我必须实现SAML2身份提供程序（IdP）并将其与现有的Symfony 2应用程序集成。
我找到了一些实现服务提供商（SP）而不是身份提供商的捆绑包，因此我认为我可以使用SimpleSAMLphp library。还有其他解决方案吗？
如何将我的用户提供程序逻辑与SimpleSAMLphp集成？
答案 0 :(得分：4)
<强>更新
正如米洛斯·托米奇在他的评论中提到的那样，“空中飞船”/“lightaml”被lightsaml/sp-bundle取代。您可以找到introduction here。
+++++++++++++++++++++++++++
我最近设置了一个SAML解决方案，使用Simplesamlphp作为IDP，SamlSPBundle作为SP，一切运行良好。
我建议先按照good Documentation here安装Simplesamlphp。
启动并运行IDP后，您应该会看到一个欢迎页面和一个名为Federation的标签（或者类似的标签，我的安装是德语版）。在那里你应该看到一个选项“SAML 2.0 IdP元数据”。按照该链接并将显示的XML复制到单独的文件并保存该文件。
在symfony方面，我创建了一个新的Bundle并称之为“SamlBundle”。按照文档（步骤1和步骤2）中的说明下载并安装SamlSPBundle。
创建您的SSO状态/用户类（步骤3）。这是我如何做到的一个例子：
namespace SamlBundle\Entity;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\UserInterface;
/**
* @ORM\Entity
* @ORM\Table(name="samlUser")
*/
class SamlUser extends \AerialShip\SamlSPBundle\Entity\SSOStateEntity implements UserInterface
{
/**
* initialize User object and generates salt for password
*/
public function __construct()
{
if (!$this->userData instanceof UserData) {
$this->userData = new UserData();
}
$this->setRoles('ROLE_USER');
}
/**
* @var int
* @ORM\Column(type="integer")
* @ORM\Id
* @ORM\GeneratedValue(strategy="AUTO")
*/
protected $id;
/**
* @var string username
*
* @ORM\Column(type="string", length=64, nullable=true)
*/
protected $username;
/**
* @var string targetedId
*
* @ORM\Column(type="string", length=64, nullable=true, name="targeted_id")
*/
protected $targetedID;
/**
* @var string
* @ORM\Column(type="string", length=32, name="provider_id", nullable=true)
*/
protected $providerID;
/**
* @var string
* @ORM\Column(type="string", length=32, name="auth_svc_name")
*/
protected $authenticationServiceName;
/**
* @var string
* @ORM\Column(type="string", length=64, name="session_index", nullable=true)
*/
protected $sessionIndex;
/**
* @var string
* @ORM\Column(type="string", length=64, name="name_id")
*/
protected $nameID;
/**
* @var string
* @ORM\Column(type="string", length=64, name="name_id_format")
*/
protected $nameIDFormat;
/**
* @var \DateTime
* @ORM\Column(type="datetime", name="created_on")
*/
protected $createdOn;
/**
* @var UserData
* @ORM\OneToOne(targetEntity="UserData", cascade={"all"}, fetch="EAGER")
* @ORM\JoinColumn(name="user_data", referencedColumnName="id")
*/
protected $userData;
将您的课程添加到config.yml（步骤4）：
# app/config/config.yml
aerial_ship_saml_sp:
driver: orm
sso_state_entity_class: SamlBundle\Entity\SamlUser
更新您的security.yml（步骤5）。实施例;
providers:
saml_user_provider:
id: SamlToState
firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
saml:
pattern: ^/(?!login_check)
anonymous: true
aerial_ship_saml_sp:
login_path: /saml/sp/login
check_path: /saml/sp/acs
logout_path: /saml/sp/logout
failure_path: /saml/sp/failure
metadata_path: /saml/sp/FederationMetadata.xml
discovery_path: /saml/sp/discovery
local_logout_path: /logout
provider: saml_user_provider
create_user_if_not_exists: true
services:
openidp:
idp:
#the XML-File you saved from the IDP earlier
file: "@SamlBundle/Resources/idp-FederationMetadata.xml"
sp:
config:
# required, has to match entity id from IDP XML
entity_id: http://your-idp-domain.com
# if different then url being used in request
# used for construction of assertion consumer and logout urls in SP entity descriptor
base_url: http://your-sp-domain.com
signing:
#self signed certificate, see [SamlSPBundle docs][4]
cert_file: "@SamlBundle/Resources/saml.crt"
key_file: "@SamlBundle/Resources/saml.pem"
key_pass: ""
meta:
# must implement SpMetaProviderInterface
# id: my.sp.provider.service.id
# or use builtin SpMetaConfigProvider
# any valid saml name id format or shortcuts: persistent or transient
name_id_format: transient
binding:
# any saml binding or shortcuts: post or redirect
authn_request: redirect
logout_request: redirect
logout:
path: /logout
target: /
invalidate_session: true
接下来按步骤6中所述导入路由。在继续执行步骤7之前，我建议先创建用户提供程序类。这是一个例子：
namespace SamlBundle\Models;
use SamlBundle\Entity\SamlUser;
use Symfony\Component\DependencyInjection\ContainerInterface;
use Symfony\Component\Security\Core\User\UserInterface;
use AerialShip\SamlSPBundle\Bridge\SamlSpInfo;
use AerialShip\SamlSPBundle\Security\Core\User\UserManagerInterface as UserManagerInterface;
class SamlToState implements UserManagerInterface
{
/**
* @var ContainerInterface base bundle container
*/
public $container;
/**
* Constructor with DependencyInjection params.
