From e33017b881ca3ebc77397916d9582b810cdb70df Mon Sep 17 00:00:00 2001 From: tvdijen Date: Thu, 26 Oct 2023 07:22:03 +0000 Subject: [PATCH] deploy: e3dcfb2b51e5c8e4c312bcb5ea540429120da9b5 --- 1.19/core/authproc_attributeadd.html | 7 +- 1.19/core/authproc_attributealter.html | 7 +- 1.19/core/authproc_attributecopy.html | 7 +- 1.19/core/authproc_attributelimit.html | 7 +- 1.19/core/authproc_attributemap.html | 7 +- 1.19/core/authproc_attributerealm.html | 7 +- 1.19/core/authproc_attributevaluemap.html | 7 +- 1.19/core/authproc_cardinality.html | 7 +- 1.19/core/authproc_cardinalitysingle.html | 7 +- 1.19/core/authproc_generategroups.html | 7 +- 1.19/core/authproc_languageadaptor.html | 7 +- 1.19/core/authproc_php.html | 7 +- 1.19/core/authproc_scopeattribute.html | 7 +- 1.19/core/authproc_scopefromattribute.html | 7 +- .../authproc_statisticswithattribute.html | 7 +- 1.19/core/authproc_targetedid.html | 7 +- 1.19/core/authproc_warnshortssointerval.html | 7 +- 1.19/cron/cron.html | 7 +- 1.19/index.html | 7 +- 1.19/multiauth/multiauth.html | 7 +- 1.19/saml/authproc_authncontextclassref.html | 7 +- ...authproc_expectedauthncontextclassref.html | 7 +- 1.19/saml/filterscopes.html | 7 +- 1.19/saml/keyrollover.html | 7 +- 1.19/saml/nameid.html | 7 +- 1.19/saml/nameidattribute.html | 7 +- 1.19/saml/sp.html | 7 +- 1.19/simplesamlphp-advancedfeatures.html | 7 +- 1.19/simplesamlphp-artifact-idp.html | 7 +- 1.19/simplesamlphp-artifact-sp.html | 7 +- 1.19/simplesamlphp-authproc.html | 7 +- 1.19/simplesamlphp-authsource.html | 7 +- 1.19/simplesamlphp-changelog.html | 7 +- 1.19/simplesamlphp-customauth.html | 7 +- 1.19/simplesamlphp-database.html | 7 +- 1.19/simplesamlphp-ecp-idp.html | 7 +- 1.19/simplesamlphp-errorhandling.html | 7 +- 1.19/simplesamlphp-googleapps.html | 7 +- 1.19/simplesamlphp-hok-idp.html | 7 +- 1.19/simplesamlphp-hok-sp.html | 7 +- 1.19/simplesamlphp-idp-more.html | 7 +- 1.19/simplesamlphp-idp.html | 7 +- 1.19/simplesamlphp-install-repo.html | 7 +- 1.19/simplesamlphp-install.html | 7 +- 1.19/simplesamlphp-maintenance.html | 7 +- 1.19/simplesamlphp-metadata-endpoints.html | 7 +- ...amlphp-metadata-extensions-attributes.html | 7 +- ...simplesamlphp-metadata-extensions-rpi.html | 7 +- .../simplesamlphp-metadata-extensions-ui.html | 7 +- ...plesamlphp-metadata-pdostoragehandler.html | 7 +- 1.19/simplesamlphp-modules.html | 7 +- 1.19/simplesamlphp-nostate.html | 7 +- 1.19/simplesamlphp-reference-idp-hosted.html | 7 +- 1.19/simplesamlphp-reference-idp-remote.html | 7 +- 1.19/simplesamlphp-reference-sp-remote.html | 7 +- 1.19/simplesamlphp-scoping.html | 7 +- 1.19/simplesamlphp-sp-api.html | 7 +- 1.19/simplesamlphp-sp.html | 7 +- 1.19/simplesamlphp-theming.html | 7 +- 1.19/simplesamlphp-translation.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.10.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.11.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.12.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.13.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.14.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.15.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.16.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.17.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.18.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.19.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.5.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.6.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.7.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.8.html | 7 +- 1.19/simplesamlphp-upgrade-notes-1.9.html | 7 +- 1.19/simplesamlphp-upgrade-notes.html | 7 +- 2.0/core/authproc_attributeadd.html | 7 +- 2.0/core/authproc_attributealter.html | 7 +- 2.0/core/authproc_attributecopy.html | 7 +- 2.0/core/authproc_attributelimit.html | 7 +- 2.0/core/authproc_attributemap.html | 7 +- 2.0/core/authproc_attributevaluemap.html | 7 +- 2.0/core/authproc_cardinality.html | 7 +- 2.0/core/authproc_cardinalitysingle.html | 7 +- 2.0/core/authproc_generategroups.html | 7 +- 2.0/core/authproc_languageadaptor.html | 7 +- 2.0/core/authproc_php.html | 7 +- 2.0/core/authproc_scopeattribute.html | 7 +- 2.0/core/authproc_scopefromattribute.html | 7 +- .../authproc_statisticswithattribute.html | 7 +- 2.0/core/authproc_targetedid.html | 7 +- 2.0/core/authproc_warnshortssointerval.html | 7 +- 2.0/core/authsource_selector.html | 7 +- 2.0/cron/cron.html | 7 +- 2.0/index.html | 7 +- 2.0/multiauth/multiauth.html | 7 +- 2.0/saml/authproc_authncontextclassref.html | 7 +- ...authproc_expectedauthncontextclassref.html | 7 +- 2.0/saml/authproc_pairwiseid.html | 7 +- 2.0/saml/authproc_subjectid.html | 7 +- 2.0/saml/filterscopes.html | 7 +- 2.0/saml/keyrollover.html | 7 +- 2.0/saml/nameid.html | 7 +- 2.0/saml/nameidattribute.html | 7 +- 2.0/saml/sp.html | 7 +- 2.0/simplesamlphp-advancedfeatures.html | 7 +- 2.0/simplesamlphp-artifact-idp.html | 7 +- 2.0/simplesamlphp-artifact-sp.html | 7 +- 2.0/simplesamlphp-authproc.html | 7 +- 2.0/simplesamlphp-authsource.html | 7 +- 2.0/simplesamlphp-changelog-1.x.html | 7 +- 2.0/simplesamlphp-changelog.html | 7 +- 2.0/simplesamlphp-customauth.html | 7 +- 2.0/simplesamlphp-database.html | 7 +- 2.0/simplesamlphp-ecp-idp.html | 7 +- 2.0/simplesamlphp-errorhandling.html | 7 +- 2.0/simplesamlphp-googleapps.html | 7 +- 2.0/simplesamlphp-hok-idp.html | 7 +- 2.0/simplesamlphp-hok-sp.html | 7 +- 2.0/simplesamlphp-idp-more.html | 7 +- 2.0/simplesamlphp-idp.html | 7 +- 2.0/simplesamlphp-install-repo.html | 7 +- 2.0/simplesamlphp-install.html | 7 +- 2.0/simplesamlphp-maintenance.html | 7 +- 2.0/simplesamlphp-metadata-endpoints.html | 7 +- ...amlphp-metadata-extensions-attributes.html | 7 +- ...simplesamlphp-metadata-extensions-rpi.html | 7 +- 2.0/simplesamlphp-metadata-extensions-ui.html | 7 +- ...plesamlphp-metadata-pdostoragehandler.html | 7 +- 2.0/simplesamlphp-modules.html | 7 +- 2.0/simplesamlphp-nostate.html | 7 +- 2.0/simplesamlphp-reference-idp-hosted.html | 7 +- 2.0/simplesamlphp-reference-idp-remote.html | 7 +- 2.0/simplesamlphp-reference-sp-remote.html | 7 +- 2.0/simplesamlphp-scoping.html | 7 +- 2.0/simplesamlphp-sp-api.html | 7 +- 2.0/simplesamlphp-sp.html | 7 +- 2.0/simplesamlphp-theming.html | 7 +- 2.0/simplesamlphp-translation.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.10.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.11.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.12.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.13.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.14.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.15.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.16.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.17.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.18.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.19.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.5.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.6.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.7.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.8.html | 7 +- 2.0/simplesamlphp-upgrade-notes-1.9.html | 7 +- 2.0/simplesamlphp-upgrade-notes-2.0.html | 7 +- 2.0/simplesamlphp-upgrade-notes.html | 7 +- 2.1/core/authproc_attributeadd.html | 156 + 2.1/core/authproc_attributealter.html | 335 + 2.1/core/authproc_attributecopy.html | 142 + 2.1/core/authproc_attributelimit.html | 274 + 2.1/core/authproc_attributemap.html | 184 + 2.1/core/authproc_attributevaluemap.html | 262 + 2.1/core/authproc_cardinality.html | 194 + 2.1/core/authproc_cardinalitysingle.html | 254 + 2.1/core/authproc_generategroups.html | 217 + 2.1/core/authproc_languageadaptor.html | 168 + 2.1/core/authproc_php.html | 195 + 2.1/core/authproc_scopeattribute.html | 210 + 2.1/core/authproc_scopefromattribute.html | 143 + .../authproc_statisticswithattribute.html | 142 + 2.1/core/authproc_targetedid.html | 190 + 2.1/core/authproc_warnshortssointerval.html | 107 + 2.1/core/authsource_selector.html | 217 + 2.1/cron/cron.html | 368 + 2.1/index.html | 262 + 2.1/multiauth/multiauth.html | 303 + 2.1/saml/authproc_authncontextclassref.html | 111 + ...authproc_expectedauthncontextclassref.html | 117 + 2.1/saml/authproc_pairwiseid.html | 130 + 2.1/saml/authproc_subjectid.html | 138 + 2.1/saml/filterscopes.html | 232 + 2.1/saml/keyrollover.html | 299 + 2.1/saml/nameid.html | 501 ++ 2.1/saml/nameidattribute.html | 239 + 2.1/saml/sp.html | 1260 +++ 2.1/simplesamlphp-advancedfeatures.html | 441 + 2.1/simplesamlphp-artifact-idp.html | 265 + 2.1/simplesamlphp-artifact-sp.html | 139 + 2.1/simplesamlphp-authproc.html | 808 ++ 2.1/simplesamlphp-authsource.html | 380 + 2.1/simplesamlphp-changelog-1.x.html | 7193 +++++++++++++++++ 2.1/simplesamlphp-changelog.html | 624 ++ 2.1/simplesamlphp-customauth.html | 689 ++ 2.1/simplesamlphp-database.html | 256 + 2.1/simplesamlphp-ecp-idp.html | 210 + 2.1/simplesamlphp-errorhandling.html | 640 ++ 2.1/simplesamlphp-googleapps.html | 605 ++ 2.1/simplesamlphp-hok-idp.html | 213 + 2.1/simplesamlphp-hok-sp.html | 158 + 2.1/simplesamlphp-idp-more.html | 314 + 2.1/simplesamlphp-idp.html | 699 ++ 2.1/simplesamlphp-install-repo.html | 166 + 2.1/simplesamlphp-install.html | 1266 +++ 2.1/simplesamlphp-maintenance.html | 961 +++ 2.1/simplesamlphp-metadata-endpoints.html | 240 + ...amlphp-metadata-extensions-attributes.html | 325 + ...simplesamlphp-metadata-extensions-rpi.html | 301 + 2.1/simplesamlphp-metadata-extensions-ui.html | 529 ++ ...plesamlphp-metadata-pdostoragehandler.html | 256 + 2.1/simplesamlphp-modules.html | 598 ++ 2.1/simplesamlphp-nostate.html | 424 + 2.1/simplesamlphp-reference-idp-hosted.html | 1193 +++ 2.1/simplesamlphp-reference-idp-remote.html | 771 ++ 2.1/simplesamlphp-reference-sp-remote.html | 1065 +++ 2.1/simplesamlphp-scoping.html | 284 + 2.1/simplesamlphp-sp-api.html | 706 ++ 2.1/simplesamlphp-sp.html | 588 ++ 2.1/simplesamlphp-theming.html | 469 ++ 2.1/simplesamlphp-translation.html | 93 + 2.1/simplesamlphp-upgrade-notes-1.10.html | 99 + 2.1/simplesamlphp-upgrade-notes-1.11.html | 108 + 2.1/simplesamlphp-upgrade-notes-1.12.html | 95 + 2.1/simplesamlphp-upgrade-notes-1.13.html | 110 + 2.1/simplesamlphp-upgrade-notes-1.14.html | 970 +++ 2.1/simplesamlphp-upgrade-notes-1.15.html | 151 + 2.1/simplesamlphp-upgrade-notes-1.16.html | 147 + 2.1/simplesamlphp-upgrade-notes-1.17.html | 146 + 2.1/simplesamlphp-upgrade-notes-1.18.html | 183 + 2.1/simplesamlphp-upgrade-notes-1.19.html | 93 + 2.1/simplesamlphp-upgrade-notes-1.5.html | 173 + 2.1/simplesamlphp-upgrade-notes-1.6.html | 170 + 2.1/simplesamlphp-upgrade-notes-1.7.html | 113 + 2.1/simplesamlphp-upgrade-notes-1.8.html | 103 + 2.1/simplesamlphp-upgrade-notes-1.9.html | 132 + 2.1/simplesamlphp-upgrade-notes-2.0.html | 648 ++ 2.1/simplesamlphp-upgrade-notes-2.1.html | 114 + 2.1/simplesamlphp-upgrade-notes.html | 178 + contrib_modules/adfs/adfs.html | 7 +- contrib_modules/authX509/authX509.html | 7 +- contrib_modules/authcrypt/authcrypt.html | 7 +- contrib_modules/authorize/authorize.html | 7 +- contrib_modules/authtwitter/oauthtwitter.html | 7 +- contrib_modules/cas/cas.html | 7 +- contrib_modules/casserver/ChangeLog.html | 7 +- contrib_modules/consent/consent.html | 7 +- .../consentadmin/consentAdmin.html | 7 +- contrib_modules/discopower/discopower.html | 7 +- contrib_modules/expirycheck/expirycheck.html | 7 +- contrib_modules/fticks/authproc_fticks.html | 7 +- contrib_modules/ldap/ldap.html | 7 +- .../simplesamlphp-automated_metadata.html | 7 +- contrib_modules/negotiate/negotiate.html | 7 +- .../negotiateext/negotiateext.html | 7 +- contrib_modules/radius/radius.html | 7 +- .../smartattributes/smartattributes.html | 7 +- contrib_modules/sqlauth/sql.html | 7 +- contrib_modules/statistics/statistics.html | 7 +- contrib_modules/webauthn/tested_tokens.html | 7 +- contributed_modules.html | 7 +- devel/core/authproc_attributeadd.html | 7 +- devel/core/authproc_attributealter.html | 7 +- devel/core/authproc_attributecopy.html | 7 +- devel/core/authproc_attributelimit.html | 7 +- devel/core/authproc_attributemap.html | 7 +- devel/core/authproc_attributevaluemap.html | 7 +- devel/core/authproc_cardinality.html | 7 +- devel/core/authproc_cardinalitysingle.html | 7 +- devel/core/authproc_generategroups.html | 7 +- devel/core/authproc_languageadaptor.html | 7 +- devel/core/authproc_php.html | 7 +- devel/core/authproc_scopeattribute.html | 7 +- devel/core/authproc_scopefromattribute.html | 7 +- .../authproc_statisticswithattribute.html | 7 +- devel/core/authproc_targetedid.html | 7 +- devel/core/authproc_warnshortssointerval.html | 7 +- devel/core/authsource_selector.html | 7 +- devel/cron/cron.html | 7 +- devel/index.html | 7 +- devel/multiauth/multiauth.html | 7 +- devel/saml/authproc_authncontextclassref.html | 7 +- ...authproc_expectedauthncontextclassref.html | 7 +- devel/saml/authproc_pairwiseid.html | 7 +- devel/saml/authproc_subjectid.html | 7 +- devel/saml/filterscopes.html | 7 +- devel/saml/keyrollover.html | 7 +- devel/saml/nameid.html | 7 +- devel/saml/nameidattribute.html | 7 +- devel/saml/sp.html | 7 +- devel/simplesamlphp-advancedfeatures.html | 7 +- devel/simplesamlphp-artifact-idp.html | 7 +- devel/simplesamlphp-artifact-sp.html | 7 +- devel/simplesamlphp-authproc.html | 7 +- devel/simplesamlphp-authsource.html | 7 +- devel/simplesamlphp-changelog-1.x.html | 7 +- devel/simplesamlphp-changelog.html | 7 +- devel/simplesamlphp-customauth.html | 7 +- devel/simplesamlphp-database.html | 7 +- devel/simplesamlphp-ecp-idp.html | 7 +- devel/simplesamlphp-errorhandling.html | 7 +- devel/simplesamlphp-googleapps.html | 7 +- devel/simplesamlphp-hok-idp.html | 7 +- devel/simplesamlphp-hok-sp.html | 7 +- devel/simplesamlphp-idp-more.html | 7 +- devel/simplesamlphp-idp.html | 7 +- devel/simplesamlphp-install-repo.html | 7 +- devel/simplesamlphp-install.html | 7 +- devel/simplesamlphp-maintenance.html | 7 +- devel/simplesamlphp-metadata-endpoints.html | 7 +- ...amlphp-metadata-extensions-attributes.html | 7 +- ...simplesamlphp-metadata-extensions-rpi.html | 7 +- .../simplesamlphp-metadata-extensions-ui.html | 7 +- ...plesamlphp-metadata-pdostoragehandler.html | 7 +- devel/simplesamlphp-modules.html | 7 +- devel/simplesamlphp-nostate.html | 7 +- devel/simplesamlphp-reference-idp-hosted.html | 7 +- devel/simplesamlphp-reference-idp-remote.html | 7 +- devel/simplesamlphp-reference-sp-remote.html | 7 +- devel/simplesamlphp-scoping.html | 7 +- devel/simplesamlphp-sp-api.html | 7 +- devel/simplesamlphp-sp.html | 7 +- devel/simplesamlphp-theming.html | 7 +- devel/simplesamlphp-translation.html | 7 +- devel/simplesamlphp-upgrade-notes-1.10.html | 7 +- devel/simplesamlphp-upgrade-notes-1.11.html | 7 +- devel/simplesamlphp-upgrade-notes-1.12.html | 7 +- devel/simplesamlphp-upgrade-notes-1.13.html | 7 +- devel/simplesamlphp-upgrade-notes-1.14.html | 7 +- devel/simplesamlphp-upgrade-notes-1.15.html | 7 +- devel/simplesamlphp-upgrade-notes-1.16.html | 7 +- devel/simplesamlphp-upgrade-notes-1.17.html | 7 +- devel/simplesamlphp-upgrade-notes-1.18.html | 7 +- devel/simplesamlphp-upgrade-notes-1.19.html | 7 +- devel/simplesamlphp-upgrade-notes-1.5.html | 7 +- devel/simplesamlphp-upgrade-notes-1.6.html | 7 +- devel/simplesamlphp-upgrade-notes-1.7.html | 7 +- devel/simplesamlphp-upgrade-notes-1.8.html | 7 +- devel/simplesamlphp-upgrade-notes-1.9.html | 7 +- devel/simplesamlphp-upgrade-notes-2.0.html | 7 +- devel/simplesamlphp-upgrade-notes.html | 7 +- stable/core/authproc_attributeadd.html | 7 +- stable/core/authproc_attributealter.html | 7 +- stable/core/authproc_attributecopy.html | 7 +- stable/core/authproc_attributelimit.html | 7 +- stable/core/authproc_attributemap.html | 7 +- stable/core/authproc_attributevaluemap.html | 7 +- stable/core/authproc_cardinality.html | 7 +- stable/core/authproc_cardinalitysingle.html | 7 +- stable/core/authproc_generategroups.html | 7 +- stable/core/authproc_languageadaptor.html | 7 +- stable/core/authproc_php.html | 7 +- stable/core/authproc_scopeattribute.html | 7 +- stable/core/authproc_scopefromattribute.html | 7 +- .../authproc_statisticswithattribute.html | 7 +- stable/core/authproc_targetedid.html | 7 +- .../core/authproc_warnshortssointerval.html | 7 +- stable/core/authsource_selector.html | 7 +- stable/cron/cron.html | 7 +- stable/index.html | 7 +- stable/multiauth/multiauth.html | 7 +- .../saml/authproc_authncontextclassref.html | 7 +- ...authproc_expectedauthncontextclassref.html | 7 +- stable/saml/authproc_pairwiseid.html | 7 +- stable/saml/authproc_subjectid.html | 7 +- stable/saml/filterscopes.html | 7 +- stable/saml/keyrollover.html | 7 +- stable/saml/nameid.html | 7 +- stable/saml/nameidattribute.html | 7 +- stable/saml/sp.html | 7 +- stable/simplesamlphp-advancedfeatures.html | 7 +- stable/simplesamlphp-artifact-idp.html | 7 +- stable/simplesamlphp-artifact-sp.html | 7 +- stable/simplesamlphp-authproc.html | 48 +- stable/simplesamlphp-authsource.html | 7 +- stable/simplesamlphp-changelog-1.x.html | 7 +- stable/simplesamlphp-changelog.html | 73 +- stable/simplesamlphp-customauth.html | 7 +- stable/simplesamlphp-database.html | 7 +- stable/simplesamlphp-ecp-idp.html | 7 +- stable/simplesamlphp-errorhandling.html | 7 +- stable/simplesamlphp-googleapps.html | 7 +- stable/simplesamlphp-hok-idp.html | 7 +- stable/simplesamlphp-hok-sp.html | 7 +- stable/simplesamlphp-idp-more.html | 7 +- stable/simplesamlphp-idp.html | 7 +- stable/simplesamlphp-install-repo.html | 7 +- stable/simplesamlphp-install.html | 13 +- stable/simplesamlphp-maintenance.html | 7 +- stable/simplesamlphp-metadata-endpoints.html | 7 +- ...amlphp-metadata-extensions-attributes.html | 7 +- ...simplesamlphp-metadata-extensions-rpi.html | 7 +- .../simplesamlphp-metadata-extensions-ui.html | 7 +- ...plesamlphp-metadata-pdostoragehandler.html | 7 +- stable/simplesamlphp-modules.html | 7 +- stable/simplesamlphp-nostate.html | 7 +- .../simplesamlphp-reference-idp-hosted.html | 15 +- .../simplesamlphp-reference-idp-remote.html | 7 +- stable/simplesamlphp-reference-sp-remote.html | 7 +- stable/simplesamlphp-scoping.html | 7 +- stable/simplesamlphp-sp-api.html | 7 +- stable/simplesamlphp-sp.html | 7 +- stable/simplesamlphp-theming.html | 7 +- stable/simplesamlphp-translation.html | 7 +- stable/simplesamlphp-upgrade-notes-1.10.html | 7 +- stable/simplesamlphp-upgrade-notes-1.11.html | 7 +- stable/simplesamlphp-upgrade-notes-1.12.html | 7 +- stable/simplesamlphp-upgrade-notes-1.13.html | 7 +- stable/simplesamlphp-upgrade-notes-1.14.html | 7 +- stable/simplesamlphp-upgrade-notes-1.15.html | 7 +- stable/simplesamlphp-upgrade-notes-1.16.html | 7 +- stable/simplesamlphp-upgrade-notes-1.17.html | 7 +- stable/simplesamlphp-upgrade-notes-1.18.html | 7 +- stable/simplesamlphp-upgrade-notes-1.19.html | 7 +- stable/simplesamlphp-upgrade-notes-1.5.html | 7 +- stable/simplesamlphp-upgrade-notes-1.6.html | 7 +- stable/simplesamlphp-upgrade-notes-1.7.html | 7 +- stable/simplesamlphp-upgrade-notes-1.8.html | 7 +- stable/simplesamlphp-upgrade-notes-1.9.html | 7 +- stable/simplesamlphp-upgrade-notes-2.0.html | 7 +- stable/simplesamlphp-upgrade-notes-2.1.html | 114 + stable/simplesamlphp-upgrade-notes.html | 7 +- 420 files changed, 37204 insertions(+), 349 deletions(-) create mode 100644 2.1/core/authproc_attributeadd.html create mode 100644 2.1/core/authproc_attributealter.html create mode 100644 2.1/core/authproc_attributecopy.html create mode 100644 2.1/core/authproc_attributelimit.html create mode 100644 2.1/core/authproc_attributemap.html create mode 100644 2.1/core/authproc_attributevaluemap.html create mode 100644 2.1/core/authproc_cardinality.html create mode 100644 2.1/core/authproc_cardinalitysingle.html create mode 100644 2.1/core/authproc_generategroups.html create mode 100644 2.1/core/authproc_languageadaptor.html create mode 100644 2.1/core/authproc_php.html create mode 100644 2.1/core/authproc_scopeattribute.html create mode 100644 2.1/core/authproc_scopefromattribute.html create mode 100644 2.1/core/authproc_statisticswithattribute.html create mode 100644 2.1/core/authproc_targetedid.html create mode 100644 2.1/core/authproc_warnshortssointerval.html create mode 100644 2.1/core/authsource_selector.html create mode 100644 2.1/cron/cron.html create mode 100644 2.1/index.html create mode 100644 2.1/multiauth/multiauth.html create mode 100644 2.1/saml/authproc_authncontextclassref.html create mode 100644 2.1/saml/authproc_expectedauthncontextclassref.html create mode 100644 2.1/saml/authproc_pairwiseid.html create mode 100644 2.1/saml/authproc_subjectid.html create mode 100644 2.1/saml/filterscopes.html create mode 100644 2.1/saml/keyrollover.html create mode 100644 2.1/saml/nameid.html create mode 100644 2.1/saml/nameidattribute.html create mode 100644 2.1/saml/sp.html create mode 100644 2.1/simplesamlphp-advancedfeatures.html create mode 100644 2.1/simplesamlphp-artifact-idp.html create mode 100644 2.1/simplesamlphp-artifact-sp.html create mode 100644 2.1/simplesamlphp-authproc.html create mode 100644 2.1/simplesamlphp-authsource.html create mode 100644 2.1/simplesamlphp-changelog-1.x.html create mode 100644 2.1/simplesamlphp-changelog.html create mode 100644 2.1/simplesamlphp-customauth.html create mode 100644 2.1/simplesamlphp-database.html create mode 100644 2.1/simplesamlphp-ecp-idp.html create mode 100644 2.1/simplesamlphp-errorhandling.html create mode 100644 2.1/simplesamlphp-googleapps.html create mode 100644 2.1/simplesamlphp-hok-idp.html create mode 100644 2.1/simplesamlphp-hok-sp.html create mode 100644 2.1/simplesamlphp-idp-more.html create mode 100644 2.1/simplesamlphp-idp.html create mode 100644 2.1/simplesamlphp-install-repo.html create mode 100644 2.1/simplesamlphp-install.html create mode 100644 2.1/simplesamlphp-maintenance.html create mode 100644 2.1/simplesamlphp-metadata-endpoints.html create mode 100644 2.1/simplesamlphp-metadata-extensions-attributes.html create mode 100644 2.1/simplesamlphp-metadata-extensions-rpi.html create mode 100644 2.1/simplesamlphp-metadata-extensions-ui.html create mode 100644 2.1/simplesamlphp-metadata-pdostoragehandler.html create mode 100644 2.1/simplesamlphp-modules.html create mode 100644 2.1/simplesamlphp-nostate.html create mode 100644 2.1/simplesamlphp-reference-idp-hosted.html create mode 100644 2.1/simplesamlphp-reference-idp-remote.html create mode 100644 2.1/simplesamlphp-reference-sp-remote.html create mode 100644 2.1/simplesamlphp-scoping.html create mode 100644 2.1/simplesamlphp-sp-api.html create mode 100644 2.1/simplesamlphp-sp.html create mode 100644 2.1/simplesamlphp-theming.html create mode 100644 2.1/simplesamlphp-translation.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.10.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.11.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.12.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.13.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.14.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.15.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.16.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.17.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.18.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.19.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.5.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.6.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.7.