Skip to content

Commit b30dcdb

Browse files
MKoddeMKodde
committed
Build a SSP debug SP
1 parent 71a21fd commit b30dcdb

File tree

14 files changed

+1988
-0
lines changed

14 files changed

+1988
-0
lines changed

‎.github/workflows/build-ssp-debug-sp.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Build docker SSP debug SP container
2+
3+
on:
4+
pull_request:
5+
workflow_dispatch:
6+
7+
jobs:
8+
build-ssp-debug-sp:
9+
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
14+
- name: Check out the repo
15+
uses: actions/checkout@v2
16+
17+
- name: Log into GitHub Container Registry
18+
uses: docker/login-action@v1
19+
with:
20+
registry: ghcr.io
21+
username: ${{ github.repository_owner }}
22+
password: ${{ secrets.GITHUB_TOKEN }}
23+
24+
- name: Build the Apache container and push to GitHub Packages
25+
uses: docker/build-push-action@v2
26+
with:
27+
tags: ghcr.io/openconext/openconext-containers/openconext-ssp-debug-sp:latest
28+
context: docker/ssp-debug-sp/
29+
push: true

‎docker/ssp-debug-sp/Dockerfile‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
FROM webdevops/php-nginx:7.2-alpine AS ssp-debug-sp
2+
MAINTAINER Michiel Kodde (michiel@ibuildings.nl)
3+
4+
RUN apt-get update && apt-get install -y \
5+
git \
6+
python \
7+
zip \
8+
libpng-dev \
9+
&& docker-php-ext-install pdo_mysql exif gd \
10+
11+
ENV NVM_DIR /usr/local/nvm
12+
ENV NODE_VERSION 14
13+
14+
# Install nvm with node and npm
15+
RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.2/install.sh | bash
16+
&& source $NVM_DIR/nvm.sh \
17+
&& nvm install $NODE_VERSION \
18+
&& nvm alias default $NODE_VERSION \
19+
&& nvm use default
20+
21+
# Install Composer
22+
COPY --from=composer /usr/bin/composer /usr/local/bin/composer
23+
24+
# Fix npm
25+
RUN mkdir /.npm && chown -R "${NPM_UID}:${NPM_GID}" "/.npm"
26+
RUN mkdir /.config && chown -R "${NPM_UID}:${NPM_GID}" "/.config"
27+
28+
# Install SSP: Clone and install rev adf1eb8 of SSP
29+
RUN mkdir -p /var/simplesamlphp/
30+
RUN git clone https://github.com/simplesamlphp/simplesamlphp.git /var/simplesamlphp
31+
RUN cd /var/simplesamlphp
32+
RUN git reset --hard adf1eb8
33+
34+
# Install SSP: Copy files
35+
COPY conf/config.php /var/simplesamlphp/config/config.php
36+
COPY conf/authsources.php /var/simplesamlphp/config/authsources.php
37+
COPY conf/accountgen.inc /var/simplesamlphp/config/accountgen.inc
38+
COPY certificates/ssp.key /var/simplesamlphp/cert/ssp.key
39+
COPY certificates/ssp.crt /var/simplesamlphp/cert/ssp.crt
40+
41+
# Install SSP: Install dependencies and build
42+
RUN composer install --prefer-dist -n -o --no-scripts
43+
44+
# Install SSP: Install and copy DebugSP files
45+
RUN composer require simplesamlphp/simplesamlphp-module-saml2debug
46+
COPY conf/DebugSP /var/simplesamlphp/modules/DebugSP
47+
COPY conf/sp.php /var/simplesamlphp/www/sp.php
48+
COPY conf/sp-config.inc /var/simplesamlphp/www/sp-config.inc
49+
COPY conf/sp-utils.inc /var/simplesamlphp/www/sp-utils.inc
50+
51+
EXPOSE 80
52+
STOPSIGNAL SIGQUIT
53+
CMD ["nginx", "-g", "daemon off;"]