*
* @param \Symfony\Component\DependencyInjection\ContainerInterface $container
*/
public function __construct(ContainerInterface $container) {
$this->container = $container;
}
/**
* {@inheritdoc}
*/
public function loadUserBySamlInfo(SamlSpInfo $samlInfo)
{
$user = $this->loadUserByTargetedID($samlInfo->getAttributes()['eduPersonTargetedID']->getFirstValue());
return $user;
}
private function loadUserByTargetedID($targetedID) {
$repository = $this->container->get('doctrine')->getManager()->getRepository('MrmPosSamlBundle:SamlUser');
$user = $repository->findOneBy(
array('targetedID' => $targetedID)
);
if ($user) {
return $user;
}
throw new \Symfony\Component\Security\Core\Exception\UsernameNotFoundException();
}
/**
* {@inheritdoc}
*/
public function createUserFromSamlInfo(SamlSpInfo $samlInfo)
{
$repository = $this->container->get('doctrine')->getManager()->getRepository('MrmPosSamlBundle:SamlUser');
$user = $repository->findOneBy(
array('nameID' => $samlInfo->getNameID()->getValue())
);
if ($user) {
$user->setUsername($samlInfo->getAttributes()['eduPersonPrincipalName']->getFirstValue());
$user->setTargetedID($samlInfo->getAttributes()['eduPersonTargetedID']->getFirstValue());
$user->setRoles($samlInfo->getAttributes()['role']->getFirstValue());
} else {
$user = new SamlUser();
$user->setUsername($samlInfo->getAttributes()['eduPersonPrincipalName']->getFirstValue());
$user->setTargetedID($samlInfo->getAttributes()['eduPersonTargetedID']->getFirstValue());
$user->setRoles($samlInfo->getAttributes()['role']->getFirstValue());
$user->setSessionIndex($samlInfo->getAuthnStatement()->getSessionIndex());
$user->setProviderID($samlInfo->getNameID()->getSPProvidedID());
$user->setAuthenticationServiceName($samlInfo->getAuthenticationServiceID());
$user->setNameID($samlInfo->getNameID()->getValue());
$user->setNameIDFormat($samlInfo->getNameID()->getFormat());
}
$em = $this->container->get('doctrine')->getManager();
$em->persist($user);
$em->flush();
return $user;
}
public function loadUserByUsername($username)
{
$repository = $this->container->get('doctrine')->getManager()->getRepository('MrmPosSamlBundle:SamlUser');
$user = $repository->findOneBy(
array('username' => $username)
);
if ($user) {
return $user;
}
throw new \Symfony\Component\Security\Core\Exception\UsernameNotFoundException();
return false;
}
/**
* {@inheritdoc}
*/
public function refreshUser(UserInterface $user)
{
$repository = $this->container->get('doctrine')->getManager()->getRepository('MrmPosSamlBundle:SamlUser');
$newUser = $repository->findOneBy(
array('nameID' => $user->getNameID())
);
if (!$newUser) {
throw new \Symfony\Component\Security\Core\Exception\UsernameNotFoundException();
}
return $newUser;
}
/**
* {@inheritdoc}
*/
public function supportsClass($class)
{
return true;
}
}
在SamlBundle / Resources / config / services.yml中创建您的服务：
services:
SamlToState:
class: SamlBundle\Models\SamlToState
arguments: [@service_container]
现在是时候进行第7步，交换元数据了。按照描述获取SP XML并返回到您的IDP。您可以在“联盟”选项卡上找到“XML to simpleSAMLphp Metadata converter”链接。按照该链接将您的SP XML数据转换为simpleSAMLphp格式。将该数据添加到IDP元数据文件夹中的saml20-sp-remote.php文件中。
好的，我很确定我忘记了什么，但希望这些信息有所帮助。如果你遇到困难，欢迎你回复我。
答案 1 :(得分：1)
我找到了：
看看这两个。第一个是非常简单的，我不知道是否有足够的文件，当然是一个活跃的项目。第二个似乎更强大并且有文档证明，但配置起来可能更困难。
希望这个帮助