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.8.html create mode 100644 2.1/simplesamlphp-upgrade-notes-1.9.html create mode 100644 2.1/simplesamlphp-upgrade-notes-2.0.html create mode 100644 2.1/simplesamlphp-upgrade-notes-2.1.html create mode 100644 2.1/simplesamlphp-upgrade-notes.html create mode 100644 stable/simplesamlphp-upgrade-notes-2.1.html diff --git a/1.19/core/authproc_attributeadd.html b/1.19/core/authproc_attributeadd.html index e88db17..6a64e21 100644 --- a/1.19/core/authproc_attributeadd.html +++ b/1.19/core/authproc_attributeadd.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributealter.html b/1.19/core/authproc_attributealter.html index 5645835..f259049 100644 --- a/1.19/core/authproc_attributealter.html +++ b/1.19/core/authproc_attributealter.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributecopy.html b/1.19/core/authproc_attributecopy.html index ad2fde3..ace10b4 100644 --- a/1.19/core/authproc_attributecopy.html +++ b/1.19/core/authproc_attributecopy.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributelimit.html b/1.19/core/authproc_attributelimit.html index 66254f3..0b713b2 100644 --- a/1.19/core/authproc_attributelimit.html +++ b/1.19/core/authproc_attributelimit.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributemap.html b/1.19/core/authproc_attributemap.html index 0883964..33476e7 100644 --- a/1.19/core/authproc_attributemap.html +++ b/1.19/core/authproc_attributemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributerealm.html b/1.19/core/authproc_attributerealm.html index 0761f8d..f150625 100644 --- a/1.19/core/authproc_attributerealm.html +++ b/1.19/core/authproc_attributerealm.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_attributevaluemap.html b/1.19/core/authproc_attributevaluemap.html index e5db1b4..4d0b704 100644 --- a/1.19/core/authproc_attributevaluemap.html +++ b/1.19/core/authproc_attributevaluemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_cardinality.html b/1.19/core/authproc_cardinality.html index 0932623..6496eb6 100644 --- a/1.19/core/authproc_cardinality.html +++ b/1.19/core/authproc_cardinality.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_cardinalitysingle.html b/1.19/core/authproc_cardinalitysingle.html index 1f0e33d..be72293 100644 --- a/1.19/core/authproc_cardinalitysingle.html +++ b/1.19/core/authproc_cardinalitysingle.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_generategroups.html b/1.19/core/authproc_generategroups.html index 48c3ee2..5b2bd7a 100644 --- a/1.19/core/authproc_generategroups.html +++ b/1.19/core/authproc_generategroups.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_languageadaptor.html b/1.19/core/authproc_languageadaptor.html index f81bf2c..a49a005 100644 --- a/1.19/core/authproc_languageadaptor.html +++ b/1.19/core/authproc_languageadaptor.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_php.html b/1.19/core/authproc_php.html index eea343a..dbc26e3 100644 --- a/1.19/core/authproc_php.html +++ b/1.19/core/authproc_php.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_scopeattribute.html b/1.19/core/authproc_scopeattribute.html index 9793a14..4e2d9e0 100644 --- a/1.19/core/authproc_scopeattribute.html +++ b/1.19/core/authproc_scopeattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_scopefromattribute.html b/1.19/core/authproc_scopefromattribute.html index 7578ea7..aae6b1e 100644 --- a/1.19/core/authproc_scopefromattribute.html +++ b/1.19/core/authproc_scopefromattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_statisticswithattribute.html b/1.19/core/authproc_statisticswithattribute.html index c3d8651..676a952 100644 --- a/1.19/core/authproc_statisticswithattribute.html +++ b/1.19/core/authproc_statisticswithattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_targetedid.html b/1.19/core/authproc_targetedid.html index 3baf307..8383837 100644 --- a/1.19/core/authproc_targetedid.html +++ b/1.19/core/authproc_targetedid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/core/authproc_warnshortssointerval.html b/1.19/core/authproc_warnshortssointerval.html index 1883390..7ef730f 100644 --- a/1.19/core/authproc_warnshortssointerval.html +++ b/1.19/core/authproc_warnshortssointerval.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/cron/cron.html b/1.19/cron/cron.html index 1057ab4..5e6b036 100644 --- a/1.19/cron/cron.html +++ b/1.19/cron/cron.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/index.html b/1.19/index.html index 0dd9eb9..3f13ea3 100644 --- a/1.19/index.html +++ b/1.19/index.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/multiauth/multiauth.html b/1.19/multiauth/multiauth.html index d88aa35..c6842fe 100644 --- a/1.19/multiauth/multiauth.html +++ b/1.19/multiauth/multiauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/authproc_authncontextclassref.html b/1.19/saml/authproc_authncontextclassref.html index 60e78ce..889bb04 100644 --- a/1.19/saml/authproc_authncontextclassref.html +++ b/1.19/saml/authproc_authncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/authproc_expectedauthncontextclassref.html b/1.19/saml/authproc_expectedauthncontextclassref.html index a222965..cf89c7a 100644 --- a/1.19/saml/authproc_expectedauthncontextclassref.html +++ b/1.19/saml/authproc_expectedauthncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/filterscopes.html b/1.19/saml/filterscopes.html index 461edc4..0136c06 100644 --- a/1.19/saml/filterscopes.html +++ b/1.19/saml/filterscopes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/keyrollover.html b/1.19/saml/keyrollover.html index 9dfe052..e994f0d 100644 --- a/1.19/saml/keyrollover.html +++ b/1.19/saml/keyrollover.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/nameid.html b/1.19/saml/nameid.html index b1fcfe6..55c7458 100644 --- a/1.19/saml/nameid.html +++ b/1.19/saml/nameid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/nameidattribute.html b/1.19/saml/nameidattribute.html index eb9ec01..36b26c3 100644 --- a/1.19/saml/nameidattribute.html +++ b/1.19/saml/nameidattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/saml/sp.html b/1.19/saml/sp.html index 7ce5b81..8c8c313 100644 --- a/1.19/saml/sp.html +++ b/1.19/saml/sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-advancedfeatures.html b/1.19/simplesamlphp-advancedfeatures.html index 36f5ce2..87b4d20 100644 --- a/1.19/simplesamlphp-advancedfeatures.html +++ b/1.19/simplesamlphp-advancedfeatures.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-artifact-idp.html b/1.19/simplesamlphp-artifact-idp.html index df9db08..212b9ee 100644 --- a/1.19/simplesamlphp-artifact-idp.html +++ b/1.19/simplesamlphp-artifact-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-artifact-sp.html b/1.19/simplesamlphp-artifact-sp.html index b9b1e6f..65abf19 100644 --- a/1.19/simplesamlphp-artifact-sp.html +++ b/1.19/simplesamlphp-artifact-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-authproc.html b/1.19/simplesamlphp-authproc.html index 39e13d4..4f7b7c9 100644 --- a/1.19/simplesamlphp-authproc.html +++ b/1.19/simplesamlphp-authproc.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-authsource.html b/1.19/simplesamlphp-authsource.html index 96e5dbc..a3380ea 100644 --- a/1.19/simplesamlphp-authsource.html +++ b/1.19/simplesamlphp-authsource.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-changelog.html b/1.19/simplesamlphp-changelog.html index e5ccfc3..1fa3da5 100644 --- a/1.19/simplesamlphp-changelog.html +++ b/1.19/simplesamlphp-changelog.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-customauth.html b/1.19/simplesamlphp-customauth.html index c14793d..0b429b1 100644 --- a/1.19/simplesamlphp-customauth.html +++ b/1.19/simplesamlphp-customauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-database.html b/1.19/simplesamlphp-database.html index 01e8817..ff6d438 100644 --- a/1.19/simplesamlphp-database.html +++ b/1.19/simplesamlphp-database.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-ecp-idp.html b/1.19/simplesamlphp-ecp-idp.html index c5a271b..4de9f02 100644 --- a/1.19/simplesamlphp-ecp-idp.html +++ b/1.19/simplesamlphp-ecp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-errorhandling.html b/1.19/simplesamlphp-errorhandling.html index 7515cf6..618d5e4 100644 --- a/1.19/simplesamlphp-errorhandling.html +++ b/1.19/simplesamlphp-errorhandling.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-googleapps.html b/1.19/simplesamlphp-googleapps.html index 485a555..ce90b2d 100644 --- a/1.19/simplesamlphp-googleapps.html +++ b/1.19/simplesamlphp-googleapps.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-hok-idp.html b/1.19/simplesamlphp-hok-idp.html index 8ede9a3..f0c68dd 100644 --- a/1.19/simplesamlphp-hok-idp.html +++ b/1.19/simplesamlphp-hok-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-hok-sp.html b/1.19/simplesamlphp-hok-sp.html index b4ea337..64fab6d 100644 --- a/1.19/simplesamlphp-hok-sp.html +++ b/1.19/simplesamlphp-hok-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-idp-more.html b/1.19/simplesamlphp-idp-more.html index fa8bfed..cae5a6d 100644 --- a/1.19/simplesamlphp-idp-more.html +++ b/1.19/simplesamlphp-idp-more.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-idp.html b/1.19/simplesamlphp-idp.html index 0af324e..462cf3a 100644 --- a/1.19/simplesamlphp-idp.html +++ b/1.19/simplesamlphp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-install-repo.html b/1.19/simplesamlphp-install-repo.html index 7b9229c..241fd35 100644 --- a/1.19/simplesamlphp-install-repo.html +++ b/1.19/simplesamlphp-install-repo.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-install.html b/1.19/simplesamlphp-install.html index 6fd4f89..e52da26 100644 --- a/1.19/simplesamlphp-install.html +++ b/1.19/simplesamlphp-install.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-maintenance.html b/1.19/simplesamlphp-maintenance.html index 35e731d..4adcd0b 100644 --- a/1.19/simplesamlphp-maintenance.html +++ b/1.19/simplesamlphp-maintenance.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-metadata-endpoints.html b/1.19/simplesamlphp-metadata-endpoints.html index cbd1ac6..7458a55 100644 --- a/1.19/simplesamlphp-metadata-endpoints.html +++ b/1.19/simplesamlphp-metadata-endpoints.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-metadata-extensions-attributes.html b/1.19/simplesamlphp-metadata-extensions-attributes.html index e5c0f22..74c3fa7 100644 --- a/1.19/simplesamlphp-metadata-extensions-attributes.html +++ b/1.19/simplesamlphp-metadata-extensions-attributes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-metadata-extensions-rpi.html b/1.19/simplesamlphp-metadata-extensions-rpi.html index 6a424f1..db79985 100644 --- a/1.19/simplesamlphp-metadata-extensions-rpi.html +++ b/1.19/simplesamlphp-metadata-extensions-rpi.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-metadata-extensions-ui.html b/1.19/simplesamlphp-metadata-extensions-ui.html index c4bf0af..05ecdca 100644 --- a/1.19/simplesamlphp-metadata-extensions-ui.html +++ b/1.19/simplesamlphp-metadata-extensions-ui.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-metadata-pdostoragehandler.html b/1.19/simplesamlphp-metadata-pdostoragehandler.html index 0f1c8c9..6137cdd 100644 --- a/1.19/simplesamlphp-metadata-pdostoragehandler.html +++ b/1.19/simplesamlphp-metadata-pdostoragehandler.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-modules.html b/1.19/simplesamlphp-modules.html index 26539ef..8c226bc 100644 --- a/1.19/simplesamlphp-modules.html +++ b/1.19/simplesamlphp-modules.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-nostate.html b/1.19/simplesamlphp-nostate.html index 3fdc235..edcc69a 100644 --- a/1.19/simplesamlphp-nostate.html +++ b/1.19/simplesamlphp-nostate.