Skip to content
This repository was archived by the owner on Jun 25, 2024. It is now read-only.

Commit b4a205d

Browse files
author
Billy Clark
committed
MFA infrastructure needed
1 parent 58a823f commit b4a205d

File tree

9 files changed

+202
-7
lines changed

9 files changed

+202
-7
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ vendor/
33
composer.lock
44
nbproject/
55
.vagrant/
6+
local.env

‎Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@ errors:
55
docker-compose exec hub cat /var/log/apache2/error.log
66
docker-compose exec idp1 cat /var/log/apache2/error.log
77
docker-compose exec idp2 cat /var/log/apache2/error.log
8+
docker-compose exec idp4 cat /var/log/apache2/error.log
9+
docker-compose exec hub2 cat /var/log/apache2/error.log
10+
docker-compose exec idp3 cat /var/log/apache2/error.log
811

912
clean:
1013
docker-compose kill
1114
docker system prune -f
15+
16+
17+
# TODO: create local migrations for broker to load users and mfas to make testing easier.

‎development/hub/saml20-idp-remote.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,17 @@
2121
'SingleLogoutService' => 'http://ssp-hub-idp2.local:8086/saml2/idp/SingleLogoutService.php',
2222
'certData' => 'MIIDzzCCAregAwIBAgIJALBaUrvz1X5DMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOQzEPMA0GA1UEBwwGV2F4aGF3MQwwCgYDVQQKDANTSUwxDTALBgNVBAsMBEdUSVMxDjAMBgNVBAMMBVN0ZXZlMSQwIgYJKoZIhvcNAQkBFhVzdGV2ZV9iYWd3ZWxsQHNpbC5vcmcwHhcNMTYxMDE4MTQwMDUxWhcNMjYxMDE4MTQwMDUxWjB+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTkMxDzANBgNVBAcMBldheGhhdzEMMAoGA1UECgwDU0lMMQ0wCwYDVQQLDARHVElTMQ4wDAYDVQQDDAVTdGV2ZTEkMCIGCSqGSIb3DQEJARYVc3RldmVfYmFnd2VsbEBzaWwub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx5mZNwjEnakJho+5etuFyx+2g9rs96iLX/LDC24aBAsdNxTNuIc1jJ7pxBxGrepEND4LkietLNBlOr1q50nq2+ddTrCfmoJB+9BqBOxcm9qWeqWbp8/arUjaxPzK3DfZrxJxIVFjzqFF7gI91y9yvEW/fqLRMhvnH1ns+N1ne59zr1y6h9mmHfBffGr1YXAfyEAuV1ich4AfTfjqhdwFwxhFLLCVnxA0bDbNw/0eGCSiA13N7a013xTurLeJu0AQaZYssMqvc/17UphH4gWDMEZAwy0EfRSBOsDOYCxeNxVajnWX1834VDpBDfpnZj996Gh8tzRQxQgT9/plHKhGiwIDAQABo1AwTjAdBgNVHQ4EFgQUApxlUQg26GrG3eH8lEG3SkqbH/swHwYDVR0jBBgwFoAUApxlUQg26GrG3eH8lEG3SkqbH/swDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEANhbm8WgIqBDlF7DIRVUbq04TEA9nOJG8wdjJYdoKrPX9f/E9slkFuD2StcK99RTcowa8Z2OmW7tksa+onyH611Lq21QXh4aHzQUAm2HbsmPQRZnkByeYoCJ/1tuEho+x+VGanaUICSBVWYiebAQVKHR6miFypRElibNBizm2nqp6Q9B87V8COzyDVngR1DlWDduxYaNOBgvht3Rk9Y2pVHqym42dIfN+pprcsB1PGBkY/BngIuS/aqTENbmoC737vcb06e8uzBsbCpHtqUBjPpL2psQZVJ2Y84JmHafC3B7nFQrjdZBbc9eMHfPo240Rh+pDLwxdxPqRAZdeLaUkCQ==',
2323
];
24+
$metadata['http://ssp-hub-idp4.local:8088'] = [
25+
'enabled' => true,
26+
'metadata-set' => 'saml20-idp-remote',
27+
'entityid' => 'http://ssp-hub-idp4.local:8088',
28+
'name' => [
29+
'en' => 'IdP 4'
30+
],
31+
'SingleSignOnService' => 'http://ssp-hub-idp4.local:8088/saml2/idp/SSOService.php',
32+
'SingleLogoutService' => 'http://ssp-hub-idp4.local:8088/saml2/idp/SingleLogoutService.php',
33+
'certData' => 'MIIDzzCCAregAwIBAgIJALBaUrvz1X5DMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJOQzEPMA0GA1UEBwwGV2F4aGF3MQwwCgYDVQQKDANTSUwxDTALBgNVBAsMBEdUSVMxDjAMBgNVBAMMBVN0ZXZlMSQwIgYJKoZIhvcNAQkBFhVzdGV2ZV9iYWd3ZWxsQHNpbC5vcmcwHhcNMTYxMDE4MTQwMDUxWhcNMjYxMDE4MTQwMDUxWjB+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCTkMxDzANBgNVBAcMBldheGhhdzEMMAoGA1UECgwDU0lMMQ0wCwYDVQQLDARHVElTMQ4wDAYDVQQDDAVTdGV2ZTEkMCIGCSqGSIb3DQEJARYVc3RldmVfYmFnd2VsbEBzaWwub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx5mZNwjEnakJho+5etuFyx+2g9rs96iLX/LDC24aBAsdNxTNuIc1jJ7pxBxGrepEND4LkietLNBlOr1q50nq2+ddTrCfmoJB+9BqBOxcm9qWeqWbp8/arUjaxPzK3DfZrxJxIVFjzqFF7gI91y9yvEW/fqLRMhvnH1ns+N1ne59zr1y6h9mmHfBffGr1YXAfyEAuV1ich4AfTfjqhdwFwxhFLLCVnxA0bDbNw/0eGCSiA13N7a013xTurLeJu0AQaZYssMqvc/17UphH4gWDMEZAwy0EfRSBOsDOYCxeNxVajnWX1834VDpBDfpnZj996Gh8tzRQxQgT9/plHKhGiwIDAQABo1AwTjAdBgNVHQ4EFgQUApxlUQg26GrG3eH8lEG3SkqbH/swHwYDVR0jBBgwFoAUApxlUQg26GrG3eH8lEG3SkqbH/swDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEANhbm8WgIqBDlF7DIRVUbq04TEA9nOJG8wdjJYdoKrPX9f/E9slkFuD2StcK99RTcowa8Z2OmW7tksa+onyH611Lq21QXh4aHzQUAm2HbsmPQRZnkByeYoCJ/1tuEho+x+VGanaUICSBVWYiebAQVKHR6miFypRElibNBizm2nqp6Q9B87V8COzyDVngR1DlWDduxYaNOBgvht3Rk9Y2pVHqym42dIfN+pprcsB1PGBkY/BngIuS/aqTENbmoC737vcb06e8uzBsbCpHtqUBjPpL2psQZVJ2Y84JmHafC3B7nFQrjdZBbc9eMHfPo240Rh+pDLwxdxPqRAZdeLaUkCQ==',
34+
];
2435
$metadata['jaars-idp'] = [
2536
'enabled' => true,
2637
'metadata-set' => 'saml20-idp-remote',

