Skip to content

Commit e47ecdc

Browse files
lucidprogrammerlucidprogrammer
committed
initial commit
1 parent 5d3a70e commit e47ecdc

7 files changed

+415
-1
lines changed

‎README.md

+84-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,85 @@
11
# yii2-simplesamlphp
2-
SAML Service Provider(SP) for Yii2 using simplesamlphp (yii2 extension)
2+
3+
SAML Service Provider(SP) for Yii2 using simplesamlphp (yii2 extension). This is useful when you want to act as a Service Provider(SP), where a partner company is acting as a SAML Identity Provider (IDP). User data and their credentials are with the IDP and you are using SAML based login and use those users information in your yii2 application.
4+
5+
This is a very basic implementation where we are not persisting user data coming from the IDP at the Service Provider side for reporting on usage etc. However, those are fairly straightforward additions one can do.
6+
7+
# Installation
8+
9+
This is available to be installed via composer. In your yii2 application folder, run the following command.
10+
11+
```
12+
composer require lucidprogrammer/yii2-simplesamlphp
13+
```
14+
15+
This will install the package as a yii2 extension and update the extensions and installs the simplesamlphp project too in the vendor folder.
16+
17+
## Configuration
18+
19+
### Step 1 - Configuring an alias for /saml in your web server.
20+
21+
In a standard web server configuration like Apache, the DocumentRoot will be pointing to the yii2 application's web folder. Create an alias for /saml pointing to pathto_my-yii2-app/vendor/simplesamlphp/simplesamlphp/www.
22+
23+
In the case of Apache, you may do something like (replace pathto_my-yii2-app with your real path.)
24+
25+
```
26+
echo "Alias /saml pathto_my-yii2-app/vendor/simplesamlphp/simplesamlphp/www" >> /etc/apache2/apache2.conf
27+
echo "<Directory \"pathto_my-yii2-app/simplesamlphp/simplesamlphp/www/\"> \n Options Indexes FollowSymLinks \n AllowOverride all \n Require all granted \n </Directory>" >> /etc/apache2/apache2.conf
28+
```
29+
30+
To explain it visually, following could help.
31+
```
32+
my-yii2-app/
33+
/web -> DocumentRoot
34+
..
35+
..
36+
/vendor
37+
...
38+
...
39+
/lucidprogrammer (newly created folder in vendor)
40+
/simplesamlphp (newly created folder in vendor)
41+
/simplesamlphp/wwww -> [Create an alias /saml pointing to pathto_my-yii2-app/vendor/simplesamlphp/simplesamlphp/www]
42+
```
43+
44+
### Step 2 - Configure yii2 configuration.
45+
46+
Yii configuration straightforward, just add the following in your config/web.php
47+
48+
```
49+
'user' => [
50+
'class' => 'lucidprogrammer\simplesamlphp\SamlUser',
51+
],
52+
53+
```
54+
55+
### Note on enabling authentication for a route using yii2
56+
57+
Let's say you have a rule like the following in your yii2 setting,
58+
59+
```
60+
'access' => [
61+
'class' => AccessControl::className(),
62+
'only' => ['index','logout','about'],
63+
'rules' => [
64+
[
65+
'allow' => true,
66+
'actions' => ['index'],
67+
'roles' => ['?'],
68+
],
69+
[
70+
'actions' => ['logout'],
71+
'allow' => true,
72+
'roles' => ['@'],
73+
],
74+
],
75+
],
76+
77+
```
78+
After the component is installed, the moment you hit the site/about page, it should redirect you to the configured saml idp login page.
79+
80+
So, if you want to do SAML provided attributes and want to implement a fine grained access control, yii2 makes it easy.
81+
82+
### Note on yii2 login link.
83+
If your application has links to login, for example, 'site/login', you need to change to _saml/login.
84+
85+
However, it is best if you use Yii::$app->user->loginUrl[0], so it will take whatever is the correct loginUrl, so it will work with or without this plugin.