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-reference-idp-hosted.html b/1.19/simplesamlphp-reference-idp-hosted.html index 3d10280..094757e 100644 --- a/1.19/simplesamlphp-reference-idp-hosted.html +++ b/1.19/simplesamlphp-reference-idp-hosted.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-reference-idp-remote.html b/1.19/simplesamlphp-reference-idp-remote.html index 49dfe36..ea7079d 100644 --- a/1.19/simplesamlphp-reference-idp-remote.html +++ b/1.19/simplesamlphp-reference-idp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-reference-sp-remote.html b/1.19/simplesamlphp-reference-sp-remote.html index 54f8ea5..93c5602 100644 --- a/1.19/simplesamlphp-reference-sp-remote.html +++ b/1.19/simplesamlphp-reference-sp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-scoping.html b/1.19/simplesamlphp-scoping.html index c00ed3c..abf501a 100644 --- a/1.19/simplesamlphp-scoping.html +++ b/1.19/simplesamlphp-scoping.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-sp-api.html b/1.19/simplesamlphp-sp-api.html index c8a0819..cace121 100644 --- a/1.19/simplesamlphp-sp-api.html +++ b/1.19/simplesamlphp-sp-api.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-sp.html b/1.19/simplesamlphp-sp.html index ac5e526..e5c0b36 100644 --- a/1.19/simplesamlphp-sp.html +++ b/1.19/simplesamlphp-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-theming.html b/1.19/simplesamlphp-theming.html index a50f920..31d476d 100644 --- a/1.19/simplesamlphp-theming.html +++ b/1.19/simplesamlphp-theming.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-translation.html b/1.19/simplesamlphp-translation.html index 70de08e..b63205a 100644 --- a/1.19/simplesamlphp-translation.html +++ b/1.19/simplesamlphp-translation.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.10.html b/1.19/simplesamlphp-upgrade-notes-1.10.html index 65028fa..238c1bd 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.10.html +++ b/1.19/simplesamlphp-upgrade-notes-1.10.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.11.html b/1.19/simplesamlphp-upgrade-notes-1.11.html index 53557ad..886d5b7 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.11.html +++ b/1.19/simplesamlphp-upgrade-notes-1.11.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.12.html b/1.19/simplesamlphp-upgrade-notes-1.12.html index 630ae1f..b2ddcec 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.12.html +++ b/1.19/simplesamlphp-upgrade-notes-1.12.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.13.html b/1.19/simplesamlphp-upgrade-notes-1.13.html index be21912..9761b45 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.13.html +++ b/1.19/simplesamlphp-upgrade-notes-1.13.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.14.html b/1.19/simplesamlphp-upgrade-notes-1.14.html index 967f89b..dd415b4 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.14.html +++ b/1.19/simplesamlphp-upgrade-notes-1.14.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.15.html b/1.19/simplesamlphp-upgrade-notes-1.15.html index 75ef91f..ba6a1e3 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.15.html +++ b/1.19/simplesamlphp-upgrade-notes-1.15.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.16.html b/1.19/simplesamlphp-upgrade-notes-1.16.html index 8078114..da73781 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.16.html +++ b/1.19/simplesamlphp-upgrade-notes-1.16.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.17.html b/1.19/simplesamlphp-upgrade-notes-1.17.html index ce708cf..eeb89e3 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.17.html +++ b/1.19/simplesamlphp-upgrade-notes-1.17.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.18.html b/1.19/simplesamlphp-upgrade-notes-1.18.html index 3a07d0f..2085c2c 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.18.html +++ b/1.19/simplesamlphp-upgrade-notes-1.18.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.19.html b/1.19/simplesamlphp-upgrade-notes-1.19.html index 12937fb..6ca0743 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.19.html +++ b/1.19/simplesamlphp-upgrade-notes-1.19.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.5.html b/1.19/simplesamlphp-upgrade-notes-1.5.html index 1e6c57b..494402a 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.5.html +++ b/1.19/simplesamlphp-upgrade-notes-1.5.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.6.html b/1.19/simplesamlphp-upgrade-notes-1.6.html index e8edfdc..081d5c0 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.6.html +++ b/1.19/simplesamlphp-upgrade-notes-1.6.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.7.html b/1.19/simplesamlphp-upgrade-notes-1.7.html index c41abeb..9a42f6d 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.7.html +++ b/1.19/simplesamlphp-upgrade-notes-1.7.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.8.html b/1.19/simplesamlphp-upgrade-notes-1.8.html index 2fe1fc8..1a01d24 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.8.html +++ b/1.19/simplesamlphp-upgrade-notes-1.8.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes-1.9.html b/1.19/simplesamlphp-upgrade-notes-1.9.html index e1aa60f..60b114f 100644 --- a/1.19/simplesamlphp-upgrade-notes-1.9.html +++ b/1.19/simplesamlphp-upgrade-notes-1.9.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/1.19/simplesamlphp-upgrade-notes.html b/1.19/simplesamlphp-upgrade-notes.html index 21e4878..4e3487d 100644 --- a/1.19/simplesamlphp-upgrade-notes.html +++ b/1.19/simplesamlphp-upgrade-notes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributeadd.html b/2.0/core/authproc_attributeadd.html index 5a9205f..f2e5a90 100644 --- a/2.0/core/authproc_attributeadd.html +++ b/2.0/core/authproc_attributeadd.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributealter.html b/2.0/core/authproc_attributealter.html index 83ffa26..ce3eeb4 100644 --- a/2.0/core/authproc_attributealter.html +++ b/2.0/core/authproc_attributealter.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributecopy.html b/2.0/core/authproc_attributecopy.html index fc74935..a3a4eda 100644 --- a/2.0/core/authproc_attributecopy.html +++ b/2.0/core/authproc_attributecopy.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributelimit.html b/2.0/core/authproc_attributelimit.html index 4475a34..2661c10 100644 --- a/2.0/core/authproc_attributelimit.html +++ b/2.0/core/authproc_attributelimit.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributemap.html b/2.0/core/authproc_attributemap.html index 0b3a7ed..6eb3d59 100644 --- a/2.0/core/authproc_attributemap.html +++ b/2.0/core/authproc_attributemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_attributevaluemap.html b/2.0/core/authproc_attributevaluemap.html index 9c5497a..827e516 100644 --- a/2.0/core/authproc_attributevaluemap.html +++ b/2.0/core/authproc_attributevaluemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_cardinality.html b/2.0/core/authproc_cardinality.html index aba5443..1f8e9da 100644 --- a/2.0/core/authproc_cardinality.html +++ b/2.0/core/authproc_cardinality.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_cardinalitysingle.html b/2.0/core/authproc_cardinalitysingle.html index 7756aff..f326684 100644 --- a/2.0/core/authproc_cardinalitysingle.html +++ b/2.0/core/authproc_cardinalitysingle.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_generategroups.html b/2.0/core/authproc_generategroups.html index 88c28aa..1f5b678 100644 --- a/2.0/core/authproc_generategroups.html +++ b/2.0/core/authproc_generategroups.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_languageadaptor.html b/2.0/core/authproc_languageadaptor.html index 259cd27..7213b31 100644 --- a/2.0/core/authproc_languageadaptor.html +++ b/2.0/core/authproc_languageadaptor.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_php.html b/2.0/core/authproc_php.html index 6cce4de..ee267c4 100644 --- a/2.0/core/authproc_php.html +++ b/2.0/core/authproc_php.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_scopeattribute.html b/2.0/core/authproc_scopeattribute.html index d4f66bf..ff69bf4 100644 --- a/2.0/core/authproc_scopeattribute.html +++ b/2.0/core/authproc_scopeattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_scopefromattribute.html b/2.0/core/authproc_scopefromattribute.html index e1ca367..ce43a44 100644 --- a/2.0/core/authproc_scopefromattribute.html +++ b/2.0/core/authproc_scopefromattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_statisticswithattribute.html b/2.0/core/authproc_statisticswithattribute.html index d6ee544..efd07ff 100644 --- a/2.0/core/authproc_statisticswithattribute.html +++ b/2.0/core/authproc_statisticswithattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_targetedid.html b/2.0/core/authproc_targetedid.html index d02cefd..1de413d 100644 --- a/2.0/core/authproc_targetedid.html +++ b/2.0/core/authproc_targetedid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authproc_warnshortssointerval.html b/2.0/core/authproc_warnshortssointerval.html index 1c36cd4..e037144 100644 --- a/2.0/core/authproc_warnshortssointerval.html +++ b/2.0/core/authproc_warnshortssointerval.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/core/authsource_selector.html b/2.0/core/authsource_selector.html index f80d196..9acfea8 100644 --- a/2.0/core/authsource_selector.html +++ b/2.0/core/authsource_selector.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/cron/cron.html b/2.0/cron/cron.html index 212d9a0..d8e514f 100644 --- a/2.0/cron/cron.html +++ b/2.0/cron/cron.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/index.html b/2.0/index.html index d0fdecf..6eaebe4 100644 --- a/2.0/index.html +++ b/2.0/index.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/multiauth/multiauth.html b/2.0/multiauth/multiauth.html index d23cb9b..00220da 100644 --- a/2.0/multiauth/multiauth.html +++ b/2.0/multiauth/multiauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/authproc_authncontextclassref.html b/2.0/saml/authproc_authncontextclassref.html index cb9789c..9e9bcd8 100644 --- a/2.0/saml/authproc_authncontextclassref.html +++ b/2.0/saml/authproc_authncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/authproc_expectedauthncontextclassref.html b/2.0/saml/authproc_expectedauthncontextclassref.html index 0e9e53a..6a7f643 100644 --- a/2.0/saml/authproc_expectedauthncontextclassref.html +++ b/2.0/saml/authproc_expectedauthncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/authproc_pairwiseid.html b/2.0/saml/authproc_pairwiseid.html index 5de060f..a917e2f 100644 --- a/2.0/saml/authproc_pairwiseid.html +++ b/2.0/saml/authproc_pairwiseid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/authproc_subjectid.html b/2.0/saml/authproc_subjectid.html index 21dd6cb..336baba 100644 --- a/2.0/saml/authproc_subjectid.html +++ b/2.0/saml/authproc_subjectid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/filterscopes.html b/2.0/saml/filterscopes.html index fdbfcc0..dcf375b 100644 --- a/2.0/saml/filterscopes.html +++ b/2.0/saml/filterscopes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/keyrollover.html b/2.0/saml/keyrollover.html index c6f2983..0241bfe 100644 --- a/2.0/saml/keyrollover.html +++ b/2.0/saml/keyrollover.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/nameid.html b/2.0/saml/nameid.html index 7fec72c..b41688c 100644 --- a/2.0/saml/nameid.html +++ b/2.0/saml/nameid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/nameidattribute.html b/2.0/saml/nameidattribute.html index 4ed10f3..0a764b3 100644 --- a/2.0/saml/nameidattribute.html +++ b/2.0/saml/nameidattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/saml/sp.html b/2.0/saml/sp.html index 37bfb34..e1305f3 100644 --- a/2.0/saml/sp.html +++ b/2.0/saml/sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-advancedfeatures.html b/2.0/simplesamlphp-advancedfeatures.html index 7ea8e02..14313b0 100644 --- a/2.0/simplesamlphp-advancedfeatures.html +++ b/2.0/simplesamlphp-advancedfeatures.