‎docker/ssp-debug-sp/certificates/ssp.crt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIID4zCCAksCFE/RXnB+y6e2zlC0Zpi7Pl6GbyuAMA0GCSqGSIb3DQEBCwUAMC4x
3+
EzARBgNVBAMMClJBIFNBTUwgU1AxFzAVBgNVBAoMDkRldmVsb3BtZW50IFZNMB4X
4+
DTIxMDQyMDA3MDIyM1oXDTI2MDQxOTA3MDIyM1owLjETMBEGA1UEAwwKUkEgU0FN
5+
TCBTUDEXMBUGA1UECgwORGV2ZWxvcG1lbnQgVk0wggGiMA0GCSqGSIb3DQEBAQUA
6+
A4IBjwAwggGKAoIBgQCyMqGyevrF/Ms8fsGQdz6fqzCA8T/QKC9Jb3m7EpQOp/OM
7+
q/qBv4gjtFf0/bAun2N/u6zZOlPk61iVWRbxIet/O9BAoqRhtT6PHQVcReXR1F3+
8+
Dk2vH8+QyZwnWGENwh16BYuirIeWQuEgfVDUpSg2MBjkHjZmpF8Dxn6d485qwrdb
9+
FZN+z3QPtxNaNu1FBktsgPNjlpE7HNB9xcGy4DlgTIP+80nKgM+Kdopw9FVk71bf
10+
KKHp1m9qSSbFI+drtbtFJ7OPqFYDs9gJEY8ivALID1ERNQkAPImr/EIPiazHc4nk
11+
Qfi4Kt5ohsvGufdCxYtOUGxjcrkq9oJX5YiiC9xfekPeU05F2FsYWxYK0nmnEP0t
12+
ydgDFeKl2FI2vUhr2oOaiTs5VlNhMz43diX9AJzjmO4nrePsuA/T3wj8rSzhS9kD
13+
9IF6GkZ+y+1Yyzf8NWxPfFCL0K4B5/+pGDY5BETX+BHq4kKCGjWVWz9Whd9MeaJb
14+
4buycT9RyKZrmSEe/fkCAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAjuAYYpA337xi
15+
Uem4MTmCB68VVEPxVeiR3geTqZdk42ep6ATfalbAIAsqzTsh5QPU5FZByrZauOWA
16+
6m5HLmlEY3UQmI6l1P9KcOAIVfHQ0uVIpREuEaiFJlA2pif/Epk+Go/jp+yKPHms
17+
/IT/ZhZTzUCM3xbcan9rDA779pgi/NqYSHJ1EljiD+Wt8jDk67hZAjHum9b79UNs
18+
bJqB4wHrNkoyOZZnmW88nDeJGvBpoeo/zsy4xi20E23oBP7ti7QVEvsvaZtJ5L7S
19+
mysHP03fIkfquXswZ8Xl5wS3Vjr82wx9LOGunzZzFF4awRrsIuovvxrTBTD/NNHA
20+
v0Mm7UC0I8A27mlpufneN4TFcXmYW0KZxkiLbcrXtOicqgRyfEB1UC2C8RAPmeX3
21+
VGM+odFNhJjkCecms4/xpSqj13CE6S6ci2+osfiMWm5uBw6wAfPt/5rPrvy50dWx
22+
J13vign9EqLAy7aVRzK8ghu1bOLlXV5Hp6kwwMYYqZBV5A0xOuSj
23+
-----END CERTIFICATE-----

