Newer
Older
IdP remote metadata reference
=============================
This is a reference for metadata options available for `metadata/saml20-idp-remote.php` and `metadata/shib13-idp-remote.php`. Both files have the following format:
<?php
/* The index of the array is the entity ID of this IdP. */
$metadata['entity-id-1'] = array(
/* Configuration options for the first IdP. */
);
$metadata['entity-id-2'] = array(
/* Configuration options for the second IdP. */
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
Common options
--------------
The following options are common between both the SAML 2.0 protocol and Shibboleth 1.3 protocol:
`authproc`
: Used to manipulate attributes, and limit access for each IdP. See the [authentication processing filter manual](http://rnd.feide.no/content/authentication-processing-filters-simplesamlphp).
`base64attributes`
: Whether attributes received from this IdP should be base64 decoded. The default is `FALSE`.
`caFile`
: Alternative to specifying a certificate. Allows you to specify a file with root certificates, and responses from the service be validated against these certificates. Note that simpleSAMLphp doesn't support chains with any itermediate certificates between the root and the certificate used to sign the response.
`certData`
: The base64 encoded certificate for this IdP. This is an alternative to storing the certificate in a file on disk and specifying the filename in the `certificate`-option.
`certFingerprint`
: If you only need to validate signatures received from this IdP, you can specify the certificate fingerprint instead of storing the full certificate. To obtain this, you can enter a bogus value, and attempt to log in. You will then receive an error message with the correct fingerprint.
: It is also possible to add an array of valid fingerprints, where any fingerprints in that array is accepted as valid. This can be used to update the certificate of the IdP without having to update every SP at that exact time. Instead, one can update the SPs with the new fingerprint, and only update the certificate after every SP is updated.
`certificate`
: The file with the certificate for this IdP. The path is relative to the `cert`-directory.
`description`
: A description of this IdP. Will be used by various modules when they need to show a description of the IdP to the user.
: This option can be translated into multiple languages in the same way as the `name`-option.
`icon`
: A logo which will be shown next to this IdP in the discovery service.
`name`
: The name of this IdP. Will be used by various modules when they need to show a name of the SP to the user.</p>
: This option can be translated into multiple languages by specifying the value as an array of language-code to translated name:
'name' => array(
'en' => 'A service',
'no' => 'En tjeneste',
),
`SingleSignOnService`
: Endpoint URL for sign on. You should obtain this from the IdP. For SAML 2.0, simpleSAMLphp will use the HTTP-Redirect binding when contacting this endpoint.
SAML 2.0 options
----------------
The following SAML 2.0 options are available:
`saml2.relaxvalidation`
: Can be used to relax some parts of the validation of assertions received from this IdP. This is an array, and can include one or more of the following flags:
- `unknowncondition` - Disables errors when encountering unknown <Condition> nodes.
- `nosubject` - Ignore missing <Subject> in <Assertion>.
- `noconditions` - Ignore missing <Conditions> in <Assertion>.
- `noauthnstatement` - Ignore missing <AuthnStatement> in <Assertion>.
- `noattributestatement` - Ignore missing <AttributeStatement> in <Assertion>.
`SingleLogoutService`
: Endpoint URL for logout requests and responses. You should obtain this from the IdP. Users who log out from your service is redirected to this URL with the LogoutRequest using HTTP-REDIRECT.
`SingleLogoutServiceResponse`
: Endpoint URL for logout responses. Overrides the `SingleLogoutService`-option for responses.
`SPNameQualifier`
: This corresponds to the SPNameQualifier in the SAML 2.0 specification. It allows to give subjects a SP specific namespace. This option is rarely used, so if you don't need it, leave it out. When left out, simpleSAMLphp assumes the entityID of your SP as the SPNameQualifier.
### Decrypting assertions
It is possible to decrypt the assertions received from an IdP. Currently the only algorithm supported is `AES128_CBC` or `RIJNDAEL_128`.
There are two modes of encryption supported by simpleSAMLphp. One is symmetric encryption, in which case both the SP and the IdP needs to share a key. The other mode is the use of public key encryption. In that mode, the public key of the SP is extracted from the certificate of the SP.
`assertion.encryption`
: Whether assertions received from this IdP must be encrypted. The default value is `FALSE`.
If this option is set to `TRUE`, assertions from the IdP must be encrypted.
Unencrypted assertions will be rejected.
: Note that this option overrides the option with the same name in the SP configuration.
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
`sharedkey`
: Symmetric key which should be used for decryption. This should be a 128-bit key. If this option is not specified, public key encryption will be used instead.
### Fields for signing and validating messages
simpleSAMLphp only signs authentication responses by default. Signing of authentication request, logout requests and logout responses can be enabled by setting the `redirect.sign` option. Validation of received messages can be enabled by the `redirect.validate` option.
These options overrides the options set in `saml20-sp-hosted`.
`redirect.sign`
: Whether authentication request, logout requests and logout responses sent to this IdP should be signed. The default is `FALSE`.
`redirect.validate`
: Whether logout requests and logout responses received from this IdP should be validated. The default is `FALSE`.
**Example: Configuration for validating messages**
'redirect.validate' => TRUE,
'certificate' => 'server.crt',
Shibboleth 1.3 options
----------------------
`saml1.useartifact`
: Request that the IdP returns the result to the artifact binding.
The default is to use the POST binding, set this option to TRUE to use the artifact binding instead.
: This option can be set for all IdPs connected to a SP by setting it in the entry for the SP in `config/authsources.php`.
: *Note*: This option only works with the `saml:SP` authentication source.
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
Examples
--------
### Configuration for openidp.feide.no ###
<?php
$metadata['https://openidp.feide.no'] = array(
'name' => array(
'en' => 'Feide OpenIdP - guest users',
'no' => 'Feide Gjestebrukere',
),
'description' => 'Here you can login with your account on Feide RnD OpenID. If you do not already have an account on this identity provider, you can create a new one by following the create new account link and follow the instructions.',
'SingleSignOnService' => 'https://openidp.feide.no/simplesaml/saml2/idp/SSOService.php',
'SingleLogoutService' => 'https://openidp.feide.no/simplesaml/saml2/idp/SingleLogoutService.php',
'certFingerprint' => 'c9ed4dfb07caf13fc21e0fec1572047eb8a7a4cb',
);
Calculating the fingerprint of a certificate
--------------------------------------------
If you have obtained a certificate file, and want to calculate the fingerprint of the file, you can use the `openssl` command:
$ openssl x509 -noout -fingerprint -in "server.crt"
SHA1 Fingerprint=AF:E7:1C:28:EF:74:0B:C8:74:25:BE:13:A2:26:3D:37:97:1D:A1:F9
In this case, the certFingerprint option should be set to `AF:E7:1C:28:EF:74:0B:C8:74:25:BE:13:A2:26:3D:37:97:1D:A1:F9`.