WS-Fed Relying Party applications want the assertion lifetime to be longer than the application's session lifetime. If not, the application will send the user to the IdP to login again, hoping for a longer lived assertion. SSP's default assertion lifetime is 5 minutes while SharePoint, by default, wants 10 minutes. Use the assertion.lifetime in adfs-sp-remote.php to set the time greater than that set in SharePoint (which can be configured by adjusting LogonTokenCacheExpirationWindow)