‎development/idp4/authsources.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<?php
2+
3+
use Sil\SilAuth\config\ConfigManager;
4+
5+
$config = [
6+
'admin' => [
7+
'core:AdminPassword',
8+
],
9+
'silauth' => ConfigManager::getSspConfig(),
10+
];

‎development/idp4/cert/ssp-hub-idp4.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDHmZk3CMSdqQmG
3+
j7l624XLH7aD2uz3qItf8sMLbhoECx03FM24hzWMnunEHEat6kQ0PguSJ60s0GU6
4+
vWrnSerb511OsJ+agkH70GoE7Fyb2pZ6pZunz9qtSNrE/MrcN9mvEnEhUWPOoUXu
5+
Aj3XL3K8Rb9+otEyG+cfWez43Wd7n3OvXLqH2aYd8F98avVhcB/IQC5XWJyHgB9N
6+
+OqF3AXDGEUssJWfEDRsNs3D/R4YJKIDXc3trTXfFO6st4m7QBBpliywyq9z/XtS
7+
mEfiBYMwRkDDLQR9FIE6wM5gLF43FVqOdZfXzfhUOkEN+mdmP33oaHy3NFDFCBP3
8+
+mUcqEaLAgMBAAECggEACinHBGdc44483u4oipns6RfXSkV2dXHOjvckeUuE5ZnP
9+
RgO4KeIwltVsn8C01JwuFt7l5e5BQhvmW6RTci1wWPwh4yTZK5vgUjsdetyyJnlt
10+
2hbeox/RSauBADDC/42Udvagbgrf4yCRF/pjPba7x9xhUMhnkH6dORpyF4XmhAPW
11+
TVCA7VVRL5aoEfemiZYOpjPkY135QqI6/PaLbRDUkqUtKdAB2+/XRTF2K8gbb44x
12+
f/wZeqpOG1y82P3aYVM1f3RLQUAS0rKyQJBRB8fHy5LY2z9LAlC8KSp1BAIKtqMT
13+
lUr6MIs2oImrLL0JyvEbcmtZI4MdGgnmkxrjc/8ZYQKBgQD8t18HVfmTu+5HZCuv
14+
NItpLOu/uxm6UwwAwbljtM2K2562wCsu9/tt72V0Ismysz19VUva/FtSqksuOWcA
15+
HC+APHtWMMtsBcQMZGrFHUlJCKv963gu7CoeJvY3mSWm4t8xuZBSz5pAeoeENioH
16+
NrL4+K2+cmVGRNjKIDipN5Ng8QKBgQDKMYrqNmH8/IaIDTi27d1A+1YTEZe/toaP
17+
YbTyyQ731mLwnukAx1MhFgoXe294nXiD3tC0g6ISpFgyUTL5OplIs/yiXks0y5/G
18+
mKxGsVc5qtBQB8utA3i8EzT6x2fIYmuJY2Pj3r6jFFzqOjlILN8ct1v05qjKH+gM
19+
n5C/IC/fOwKBgQCEcubPRXQkxZ5AtHNgxD08xlpYhosZaGUmEGJFq4D+gdRRG66G
20+
U1nnaEzX7VOg4OgdRBMZlqGWVcJJW7RsDlmm8AwERFaZKvxxMj/zR0IdkPnzfvHi
21+
RcxdOTZaNV3SdZ1cxlCp1jyWBqH33Rtx5G0wp8UHx5Tkmziz1udbaNFJQQKBgQDA
22+
EvpE7i59tqJSQkUbObFSVrB44uCGJW2EbawIa0lF1KoerMbpj3B/4MDrd734FZdz
23+
pkobAWUIUojaG9rReYI914Vp9St6VulMLqKRcUxMIuFK9WzdyYt7Fr/gb2c+q4g+
24+
dmVhBauRnfl6JJ9f2giE7gZ0Cl5TzKWSwE4v0fLIGwKBgGuiI+2j8YOsV4LYyin+
25+
9p5qmk4gVUe5ohPUKCdPeaZiiQbAJ3l5B3LR2sgV1mOm996Nm9Y0HEback4ISAjz
26+
Nd3TkcwDVaa7GV9pMknM2rK0U6gupbtPAaTMCanXu2VZbKGfQDlkpE3iYvMsuGIW
27+
1ppvkZ+ZtqGlvPGk+CWjr6vu
28+
-----END PRIVATE KEY-----

‎development/idp4/saml20-idp-hosted.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
use Sil\PhpEnv\Env;
3+
use Sil\Psr3Adapters\Psr3SamlLogger;
4+
5+
$metadata['http://ssp-hub-idp4.local:8088'] = [
6+
'host' => '__DEFAULT__',
7+
'privatekey' => 'ssp-hub-idp4.pem',
8+
'auth' => 'silauth',
9+
'authproc' => [
10+
10 => [
11+
'class' => 'mfa:Mfa',
12+
'employeeIdAttr' => 'employeeNumber',
13+
'idBrokerAccessToken' => Env::get('ID_BROKER_ACCESS_TOKEN'),
14+
'idBrokerAssertValidIp' => Env::get('ID_BROKER_ASSERT_VALID_IP'),
15+
'idBrokerBaseUri' => Env::get('ID_BROKER_BASE_URI'),
16+
'idBrokerTrustedIpRanges' => Env::get('ID_BROKER_TRUSTED_IP_RANGES'),
17+
'mfaSetupUrl' => Env::get('MFA_SETUP_URL'),
18+
'loggerClass' => Psr3SamlLogger::class,
19+
],
20+
]
21+
];

‎development/idp4/saml20-sp-remote.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<?php
2+
$metadata['ssp-hub.local'] = [
3+
'AssertionConsumerService' => 'http://ssp-hub.local:8080/module.php/saml/sp/saml2-acs.php/hub-discovery',
4+
'SingleLogoutService' => 'http://ssp-hub.local:8080/module.php/saml/sp/saml2-logout.php/hub-discovery',
5+
];

