Skip to content

Commit d66c6f8

Browse files
aacotroneoaacotroneo
committed
some release details
1 parent 5697e0e commit d66c6f8

File tree

7 files changed

+116
-113
lines changed

7 files changed

+116
-113
lines changed

‎composer.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
2-
"name": "aacotroneo/saml2",
2+
"name": "aacotroneo/laravel-saml2",
33
"description": "A Laravel package for Saml2 integration as a SP (service provider) based on OneLogin toolkit, which is much lightweight than simplesamlphp",
4+
"keywords": ["laravel","saml", "saml2", "onelogin"],
5+
"homepage": "https://github.com/aacotroneo/laravel-saml2",
6+
"license": "MIT",
47
"authors": [
58
{
69
"name": "aacotroneo",

‎src/Aacotroneo/Saml2/Saml2Auth.php‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@ class Saml2Auth
1919

2020
protected $samlAssertion;
2121

22-
protected $redirectUrl; //not used right now. Handled in Laravel
23-
24-
2522
function __construct($config)
2623
{
2724
$this->auth = new OneLogin_Saml2_Auth($config);
@@ -70,7 +67,7 @@ function logout()
7067
}
7168

7269
/**
73-
* Porcess a Saml response (assertion consumer service)
70+
* Process a Saml response (assertion consumer service)
7471
* @throws \Exception when errors are encountered. This sould not happen in a normal flow.
7572
*/
7673
function acs()
@@ -93,14 +90,10 @@ function acs()
9390
throw new \Exception("The saml assertion is not valid, please check the logs.");
9491
}
9592

96-
97-
if (isset($_POST['RelayState']) && OneLogin_Saml2_Utils::getSelfURL() != $_POST['RelayState']) {
98-
$this->redirectUrl = $_POST['RelayState'];
99-
}
10093
}
10194

10295
/**
103-
* Porcess a Saml response (assertion consumer service)
96+
* Process a Saml response (assertion consumer service)
10497
* @throws \Exception
10598
*/
10699
function sls()
@@ -131,10 +124,9 @@ function getMetadata()
131124
$metadata = $settings->getSPMetadata();
132125
$errors = $settings->validateMetadata($metadata);
133126

134-
135127
if (empty($errors)) {
136-
return $metadata;
137128

129+
return $metadata;
138130
} else {
139131

140132
throw new InvalidArgumentException(

‎src/Aacotroneo/Saml2/Saml2User.php‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
use Input;
66
use OneLogin_Saml2_Auth;
7-
use Symfony\Component\HttpFoundation\Request;
7+
use URL;
88

99
/**
1010
* A simple class that represents the user that 'came' inside the saml2 assertion
@@ -14,7 +14,6 @@
1414
class Saml2User
1515
{
1616

17-
1817
protected $auth;
1918

2019
function __construct(OneLogin_Saml2_Auth $auth)
@@ -48,7 +47,17 @@ function getAttributes()
4847
*/
4948
function getRawSamlAssertion()
5049
{
51-
return Input::get('SAMLResponse'); //rememeber this is only valid the request the assertion is received!!
50+
return Input::get('SAMLResponse'); //just this request
51+
}
52+
53+
function getIntendedUrl()
54+
{
55+
$relayState = Input::get('RelayState'); //just this request
56+
57+
if ($relayState && URL::full() !=$relayState) {
58+
59+
return $relayState;
60+
}
5261
}
5362

5463
}

‎src/config/advanced_saml_settings.php‎

Lines changed: 0 additions & 86 deletions
This file was deleted.

‎src/config/saml_settings.php‎

Lines changed: 93 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
<?php
22

33
//This is variable is an example - Just make sure that the urls in the 'idp' config are ok.
4-
$idp_host = 'http://idp_host/simplesaml';
4+
$idp_host = 'http://localhost:8000/simplesaml';
55

66
return $settings = array(
77
// If 'strict' is True, then the PHP Toolkit will reject unsigned
88
// or unencrypted messages if it expects them signed or encrypted
99
// Also will reject the messages if not strictly follow the SAML
1010
// standard: Destination, NameId, Conditions ... are validated too.
11-
'strict' => false,
11+
'strict' => true, //@todo: make this depend on laravel config
1212

1313
// Enable debug mode (to print errors)
14-
'debug' => false,
14+
'debug' => false, //@todo: make this depend on laravel config
1515

