README

OneLogin SAML Bundle for Symfony. (https://github.com/onelogin/php-saml)

安装

使用composer安装

"require": {
    "ae/oneloginsaml-bundle": "dev-master"
}

运行composer update

composer update ae/oneloginsaml-bundle

在app/AppKernel.php中启用bundle

$bundles = array(
    // ...
    new AE\OneLoginSamlBundle\AEOneLoginSamlBundle(),
)

配置

在app/config/config.yml中配置SAML元数据。更多信息请查看https://github.com/onelogin/php-saml#settings。

ae_one_login_saml:
    # default is the config name, but can be anything. This is used in firewall and route config
    default:
        # Basic settings
        idp:
            entityId: 'http://id.example.com/saml2/idp/metadata.php'
            singleSignOnService:
                url: 'http://id.example.com/saml2/idp/SSOService.php'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
            singleLogoutService:
                url: 'http://id.example.com/saml2/idp/SingleLogoutService.php'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
            x509cert: ''
        sp:
            entityId: 'http://myapp.com/app_dev.php/saml/metadata'
            assertionConsumerService:
                url: 'http://myapp.com/app_dev.php/saml/acs'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
            singleLogoutService:
                url: 'http://myapp.com/app_dev.php/saml/logout'
                binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
        # Optional settings
        security:
            nameIdEncrypted:       false
            authnRequestsSigned:   false
            logoutRequestSigned:   false
            logoutResponseSigned:  false
            wantMessagesSigned:    false
            wantAssertionsSigned:  false
            wantNameIdEncrypted:   false
            requestedAuthnContext: true
            signMetadata: false
            wantXMLValidation: true
            signatureAlgorithm: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
            digestAlgorithm: 'http://www.w3.org/2000/09/xmldsig#sha1'
        contactPerson:
            technical:
                givenName: 'Tech User'
                emailAddress: 'techuser@example.com'
            support:
                givenName: 'Support User'
                emailAddress: 'supportuser@example.com'
        organization:
            en:
                name: 'Example'
                displayname: 'Example'
                url: 'http://example.com'

如果您不想设置contactPerson或organization，请勿添加这些参数，而不是留空。

在app/config/security.yml中配置防火墙和用户提供者

security:
    # ...

    providers:
        saml_provider:
            # Basic provider instantiates a user with default roles
            saml:
                user_class: 'AppBundle\Entity\User'
                default_roles: ['ROLE_USER']

    firewalls:
        app:
            pattern:    ^/
            anonymous: true
            saml:
                # Tell the firewall which SAML config to use, defaults to 'default'
                config: default
                # Match SAML attribute 'uid' with username.
                # Uses getNameId() method by default.
                username_attribute:
                check_path: /saml/default/acs
                login_path: /saml/default/login
            logout:
                # Path should be /saml/[CONFIG NAME]/logout
                path: /saml/default/logout

    access_control:
        - { path: ^/saml/default/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/saml/default/metadata, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/, roles: ROLE_USER }

编辑app/config/routing

ae_saml_sp:
    resource: "@AEOneLoginSamlBundle/Resources/config/routing.yml"

将SAML属性注入到User对象中（可选）

您的用户类必须实现SamlUserInterface

<?php

namespace AppBundle\Entity;

use AE\OneLoginSamlBundle\Security\User\SamlUserInterface;

class User implements SamlUserInterface
{
    protected $username;
    protected $email;

    // ...

    public function setSamlAttributes(array $attributes)
    {
        $this->email = $attributes['mail'][0];
    }
}

然后您可以从用户对象中获取属性

$email = $this->getUser()->getEmail();

与经典登录表单集成

通过编辑security.yml，您可以集成SAML身份验证与传统的登录表单

security:
    providers:
        user_provider:
            # Loads user from user repository
            entity:
                class: AppBundle:User
                property: username

    firewalls:
        default:
            anonymous: ~
            saml:
                # Tell the firewall which SAML Config you want to use (defaults to 'default')
                config: default
                username_attribute: uid
                # No need to specify check_path and login_path, they're set based on config name
                failure_path: /login
                always_use_default_target_path: true

            # Traditional login form
            form_login:
                login_path: /login
                check_path: /login_check
                always_use_default_target_path: true

            logout:
                path: /saml/default/logout

然后您可以在登录页面中添加一个链接到路由saml_login，以启动SAML登录。

    <a href="{{ path('saml_login', {saml: 'default'}) }}">SAML Login</a>

即时用户供应（可选）

当用户提供者找不到用户时，您可以设置一个用户工厂来创建一个新的用户映射SAML属性。

在security.yml中编辑防火墙设置

firewalls:
    default:
        anonymous: ~
        saml:
            # Tell the firewall which config to use (default is the default)
            config: default
            username_attribute: uid
            # User factory service
            user_factory: my_user_factory
            # Persist new user. Doctrine is required.
            persist_user: true
        logout:
            path: /saml/logout

通过编辑services.yml创建用户工厂服务

services:
    my_user_factory:
        class: AE\OneLoginSamlBundle\Security\User\SamlUserFactory
        arguments:
            # User class
            - AppBundle\Entity\User
            # Attribute mapping.
            - password: 'notused'
              email: $mail
              name: $cn
              lastname: $sn
              roles: ['ROLE_USER']

带有'$'引用SAML属性值的字段。

或者您可以创建自己的User Factory，该工厂实现SamlUserFactoryInterface

<?php

namespace AppBundle\Security;

use AppBundle\Entity\User;
use AE\OneLoginSamlBundle\Security\Authentication\Token\SamlTokenInterface;
use AE\OneLoginSamlBundle\Security\User\SamlUserFactoryInterface;

class UserFactory implements SamlUserFactoryInterface
{
    public function createUser(SamlTokenInterface $token)
    {
        $attributes = $token->getAttributes();
        $user = new User();
        $user->setRoles(array('ROLE_USER'));
        $user->setUsername($token->getUsername());
        $user->setPassword('notused');
        $user->setEmail($attributes['mail'][0]);
        $user->setName($attributes['cn'][0]);

        return $user;
    }
}

services:
    my_user_factory:
        class: AppBundle\Security\UserFactory