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-artifact-idp.html b/2.0/simplesamlphp-artifact-idp.html index 9fd88fe..badca85 100644 --- a/2.0/simplesamlphp-artifact-idp.html +++ b/2.0/simplesamlphp-artifact-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-artifact-sp.html b/2.0/simplesamlphp-artifact-sp.html index b9b1e6f..65abf19 100644 --- a/2.0/simplesamlphp-artifact-sp.html +++ b/2.0/simplesamlphp-artifact-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-authproc.html b/2.0/simplesamlphp-authproc.html index b1b02f1..8758775 100644 --- a/2.0/simplesamlphp-authproc.html +++ b/2.0/simplesamlphp-authproc.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-authsource.html b/2.0/simplesamlphp-authsource.html index 320c91a..e6fd56f 100644 --- a/2.0/simplesamlphp-authsource.html +++ b/2.0/simplesamlphp-authsource.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-changelog-1.x.html b/2.0/simplesamlphp-changelog-1.x.html index c54d8f7..9278985 100644 --- a/2.0/simplesamlphp-changelog-1.x.html +++ b/2.0/simplesamlphp-changelog-1.x.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-changelog.html b/2.0/simplesamlphp-changelog.html index 8b719f8..3cb39fc 100644 --- a/2.0/simplesamlphp-changelog.html +++ b/2.0/simplesamlphp-changelog.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-customauth.html b/2.0/simplesamlphp-customauth.html index ad21dc5..b632c09 100644 --- a/2.0/simplesamlphp-customauth.html +++ b/2.0/simplesamlphp-customauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-database.html b/2.0/simplesamlphp-database.html index 5ab3be3..78800c8 100644 --- a/2.0/simplesamlphp-database.html +++ b/2.0/simplesamlphp-database.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-ecp-idp.html b/2.0/simplesamlphp-ecp-idp.html index fc6f96e..c7c4435 100644 --- a/2.0/simplesamlphp-ecp-idp.html +++ b/2.0/simplesamlphp-ecp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-errorhandling.html b/2.0/simplesamlphp-errorhandling.html index b1a458c..f11b114 100644 --- a/2.0/simplesamlphp-errorhandling.html +++ b/2.0/simplesamlphp-errorhandling.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-googleapps.html b/2.0/simplesamlphp-googleapps.html index d845d13..bf610c3 100644 --- a/2.0/simplesamlphp-googleapps.html +++ b/2.0/simplesamlphp-googleapps.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-hok-idp.html b/2.0/simplesamlphp-hok-idp.html index 1a699dd..f89bd3c 100644 --- a/2.0/simplesamlphp-hok-idp.html +++ b/2.0/simplesamlphp-hok-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-hok-sp.html b/2.0/simplesamlphp-hok-sp.html index b4ea337..64fab6d 100644 --- a/2.0/simplesamlphp-hok-sp.html +++ b/2.0/simplesamlphp-hok-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-idp-more.html b/2.0/simplesamlphp-idp-more.html index d0b4d4c..f8bab0b 100644 --- a/2.0/simplesamlphp-idp-more.html +++ b/2.0/simplesamlphp-idp-more.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-idp.html b/2.0/simplesamlphp-idp.html index 8ef721c..9b67afc 100644 --- a/2.0/simplesamlphp-idp.html +++ b/2.0/simplesamlphp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-install-repo.html b/2.0/simplesamlphp-install-repo.html index 3f7317c..2e02eea 100644 --- a/2.0/simplesamlphp-install-repo.html +++ b/2.0/simplesamlphp-install-repo.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-install.html b/2.0/simplesamlphp-install.html index b444645..f9afa80 100644 --- a/2.0/simplesamlphp-install.html +++ b/2.0/simplesamlphp-install.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-maintenance.html b/2.0/simplesamlphp-maintenance.html index dabaaf0..48d4e3b 100644 --- a/2.0/simplesamlphp-maintenance.html +++ b/2.0/simplesamlphp-maintenance.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-metadata-endpoints.html b/2.0/simplesamlphp-metadata-endpoints.html index eaa5e1a..64ef497 100644 --- a/2.0/simplesamlphp-metadata-endpoints.html +++ b/2.0/simplesamlphp-metadata-endpoints.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-metadata-extensions-attributes.html b/2.0/simplesamlphp-metadata-extensions-attributes.html index e5c0f22..74c3fa7 100644 --- a/2.0/simplesamlphp-metadata-extensions-attributes.html +++ b/2.0/simplesamlphp-metadata-extensions-attributes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-metadata-extensions-rpi.html b/2.0/simplesamlphp-metadata-extensions-rpi.html index 50229f5..a54d86d 100644 --- a/2.0/simplesamlphp-metadata-extensions-rpi.html +++ b/2.0/simplesamlphp-metadata-extensions-rpi.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-metadata-extensions-ui.html b/2.0/simplesamlphp-metadata-extensions-ui.html index 02481cc..7a2d16d 100644 --- a/2.0/simplesamlphp-metadata-extensions-ui.html +++ b/2.0/simplesamlphp-metadata-extensions-ui.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-metadata-pdostoragehandler.html b/2.0/simplesamlphp-metadata-pdostoragehandler.html index 87182ed..21b73b1 100644 --- a/2.0/simplesamlphp-metadata-pdostoragehandler.html +++ b/2.0/simplesamlphp-metadata-pdostoragehandler.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-modules.html b/2.0/simplesamlphp-modules.html index b694b61..ca10bf2 100644 --- a/2.0/simplesamlphp-modules.html +++ b/2.0/simplesamlphp-modules.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-nostate.html b/2.0/simplesamlphp-nostate.html index 7e893ef..0669ba7 100644 --- a/2.0/simplesamlphp-nostate.html +++ b/2.0/simplesamlphp-nostate.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-reference-idp-hosted.html b/2.0/simplesamlphp-reference-idp-hosted.html index 092d68b..e4e36a0 100644 --- a/2.0/simplesamlphp-reference-idp-hosted.html +++ b/2.0/simplesamlphp-reference-idp-hosted.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-reference-idp-remote.html b/2.0/simplesamlphp-reference-idp-remote.html index ab04f9b..0d7574d 100644 --- a/2.0/simplesamlphp-reference-idp-remote.html +++ b/2.0/simplesamlphp-reference-idp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-reference-sp-remote.html b/2.0/simplesamlphp-reference-sp-remote.html index ce73824..ff870f1 100644 --- a/2.0/simplesamlphp-reference-sp-remote.html +++ b/2.0/simplesamlphp-reference-sp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-scoping.html b/2.0/simplesamlphp-scoping.html index 55c4d39..fdc4a96 100644 --- a/2.0/simplesamlphp-scoping.html +++ b/2.0/simplesamlphp-scoping.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-sp-api.html b/2.0/simplesamlphp-sp-api.html index 38cf81d..b507554 100644 --- a/2.0/simplesamlphp-sp-api.html +++ b/2.0/simplesamlphp-sp-api.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-sp.html b/2.0/simplesamlphp-sp.html index f04e830..d00c67b 100644 --- a/2.0/simplesamlphp-sp.html +++ b/2.0/simplesamlphp-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-theming.html b/2.0/simplesamlphp-theming.html index 34f8e5f..1a7549b 100644 --- a/2.0/simplesamlphp-theming.html +++ b/2.0/simplesamlphp-theming.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-translation.html b/2.0/simplesamlphp-translation.html index 197cb78..ba1c793 100644 --- a/2.0/simplesamlphp-translation.html +++ b/2.0/simplesamlphp-translation.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.10.html b/2.0/simplesamlphp-upgrade-notes-1.10.html index 316d934..f4a3217 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.10.html +++ b/2.0/simplesamlphp-upgrade-notes-1.10.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.11.html b/2.0/simplesamlphp-upgrade-notes-1.11.html index 9ec0fbc..5b3b8b7 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.11.html +++ b/2.0/simplesamlphp-upgrade-notes-1.11.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.12.html b/2.0/simplesamlphp-upgrade-notes-1.12.html index f7f417e..4c7dddc 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.12.html +++ b/2.0/simplesamlphp-upgrade-notes-1.12.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.13.html b/2.0/simplesamlphp-upgrade-notes-1.13.html index 2df27b7..3c71d51 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.13.html +++ b/2.0/simplesamlphp-upgrade-notes-1.13.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.14.html b/2.0/simplesamlphp-upgrade-notes-1.14.html index 87e27d6..88f7334 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.14.html +++ b/2.0/simplesamlphp-upgrade-notes-1.14.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.15.html b/2.0/simplesamlphp-upgrade-notes-1.15.html index 75ef91f..ba6a1e3 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.15.html +++ b/2.0/simplesamlphp-upgrade-notes-1.15.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.16.html b/2.0/simplesamlphp-upgrade-notes-1.16.html index 83409fe..1070e03 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.16.html +++ b/2.0/simplesamlphp-upgrade-notes-1.16.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.17.html b/2.0/simplesamlphp-upgrade-notes-1.17.html index a78c8dc..99a1803 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.17.html +++ b/2.0/simplesamlphp-upgrade-notes-1.17.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.18.html b/2.0/simplesamlphp-upgrade-notes-1.18.html index b5cb729..616046f 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.18.html +++ b/2.0/simplesamlphp-upgrade-notes-1.18.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.19.html b/2.0/simplesamlphp-upgrade-notes-1.19.html index e1765b3..e319476 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.19.html +++ b/2.0/simplesamlphp-upgrade-notes-1.19.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.5.html b/2.0/simplesamlphp-upgrade-notes-1.5.html index 2b1b58d..bfae196 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.5.html +++ b/2.0/simplesamlphp-upgrade-notes-1.5.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.6.html b/2.0/simplesamlphp-upgrade-notes-1.6.html index 94674a8..6a55315 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.6.html +++ b/2.0/simplesamlphp-upgrade-notes-1.6.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.7.html b/2.0/simplesamlphp-upgrade-notes-1.7.html index 0b60a61..5ed2be8 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.7.html +++ b/2.0/simplesamlphp-upgrade-notes-1.7.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.8.html b/2.0/simplesamlphp-upgrade-notes-1.8.html index 6188e26..a29f51e 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.8.html +++ b/2.0/simplesamlphp-upgrade-notes-1.8.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-1.9.html b/2.0/simplesamlphp-upgrade-notes-1.9.html index 6301080..0982f7e 100644 --- a/2.0/simplesamlphp-upgrade-notes-1.9.html +++ b/2.0/simplesamlphp-upgrade-notes-1.9.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes-2.0.html b/2.0/simplesamlphp-upgrade-notes-2.0.html index e0fc628..6c2c396 100644 --- a/2.0/simplesamlphp-upgrade-notes-2.0.html +++ b/2.0/simplesamlphp-upgrade-notes-2.0.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.0/simplesamlphp-upgrade-notes.html b/2.0/simplesamlphp-upgrade-notes.html index 6517a36..89bde5b 100644 --- a/2.0/simplesamlphp-upgrade-notes.html +++ b/2.0/simplesamlphp-upgrade-notes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/2.1/core/authproc_attributeadd.html b/2.1/core/authproc_attributeadd.html new file mode 100644 index 0000000..f2e5a90 --- /dev/null +++ b/2.1/core/authproc_attributeadd.html @@ -0,0 +1,156 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeAdd + +

