EzDevInfo.com

Does the SimpleSAMLphp frontend need to be on for the service prodivder to act like a service provider?

Pretty simple, setup simpleSAMLphp and went through all the configuration.

The default simpleSAMLphp seems very 'open', and a little unprofessional (under reset password it says "Too Bad! Contact your university"). I know I could technically just edit out some of those messages as a theme, but does it actually need to be on at all?

Or could I simply just turn the web front end off?

SimpleSamlPhp with CustomIdP Implementation

I'm just wondering if any you have a experience integrating SSO using SimpleSamlPhp and Custom IdP. We actually manage to make it work but we're just being skeptical regarding on the security and stability of the SSO using just SAML2.0 as our Service Provider and Identity Provider we're just allowed to use free SSO for now. So my questions is:

How's your experience in terms of security and stability of simplesamlphp?

how to use SimpleSAMLphp in yii framework?

I have two project in yii framework and I want to use both project using SimpleSAMLphp with SSO. The condition, I need is if I login from the first project, i want access to the second project. Thank you in advance.

SimpleSaml Memcache Username/Password

After looking at the documentation, I can't figure out how to set the memchached username and password for a memcache_store server. Does anybody know?

https://simplesamlphp.org/docs/stable/simplesamlphp-maintenance#section_2

SimpleSAMLPHP: because it isn't a valid IdP for this SP

i am getting the following error when i am redirecting back from idp to saml-sp.

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
Backtrace:
0 /var/simplesamlphp/www/module.php:180 (N/A)
Caused by: SimpleSAML_Error_Exception: Cannot retrieve metadata for IdP 'https://openidp.feide.no' because it isn't a valid IdP for this SP.

I tried to change metadata 'https://openidp.feide.no' to 'http://192.168.0.105:81'. But still the issue is not resolved. Could someone suggest any idea to resolve it?

Proper XML Canonicalization for SAML

I am running into the problem with validating the signature for the SAML 2.0 Assertion XML. I am using the SAML2 library from simpleSAMLphp project, which in turn is using the PHP xmlseclibs library for signing XML and verifying the signatures.

I am receiving the following assertion from my partner:

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="_c43265fe-8cd5-410f-b63d-dac9f266d4c9" IssueInstant="2015-01-23T17:46:28.456Z"><saml:Issuer>uat.test.com/saml2.0</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_c43265fe-8cd5-410f-b63d-dac9f266d4c9"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default saml ds xs xsi"/></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>mFKEIdw+cEielORqscbHuAJhI58=</DigestValue></Reference></SignedInfo><SignatureValue>kEZHloxYJVqDg8oxLNpl+sbJYhv9r7yYU5yQi71gCNm/Cdtj9/P2LR5cnopKZZu+7j3PVimeZoir6RTTrdVKTLkp+PmvOmTlLH/LVtntQZ68TaUxUd3BvtQiKuJ8KFwWPmQ+W3RIKv4ySAsy6PUiWPcr8eIYpIiUA6rxCuSEpdA=</SignatureValue><KeyInfo><X509Data><X509Certificate>MIICczCCAdygAwIBAgIEdWfFczANBgkqhkiG9w0BAQUFADB0MQswCQYDVQQIEwJNQTEQMA4GA1UEBxMHTm9yd29vZDEPMA0GA1UEChMGTWVyY2VyMRswGQYDVQQLExJNZXJjZXIgSFIgU2VydmljZXMxJTAjBgNVBAMTHE1lcmNlciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDcwNjI5MDI1NTQxWhcNMTcwNzI5MDQwMDAwWjB2MQswCQYDVQQIEwJNQTEQMA4GA1UEBxMHTm9yd29vZDEPMA0GA1UEChMGTWVyY2VyMRswGQYDVQQLExJNZXJjZXIgSFIgU2VydmljZXMxJzAlBgNVBAMTHk1lcmNlciBIdW1hbiBSZXNvdXJjZSBTZXJ2aWNlczCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAm9KNx7UmRbWwJ0gmIV9sZzMDH4uz+o6ZmOxVRLvrO0Yzc9Qsc+7f+jIEGsVpbeaj5zx+4c8g46QqGam/Ap+4peewduVAN7GwK8UrmveASQH1Y/byTVGhyndfEtHfauresYpNDbgCn/iq/cXNapuFaTB4U0MPtz8Bqds1871hNasCAwEAAaMQMA4wDAYDVR0PBAUDAwf/gDANBgkqhkiG9w0BAQUFAAOBgQBR5wV43k1XcIM7z24SBvpEDWgEawXZ3TjTI9/54v/ZAdzXAiYfLKVV+hiyum+QP9jezDUH+Wz2bqzjlxOSU7HvUn4MwN+88a1hvSXpPxsp7y4d7juVt66aip/9NuSWbNqUPdhgK/KvMHrZpksCoxUJG2+Q1Jz7aNiBQvONRRPdTg==</X509Certificate></X509Data></KeyInfo></Signature><saml:Subject><saml:NameID>000786320</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2015-01-23T17:51:28.471Z" Recipient="https://test.com/sso"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2015-01-23T17:41:28.456Z" NotOnOrAfter="2015-01-23T17:51:28.456Z"><saml:AudienceRestriction><saml:Audience>test.com:saml2.0</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2015-01-23T17:46:28.456Z" SessionIndex="SI-8bd89651-62da-4b7d-9a54-04eb2eb90784"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="email"><saml:AttributeValue>invalidemail@invalid.com</saml:AttributeValue></saml:Attribute><saml:Attribute Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="firstName"><saml:AttributeValue>Diane</saml:AttributeValue></saml:Attribute><saml:Attribute Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="lastname"><saml:AttributeValue>Test</saml:AttributeValue></saml:Attribute><saml:Attribute Name="zipCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="zipCode"><saml:AttributeValue>02062</saml:AttributeValue></saml:Attribute><saml:Attribute Name="businessUnit" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="businessUnit"><saml:AttributeValue>78945</saml:AttributeValue></saml:Attribute><saml:Attribute Name="employeeID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" FriendlyName="employeeID"><saml:AttributeValue>000786320</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>