‎docker/ssp-debug-sp/certificates/ssp.key‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG4gIBAAKCAYEAsjKhsnr6xfzLPH7BkHc+n6swgPE/0CgvSW95uxKUDqfzjKv6
3+
gb+II7RX9P2wLp9jf7us2TpT5OtYlVkW8SHrfzvQQKKkYbU+jx0FXEXl0dRd/g5N
4+
rx/PkMmcJ1hhDcIdegWLoqyHlkLhIH1Q1KUoNjAY5B42ZqRfA8Z+nePOasK3WxWT
5+
fs90D7cTWjbtRQZLbIDzY5aROxzQfcXBsuA5YEyD/vNJyoDPinaKcPRVZO9W3yih
6+
6dZvakkmxSPna7W7RSezj6hWA7PYCRGPIrwCyA9RETUJADyJq/xCD4msx3OJ5EH4
7+
uCreaIbLxrn3QsWLTlBsY3K5KvaCV+WIogvcX3pD3lNORdhbGFsWCtJ5pxD9LcnY
8+
AxXipdhSNr1Ia9qDmok7OVZTYTM+N3Yl/QCc45juJ63j7LgP098I/K0s4UvZA/SB
9+
ehpGfsvtWMs3/DVsT3xQi9CuAef/qRg2OQRE1/gR6uJCgho1lVs/VoXfTHmiW+G7
10+
snE/Ucima5khHv35AgMBAAECggGAKVZrgj7bG8C32NHCz2OKKHoK526PkhcwWQW+
11+
JHJ73CaD7hcbJqwqxbWZTeDn1PjumPwNbdsFCS67PvIKy2dF/R8AAW55WZ005Pgj
12+
fTNNy+5K25uv07c6bGkIi2wKH6nvMpZEvTjuvyHGncXUUW/6sw9XRtvnXMo2rGaI
13+
itIE2WlQJZYMwDcZwmeC2sOxKPj72DDVxT1xdVgK2ZJdi8ROKxO07xi6/noBKyqy
14+
lN9pS9/ltCD15ovzDqHnl4XrsmXWpvMuBl6f9ACNTI0jZE1WoMMKhxPdWvRm+gId
15+
U3ikNK6eLfReHu6jeTQRNCAO9dExrAJzgV7G4jHwinDrBk8ywYqSYVrbpz5Sx/Ij
16+
W6Gt9XMjHz2y8Bs114foVW3Fr3Fj55/eQu1xa6WaxFcF5nEP2/bLXexMJHqeMI4r
17+
T+150G6pjHk2uvh61JB8aAfaqIrOP7/1hjbJBIHjD/ub2xZ7uwtibFQvhmOpzYE8
18+
jeO09A2byQU2yIXvZXxVJWE4vmwBAoHBAOuRI+WqFpRAlJ7yolRfM0uwo3R09+Aw
19+
LZ3tvnMHGJPipImFC5k2ralll/tstBVdRNEMIqsLcogBfMt3F1kx6hYtMXj3gy9S
20+
b0XKJvEikdQvmdUjVfkIlRI+yMm811xqtqNXcLqndSxTUkTotpxmU7p1AhdXpIv9
21+
IiXaBfuUvBi68M8tJ0tgJWKCDtwJWtlvhKRv6UXVauJbb8QczIgrpk0PVI9WvX0Z
22+
VN/3bq/BxJBjD/RvLN1uNqjsi/qoN1wWeQKBwQDBp5XrNzU8wctaLxdZrKCjfe0T
23+
X3Scm9xgWKZOZUBOH6ydbVya/g0VsFM6mgu6tz2yMGA4TlmqM2WfzhzVkb2aJ8Z4
24+
me2jsyqku3sANZzFaGRMu0i03LC6SFv9NQ+YA8p01Ry9KPF8RU0Ows9Zv/uVgPNp
25+
CEy8GfjbmJsbfEPkj5gNIJx5RNEgI6mSOOtTAiQK7Mra4bJwgvRSudhpMQJWUdbo
26+
J8k0+VSspmC0gIh108rAvlpEDTBgDa7QAbMGQ4ECgcB1bQNk79WTj2HGnhK3VkF+
27+
wI2qdsg9dCa5LBMcyfPBfGAiwTSX6n7FC4Soa3aVk8nDH3aEpw8vpvYrgrEb4Frd
28+
NSgNMeyuATzAoFWrLF1fVV8stRGdM18EGlIC5mTAh92FLQhfsywgrWQ8P3kQG54v
29+
OzaQpjq7IbMNBVKoJ2tgNIfn7o1A8KuSIF0B6JPmAcYwJi01h35hWc0sCGMYmhGr
30+
JjIzxbxtiNwbTP9bE49FnmwMoALQWqlaqZfZmlMGT5kCgcBKaPiEHvyH0fcvOfUA
31+
8gHvkE1uKjmGi6UMKEQOz3z8B9Ot0f3JWGDyuoPgepyTLCG6vDfcqs5tRb6AvxP5
32+
RDzUZQAwCwVy5z81eQx0MiWA/PG9QiFXzYzipzchfif1w08hwVl/naHcnExVpalC
33+
1S/4bEobS6Mgi+JBjsvarc7wnfRQ5vz44+ZvMQTROKnDhYkP4Zi4rgyAivEScHKl
34+
SL2bKWsoXVFE16EfjfaOpOzKSY0YrovEpkS2Q8uuBVkiyQECgcB4JN+HiWD5auBl
35+
S0eDa+cGd7dNcs3d1t++sIyGZtxclzlpzHl5mr5Ey9UdkCvB3JmUh+fSsxBile7Y
36+
n03lt29kozvJ5FsL6t8zp3Fs9HY9fvNJQ51J7xLJpeGuZkUebxQRad/Gs18EkP4c
37+
5Wpa8inZay7o2+VHPcgyp1OmAMwUxof8WNdzhpqe1SR/c58WOOu0OPyDP6gmEUu3
38+
rka3UsBdb2pXLUCipKVDOOO64ACNicH6Lp+jZgdNCg1N+KKdTdM=
39+
-----END RSA PRIVATE KEY-----

