Skip to content

Commit 4f8aa73

Browse files
pcablepcable
committed
Changed the sp setup so we don't need a base 64 encoded value.
Verfiy sp signatures if certificates are passed in Made installation a little easier and updated the README.md Removed EncodeAssertionUrlCommand.php as we now use actual urls.
1 parent 497c564 commit 4f8aa73

File tree

7 files changed

+206
-258
lines changed

7 files changed

+206
-258
lines changed

‎README.md‎

Lines changed: 70 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -38,64 +38,6 @@ php artisan vendor:publish --tag="saml_config"
3838

3939
will publish the config/saml.php file.
4040

41-
#### SAML SP entries
42-
43-
Within the saml.php config file the SAML Service Provider array needs to be filled. Subsequently an example from the config/saml.php file:
44-
45-
```
46-
'sp' => [
47-
48-
/**
49-
* Sample SP entry
50-
* The entry is identified by the base64 encoded URL. This example shows a possible entry for
51-
* a SimpleSamlPhp service provider running on localhost:
52-
*
53-
* Sample URL: https://localhost/samlsp/module.php/saml/sp/saml2-acs.php/default-sp
54-
* Base64 encoded URL: aHR0cHM6Ly9sb2NhbGhvc3Qvc2FtbHNwL21vZHVsZS5waHAvc2FtbC9zcC9zYW1sMi1hY3MucGhwL2RlZmF1bHQtc3A=
55-
*/
56-
'aHR0cHM6Ly9sb2NhbGhvc3Qvc2FtbHNwL21vZHVsZS5waHAvc2FtbC9zcC9zYW1sMi1hY3MucGhwL2RlZmF1bHQtc3A=' => [
57-
58-
// The destination is the consuming SAML URL. This might be a SamlAuthController receiving the SAML response.
59-
'destination' => 'https://localhost/samlsp/module.php/saml/sp/saml2-acs.php/default-sp',
60-
// Issuer could be anything, mostly it makes sense to pass the metadata URL
61-
'issuer' => 'https://localhost',
62-
63-
// OPTIONAL: Use a specific audience restriction value when creating the SAMLRequest object.
64-
// Default value is the assertion consumer service URL (the base64 encoded SP url).
65-
// This is a bugfix for Nextcloud as SP and can be removed for normal SPs.
66-
'audience_restriction' => 'http://localhost',
67-
],
68-
69-
],
70-
```
71-
72-
You can generate the base_64 encoded AssertionURL by using the following artisan command.
73-
74-
```bash
75-
$ php artisan laravel-saml:encodeurl https://sp.webapp.com/saml/login
76-
--
77-
URL Given: https://sp.webapp.com/saml/login
78-
Encoded AssertionURL:aHR0cHM6Ly9zcC53ZWJhcHAuY29tL3NhbWwvbG9naW4=
79-
```
80-
81-
config/saml.php:
82-
```
83-
'sp' => [
84-
85-
...
86-
87-
/**
88-
* New entry
89-
*
90-
* Sample URL: https://sp.webapp.com/saml/login
91-
* Base64 encoded URL: aHR0cHM6Ly9zcC53ZWJhcHAuY29tL3NhbWwvY29uc3VtZQ==
92-
*/
93-
'aHR0cHM6Ly9zcC53ZWJhcHAuY29tL3NhbWwvY29uc3VtZQ==' => [
94-
'destination' => 'https://sp.webapp.com/saml/consume',
95-
'issuer' => 'https://sp.webapp.com',
96-
],
97-
],
98-
```
9941