The signature element requests exclusive C14N canonicalization. The xmlseclibs library library canonicalizes this as following:

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_c43265fe-8cd5-410f-b63d-dac9f266d4c9" IssueInstant="2015-01-23T17:46:28.456Z" Version="2.0"><saml:Issuer>uat.test.com/saml2.0</saml:Issuer><saml:Subject><saml:NameID>000786320</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2015-01-23T17:51:28.471Z" Recipient="https://test.com/sso"></saml:SubjectConfirmationData></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2015-01-23T17:41:28.456Z" NotOnOrAfter="2015-01-23T17:51:28.456Z"><saml:AudienceRestriction><saml:Audience>test.com:saml2.0</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2015-01-23T17:46:28.456Z" SessionIndex="SI-8bd89651-62da-4b7d-9a54-04eb2eb90784"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute FriendlyName="email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>invalidemail@invalid.com</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="firstName" Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>Diane</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="lastname" Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>Test</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="zipCode" Name="zipCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>02062</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="businessUnit" Name="businessUnit" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>78945</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="employeeID" Name="employeeID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>000786320</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>

However the element my partner actually signs is this:

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c43265fe-8cd5-410f-b63d-dac9f266d4c9" IssueInstant="2015-01-23T17:46:28.456Z" Version="2.0"><saml:Issuer>uat.test.com/saml2.0</saml:Issuer><saml:Subject><saml:NameID>000786320</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2015-01-23T17:51:28.471Z" Recipient="https://test.com/sso"></saml:SubjectConfirmationData></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2015-01-23T17:41:28.456Z" NotOnOrAfter="2015-01-23T17:51:28.456Z"><saml:AudienceRestriction><saml:Audience>test.com:saml2.0</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2015-01-23T17:46:28.456Z" SessionIndex="SI-8bd89651-62da-4b7d-9a54-04eb2eb90784"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute FriendlyName="email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>invalidemail@invalid.com</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="firstName" Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>Diane</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="lastname" Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>Test</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="zipCode" Name="zipCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>02062</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="businessUnit" Name="businessUnit" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>78945</saml:AttributeValue></saml:Attribute><saml:Attribute FriendlyName="employeeID" Name="employeeID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue>000786320</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>

Pretty much the same, however without the xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" namespace. The xsi namespace is mentioned in the signature Transform elements: <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default saml ds xs xsi"/></Transform>

The SAML authentication fails because of this since the SHA1 digest in the signature does not match the digest xmlseclibs calculated on the element.

So I was wondering who is correct here -- does the xsi namespace have to be included (even though there are no elements in this namespace) because it is included in the InclusiveNamespaces, or if it is not, why does xmlseclibs includes that namespace there with C14N canonicalization?

"Received an assertion that is valid in the future. Check clock synchronization on IdP and SP"

I'm using https://simplesamlphp.org/ in my app. Most of the time it's fine and there are no issues. Other times I get this:

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
Backtrace:
0 ssoclient/www/module.php:180 (N/A)
Caused by: SimpleSAML_Error_Exception: Received an assertion that is valid in the future. Check clock synchronization on IdP and SP. 
Backtrace:
3 ssoclient/modules/saml/lib/Message.php:565 (sspmod_saml_Message::processAssertion)
2 ssoclient/modules/saml/lib/Message.php:523 (sspmod_saml_Message::processResponse)
1 ssoclient/modules/saml/www/sp/saml2-acs.php:75 (require)
0 ssoclient/www/module.php:135 (N/A)

Why would this happen, and how can I resolve it? Do I need to change my system time? ( I'm on Debian ).