+

+ Filter that adds attributes to the user. +

+

+ If the attribute already exists, the values added will be merged into a multi-valued attribute. +If you instead want to replace the existing attribute, you may add the + + '%replace' + + option. +

+

+ Examples +

+

+ Add a single-valued attributes: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeAdd',
+          'source' => ['myidp'],
+      ],
+  ],
+
+
+

+ Add a multi-valued attribute: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeAdd',
+          'groups' => ['users', 'members'],
+      ],
+  ],
+
+
+

+ Add multiple attributes: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeAdd',
+          'eduPersonPrimaryAffiliation' => 'student',
+          'eduPersonAffiliation' => ['student', 'employee', 'members'],
+      ],
+  ],
+
+
+

+ Replace an existing attributes: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeAdd',
+          '%replace',
+          'uid' => ['guest'],
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_attributealter.html b/2.1/core/authproc_attributealter.html new file mode 100644 index 0000000..ce3eeb4 --- /dev/null +++ b/2.1/core/authproc_attributealter.html @@ -0,0 +1,335 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeAlter + +

+

+ This filter can be used to substitute and replace different parts of the attribute values based on regular expressions. +It can also be used to create new attributes based on existing values, or even to remove blacklisted values from +attributes. +

+

+ Parameters +

+
+
+ + class + +
+
+ This is the name of the filter. + It must be + + 'core:AttributeAlter' + + . +
+
+ + subject + +
+
+ The attribute in which the search is performed. + This parameter is REQUIRED and the filter will throw an exception if it is not set. The filter will + stop quietly if the attribute specified here is empty or not found. +
+
+ + pattern + +
+
+ The pattern to look for inside the subject. Supports full Perl Compatible Regular Expressions (PCRE). + This parameter is REQUIRED and the filter will throw an exception if it is not set. +
+
+ + replacement + +
+
+ The value used to replace the match. Back references are not supported. + This parameter is REQUIRED, except when using the + + %replace + + or + + %remove + + options. If + + %replace + + is used and + + replacement + + is not set, then the match is used as a replacement. +
+
+ + target + +
+
+ The attribute where the replaced value will be placed. + This parameter is OPTIONAL, and if not set, + + subject + + is used as + + target + + . +
+
+ + %replace + +
+
+ Indicates that the whole value of the attribute should be replaced if there is a match, + instead of just the match. If there's no match, the value will not be changed. This parameter is OPTIONAL. +
+
+ + %remove + +
+
+ Indicates that the whole value of the attribute should be removed completely if there is a match. + If no other values exist, the attribute will be removed completely. + This parameter is OPTIONAL. +
+
+ + %merge + +
+
+ Indicates whether the altered values must be merged with the target attribute values. The default + behaviour is to overwrite the target attribute completely. + This parameter is OPTIONAL. +
+
+

+ Examples +

+

+ Change the domain on the + + mail + + attribute (when both the new and old domain are known): +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'mail',
+      'pattern' => '/olddomain.com/',
+      'replacement' => 'newdomain.com',
+  ],
+
+
+

+ Change the domain on the + + mail + + attribute (when new domain is known): +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'mail',
+      'pattern' => '/(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,6}$/',
+      'replacement' => 'newdomain.com',
+  ],
+
+
+

+ Set the eduPersonPrimaryAffiliation based on users' distinguishedName: +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'dn',
+      'pattern' => '/OU=Staff/',
+      'replacement' => 'staff',
+      'target' => 'eduPersonPrimaryAffiliation',
+  ],
+
+
+

+ Normalize the eduPersonPrimaryAffiliation: +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'eduPersonPrimaryAffiliation',
+      'pattern' => '/Student in school/',
+      'replacement' => 'student',
+      '%replace',
+  ],
+
+
+

+ Get the domain of the emailaddress and put it in a separate attribute: +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'mail',
+      'pattern' => '/(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,6}$/',
+      'target' => 'domain',
+      '%replace',
+  ],
+
+
+

+ Defaulting an attribute to one value (add it with the default before altering) +unless another attribute meets a condition: +

