You are here

README.txt in SAML Service Provider 7.8

SAML Service Provider
=====================

This package provides two modules:
- SAML Service Provider API
- SAML Drupal Login


The API module lets other modules leverage SAML authentication.

The SAML Drupal Login module specifically enables Drupal to become a "Service
Provider" for an IDP, so users can authenticate to Drupal (without entering a
username or password) by delegating authenticate to a SAML IDP (Identity
Provider).


Dependencies
============
Drupal module ctools http://drupal.org/project/ctools

Requires the OneLogin SAML-PHP toolkit, downloaded to your 'libraries' folder:

'cd libraries'
'git clone https://github.com/onelogin/php-saml.git .'

So that the folder structure looks like this when it comes to lib folder
- libraries
  - php-saml
    ...
    - lib
      - Saml
      - Saml2
        - Auth.php
        ...


SimpleSamlPHP Configuration
===========================

First, configure your IdP in Drupal:
Note: Multiple IdPs can be configured, but only one is chosen to be used for the
Drupal login. This is good for development purposes, because different
environments (local, development, staging, production etc.) can be configured
with different App names and exported to code with Features. Then each
environment chooses a different IdP configuration for the Drupal login.

Name = Human readable name for IdP.

App Name: will be used in the IdP configuration. For example
"demoLocalDrupal".

NameID field: this defaults to user mail and works for most configurations. In
that case the IdP is configure to use email address for NameID.
But if you need to support changing email on the IdP, then you need to add
a custom field to user profile and then choose that field here. It is
recommended to use "Hidden Field Widgets" module (https://www.drupal.org/project/hidden_field)
for that field so that users don't need to worry about it, ever.

IDP Login URL: e.g. http:///myIdp.example.com/simplesaml/saml2/idp/SSOService.php
IDP Logout URL: e.g. http:///myIdp.example.com/simplesaml/saml2/idp/SingleLogoutService.php

x.509 certificate: Should correspond to the "certificate" field in
saml20-idp-hostd.php

Here's a sample config for saml20-sp-remote.php (when email is used for NameID):

$metadata['demoLocalDrupal'] = array(
'AssertionConsumerService' => 'http://mydrupal.example.com/drupal7/?q=saml/consume',
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:email',
'simplesaml.nameidattribute' => 'uid',
'simplesaml.attributes' => FALSE,
);

Usage
=====

When everything is set and ready to go, the process begins from
http://www.yoursite.com/saml/drupal_login

A returnTo parameter can be appended to the url, if you want to redirect
the user somewhere else than the front page after login. For example the user
profile page http://www.yoursite.com/saml/drupal_login?returnTo=user

The login block and user login form will show a link with
"Log in using Single Sign-On" text on it. The user login page will return the
user to the profile page and the login block will return the user to the same page
where the login process was started from.

File

README.txt
View source
  1. SAML Service Provider
  2. =====================
  3. This package provides two modules:
  4. - SAML Service Provider API
  5. - SAML Drupal Login
  6. The API module lets other modules leverage SAML authentication.
  7. The SAML Drupal Login module specifically enables Drupal to become a "Service
  8. Provider" for an IDP, so users can authenticate to Drupal (without entering a
  9. username or password) by delegating authenticate to a SAML IDP (Identity
  10. Provider).
  11. Dependencies
  12. ============
  13. Drupal module ctools http://drupal.org/project/ctools
  14. Requires the OneLogin SAML-PHP toolkit, downloaded to your 'libraries' folder:
  15. 'cd libraries'
  16. 'git clone https://github.com/onelogin/php-saml.git .'
  17. So that the folder structure looks like this when it comes to lib folder
  18. - libraries
  19. - php-saml
  20. ...
  21. - lib
  22. - Saml
  23. - Saml2
  24. - Auth.php
  25. ...
  26. SimpleSamlPHP Configuration
  27. ===========================
  28. First, configure your IdP in Drupal:
  29. Note: Multiple IdPs can be configured, but only one is chosen to be used for the
  30. Drupal login. This is good for development purposes, because different
  31. environments (local, development, staging, production etc.) can be configured
  32. with different App names and exported to code with Features. Then each
  33. environment chooses a different IdP configuration for the Drupal login.
  34. Name = Human readable name for IdP.
  35. App Name: will be used in the IdP configuration. For example
  36. "demoLocalDrupal".
  37. NameID field: this defaults to user mail and works for most configurations. In
  38. that case the IdP is configure to use email address for NameID.
  39. But if you need to support changing email on the IdP, then you need to add
  40. a custom field to user profile and then choose that field here. It is
  41. recommended to use "Hidden Field Widgets" module (https://www.drupal.org/project/hidden_field)
  42. for that field so that users don't need to worry about it, ever.
  43. IDP Login URL: e.g. http:///myIdp.example.com/simplesaml/saml2/idp/SSOService.php
  44. IDP Logout URL: e.g. http:///myIdp.example.com/simplesaml/saml2/idp/SingleLogoutService.php
  45. x.509 certificate: Should correspond to the "certificate" field in
  46. saml20-idp-hostd.php
  47. Here's a sample config for saml20-sp-remote.php (when email is used for NameID):
  48. $metadata['demoLocalDrupal'] = array(
  49. 'AssertionConsumerService' => 'http://mydrupal.example.com/drupal7/?q=saml/consume',
  50. 'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:email',
  51. 'simplesaml.nameidattribute' => 'uid',
  52. 'simplesaml.attributes' => FALSE,
  53. );
  54. Usage
  55. =====
  56. When everything is set and ready to go, the process begins from
  57. http://www.yoursite.com/saml/drupal_login
  58. A returnTo parameter can be appended to the url, if you want to redirect
  59. the user somewhere else than the front page after login. For example the user
  60. profile page http://www.yoursite.com/saml/drupal_login?returnTo=user
  61. The login block and user login form will show a link with
  62. "Log in using Single Sign-On" text on it. The user login page will return the
  63. user to the profile page and the login block will return the user to the same page
  64. where the login process was started from.