Skip to content

Commit e5d0d9b

Browse files
aacotroneoaacotroneo
committed
Basic wiring
1 parent 3fb66fe commit e5d0d9b

File tree

6 files changed

+222
-7
lines changed

6 files changed

+222
-7
lines changed

‎composer.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{
2-
"name": "aacotroneo/laravel-saml2",
2+
"name": "aacotroneo/saml2",
33
"description": "A laravel package for saml2 integration as a SP (service provider) based on OneLogin toolkit, which is much lightweight than simplesamlphp",
44
"authors": [
55
{
66
"name": "aacotroneo",
7-
"email": "aacotroneo at gmail dot com"
7+
"email": "aacotroneo@gmail.com"
88
}
99
],
1010
"require": {
@@ -14,10 +14,10 @@
1414
},
1515
"autoload": {
1616
"classmap": [
17-
"src/migrations"
17+
"src/controllers"
1818
],
1919
"psr-0": {
20-
"Aacotroneo\\LaravelSaml2\\": "src/"
20+
"Aacotroneo\\Saml2\\": "src/"
2121
}
2222
},
2323
"minimum-stability": "stable"

‎src/Aacotroneo/LaravelSaml2/LaravelSaml2ServiceProvider.php‎ renamed to ‎src/Aacotroneo/Saml2/Saml2ServiceProvider.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
<?php namespace Aacotroneo\LaravelSaml2;
1+
<?php
2+
namespace Aacotroneo\Saml2;
23

34
use Illuminate\Support\ServiceProvider;
45

5-
class LaravelSaml2ServiceProvider extends ServiceProvider {
6+
class Saml2ServiceProvider extends ServiceProvider {
67

78
/**
89
* Indicates if loading of the provider is deferred.
@@ -18,7 +19,9 @@ class LaravelSaml2ServiceProvider extends ServiceProvider {
1819
*/
1920
public function boot()
2021
{
21-
$this->package('aacotroneo/laravel-saml2');
22+
$this->package('aacotroneo/saml2');
23+
24+
include __DIR__.'/../../routes.php';
2225
}
2326

2427
/**

‎src/config/advanced_saml_settings.php‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
<?php
2+
3+
return $advancedSettings = array (
4+
5+
// Security settings
6+
'security' => array (
7+
8+
/** signatures and encryptions offered */
9+
10+
// Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
11+
// will be encrypted.
12+
'nameIdEncrypted' => false,
13+
14+
// Indicates whether the <samlp:AuthnRequest> messages sent by this SP
15+
// will be signed. [The Metadata of the SP will offer this info]
16+
'authnRequestsSigned' => false,
17+
18+
// Indicates whether the <samlp:logoutRequest> messages sent by this SP
19+
// will be signed.
20+
'logoutRequestSigned' => false,
21+
22+
// Indicates whether the <samlp:logoutResponse> messages sent by this SP
23+
// will be signed.
24+
'logoutResponseSigned' => false,
25+
26+
/* Sign the Metadata
27+
False || True (use sp certs) || array (
28+
keyFileName => 'metadata.key',
29+
certFileName => 'metadata.crt'
30+
)
31+
*/
32+
'signMetadata' => false,
33+
34+
35+
/** signatures and encryptions required **/
36+
37+
// Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
38+
// <samlp:LogoutResponse> elements received by this SP to be signed.
39+
'wantMessagesSigned' => false,
40+
41+
// Indicates a requirement for the <saml:Assertion> elements received by
42+
// this SP to be signed. [The Metadata of the SP will offer this info]
43+
'wantAssertionsSigned' => false,
44+
45+
// Indicates a requirement for the NameID received by
46+
// this SP to be encrypted.
47+
'wantNameIdEncrypted' => false,
48+
49+
// Authentication context.
50+
// Set to false and no AuthContext will be sent in the AuthNRequest,
51+
// Set true or don't present thi parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
52+
// Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
53+
'requestedAuthnContext' => true,
54+
),
55+
56+
// Contact information template, it is recommended to suply a technical and support contacts
57+
'contactPerson' => array (
58+
'technical' => array (
59+
'givenName' => '',
60+
'emailAddress' => ''
61+
),
62+
'support' => array (
63+
'givenName' => '',
64+
'emailAddress' => ''
65+
),
66+
),
67+
68+
// Organization information template, the info in en_US lang is recomended, add more if required
69+
'organization' => array (
70+
'en-US' => array(
71+
'name' => '',
72+
'displayname' => '',
73+
'url' => ''
74+
),
75+
),
76+
);
77+
78+
79+
/* Interoperable SAML 2.0 Web Browser SSO Profile [saml2int] http://saml2int.org/profile/current
80+
81+
'authnRequestsSigned' => false, // SP SHOULD NOT sign the <samlp:AuthnRequest>,
82+
// MUST NOT assume that the IdP validates the sign
83+
'wantAssertionsSigned' => true,
84+
'wantAssertionsEncrypted' => true, // MUST be enabled if SSL/HTTPs is disabled
85+
'wantNameIdEncrypted' => false,
86+
*/