1616
// Service Provider Data that we are deploying
1717
'sp' => array(
@@ -81,4 +81,94 @@
8181
*/
8282
// 'certFingerprint' => '',
8383
),
84+
85+
86+
87+
/***
88+
*
89+
* OneLogin advanced settings
90+
*
91+
*
92+
*/
93+
// Security settings
94+
'security' => array(
95+
96+
/** signatures and encryptions offered */
97+
98+
// Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
99+
// will be encrypted.
100+
'nameIdEncrypted' => false,
101+
102+
// Indicates whether the <samlp:AuthnRequest> messages sent by this SP
103+
// will be signed. [The Metadata of the SP will offer this info]
104+
'authnRequestsSigned' => false,
105+
106+
// Indicates whether the <samlp:logoutRequest> messages sent by this SP
107+
// will be signed.
108+
'logoutRequestSigned' => false,
109+
110+
// Indicates whether the <samlp:logoutResponse> messages sent by this SP
111+
// will be signed.
112+
'logoutResponseSigned' => false,
113+
114+
/* Sign the Metadata
115+
False || True (use sp certs) || array (
116+
keyFileName => 'metadata.key',
117+
certFileName => 'metadata.crt'
118+
)
119+
*/
120+
'signMetadata' => false,
121+
122+
123+
/** signatures and encryptions required **/
124+
125+
// Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
126+
// <samlp:LogoutResponse> elements received by this SP to be signed.
127+
'wantMessagesSigned' => false,
128+
129+
// Indicates a requirement for the <saml:Assertion> elements received by
130+
// this SP to be signed. [The Metadata of the SP will offer this info]
131+
'wantAssertionsSigned' => false,
132+
133+
// Indicates a requirement for the NameID received by
134+
// this SP to be encrypted.
135+
'wantNameIdEncrypted' => false,
136+
137+
// Authentication context.
138+
// Set to false and no AuthContext will be sent in the AuthNRequest,
139+
// Set true or don't present thi parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
140+
// Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
141+
'requestedAuthnContext' => true,
142+
),
143+
144+
// Contact information template, it is recommended to suply a technical and support contacts
145+
'contactPerson' => array(
146+
'technical' => array(
147+
'givenName' => 'name',
148+
'emailAddress' => '[email protected]'
149+
),
150+
'support' => array(
151+
'givenName' => 'Support',
152+
'emailAddress' => '[email protected]'
153+
),
154+
),
155+
156+
// Organization information template, the info in en_US lang is recomended, add more if required
157+
'organization' => array(
158+
'en-US' => array(
159+
'name' => 'Name',
160+
'displayname' => 'Display Name',
161+
'url' => 'http://url'
162+
),
163+
),
164+
165+
/* Interoperable SAML 2.0 Web Browser SSO Profile [saml2int] http://saml2int.org/profile/current
166+
167+
'authnRequestsSigned' => false, // SP SHOULD NOT sign the <samlp:AuthnRequest>,
168+
// MUST NOT assume that the IdP validates the sign
169+
'wantAssertionsSigned' => true,
170+
'wantAssertionsEncrypted' => true, // MUST be enabled if SSL/HTTPs is disabled
171+
'wantNameIdEncrypted' => false,
172+
*/
173+
84174
);

‎src/controllers/Saml2Controller.php‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
namespace Aacotroneo\Saml2\Controllers;
44

5-
use Auth;
65
use Event;
76
use Saml2Auth;
87
use Controller;
@@ -33,7 +32,6 @@ public function metadata()
3332
*/
3433
public function acs()
3534
{
36-
//if successful will redirect to
3735
Saml2Auth::acs();
3836
$user = Saml2Auth::getSaml2User();
3937
Event::fire('saml2.loginRequestReceived', array($user));
@@ -42,7 +40,7 @@ public function acs()
4240
/**
4341
* Process an incoming saml2 logout request.
4442
* Fires 'saml2.logoutRequestReceived' event if its valid.
45-
* This means the user logged out of the SSO infrastructre, you 'should' log him out locally too.
43+
* This means the user logged out of the SSO infrastructure, you 'should' log him out locally too.
4644
*/
4745
public function sls()
4846
{
@@ -51,12 +49,11 @@ public function sls()
5149
}
5250

5351
/**
54-
* This initiats a logout request across all the SSO infrastructure.
52+
* This initiates a logout request across all the SSO infrastructure.
5553
*/
5654
public function logout()
5755
{
58-
Saml2Auth::logout();
59-
//will actually end up in the sls endpoint
56+
Saml2Auth::logout(); //will actually end up in the sls endpoint
6057
}
6158

6259
}

‎src/routes.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
11
<?php
22

3-
//Config::get('administrator::administrator.uri')
4-
Route::group(array('prefix' => '/saml'), function () {
3+
Route::group(array('prefix' => '/saml2'), function () {
54

65
Route::get('/logout', array(
76
'as' => 'saml_logout',
87
'uses' => 'Aacotroneo\Saml2\Controllers\Saml2Controller@logout',
98
));
109

11-
1210
Route::get('/metadata', array(
1311
'as' => 'saml_metadata',
1412
'uses' => 'Aacotroneo\Saml2\Controllers\Saml2Controller@metadata',

0 commit comments

Comments
 (0)