Hi,

At our company, we had to implement an SP to accept more than one idP. We developed a solution and are sharing the code via github. We would love to be able to contribute this version of the module. Maybe it can be integrated in a future release? We are still adapting the code for a broader audience.

We changed many files and approaches of the code; therefore we think it might not make sense to create just simple diffs. This module provides a OO approach and a seamlessly deep linking integration.

Comments

angel.angelio created an issue. See original summary.

angel.angelio’s picture

angel.angelio commented
Assigned: angel.angelio » Unassigned
snufkin’s picture

snufkin commented
Status: Active » Closed (duplicate)

I think this may be a duplicate of #2479301: WSOD on _simplesaml_auth_autoload() if simplesaml's autoload found, but cannot be loaded

snufkin’s picture

snufkin commented
Status: Closed (duplicate) » Active

Sorry, wrong issue

snufkin’s picture

snufkin commented

The idea may be valid, but a major rewrite could only be done in 4.x as we are still working on 3.x to ensure it works well enough to publish a stable version for 7.x. Given that there is also work invested in the 8.x-3.x version I don't think we will have enough resources to incorporate your changes into these branches in the near future.

Stevel’s picture

Stevel commented

I don't believe this is a problem with the current version, since the IdP-handling stuff is already handled by Simplesamlphp? What am I missing here?

angel.angelio’s picture

angel.angelio commented

Yes, Simplesamlphp handles multiple-IdP stuff. However, that fact is based on the premise that all your customers use the same SAML attributes and that you do not mind letting the N user being able to pick her idP (if they know their idP's name) from a Select Box. https://drive.google.com/file/d/0B2Gbx7wahX75aXV5MUMyWDZDa00/view?usp=sh...

This version of the module lets you configure custom attributes per idP. For example: on auto-provisioning users, not all your customers might use the 'email' attribute as their unique identifier https://drive.google.com/file/d/0B2Gbx7wahX75dDZqR05sNGpoa28/view?usp=sh.... The latter provides the following features:

-If Drupal detects a SSO user on the login box she is taken to her idP or logged in automatically (if there's a SP/idP session)
-There's deep linking integration per customer/idP
-Updates to any user's attributes (from any idP) will be reflected in Drupal (i.e. an idP updates a user's first name; then, the module will update user's fields as needed https://drive.google.com/file/d/0B2Gbx7wahX75UjlaSHNrLTgxa0E/view?usp=sh...).

Anonymous’s picture

Anonymous (not verified) commented

Another change we did that we consider important to mention is the fact that we change the use of global variables for an object using a single factory method that is able to keep the same instance alive for the execution of the script. (Also using cookies)

This object allow us to have multiple users and multiple IDPs at the same time because the object encapsulates the behavior of the SAML process for each user and it also allows to execute some custom tasks after the user was succesfully authenticated on the IDP, for example after we authenticate the user and created the account we also map additional attributes to an external ERP to have a more complete sign up process.

It also allowed us to extend the functionality already provided by both the module and the library, we feel the obligation to share these changes with the community since the module worked as a start point for us to execute a more complete SSO process.

escuriola’s picture

escuriola commented

Hello, I'm using this approach, and I have two questions.

- I have a problem with the customer_id attribute, is missing and I don't know where is supossed to be configured, but this line in the .inc file:

if(NULL !== $simplesamlphp_authsource && isset($simplesamlphp_authsource->user_customer_id)) {
...

avoid me to create or login users. I force this user_customer_id with the same value of the drupal sp id I'm using to solve this temporally.

- The second question is that the global $_simplesamlphp_auth_saml_attributes is always empty in all the user hooks (user presave, login, create, update...). How is the best way to get the user federated fields? I'm initializing the saml and using the getAuthSourceAttributes() method.

Thanks in advance!!

snufkin’s picture

snufkin commented

By this approach do you mean you are using multiple IdPs?

In any case, there should be no need to change the code to customise the module for a particular IdP. All configuration should take place either on the IdP level, or in the simplesamlphp library itself.

For the remaining questions I'd like to ask you to open a separate ticket, this one should be reserved for the discussion around multiple IdP support.

angel.angelio’s picture

angel.angelio commented

@escuriola FYI the module lives at this github repo. That issue was solved a while ago, sorry for not replying soon enough.

Cheers.

Stevel’s picture

Stevel commented

I agree with snufkin that multiple IdPs should be configured in the simplesamlphp library.

Yes, Simplesamlphp handles multiple-IdP stuff. However, that fact is based on the premise that all your customers use the same SAML attributes

Most IdPs will use a fairly standard set of attributes (e.g. eduPerson), however, you can still rename/rewrite/do whatever with the attributes in the simplesaml SP config, either globally per SP/IdP. See https://simplesamlphp.org/docs/1.5/simplesamlphp-authproc#section_2_3

and that you do not mind letting the N user being able to pick her idP (if they know their idP's name) from a Select Box.

Yes, they should know their IdP ('home institution'). You could use pretty-print display names and/or logo's on the WAYF to help them recognise this.

Stevel’s picture

Stevel commented
Category: Task » Support request
Status: Active » Closed (works as designed)

Closing this as 'works as designed', since multiple IdP are effectively supported.

johnbarclay’s picture

johnbarclay commented

This is still not implemented in Drupal 8 version. The comment using the term "essentially" eludes me. The configuration screens themselves only configure one Idp, so its obvious that multiple idps aren't supported. The shibboleth modules for Drupal are the same.

The language seems to be the issue. Here is my attempt at clarifying this:

- Support for multiple authentication protocols. This is ambiguous and is in the modules description and should be updated.
- Support for many authentication protocols, but only one per Drupal site. This means site admin can pick a single Idp with a single protocol and configuree and use it. This is what is implemented.
- Support for multiple authentication protocols within a Drupal site. This means the site admin can pick and configure more than one Idp for the site. The end user can with select the idp from a pull down or list of urls.

When I rewrote the LDAP module for Drupal 7, I changed it to allow for multiple LDAPs. Took some work but solved many issues.

A workaround is to install one SAML framework for each idp (e.g. install shibboleth, simplesamlphp, and their accompanying modules). With this approach using simplesaml_auth, shib auth, minorange saml, etc you could have 5 or 6 idps. Of course, that is a ridiculous approach.