Development/SAML 2.0 IdP

Create the following files and folders within your $DATADIR

└── saml-idp
    ├── saml-config.php
    ├── saml-sp-metadata.php
    └── saml-users.php

Add the following content to the files

saml-sp-metadata.php

<?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
	$spParts = explode( '###', $spHostAndName );
	$spHost = $spParts[0];
	$spName = $spParts[1];
	$metadata["https://$spHost"] = array(
		'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
		'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
	);
}

saml-sp-metadata.php

<?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
	$spParts = explode( '###', $spHostAndName );
	$spHost = $spParts[0];
	$spName = $spParts[1];
	$metadata["https://$spHost"] = array(
		'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
		'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
	);
}

saml-users.php

<?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
	'admin' => [
		'core:AdminPassword',
	],
	'example-userpass' => [
		// First element must be a string which identifies the authentication source.
		'exampleauth:UserPass',

		"alice@example.invalid:$pass" => [
			'username' => [ 'alice@example.invalid' ],
			'name' => [ 'Alice' ],
			'email' => [ 'alice@example.invalid' ],
			'groups' => [ 'wiki-contributor', 'wiki-admin' ]
		],
		"bob@example.invalid:$pass" => [
			'username' => [ 'bob@example.invalid' ],
			'name' => [ 'Bob' ],
			'email' => [ 'bob@example.invalid' ],
			'groups' => [ 'wiki-contributor' ]
		],
		"charlie@example.invalid:$pass" => [
			'username' => [ 'charlie@example.invalid' ],
			'name' => [ 'Charlie' ],
			'email' => [ 'charlie@example.invalid' ],
			'groups' => [ 'wiki-admin' ]
		]
	],
];

In your docker-compose.override.yml add

  samlidp:
    image: kristophjunge/test-saml-idp
    container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
    volumes:
      - ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
      - ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
      - ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
    environment:
      VIRTUAL_HOST: ${WIKI_HOST}
      VIRTUAL_PATH: /_samlidp/
      VIRTUAL_PORT: 8080
      VIRTUAL_DEST: /
      DEV_SHARED_IDP_HOST: ${WIKI_HOST}
      DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
    restart: no

After

Within your $CODEDIR, create a new file

settings.d/099-SAML-dev.local.php

<?php

$GLOBALS['wgExtensionFunctions'][] = function () {
	$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
	$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
		'plugin' => 'SimpleSAMLphp',
		'data' => [
			'authSourceId' => 'default-sp',
			'usernameAttribute' => 'username',
			'realNameAttribute' => 'name',
			'emailAttribute' => 'email'
		],
		'groupsyncs' => [
			[
				'type' => 'mapped',
					'map' => [
						'editor' => [
							'groups' => 'wiki-contributor'
						],
						'sysop' => [
							'groups' => 'wiki-admin'
						]
					]
			]
		]

	];
};

PDF exclude - start

---

To submit feedback about this documentation, visit our community forum.

PDF exclude - end