+
+ 
  10 => [
+      'class' => 'core:AttributeAdd',
+      'myAttribute' => 'default-value'
+  ],
+  11 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'entitlement',
+      'pattern' => '/faculty/',
+      'target' => 'myAttribute',
+      '%replace',
+  ],
+
+
+

+ Remove internal, private values from eduPersonEntitlement: +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'eduPersonEntitlement',
+      'pattern' => '/ldap-admin/',
+      '%remove',
+  ],
+
+
+

+ Set a value to be blank (which will be sent as an empty string): +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'cn',
+      'pattern' => '/No name/',
+      'replacement' => '',
+      '%replace',
+  ],
+
+
+

+ Set a value to be NULL (which will be sent as a NULL value): +

+
+ 
  10 => [
+      'class' => 'core:AttributeAlter',
+      'subject' => 'telephone',
+      'pattern' => '/NULL/',
+      'replacement' => null,
+      '%replace',
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_attributecopy.html b/2.1/core/authproc_attributecopy.html new file mode 100644 index 0000000..a3a4eda --- /dev/null +++ b/2.1/core/authproc_attributecopy.html @@ -0,0 +1,142 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeCopy + +

+

+ Filter that copies attributes. +

+

+ Examples +

+

+ Copy a single attribute (user's + + uid + + will be copied to the user's + + username + + ): +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeCopy',
+          'uid' => 'username',
+      ],
+  ],
+
+
+

+ Copy a single attribute to more than one attribute (user's + + uid + + will be copied to the user's + + username + + and to + + urn:mace:dir:attribute-def:uid + + ) +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeCopy',
+          'uid' => ['username', 'urn:mace:dir:attribute-def:uid'],
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_attributelimit.html b/2.1/core/authproc_attributelimit.html new file mode 100644 index 0000000..2661c10 --- /dev/null +++ b/2.1/core/authproc_attributelimit.html @@ -0,0 +1,274 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeLimit + +

+

+ A filter that limits the attributes (and their values) sent to a service provider. +

+

+ If the configuration is empty, the filter will use the attributes configured in the + + attributes + + option in the SP +metadata. The configuration is a list of attributes that should be allowed. In case you want to limit an attribute to +release some specific values, make the name of the attribute the key of the array, and its value an array with all the +different values allowed for it. +

+

+ Examples +

+

+ Here you will find a few examples on how to use this simple module: +

+

+ Limit to the + + cn + + and + + mail + + attribute: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'cn', 'mail'
+      ],
+  ],
+
+
+

+ Allow + + eduPersonTargetedID + + and + + eduPersonAffiliation + + by default, but allow the metadata to override the limitation. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'default' => true,
+          'eduPersonTargetedID', 'eduPersonAffiliation',
+      ],
+  ],
+
+
+

+ Only allow specific values for an attribute. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'eduPersonEntitlement' => ['urn:mace:surf.nl:surfdrive:quota:100']
+      ],
+  ],
+
+
+

+ Only allow specific values for an attribute ignoring case. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'eduPersonEntitlement' => [
+              'ignoreCase' => true,
+              'URN:mace:surf.nl:SURFDRIVE:quota:100'
+           ]
+      ],
+  ],
+
+
+

+ Only allow specific values for an attribute that match a regex pattern +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'eduPersonEntitlement' => [
+              'regex' => true,
+              '/^urn:mace:surf/',
+              '/^urn:x-IGNORE_Case/i',
+          ]
+      ],
+  ],
+
+
+

+ Don't allow any attributes by default, but allow the metadata to override it. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeLimit',
+          'default' => true,
+      ],
+  ],
+
+
+

+ In order to just use the list of attributes defined in the metadata for each service provider, configure the module +like this: +

+
+ 
  'authproc' => [
+      50 => 'core:AttributeLimit',
+  ],
+
+
+

+ Then, add the allowed attributes to each service provider metadata, in the + + attributes + + option: +

+
+ 
  $metadata['https://saml2sp.example.org'] = [
+      'AssertionConsumerService' => 'https://saml2sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+      'SingleLogoutService' => 'https://saml2sp.example.org/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp',
+      ...
+      'attributes' => ['cn', 'mail'],
+      ...
+  ];
+
+
+

+ Now, let's look to a couple of examples on how to filter out attribute values. First, allow only the entitlements known +to be used by a service provider (among other attributes): +

+
+ 
  $metadata['https://saml2sp.example.org'] = [
+      'AssertionConsumerService' => 'https://saml2sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+      'SingleLogoutService' => 'https://saml2sp.example.org/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp',
+      ...
+      'attributes' => [
+          'uid',
+          'mail',
+          'eduPersonEntitlement' => [
+              'urn:mace:example.org:admin',
+              'urn:mace:example.org:user',
+          ],
+      ],
+      ...
+  ];
+
+
+

+ Now, an example on how to normalize the affiliations sent from an identity provider, to make sure that no custom +values ever reach the service providers. Bear in mind that this configuration can be overridden by metadata: +

+
+ 
  'authproc' => [
+      50 => 'core:AttributeLimit',
+      'default' => true,
+      'eduPersonAffiliation' => [
+          'student',
+          'staff',
+          'member',
+          'faculty',
+          'employee',
+          'affiliate',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_attributemap.html b/2.1/core/authproc_attributemap.html new file mode 100644 index 0000000..6eb3d59 --- /dev/null +++ b/2.1/core/authproc_attributemap.html @@ -0,0 +1,184 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeMap + +

+

+ Filter to change attribute names. +

+

+ This filter can either contain the name of a map file or a set of name => value pairs describing the transformation. +If configuration references a map file, the file must be located in the + + attributemap/ + + directory in the root of +SimpleSAMLphp's installation. Attribute map files located in the + + attributemap/ + + directory in the root of a module can +also be used by specifying the file with the + + module:file + + syntax. +

+

+ It can also create multiple attributes from a single attribute by specifying multiple target attributes as an array. +

+

+ Examples +

+

+ Attribute maps embedded as parameters: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeMap',
+          'mail' => 'email',
+          'uid' => 'user'
+          'cn' => ['name', 'displayName'],
+      ],
+  ],
+
+
+

+ Attribute map in separate file: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeMap',
+          'name2oid',
+      ],
+  ],
+
+
+

+ This filter will use the map file from + + simplesamlphp/attributemap/name2oid.php + + . +

+

+ Attribute map in a file contained in a module: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeMap',
+          'module:src2dst'
+      ],
+  ],
+
+
+

+ This filter will use the map file from + + simplesamlphp/modules/module/attributemap/src2dst.php + + . +

+

+ Duplicate attributes based on a map file: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeMap',
+          'name2urn', 'name2oid',
+          '%duplicate',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_attributevaluemap.html b/2.1/core/authproc_attributevaluemap.html new file mode 100644 index 0000000..827e516 --- /dev/null +++ b/2.1/core/authproc_attributevaluemap.html @@ -0,0 +1,262 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:AttributeValueMap + +

+

+ Filter that creates a target attribute based on one or more value(s) in source attribute. +

+

+ Besides the mapping of source values to target values, the filter has the following options: +

+
    +
  • + + %replace + + can be used to replace all existing values in target with new ones (any existing values will be lost) +
    • +
  • + + %keep + + can be used to keep the source attribute, otherwise it will be removed. +
    • +
+

+ + Examples + + : +

+

+ Add student affiliation based on LDAP groupmembership +

+

+ Will add eduPersonAffiliation containing value " + + student + + " if the + + memberOf + + attribute contains +either ' + + cn=student,o=some,o=organization,dc=org + + ' or ' + + cn=student,o=other,o=organization,dc=org + + '. +The ' + + memberOf + + ' attribute will be removed (use + + %keep + + , to keep it) and existing values in +' + + eduPersonAffiliation + + ' will be merged (use + + %replace + + to replace them). +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeValueMap',
+          'sourceattribute' => 'memberOf',
+          'targetattribute' => 'eduPersonAffiliation',
+          'values' => [
+              'student' => [
+                  'cn=student,o=some,o=organization,dc=org',
+                  'cn=student,o=other,o=organization,dc=org',
+              ],
+          ],
+      ],
+  ],
+
+
+

+ Multiple assignments +

+

+ Add + + student + + , + + employee + + and + + both + + affiliation based on LDAP groupmembership in the + + memberOf + + attribute. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeValueMap',
+          'sourceattribute' => 'memberOf',
+          'targetattribute' => 'eduPersonAffiliation',
+          'values' => [
+              'student' => [
+                  'cn=student,o=some,o=organization,dc=org',
+                  'cn=student,o=other,o=organization,dc=org',
+              ],
+              'employee' => [
+                  'cn=employees,o=some,o=organization,dc=org',
+                  'cn=employee,o=other,o=organization,dc=org',
+                  'cn=workers,o=any,o=organization,dc=org',
+              ],
+              'both' => [
+                  'cn=student,o=some,o=organization,dc=org',
+                  'cn=student,o=other,o=organization,dc=org',
+                  'cn=employees,o=some,o=organization,dc=org',
+                  'cn=employee,o=other,o=organization,dc=org',
+                  'cn=workers,o=any,o=organization,dc=org',
+              ],
+          ],
+      ],
+  ],
+
+
+

+ Replace and Keep +

+

+ Replace any existing ' + + affiliation + + ' attribute values and keep the ' + + groups + + ' attribute. +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeValueMap',
+          'sourceattribute' => 'groups',
+          'targetattribute' => 'affiliation',
+          '%replace',
+          '%keep',
+          'values' => [
+              'student' => [
+                  'cn=student,o=some,o=organization,dc=org',
+                  'cn=student,o=other,o=organization,dc=org',
+              ],
+              'employee' => [
+                  'cn=employees,o=some,o=organization,dc=org',
+                  'cn=employee,o=other,o=organization,dc=org',
+                  'cn=workers,o=any,o=organization,dc=org',
+              ],
+          ],
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_cardinality.html b/2.1/core/authproc_cardinality.html new file mode 100644 index 0000000..1f8e9da --- /dev/null +++ b/2.1/core/authproc_cardinality.html @@ -0,0 +1,194 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:Cardinality + +

+

+ Ensure the number of attribute values is within the specified multiplicity. +

+

+ This filter should contain a set of attribute name => rule pairs describing the multiplicity rules for an attribute. +

+

+ The special parameter + + %ignoreEntities + + can be used to give an array of entity IDs that should be ignored for testing, etc purposes. +

+

+ A separate + + + core:CardinalitySingle + + + authproc filter provides additional functionality for the special case where attributes are single valued. +

+

+ Specifying Rules +

+

+ Multiplicity rules are specified as an associative array containing one or more of the following parameters: +

+
+
+ + min + +
+
+ The minimum number of values (participation) this attribute should have. Defaults to + + zero + + . +
+
+ + max + +
+
+ The maximum number of values (cardinality) this attribute should have. Defaults to no upper bound. +
+
+ + warn + +
+
+ Log a warning rather than generating an error. Defaults to + + false + + . +
+
+

+ For convenience, minimum and maximum values can also be specified using a shorthand list notation. +