‎composer.json

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"name": "lucidprogrammer/yii2-simplesamlphp",
3+
"type": "yii2-extension",
4+
"description": "SAML Service Provider(SP) for Yii2 using simplesamlphp",
5+
"keywords": ["yii2", "saml","simplesamlphp","yii"],
6+
"license": "BSD-3-Clause",
7+
"require": {
8+
"yiisoft/yii2": "2.*.*",
9+
"simplesamlphp/simplesamlphp": ">=1.14"
10+
},
11+
"authors": [
12+
{
13+
"name": "Lucid Programmer",
14+
"email": "[email protected]"
15+
}
16+
],
17+
"autoload": {
18+
"psr-4": {
19+
"lucidprogrammer\\simplesamlphp\\": "src/"
20+
}
21+
},
22+
"extra": {
23+
"bootstrap": "lucidprogrammer\\simplesamlphp\\BootstrapClass"
24+
}
25+
26+
}

‎src/BootstrapClass.php

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<?php
2+
/**
3+
* Bootstrap class for the extension.
4+
*
5+
* @see http://www.yiiframework.com/doc-2.0/guide-runtime-bootstrapping.html
6+
*
7+
* @author Lucid Programmer<[email protected]>
8+
* @copyright 2017 Lucid Programmer
9+
* @license https://github.com/lucidprogrammer/yii2-simplesamlphp/blob/master/README.md
10+
* @link https://github.com/lucidprogrammer/yii2-simplesamlphp
11+
*/
12+
13+
namespace lucidprogrammer\simplesamlphp;
14+
use yii;
15+
use yii\base\BootstrapInterface;
16+
use yii\base\Application;
17+
use lucidprogrammer\simplesamlphp\Saml;
18+
19+
class BootstrapClass implements BootstrapInterface
20+
{
21+
public function bootstrap($app)
22+
{
23+
$app->on(Application::EVENT_BEFORE_REQUEST, function () {
24+
//creating a controller for the login route
25+
Yii::$app->controllerMap['_saml'] = '\lucidprogrammer\simplesamlphp\_SamlController';
26+
//a globally accessible instance of saml
27+
Yii::$container->set('saml',new Saml());
28+
// TODO possibly check if the user has enabled /saml alias.
29+
});
30+
}
31+
32+
33+
}

‎src/Saml.php

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
<?php
2+
/**
3+
* Saml Object which uses the simplesamlphp project
4+
*
5+
* @see https://simplesamlphp.org
6+
* @author Lucid Programmer<[email protected]>
7+
* @copyright 2017 Lucid Programmer
8+
* @license https://github.com/lucidprogrammer/yii2-simplesamlphp/blob/master/README.md
9+
* @link https://github.com/lucidprogrammer/yii2-simplesamlphp
10+
*/
11+
12+
namespace lucidprogrammer\simplesamlphp;
13+
use yii\base\Object;
14+
15+
class Saml extends Object {
16+
17+
/**
18+
* Authentication source you will use.
19+
*/
20+
public $authSource='default-sp';
21+
22+
/**
23+
* SimpleSAML_Auth_Simple's object.
24+
*/
25+
private $auth;
26+
27+
28+
public function init() {
29+
$this->auth = new \SimpleSAML_Auth_Simple($this->authSource);
30+
parent::init();
31+
}
32+
33+
34+
/**
35+
* Make sure user is authenticated. If the user is not authenticated, he will be rediected to Simplesamlphp IdP login page. If he is authenticated, it does nothing.
36+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_3
37+
*/
38+
public function requireAuth(array $params = array()) {
39+
$this->auth->requireAuth($params);
40+
}
41+
42+
/**
43+
* Log in the current user. He will be redirected to Simplesamlphp IdP login page. After a successfull login, he will be redirected to the referer page.
44+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_4
45+
*/
46+
public function login(array $params = array()) {
47+
$this->auth->login($params);
48+
}
49+
50+
/**
51+
* Logout the current user. Clear Simplesamlphp Sp and Simplesamlphp IdP session and redirected to the referer page.
52+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_5
53+
*/
54+
public function logout($params = NULL) {
55+
$this->auth->logout($params);
56+
}
57+
58+
/**
59+
* Get login url.
60+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_8
61+
*/
62+
public function getLoginURL($returnTo = null) {
63+
$this->auth->getLogoutUrl($returnTo);
64+
}
65+
66+
/**
67+
* Get logout url.
68+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_9
69+
*/
70+
public function getLogoutURL($returnTo = null) {
71+
$this->auth->getLogoutUrl($returnTo);
72+
}
73+
74+
/**
75+
* Check wether the user is authenticated or not.
76+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_9
77+
* @return bool true if user is authenticated, false it he is not.
78+
*/
79+
public function isAuthenticated() {
80+
return $this->auth->isAuthenticated();
81+
}
82+
83+
/**
84+
* Get attributes which are returned from Simplesamlphp IdP after a successfull login.
85+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_6
86+
* @return array attributes
87+
*/
88+
public function getAttributes() {
89+
return $this->auth->getAttributes();
90+
}
91+
92+
/**
93+
* Get auth data.
94+
* @see https://simplesamlphp.org/docs/stable/simplesamlphp-sp-api#section_7
95+
* @return mixed
96+
*/
97+
public function getAuthData(string $name) {
98+
return $this->auth->getAuthData($name);
99+
}
100+
101+
/**
102+
* Get attribute by it's key.
103+
* @return string the attribute value
104+
*/
105+
public function __get($name) {
106+
return isset($this->getAttributes()[$name]) ? $this->getAttributes()[$name][0] : null;
107+
}
108+
109+
}