‎docker-compose.yml‎

Lines changed: 108 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
version: '2'
1+
version: '2.0'
2+
#TODO: update README with new idp and local mfa testing (also need a reference in /etc/hosts to idp4)
3+
#TODO: change names to idp's to exclude hub, e.g., ssp-hub-idp4.local is misleading...ssp-idp4.local would be better
4+
25
services:
36
hub:
47
image: silintl/ssp-base:develop
@@ -11,7 +14,13 @@ services:
1114
- ./www/default-logo.png:/data/vendor/simplesamlphp/simplesamlphp/www/logo.png
1215
- ./:/data/vendor/simplesamlphp/simplesamlphp/modules/material
1316
ports:
14-
- '80:80'
17+
- "80:80"
18+
depends_on:
19+
- idp1
20+
- idp2
21+
- idp4
22+
env_file:
23+
- ./local.env
1524
environment:
1625
ADMIN_PASS: "abc123"
1726
SECURE_COOKIE: "false"
@@ -20,9 +29,10 @@ services:
2029
HUB_MODE: "true"
2130
ADMIN_EMAIL: "[email protected]"
2231
SECRET_SALT: "FcJwl0zCDc4nuzOuQL9/7WPIj3hdfusGm2ny0dcRQm0="
23-
IDP_NAME: hub
32+
IDP_NAME: "hub"
2433
IDP_DISPLAY_NAME: "The Hub"
2534
ANALYTICS_ID: "UA-XXXX-Y"
35+
2636
idp1:
2737
image: silintl/ssp-base:develop
2838
volumes:
@@ -31,7 +41,9 @@ services:
3141
- ./development/idp1/saml20-idp-hosted.php:/data/vendor/simplesamlphp/simplesamlphp/metadata/saml20-idp-hosted.php
3242
- ./development/idp1/saml20-sp-remote.php:/data/vendor/simplesamlphp/simplesamlphp/metadata/saml20-sp-remote.php
3343
ports:
34-
- '8085:80'
44+
- "8085:80"
45+
env_file:
46+
- ./local.env
3547
environment:
3648
ADMIN_PASS: "a"
3749
SECURE_COOKIE: "false"
@@ -53,7 +65,9 @@ services:
5365
- ./www/default-logo.png:/data/vendor/simplesamlphp/simplesamlphp/www/logo.png
5466
- ./:/data/vendor/simplesamlphp/simplesamlphp/modules/material
5567
ports:
56-
- '8086:80'
68+
- "8086:80"
69+
env_file:
70+
- ./local.env
5771
environment:
5872
ADMIN_PASS: "b"
5973
SECURE_COOKIE: "false"
@@ -68,6 +82,86 @@ services:
6882
PASSWORD_CHANGE_URL: "http://example.org"
6983
PASSWORD_FORGOT_URL: "http://example.org"
7084