‎docker/ssp-debug-sp/conf/DebugSP/default-disable‎

Whitespace-only changes.

‎docker/ssp-debug-sp/conf/DebugSP/lib/Auth/Source/SP.php‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<?php
2+
3+
/**
4+
* Copyright 2018 SURFnet bv
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
/* Installation: copy this file to the "modules/saml/lib/Auth/Source/" directory of your SimpleSAMLphp installation
20+
Usage:
21+
- In authsourcesphp use "DebugSP:SP" where you would otherwise use "saml:SP"
22+
- In the call to AuthSimple::requireAuth($params), AuthSimple::login($params) set 'saml:AssertionConsumerServiceURL'
23+
and 'DebugSP:extraPOSTvars' to the desired values.
24+
E.g.:
25+
$params=array(
26+
'DebugSP:AssertionConsumerServiceURL' => 'https://...',
27+
'DebugSP:extraPOSTvars' => array(
28+
'SomePOSTvariable' => 'SomeValue',
29+
'AnotherPOSTvariable' => 'AnotherValue'
30+
),
31+
);
32+
$as->login($params);
33+
*/
34+
35+
// Extend from the SimpleSAMLphp SAML 2.0 authentication source "saml:SP"
36+
class sspmod_DebugSP_Auth_Source_SP extends \SimpleSAML\Module\DebugSP\Auth\Source\SP {
37+
38+
public function __construct($info, $config) {
39+
parent::__construct($info, $config);
40+
}
41+
42+
public function sendSAML2AuthnRequest(array &$state, \SAML2\Binding $binding, \SAML2\AuthnRequest $ar) {
43+
44+
if ( isset( $state['DebugSP:AssertionConsumerServiceURL'] ) ) {
45+
// Set the AssertionConsumerServiceURL in the AuthnRequest
46+
$ar->setAssertionConsumerServiceURL( $state['DebugSP:AssertionConsumerServiceURL'] );
47+
}
48+
49+
if ($binding instanceof \SAML2\HTTPPost) {
50+
// replicate \SAML2\HTTPPost::send(Message $message) so we can set additional POST variables
51+
$destination = $ar->getDestination();
52+
$relayState = $ar->getRelayState();
53+
$post = array();
54+
55+
// Set extra POST variables
56+
if (isset($state['DebugSP:extraPOSTvars'])) {
57+
assert(is_array($state['DebugSP:extraPOSTvars']), 'DebugSP:extraPOSTvars must be array()');
58+
foreach ($state['DebugSP:extraPOSTvars'] as $key => $value) {
59+
$post[$key] = $value;
60+
}
61+
}
62+
63+
// Create SAMLRequest
64+
$msgStr = $ar->toSignedXML();
65+
$msgStr = $msgStr->ownerDocument->saveXML($msgStr);
66+
67+
\SAML2\Utils::getContainer()->debugMessage($msgStr, 'out');
68+
69+
$post['SAMLRequest'] = base64_encode($msgStr);
70+
71+
if ($relayState !== null) {
72+
$post['RelayState'] = $relayState;
73+
}
74+
75+
\SAML2\Utils::getContainer()->postRedirect($destination, $post);
76+
77+
return;
78+
}
79+
80+
// Use partent implementation
81+
parent::sendSAML2AuthnRequest($state, $binding, $ar);
82+
}
83+
}