‎src/config/saml_settings.php‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?php
2+
3+
return $settings = array (
4+
// If 'strict' is True, then the PHP Toolkit will reject unsigned
5+
// or unencrypted messages if it expects them signed or encrypted
6+
// Also will reject the messages if not strictly follow the SAML
7+
// standard: Destination, NameId, Conditions ... are validated too.
8+
'strict' => false,
9+
10+
// Enable debug mode (to print errors)
11+
'debug' => false,
12+
13+
// Service Provider Data that we are deploying
14+
'sp' => array (
15+
// Identifier of the SP entity (must be a URI)
16+
'entityId' => '',
17+
// Specifies info about where and how the <AuthnResponse> message MUST be
18+
// returned to the requester, in this case our SP.
19+
'assertionConsumerService' => array (
20+
// URL Location where the <Response> from the IdP will be returned
21+
'url' => '',
22+
// SAML protocol binding to be used when returning the <Response>
23+
// message. Onelogin Toolkit supports for this endpoint the
24+
// HTTP-Redirect binding only
25+
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
26+
),
27+
// Specifies info about where and how the <Logout Response> message MUST be
28+
// returned to the requester, in this case our SP.
29+
'singleLogoutService' => array (
30+
// URL Location where the <Response> from the IdP will be returned
31+
'url' => '',
32+
// SAML protocol binding to be used when returning the <Response>
33+
// message. Onelogin Toolkit supports for this endpoint the
34+
// HTTP-Redirect binding only
35+
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
36+
),
37+
// Specifies constraints on the name identifier to be used to
38+
// represent the requested subject.
39+
// Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
40+
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
41+
42+
// Usually x509cert and privateKey of the SP are provided by files placed at
43+
// the certs folder. But we can also provide them with the following parameters
44+
'x509cert' => '',
45+
'privateKey' > '',
46+
),
47+
48+
// Identity Provider Data that we want connect with our SP
49+
'idp' => array (
50+
// Identifier of the IdP entity (must be a URI)
51+
'entityId' => '',
52+
// SSO endpoint info of the IdP. (Authentication Request protocol)
53+
'singleSignOnService' => array (
54+
// URL Target of the IdP where the SP will send the Authentication Request Message
55+
'url' => '',
56+
// SAML protocol binding to be used when returning the <Response>
57+
// message. Onelogin Toolkit supports for this endpoint the
58+
// HTTP-POST binding only
59+
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
60+
),
61+
// SLO endpoint info of the IdP.
62+
'singleLogoutService' => array (
63+
// URL Location of the IdP where the SP will send the SLO Request
64+
'url' => '',
65+
// SAML protocol binding to be used when returning the <Response>
66+
// message. Onelogin Toolkit supports for this endpoint the
67+
// HTTP-Redirect binding only
68+
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
69+
),
70+
// Public x509 certificate of the IdP
71+
'x509cert' => '',
72+
/*
73+
* Instead of use the whole x509cert you can use a fingerprint
74+
* (openssl x509 -noout -fingerprint -in "idp.crt" to generate it)
75+
*/
76+
// 'certFingerprint' => '',
77+
),
78+
);

‎src/controllers/Saml2Controller.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
3+
namespace Aacotroneo\Saml2;
4+
5+
6+
use Illuminate\Routing\Controller;
7+
use Illuminate\Support\Facades\Config;
8+
9+
class Saml2Controller extends Controller {
10+
11+
12+
public function metadata(){
13+
14+
$config = Config::get('saml2::saml_settings');
15+
16+
17+
return print_r($config, true);
18+
}
19+
20+
public function acs(){
21+
return "acs";
22+
}
23+
24+
25+
public function sls(){
26+
return "sls";
27+
}
28+
}

‎src/routes.php‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?php
2+
3+
//Config::get('administrator::administrator.uri')
4+
Route::group(array('prefix' => '/saml'), function() {
5+
//Admin Dashboard
6+
Route::get('/metadata', array(
7+
'as' => 'saml_metadata',
8+
'uses' => 'Aacotroneo\Saml2\Saml2Controller@metadata',
9+
));
10+
11+
Route::post('/acs', array(
12+
'as' => 'saml_metadata',
13+
'uses' => 'Aacotroneo\Saml2\Controllers\AdminController@acs',
14+
));
15+
16+
Route::get('/sls', array(
17+
'as' => 'saml_metadata',
18+
'uses' => 'Aacotroneo\Saml2\Controllers\AdminController@sls',
19+
));
20+
});

0 commit comments

Comments
 (0)