simplesamlphp / simplesamlphp-module-aggregator
A SAML 2.0 metadata aggregator for SimpleSAMLphp.
Installs: 14 734
Dependents: 0
Suggesters: 0
Security: 0
Stars: 1
Watchers: 6
Forks: 1
Open Issues: 0
Type:simplesamlphp-module
Requires
This package is auto-updated.
Last update: 2020-03-25 13:49:06 UTC
README
This is a module for SimpleSAMLphp that aggregates a set of SAML entities into SAML 2.0 metadata documents. The resulting metadata documents contain an EntitiesDescriptor element with the multiple entities configured as sources inside. Multiple aggregates can be configured at the same time.
Please note that this module has been deprecated in favour of the more recent Aggregator2 module.
Configuration
To configure the aggregator module, add a PHP file named module_aggregate.php
to the config
directory in the root of your SimpleSAMLphp installation. Alternatively, you can use the
configuration template provider in the config-templates
directory of this module.
The configuration file includes an option aggregators
, which includes a indexed list of different aggregator configurations that all can be accessed independently. The structure is as follows:
'aggregators' => array( 'aggr1' => array( 'sources' => [...] [...local params...] ), 'aggr2' => ... ) [...global params...]
All of the global parameters can be overriden for each aggregator. Here is a list of the available (global) paramters:
-
maxDuration
: Max validity of metadata (duration) in seconds. -
reconstruct
: Whether simpleSAMLphp should regenerate the metadata XML (TRUE) or pass-through the input metadata XML (FALSE). -
RegistrationInfo
: Allows to specify information about the registrar of this metadata. Please refer to the MDRPI extension document for further information. -
set
: By default all SAML types are available, including:array('saml20-idp-remote', 'saml20-sp-remote')
. This list can be reduced by specifying one of the following values:saml20-idp-remote
saml20-sp-remote
saml2
-
sign.enable
: Enable signing of metadata document -
sign.certificate
: Certificate to embed, corresponding to the private key. -
sign.privatekey
: Private key to use when signing -
sign.privatekey_pass
: Optionally a passphrase to the private key
Accessing the aggregate
On the SimpleSAMLphp frontpage on the federation tab, there is a link to the aggregator named Metadata aggregator.
When accessing the aggregator endpoint without specifying an aggregate ID, a list of available aggregators will be presented, with different options for mime-type presenting the result.
The endpoint supports the following query parameter:
-
id
: The ID of the aggregator (From configuration file) -
set
: Subset the available types of SAML entities. Similar to theset
parameter described over in the configuration file description. -
exclude
: Specify atag
that will be excluded from the metadata set. Useful for leaving out your own federation metadata. -
mimetype
: Select the Mime-Type that will be used. Default isapplication/samlmetadata+xml
.