miniOrange SAML SSO

This module provides secure access to Drupal for enterprises and full control over access of applications, Single Sign On (SSO) into Drupal with one set of login credentials.

Why should you pick our Drupal plugin over other plugins that are available?

  • The most extensive range of 2 factor authentication methods
  • A single sign on service for 3000+ apps (whether they are standards based or not), besides Drupal, like Google apps, Salesforce etc.
  • A fraud prevention service that lets you define trusted devices, location, time of access and other parameters that are extensive
  • All the above bundled together and available instantly to you as a cloud service
  • REST APIs that can be called from anywhere anytime
  • Secure login APIs using standards such as SAML and OpenID Connect
  • APIs for Single Sign on, 2 Factor Authentication and Fraud Prevention for Any App
  • Plugin based login for non standard apps
  • Admin dashboard to manage your account
  • Self service dashboard for letting end users manage their profiles
  • Customization for look and feel and functionality

Project link: miniOrange sandbox

Git clone command: git clone --branch 7.x-1.1 http://git.drupal.org/sandbox/miniorange/2498147.git miniorange_saml_sso
cd miniorange_saml_sso

CommentFileSizeAuthor
d7miniorangesamlsso.zip29.76 KBminiOrange

Comments

rutel95’s picture

rutel95
Primary language Russian
Location Wroclaw
commented

Automated Review

Please add the project to the repository drupal.

Manual Review

Individual user account
Yes: Follows the guidelines for individual user accounts.
No duplication
Yes: Does not cause module duplication and/or fragmentation.
Master Branch
No: Does not follow the guidelines for master branch.
Licensing
Yes: Follows the licensing requirements.
3rd party assets/code
Yes: Follows the guidelines for 3rd party assets/code.
README.txt/README.md
No: Does not follow the guidelines for in-project documentation and/or the README Template.
Add please CONTENTS OF THIS FILE.
Code long/complex enough for review
No: Does not follow the guidelines for project length and complexity.
Secure code
Yes: Meets the security requirements.
Coding style & Drupal API usage
[List of identified issues in no particular order. Use (*) and (+) to indicate an issue importance. Replace the text below by the issues themselves:
  1. (*) Please see https://www.drupal.org/coding-standards, add hook_uninstall() and there write delete variables saml_idp_*.
    Folder sal2 rename to includes. Please add access callback for page module.
  2. ...]

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

rutel95’s picture

rutel95
Primary language Russian
Location Wroclaw
commented
Status: Needs review » Needs work
miniOrange’s picture

miniOrange commented
Issue summary: View changes
Status: Needs work » Needs review

Did changes for resolving the issues listed in the review. Please review.

pravin ajaaz’s picture

pravin ajaaz commented
Issue tags: +PAreview: security

Manual Review

1. In miniorange_samlauth_menu() for all menu items you have given access callback => TRUE . So even anonymous user can access the page. It's a security vulnerability. (I think you have created a permission "config saml" but didn't used it. Please make use of it)

2. Try to format the code so that it could be more readable for other developers including comments. (make use of PAReview)

3. Delete all unused variables.

pravin ajaaz’s picture

pravin ajaaz commented
Status: Needs review » Needs work
miniOrange’s picture

miniOrange commented

The issues listed in previous review are resolved. Please review.

miniOrange’s picture

miniOrange commented
Status: Needs work » Needs review

The issues listed in previous review are resolved. Please review.

PA robot’s picture

PA robot commented
Status: Needs review » Needs work

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxminiorange2498147git

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

PA robot’s picture

PA robot commented
Status: Needs work » Closed (won't fix)

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

tr’s picture

tr commented

This does NOT appear to be an individual user account - it seems to be a company account. If you reopen this issue, this must be addressed.

Likewise, xmlseclibs.php is NOT GPL, so it cannot be included in the Drupal repository. This also must be addressed if you intend to publish this module.