SimpleSAMLphp installation in Windows Apache

I want to install SimpleSAMLphp in windows Apache/Xampp. Let me tell you what did so far: 1. I have downloaded latest stable version from https://simplesamlphp.org/download and placed the unzipped file in Apache folder, i.e. C:\Apache24\simplesamlphp directory contains composer.json. I have downloaded dependencies as well. 2. Now when I am going to setup the vhost as shows in the site 6. Configuring Apache section as

<VirtualHost *:80>
        ServerName localhost
        DocumentRoot C:/Apache24/htdocs
</VirtualHost>

<VirtualHost *:80>
        ServerName service.example.com
        DocumentRoot C:/Apache24/service.example.com

        Alias /simplesaml C:/Apache24/simplesamlphp/www
</VirtualHost>

3. Changed the config file.

Now the problem: I am unable to open the Alias in browser. And running httpd.exe in browser shows error about the example.com does not exist.

Need help if anyone have setup SimpleSAMLphp in Windows, please share your steps and vhosting configurations. It would help I think lot of peoples.

Thanks in advance.

Using SimpleSAMLphp in a multi-tenant app

Tenants of our app have their own subdomain, e.g. customer1.domain.com, although it's one code base. Some tenants want SP initiated SSO with SAML.

What's the best approach for making this happen?

1. SimpleSAMLphp on a static shared subdomain, e.g. sso.domain.com/saml/
2. SimpleSAMLphp as part of the tenant, e.g. customer1.domain.com/saml/

If we go for option 1, how would we know what tenant an incoming SAML request is for?

If we go for option 2, how would you recommend configuring SimpleSAMLphp for metadata/authsources as it only seems to support hardcoded files.

Thanks

How to validate SAML response and assertion signature using SimpleSAMLphp

I'm trying out the SimpleSAMLphp sample app with WSO2 Identity Server as the Identity Provider. I can successfully login and logout. The SAML assertion and the response is signed.

I want to know how to validate the (response and assertion) signature in the client application using SimpleSAMLphp.

SimpleSamlPHP (SP) & OKTA (IdP)

I have a web application on my local computer: https://test.staging.me

This is PHP (cakephp) application.

I installed SimpleSamlPHP and configured it as the Service Provider(SP). I created some tests from instruction: https://simplesamlphp.org/docs/stable/simplesamlphp-sp And my tests with openidp.feide.no were successfully.

But I have problem with OKTA. I created "Test App Cakephp" and assigned people and configured SimpleSamlPHP for this.

But after logIn I get this SAML (without user attributes):

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://test.staging.me/simplesamlphp/module.php/saml/sp/saml2-acs.php/okta-sp" ID="id12087736095048056708868080" IssueInstant="2015-04-07T15:49:27.571Z" Version="2.0" > 
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" >http://www.okta.com/exk3ov34irLCZc7Ti0h7</saml2:Issuer> 
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
    <ds:SignedInfo> 
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> 
        <ds:Reference URI="#id12087736095048056708868080"> 
            <ds:Transforms> 
                <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> 
                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
            </ds:Transforms> 
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> 
            <ds:DigestValue>pU2jLhg9A4w97r8NVnBKl3IQZLE=</ds:DigestValue> 
        </ds:Reference> 
    </ds:SignedInfo> 
    <ds:SignatureValue>VPDveGXR0s0aL87FHcwlgox2jpF8Ka68+35u5sAwtNPu6YGLeHBZXMM0VJBGubXaP43p7U/bOCEDN28Unvdu+r7nsPayg7KRJtEBG5IPS0aHAsAVvFWCNKwbj/F3V+mNfjj6tyCYxfUv0VzGYFx74sR4jyatwMWM0C8Tn5/
    </ds:SignatureValue> 
    <ds:KeyInfo> 

        <ds:X509Data> 
            <ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAUx+YiPyMA0GCSqGSIb3DQEBBQUAMIGSMQswCQYDVQQGEwJVUzETMBEG A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU 
            </ds:X509Certificate> 
        </ds:X509Data> 
    </ds:KeyInfo> 
</ds:Signature> 

<saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"> 
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /> 
</saml2p:Status> 
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="id120877360951785121155512781" IssueInstant="2015-04-07T15:49:27.571Z" Version="2.0" > 
    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" >http://www.okta.com/exk3ov34irLCZc7Ti0h7</saml2:Issuer> 
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
        <ds:SignedInfo> 
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> 
            <ds:Reference URI="#id120877360951785121155512781"> 
                <ds:Transforms> 
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> 
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
                </ds:Transforms> 

