SAML (php-saml-sp)#

Very simple, secure SAML SP written in PHP.

Why#

This application was written to be (a lot) simpler to use and configure than simpleSAMLphp and only work as a SAML SP supporting only secure cryptographic algorithms, see the project site for more information.

Installation#

Enable the repository for your platform as instructed here. Make sure you use the repository for v2!

Fedora#

$ sudo dnf -y install php-saml-sp
$ sudo systemctl restart httpd

Debian#

$ sudo apt -y install php-saml-sp
$ sudo a2enconf php-saml-sp
$ sudo systemctl restart apache2

Configuring the SP#

See /etc/php-saml-sp/config.php.

The metadata URL is https://vpn.example.org/php-saml-sp/metadata. The entityID is the same (by default). You can override this by setting entityId to a value of your choice, e.g. https://vpn.example.org/saml to be vendor neutral in case you want to switch later. Choosing something stable here is important when you use for example eduPersonTargetedID as that identifier is typically bound to the SP entityID.

Copy the IdP(s) metadata to /etc/php-saml-sp/metadata. Make sure the metadata files have the .xml extension and are valid XML.

Make sure you at least configure idpList in /etc/php-saml-sp/config.php with the list of IdPs that have access to this SP. If you don’t do this, all IdPs found in the metadata will be allowed access.

To test your SP/IdP configuration, go to https://vpn.example.org/php-saml-sp/ and use the “Test” button.

You can look here if you want all details on how to (properly) configure IdP metadata, including dynamic refresh.

Configuring the VPN Service#

The configuration is done through /etc/vpn-user-portal/config.php.

Set the authModule option:

'authModule' => 'PhpSamlSpAuthModule',

Now the PhpSamlSpAuthModule specific options can be set as well:

'PhpSamlSpAuthModule' => [
    'userIdAttribute' => 'eduPersonTargetedID',
    //'userIdAttribute' => 'eduPersonPrincipalName',

    //'permissionAttributeList' => [
    //      'eduPersonEntitlement',
    //      'eduPersonAffiliation',
    //],

    // AuthnContext required for *all* users
    //'authnContext' => ['urn:oasis:names:tc:SAML:2.0:ac:classes:TimesyncToken'],
],

The permissionAttributeList option contains attribute(s) that will be used for authorization in the VPN server, see Permissions for more information.

The authnContext will request the specified AuthnContext of the IdP, this is to trigger for example MFA/2FA. It integrates with SURFsecureID as well. Setting authnContext means this context will be required for ALL users.