85+
idp4:
86+
image: silintl/ssp-base:feature_mfa #TODO: move this to :develop when PR'd
87+
volumes:
88+
- ./development/idp4/cert:/data/vendor/simplesamlphp/simplesamlphp/cert
89+
- ./development/idp4/authsources.php:/data/vendor/simplesamlphp/simplesamlphp/config/authsources.php
90+
- ./development/idp4/saml20-idp-hosted.php:/data/vendor/simplesamlphp/simplesamlphp/metadata/saml20-idp-hosted.php
91+
- ./development/idp4/saml20-sp-remote.php:/data/vendor/simplesamlphp/simplesamlphp/metadata/saml20-sp-remote.php
92+
- ./www/default-logo.png:/data/vendor/simplesamlphp/simplesamlphp/www/logo.png
93+
- ./:/data/vendor/simplesamlphp/simplesamlphp/modules/material
94+
ports:
95+
- "8088:80"
96+
depends_on:
97+
- silAuthDb
98+
- broker
99+
env_file:
100+
- ./local.env
101+
environment:
102+
ADMIN_PASS: "b"
103+
SECURE_COOKIE: "false"
104+
SHOW_SAML_ERRORS: "true"
105+
ADMIN_PROTECT_INDEX_PAGE: "false"
106+
THEME_USE: "material:material"
107+
ADMIN_EMAIL: "[email protected]"
108+
SECRET_SALT: "NlFalr5Faa73coPUFPP78BCi2ZUYhL+qVCOuJ466Bh4="
109+
IDP_NAME: "idp-4"
110+
IDP_DISPLAY_NAME: "Idp 4"
111+
IDP_DOMAIN_NAME: "idp-4.local"
112+
MFA_SETUP_URL: "https://example.org/mfa-setup"
113+
MYSQL_HOST: "silAuthDb"
114+
MYSQL_DATABASE: "silauth"
115+
MYSQL_USER: "user"
116+
MYSQL_PASSWORD: "pass"
117+
ID_BROKER_ACCESS_TOKEN: "arc-cli-abc123"
118+
ID_BROKER_ASSERT_VALID_IP: "false"
119+
ID_BROKER_BASE_URI: "http://broker"
120+
REMEMBER_ME_SECRET: "dummy"
121+
command: ["bash", "-c", "whenavail silAuthDb 3306 60 ./run-idp.sh"]
122+
123+
silAuthDb:
124+
image: silintl/mariadb:latest
125+
ports:
126+
- "3306"
127+
environment:
128+
MYSQL_ROOT_PASSWORD: "r00tp@ss!"
129+
MYSQL_DATABASE: "silauth"
130+
MYSQL_USER: "user"
131+
MYSQL_PASSWORD: "pass"
132+
133+
broker:
134+
image: silintl/idp-id-broker:feature2sv #TODO: move this to :develop when PR'd
135+
ports:
136+
- "8090:80"
137+
depends_on:
138+
- brokerDb
139+
env_file:
140+
- ./local.env
141+
environment:
142+
IDP_NAME: "idp-4"
143+
MYSQL_HOST: "brokerDb"
144+
MYSQL_DATABASE: "broker"
145+
MYSQL_USER: "user"
146+
MYSQL_PASSWORD: "pass"
147+
EMAIL_SERVICE_accessToken: "dummy"
148+
EMAIL_SERVICE_assertValidIp: "false"
149+
EMAIL_SERVICE_baseUrl: "localhost"
150+
API_ACCESS_KEYS: "arc-cli-abc123"
151+
APP_ENV: "dev"
152+
MIGRATE_PW_FROM_LDAP: "false"
153+
command: ["bash", "-c", "whenavail brokerDb 3306 60 ./yii migrate --interactive=0 && ./run.sh"]
154+
155+
brokerDb:
156+
image: silintl/mariadb:latest
157+
ports:
158+
- "3306"
159+
environment:
160+
MYSQL_ROOT_PASSWORD: "r00tp@ss!"
161+
MYSQL_DATABASE: "broker"
162+
MYSQL_USER: "user"
163+
MYSQL_PASSWORD: "pass"
164+
71165
hub2:
72166
image: silintl/ssp-base:develop
73167
volumes:
@@ -78,7 +172,11 @@ services:
78172
- ./:/data/vendor/simplesamlphp/simplesamlphp/modules/material
79173
- ./development/idp3/announcement.php:/data/vendor/simplesamlphp/simplesamlphp/announcement/announcement.php
80174
ports:
81-
- '8081:80'
175+
- "8081:80"
176+
depends_on:
177+
- idp3
178+
env_file:
179+
- ./local.env
82180
environment:
83181
ADMIN_PASS: "abc123"
84182
SECURE_COOKIE: "false"
@@ -89,6 +187,7 @@ services:
89187
SECRET_SALT: "QthhmKnsmC7X/+2bv3CgzBWaFR68J3fP6QgmZhM1L7M="
90188
IDP_NAME: "hub-2"
91189
IDP_DISPLAY_NAME: "The Hub2"
190+
92191
idp3:
93192
image: silintl/ssp-base:develop
94193
volumes:
@@ -100,7 +199,9 @@ services:
100199
- ./:/data/vendor/simplesamlphp/simplesamlphp/modules/material
101200
- ./development/idp3/announcement.php:/data/vendor/simplesamlphp/simplesamlphp/announcement/announcement.php
102201
ports:
103-
- '8087:80'
202+
- "8087:80"
203+
env_file:
204+
- ./local.env
104205
environment:
105206
ADMIN_PASS: "a"
106207
SECURE_COOKIE: "false"

‎local.env.dist‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
### Required ENV vars ###
2+
MFA_TOTP_apiBaseUrl=
3+
MFA_TOTP_apiKey=
4+
MFA_TOTP_apiSecret=
5+
MFA_U2F_apiBaseUrl=
6+
MFA_U2F_apiKey=
7+
MFA_U2F_apiSecret=
8+
MFA_U2F_appId=
9+
10+
### Optional ENV vars ###
11+
LOGENTRIES_KEY=
12+
COMPOSER_AUTH=

0 commit comments

Comments
 (0)