10042
#### FileSystem configuration
10143

@@ -113,18 +55,55 @@ Within ```config/filesystem.php``` following entry needs to be added:
11355
],
11456
```
11557

116-
The package controllers are using the ```storage/saml``` path for retrieving both certificates and the metadata file. Create first the storage path, then either add or link the certificates. Add also a metadata file for the SAML IDP. For help generating an IDP metadata.xml file, see https://www.samltool.com/idp_metadata.php.
58+
#### Setting the entity id
11759

60+
In config/saml.php set the field idp.entity-id to your entity id. This is normally a uri, the uri doesn't need to exist, it just needs to be unique
61+
62+
'idp' => [
63+
.....
64+
'entityId' => 'http://idp.wherever.com'
65+
],
66+
67+
#### Generating metadata and certificates
68+
69+
There is a sample metadata template in storage/saml/idp/metadata.blade.php, This was generated using https://www.samltool.com/idp_metadata.php
70+
71+
Edit this template to customize it for your site.
72+
73+
When you're finished run the following command to generate certificates and the metadata file
74+
75+
```
76+
php artisan laravel-saml:generate-meta --cert
11877
```
119-
mkdir -p storage/saml/idp
120-
touch storage/saml/idp/{metadata.xml,cert.pem,key.pem}
78+
79+
To use exisiting certificates just make sure they're present in the saml drive then run the command without the --cert option
80+
81+
#### SAML SP entries
82+
83+
Within the saml.php config file the SAML Service Provider array needs to be filled.
84+
12185
```
86+
'sp' => [
87+
88+
//Tableau
89+
'https://sso.online.tableau.com/public/sp/SSO?alias=xxxx-xxxx-xxxx-xxxx-xxxxxxxx' => [
90+
'entity-id' => 'https://sso.online.tableau.com/public/sp/metadata?alias=xxxx-xxxx-xxxx-xxxx-xxxxxxxx',
91+
'certificate' => 'MIICozC........dUvTnGP18g=='
92+
],
12293
123-
Add the contents to the metadata.xml, cert.pem and key.pem files for the IDP.
94+
//A nifty testing service provider
95+
'https://sptest.iamshowcase.com/acs' => [
96+
97+
]
98+
99+
],
100+
```
124101

125102
### Using the SAML package
126103

127-
To use the SAML package, some files need to be modified. Within your login view, problably ```resources/views/auth/login.blade.php``` add a SAMLRequest field beneath the CSRF field (this is actually a good place for it):
104+
To use the SAML package, some files need to be modified.
105+
Within your login view, problably ```resources/views/auth/login.blade.php``` add a SAMLRequest field beneath the CSRF field
106+
(this is actually a good place for it):
128107
```
129108
{{-- The hidden CSRF field for secure authentication --}}
130109
{{ csrf_field() }}
@@ -134,37 +113,24 @@ To use the SAML package, some files need to be modified. Within your login view,
134113
@endif
135114
```
136115

137-
The SAMLRequest field will be filled automatically when a SAMLRequest is sent by a http request and therefore initiate a SAML authentication attempt. To initiate the SAML auth, the login and redirect functions need to be modified. Within ```app/Http/Middleware/AuthenticatesUsers.php``` add following lines to both the top and the authenticated function:
138-
(NOTE: you might need to copy it out from vendor/laravel/framework/src/Illuminate/Foundation/Auth/ to your Middleware directory)
139-
116+
The SAMLRequest field will be filled automatically when a SAMLRequest is sent by a http request and therefore initiate a SAML authentication attempt.
117+
To initiate the SAML auth, the login and redirect functions need to be modified.
118+
Within ```app/Http/Controllers/Auth/LoginController.php``` change ```use AuthenticatesUsers``` to ```use SamlAuthenticatesUsers```
119+
140120
```
141-
<?php
142-
143-
namespace App\Http\Middleware;
144-
145-
use Illuminate\Http\Request;
146-
use Illuminate\Support\Facades\Auth;
147-
use Illuminate\Foundation\Auth\RedirectsUsers;
148-
use Illuminate\Foundation\Auth\ThrottlesLogins;
149-
150-
use KingStarter\LaravelSaml\Http\Traits\SamlAuth;
121+
use App\Http\Controllers\Controller;
122+
use KingStarter\LaravelSaml\Http\Traits\SamlAuthenticatesUsers;
151123
152-
trait AuthenticatesUsers
124+
class LoginController extends Controller
153125
{
154-
use RedirectsUsers, ThrottlesLogins, SamlAuth;
155-
156-
...
126+
...
157127
158-
protected function authenticated(Request $request, $user)
159-
{
160-
if(Auth::check() && isset($request['SAMLRequest'])) {
161-
$this->handleSamlLoginRequest($request);
162-
}
163-
}
164-
165-
...
128+
use SamlAuthenticatesUsers;
129+
130+
.....
166131
```
167132

133+
168134
To allow later direct redirection when somebody is already logged in, we need to add also some lines to ```app/Http/Middleware/RedirectIfAuthenticated.php```:
169135
```
170136
<?php
@@ -201,19 +167,29 @@ class RedirectIfAuthenticated
201167
}
202168
```
203169

204-
## SAML Service Providers (SPs)
205170

206-
To add one or more service providers, go to the ```config/saml.php``` configuration file and scroll down to the 'sp' array. Having the Login-Address of the SAML-SP, add another entry. For reasons of internal interpretation, the URL needs to be Base64 encoded.
171+
### bindings:HTTP-POST
207172

208-
### Debugging SP entries
173+
If you're using HTTP post bindings then you'll need to allow saml to get the login request via post.
209174

210-
In case that there are some problems receiving the Base64 string or evaluating SAML authentication requests in general, it is possible to use the debugger setting ```saml.debug_saml_request``` within the config file.
175+
in web.php add the new route
176+
177+
```
178+
....
179+
Auth::routes();
180+
Route::post('/postLogin', 'Auth\LoginController@showLoginForm');
181+
```
182+
183+
184+
185+
### Debugging Connection
186+
187+
You can enable logging with the config/saml.php setting debug_saml_request
211188

212189
```
213190
// Allow debugging within SamlAuth trait to get SP data
214191
// during SAML authentication request
215192
'debug_saml_request' => true,
216193
```
217194

218-
Make sure that the environmental logging variable ```APP_LOG_LEVEL``` is set to debug within your ```.env``` file.
219-
195+
Make sure that the environmental logging variable ```APP_LOG_LEVEL``` is set to debug within your ```.env``` file. It will log to ```storage/logs/laravel.log```

‎src/Console/EncodeAssertionUrlCommand.php‎

Lines changed: 0 additions & 71 deletions
This file was deleted.

0 commit comments

Comments
 (0)