‎src/SamlIdentity.php

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
<?php
2+
3+
/**
4+
* Identity Object as per yii2
5+
*
6+
* @see http://www.yiiframework.com/doc-2.0/guide-security-authentication.html
7+
* @author Lucid Programmer<[email protected]>
8+
* @copyright 2017 Lucid Programmer
9+
* @license https://github.com/lucidprogrammer/yii2-simplesamlphp/blob/master/README.md
10+
* @link https://github.com/lucidprogrammer/yii2-simplesamlphp
11+
*/
12+
13+
namespace lucidprogrammer\simplesamlphp;
14+
15+
16+
use yii;
17+
use yii\base\Object;
18+
use yii\web\IdentityInterface;
19+
use lucidprogrammer\simplesamlphp\SamlIdentity;
20+
21+
class SamlIdentity extends Object implements IdentityInterface {
22+
23+
public $id;
24+
public $attributes;
25+
26+
27+
public function __construct($id,$attributes, $config = [])
28+
{
29+
$this->id = $id;
30+
$this->attributes = $attributes;
31+
parent::__construct($config);
32+
}
33+
34+
35+
/**
36+
* Finds an identity by the given ID.
37+
*
38+
* @param string|int $id the ID to be looked for
39+
* @return IdentityInterface|null the identity object that matches the given ID.
40+
*/
41+
public static function findIdentity($id)
42+
43+
{
44+
$attributes = Yii::$container->get('saml')->getAttributes();
45+
if(sizeof($attributes) > 0){
46+
$id = $attributes['username'][0];
47+
return new SamlIdentity($id,$attributes);
48+
}
49+
return null;
50+
51+
52+
}
53+
54+
/**
55+
* @return int|string current user ID
56+
*/
57+
public function getId()
58+
{
59+
return $this->id;
60+
}
61+
62+
/**
63+
* @return string current user auth key
64+
*/
65+
public function getAuthKey()
66+
{
67+
68+
}
69+
70+
/**
71+
* @param string $authKey
72+
* @return bool if auth key is valid for current user
73+
*/
74+
public function validateAuthKey($authKey)
75+
{
76+
77+
}
78+
public static function findIdentityByAccessToken($token, $type = null)
79+
{
80+
81+
}
82+
83+
public function __get($name)
84+
{
85+
return isset($this->attributes[$name]) ? $this->attributes[$name][0] : null;
86+
}
87+
88+
89+
90+
91+
}

‎src/SamlUser.php

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* User Object as per yii2, minor changes to the yii\web\User
4+
*
5+
* @see http://www.yiiframework.com/doc-2.0/guide-security-authentication.html
6+
* @author Lucid Programmer<[email protected]>
7+
* @copyright 2017 Lucid Programmer
8+
* @license https://github.com/lucidprogrammer/yii2-simplesamlphp/blob/master/README.md
9+
* @link https://github.com/lucidprogrammer/yii2-simplesamlphp
10+
*/
11+
12+
namespace lucidprogrammer\simplesamlphp;
13+
14+
use yii;
15+
use yii\web\User;
16+
17+
class SamlUser extends User
18+
{
19+
/**
20+
* changing the loginUrl and identityClass
21+
* so while configuring yii2, just point to the user class and all other auth rules should automatically work.
22+
*/
23+
public function init()
24+
{
25+
$this->loginUrl = ['_saml/login'];
26+
$this->identityClass = 'lucidprogrammer\simplesamlphp\SamlIdentity';
27+
$this->enableAutoLogin = true;
28+
parent::init();
29+
}
30+
31+
public function logout($destroySession = true)
32+
{
33+
34+
Yii::$container->get('saml')->logout(Yii::$app->homeUrl);
35+
parent::logout($destroySession);
36+
37+
}
38+
39+
40+
}

0 commit comments

Comments
 (0)