Revision as of 11:24, 14 July 2026 by Robert Vogel (talk | contribs)
Create the following files and folders within your $DATADIR
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php
Add the following content to the files
saml-sp-metadata.php
<?php
#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp
# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp
$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );
$metadata = [];
foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
saml-sp-metadata.php
<?php
#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp
# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp
$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );
$metadata = [];
foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
saml-users.php
<?php
// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php
$pass = getenv( 'DB_ROOT_PASS' );
$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',
"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];
In your docker-compose.override.yml add
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
After
Within your $CODEDIR, create a new file
settings.d/099-SAML-dev.local.php
<?php
$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'username',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]
];
};