                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> 
                <ds:DigestValue>lob8Do3NlCm0YApUEdGks7Lvj5g=</ds:DigestValue> 
            </ds:Reference> 
        </ds:SignedInfo> 
        <ds:SignatureValue>cxCVxow1zv7/C9fyG3n8FqXLNUCx6J3WMzZSB7oOQhBCWt1x+EmkB/Hh3l1AajeCRe50uCZlSfy5eN1kpLQPy1oqyTH/i08cdnzeb94eMh06JRpljSrGFBRyNz7RfoHSs13v8R3PEweDsM0XIUhfX3oL2JpGm7yxwcm/+UZpI2eq
        </ds:SignatureValue> 
        <ds:KeyInfo> 
            <ds:X509Data> 
                <ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAUx+YiPyMA0GCSqGSIb3DQEBBQUAMIGSMQswCQYDVQQGEwJVUzETMBEG A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU MBIGA1UECwwLU1NPUHJv
                </ds:X509Certificate> 
            </ds:X509Data> 

        </ds:KeyInfo> 
    </ds:Signature> 
    <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"> 
        <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">test1@my_domain.com</saml2:NameID> 
        <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> 
            <saml2:SubjectConfirmationData NotOnOrAfter="2015-04-07T15:54:27.571Z" Recipient="https://test.staging.me/simplesamlphp/module.php/saml/sp/saml2-acs.php/okta-sp" /> 
        </saml2:SubjectConfirmation> 
    </saml2:Subject> 
    <saml2:Conditions NotBefore="2015-04-07T15:44:27.571Z" NotOnOrAfter="2015-04-07T15:54:27.571Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" > 
        <saml2:AudienceRestriction> 
            <saml2:Audience>https://test.staging.me/simplesamlphp/module.php/saml/sp/metadata.php/okta-sp</saml2:Audience> 
        </saml2:AudienceRestriction> 
    </saml2:Conditions> 
    <saml2:AuthnStatement AuthnInstant="2015-04-07T15:49:27.571Z" SessionIndex="id1428421767571.740119289" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" > 
        <saml2:AuthnContext>
            <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef> 
        </saml2:AuthnContext> 
    </saml2:AuthnStatement> 
</saml2:Assertion> 

I cut off "ds:SignatureValue" and "ds:X509Certificate" fields for convenience.

My question: Why I don't receive attributes of the user? Thanks )

Handle user-specific data in a SAML authenticated SP

I am just getting started with SAML. AFAIK, in the authentication step, there is no direct communication between the IdP and the SP and the assertion happens via the browser.

In my applications (which will be the SP), I would like to store some user specific data (stuff like page size, other UI preferences). When the user is deleted from the IdP, I would like to purge this data from my application as well ? Is it possible to get this "event" from the IdP to the SP for such tasks ?

PS - My app is PHP based and I am likely to simplesamlphp.

Thanks, ~preetham

Using composer package with deleted dependency

I want to use the simplesamlphp package for my SSO implementation. However, I cannot install the package via composer, because one of the dependencies no longer exists.

"simplesamlphp/simplesamlphp": "dev-master"

Output after running composer update -o:

  Problem 1
    - simplesamlphp/saml2 v0.4.1 requires robrichards/xmlseclibs 1.3.* -> no matching package found.
    - simplesamlphp/saml2 v0.4.0 requires robrichards/xmlseclibs 1.3.* -> no matching package found.
    - simplesamlphp/saml2 v0.3.0 requires robrichards/xmlseclibs 1.3.* -> no matching package found.

I know that simplesamlphp has a package simplesamlphp/xmlseclibs. Is there a way to load that package instead of the non-existing robrichards package?

I have searched for answers in the Composer documentation, but an alias is only used for local repositories it seems.

How to configure SSO by SAML on Drupal?

At first, I am new in SAML. Could somebody tell step by step, how to configure SSO on Drupal using simplesamlphp? Or how to test by "Test configured authentication sources"?

What I have now.

1. Installed simpleSAMLphp Authentication module.
2. Add simplesamlphp library to my site (mysite/simplesamlphp).
3. Changed config.php

4. Added meta to saml20-sp-remote.php

   $metadata['name'] = array(
       'SingleSignOnService'  => 'url_login',
       'SingleLogoutService'  => 'url_logout',
       'certFingerprint'      => 'key'
   );
   

5. When I go to mysite/saml_login, I am return to login page on IdP. After login I return to my site (mysite/sso/login?params) with SAMLRequest and other GET-params. But site show page not fount error. On wiki it step 2.

So what I did wrong? May be I must set same page callback to handle this GET-params?

I also try to did this by simplesaml "Test configured authentication sources", but I got the same result.

Please, help!

saml2 identity provider in Symfony2

I must implement and integrate a SAML2 Identity Provider (IdP) with an existing Symfony 2 application.

I found some bundle that implement Service Provider (SP) but not Identity Provider so I think that I may use SimpleSAMLphp library. Are there other solutions?

How can I integrate my user provider logic with SimpleSAMLphp?