‎docker/ssp-debug-sp/conf/DebugSP/www/sp/saml2-acs.php‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php
2+
3+
/**
4+
* Copyright 2018 SURFnet bv
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
// Rename the "_SAMLResponse" variable that used by the ADFS SFO extension back to the SAML HTTP-POST standard
20+
// "SAMLResponse" and then hand over processing to the standard SSP ACS processing
21+
22+
if (isset($_POST['_SAMLResponse'])) {
23+
$_POST['SAMLResponse'] = $_POST['_SAMLResponse'];
24+
}
25+
26+
require(__DIR__.'/../../../saml/www/sp/saml2-acs.php');

‎docker/ssp-debug-sp/conf/accountgen.inc‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
<?php
2+
3+
/*
4+
Generate accounts for simpleSAMLphp "example-userpass" auth source
5+
6+
$config: simplesaml php config array
7+
$prefix: account name prefix
8+
$email: An existing email address, if you want to receive mail
9+
$scope: Used as schachome, EPPN scope and names
10+
$slugs: array of account variants
11+
*/
12+
13+
function account_gen(&$config, $prefix, $email, $scope, $slugs)
14+
{
15+
foreach($slugs as $slug)
16+
{
17+
$uid=$prefix.$slug;
18+
$account=array(
19+
'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
20+
'uid' => array($uid),
21+
'eduPersonPrincipalName' => $uid.'@'.$scope,
22+
'givenName' => 'gn-'.$uid,
23+
'sn' => 'sn-'.$scope,
24+
'cn' => $uid.' '.$scope,
25+
'mail' => str_replace('@', '+'.$uid.'@', $email),
26+
'displayName' => 'd-'.$uid.' '.$scope,
27+
'eduPersonAffiliation' => array('student'),
28+
'schacHomeOrganization' => $scope,
29+
'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
30+
);
31+
$config['example-userpass'][$uid.':'.$uid]=$account;
32+
}
33+
34+
// Without SHO
35+
$uid=$prefix.'-nosho';
36+
$account=array(
37+
'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
38+
'uid' => array($uid),
39+
'eduPersonPrincipalName' => $uid.'@'.$scope,
40+
'givenName' => 'gn-'.$uid,
41+
'sn' => 'sn-'.$scope,
42+
'cn' => $uid.' '.$scope,
43+
'mail' => str_replace('@', '+'.$uid.'@', $email),
44+
'displayName' => 'd-'.$uid.' '.$scope,
45+
'eduPersonAffiliation' => array('student'),
46+
//'schacHomeOrganization' => $scope,
47+
'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
48+
);
49+
$config['example-userpass'][$uid.':'.$uid]=$account;
50+
51+
// Without mail
52+
$uid=$prefix.'-nomail';
53+
$account=array(
54+
'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
55+
'uid' => array($uid),
56+
'eduPersonPrincipalName' => $uid.'@'.$scope,
57+
'givenName' => 'gn-'.$uid,
58+
'sn' => 'sn-'.$scope,
59+
'cn' => $uid.' '.$scope,
60+
//'mail' => str_replace('@', '+'.$uid.'@', $email),
61+
'displayName' => 'd-'.$uid.' '.$scope,
62+
'eduPersonAffiliation' => array('student'),
63+
'schacHomeOrganization' => $scope,
64+
'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
65+
);
66+
$config['example-userpass'][$uid.':'.$uid]=$account;
67+
68+
// Without cn
69+
$uid=$prefix.'-nocn';
70+
$account=array(
71+
'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
72+
'uid' => array($uid),
73+
'eduPersonPrincipalName' => $uid.'@'.$scope,
74+
'givenName' => 'gn-'.$uid,
75+
'sn' => 'sn-'.$scope,
76+
//'cn' => $uid.' '.$scope,
77+
'mail' => str_replace('@', '+'.$uid.'@', $email),
78+
'displayName' => 'd-'.$uid.' '.$scope,
79+
'eduPersonAffiliation' => array('student'),
80+
'schacHomeOrganization' => $scope,
81+
'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
82+
);
83+
$config['example-userpass'][$uid.':'.$uid]=$account;
84+
85+
}

0 commit comments

Comments
 (0)