+

+ Examples +

+

+ Require at least one + + givenName + + , no more than two email addresses, and between two and four values for + + eduPersonScopedAffiliation + + . +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:Cardinality',
+          'givenName' => ['min' => 1],
+          'mail' => ['max' => 2],
+          'eduPersonScopedAffiliation' => ['min' => 2, 'max' => 4],
+      ],
+  ],
+
+
+

+ Use the shorthand notation for min, max: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:Cardinality',
+          'mail' => [0, 2],
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_cardinalitysingle.html b/2.1/core/authproc_cardinalitysingle.html new file mode 100644 index 0000000..f326684 --- /dev/null +++ b/2.1/core/authproc_cardinalitysingle.html @@ -0,0 +1,254 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:CardinalitySingle + +

+

+ Ensure the correct cardinality of single-valued attributes. This filter is a special case +of the more generic + + + core:Cardinality + + + filter that allows for optional corrective measures +when multi-valued attributes are received where single-valued ones are expected. +

+

+ Parameters +

+

+ This filter implements a number of optional parameters: +

+
+
+ + singleValued + +
+
+ array of attribute names that + + must + + be single-valued, or a 403 error is generated. +
+
+ + firstValue + +
+
+ array of attribute names where only the first value of a multi-valued assertion should be returned. +
+
+ + flatten + +
+
+ array of attribute names where a multi-valued assertion is flattened into a single delimited string. +
+
+ + flattenWith + +
+
+ the delimiter for + + flatten + + . Defaults to ";". +
+
+ + ignoreEntities + +
+
+ array of entity IDs that should be ignored for testing, etc purposes. +
+
+

+ When the same attribute name appears in multiple stanzas, they are processed in the order above. +

+

+ Examples +

+

+ Abort with an error if any attribute defined as single-valued in the eduPerson or SCHAC schemas exists and has more than one value: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:CardinalitySingle',
+          'singleValued' => [
+              /* from eduPerson (internet2-mace-dir-eduperson-201602) */
+              'eduPersonOrgDN', 'eduPersonPrimaryAffiliation', 'eduPersonPrimaryOrgUnitDN',
+              'eduPersonPrincipalName', 'eduPersonUniqueId',
+              /* from inetOrgPerson (RFC2798), referenced by internet2-mace-dir-eduperson-201602 */
+              'displayName', 'preferredLanguage',
+              /* from SCHAC-IAD Version 1.3.0 */
+              'schacMotherTongue', 'schacGender', 'schacDateOfBirth', 'schacPlaceOfBirth',
+              'schacPersonalTitle', 'schacHomeOrganization', 'schacHomeOrganizationType',
+              'schacExpiryDate',
+          ],
+      ],
+  ],
+
+
+

+ Abort if multiple values are received for + + eduPersonPrincipalName + + , but take the first value for + + eduPersonPrimaryAffiliation + + : +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:CardinalitySingle',
+          'singleValued' => ['eduPersonPrincipalName'],
+          'firstValue' => ['eduPersonPrimaryAffiliation'],
+          ],
+      ],
+  ],
+
+
+

+ Construct + + eduPersonPrimaryAffiliation + + using the first value in + + eduPersonAffiliation + + : +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeCopy',
+          'eduPersonAffiliation' => 'eduPersonPrimaryAffiliation',
+      ],
+      51 => [
+          'class' => 'core:CardinalitySingle',
+          'firstValue' => ['eduPersonPrimaryAffiliation'],
+      ],
+  ],
+
+
+

+ Construct a single, comma-separated value version of + + eduPersonAffiliation + + : +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:AttributeCopy',
+          'eduPersonAffiliation' => 'eduPersonAffiliationWithCommas',
+      ],
+      51 => [
+          'class' => 'core:CardinalitySingle',
+          'flatten' => ['eduPersonAffiliationWithCommas'],
+          'flattenWith' => ',',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_generategroups.html b/2.1/core/authproc_generategroups.html new file mode 100644 index 0000000..1f5b678 --- /dev/null +++ b/2.1/core/authproc_generategroups.html @@ -0,0 +1,217 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:GenerateGroups + +

+

+ This filter creates a + + group + + attribute based on the contents of the other attributes of the user. +

+

+ By default this filter will generate groups from the following set of attributes: +

+
    +
  • + + eduPersonAffiliation + +
    • +
  • + + eduPersonOrgUnitDN + +
    • +
  • + + eduPersonEntitlement + +
    • +
+

+ This can be overridden by specifying the names of the attributes in the configuration. +

+

+ It will attempt to determine a realm the user belongs to based on the + + eduPersonPrincipalName + + attribute, if it is present. +

+

+ The groups this filter generates are on the form + + <attribute name>-<attributevalue> + + and + + <attributename>-<realm>-<attributevalue> + + . +For example, if the user has the following attributes: +

+
    +
  • + + eduPersonPrincipalName + + : + + user@example.org + +
    • +
  • + + eduPersonAffiliation + + : + + student + + , + + member + +
    • +
+

+ The following groups will be created: +

+
    +
  • + + eduPersonAffiliation-student + +
    • +
  • + + eduPersonAffiliation-member + +
    • +
  • + + eduPersonAffiliation-example.org-student + +
    • +
  • + + eduPersonAffiliation-example.org-member + +
    • +
+

+ Examples +

+

+ Default attributes: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:GenerateGroups',
+      ],
+  ],
+
+
+

+ Custom attributes: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:GenerateGroups',
+          'someAttribute',
+          'someOtherAttribute',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_languageadaptor.html b/2.1/core/authproc_languageadaptor.html new file mode 100644 index 0000000..7213b31 --- /dev/null +++ b/2.1/core/authproc_languageadaptor.html @@ -0,0 +1,168 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:LanguageAdaptor + +

+

+ SimpleSAMLphp has built in language support, and stores the preferred language in a cookie. +

+

+ Identity systems also often has a specific attribute that indicates what language is understood by the user. +MACE defines an attribute with preferred language: + + preferredLanguage + + . + + Read more about the preferredLanguage attribute defined by MACE + + . +

+

+ The LanguageAdaptor brings these two concepts together. +If executed early at the IdP it will check if the + + preferredLanguage + + attribute is among the user's attributes, and if it is, SimpleSAMLphp will use that language in the user interface. + + Note: + + the login page itself is too early to be influenced by the user attributes, because the IdP does not know any user attributes before the user logs in. +In contrast, the consent module will be presented in the correct language based on the user attribute. +

+

+ The LanguageAdaptor also works the other way around. +If the user does not have the + + preferredLanguage + + attribute, the user interface for the user will be set to the default for the installation. +If this language is not correct for the user, the user may click to switch language on the login page (or any other UI page in SimpleSAMLphp). +SimpleSAMLphp then stores the preferred language in a cookie. +Now, the LanguageAdaptor will read the preferred language from the cookie and add a user attribute with the preferred language, that is sent to the service provider. +

+

+ The name of the attribute can be changed from the default by adding the + + attributename + + option. +

+

+ Examples +

+

+ Default attribute ( + + preferredLanguage + + ): +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:LanguageAdaptor',
+      ],
+  ],
+
+
+

+ Custom attribute: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:LanguageAdaptor',
+          'attributename' => 'lang',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_php.html b/2.1/core/authproc_php.html new file mode 100644 index 0000000..ee267c4 --- /dev/null +++ b/2.1/core/authproc_php.html @@ -0,0 +1,195 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:PHP + +

+

+ This is a filter which makes it possible to run arbitrary PHP code to modify the attributes or state of an user. +

+

+ Parameters +

+
+
+ + class + +
+
+ This is the name of the filter. + It must be + + 'core:PHP' + + . +
+
+ + code + +
+
+ The PHP code that should be run. This code will have two variables available: +
+
+
    +
  • +

    + + $attributes + + . + This is an associative array of attributes, and can be modified to add or remove attributes. +

    +
    • +
  • +

    + + $state + + . + This is an associative array of request state. It can be modified to adjust data related to the authentication + such as desired NameId, requested Attributes, authnContextRef and many more. +

    +
    • +
+

+ Examples +

+

+ Add the + + mail + + attribute based on the user's + + uid + + attribute: +

+
+ 
  10 => [
+      'class' => 'core:PHP',
+      'code' => '
+          if (empty($attributes["uid"])) {
+              throw new Exception("Missing uid attribute.");
+          }
+
+          $uid = $attributes["uid"][0];
+          $mail = $uid . "@example.net";
+          $attributes["mail"] = [$mail];
+      ',
+  ],
+
+
+

+ Create a random number variable: +

+
+ 
  10 => [
+      'class' => 'core:PHP',
+      'code' => '
+          $attributes["random"] = [
+              (string)rand(),
+          ];
+      ',
+  ],
+
+
+

+ Force a specific NameIdFormat. Useful if an SP misbehaves and requests (or publishes) an incorrect NameId +

+
+ 
  90 => [
+       'class' => 'core:PHP',
+       'code' => '$state["saml:NameIDFormat"] = ["Format" => "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", "AllowCreate" => true];'
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_scopeattribute.html b/2.1/core/authproc_scopeattribute.html new file mode 100644 index 0000000..ff69bf4 --- /dev/null +++ b/2.1/core/authproc_scopeattribute.html @@ -0,0 +1,210 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:ScopeAttribute + +

+

+ A filter which combines two attributes into a scoped attribute. +That is, the value will be + + something@scope + + , usually to make it globally unique. +

+

+ Parameters +

+
+
+ + scopeAttribute + +
+
+ The attribute that contains the scope. +
+
+ If the attribute contains a '@', we will take the scope from the part following the '@'. + Otherwise, we will use the entire value. +
+
+ If the attribute is multi-valued, we will add all the scopes to the target. +
+
+ + sourceAttribute + +
+
+ The attribute that contains the values we shall add the scope to. +
+
+ This attribute can be multi-valued, in which case we will add all the values. +
+
+ + targetAttribute + +
+
+ The attribute we shall add the scoped attributes to. +
+
+ If the attribute already exists, the new values will be merged into the existing attribute. +
+
+ + onlyIfEmpty + +
+
+ Only replace the targetAttribute if it is empty to begin with. +
+
+ If + + true + + , then the targetAttribute will only be created if it didn't already contain values. Defaults to + + false + + . +
+
+ This is useful if, for instance, you want to create eduPersonScopedAffiliation from eduPersonAffiliation + + only + + if eduPersonScopedAffiliation was not returned by the authenticaton source. +
+
+

+ Example +

+

+ Add eduPersonScopedAffiliation based on eduPersonAffiliation and eduPersonPrincipalName. +

+
+ 
  10 => [
+      'class' => 'core:ScopeAttribute',
+      'scopeAttribute' => 'eduPersonPrincipalName',
+      'sourceAttribute' => 'eduPersonAffiliation',
+      'targetAttribute' => 'eduPersonScopedAffiliation',
+  ],
+
+
+

+ With values being + + eduPersonPrincipalName + + : + + jdoe@example.edu + + and + + eduPersonAffiliation + + : + + faculty + + , this will result in the attribute + + eduPersonScopedAffiliation + + with value + + faculty@example.edu + + . +

+
+ diff --git a/2.1/core/authproc_scopefromattribute.html b/2.1/core/authproc_scopefromattribute.html new file mode 100644 index 0000000..ce43a44 --- /dev/null +++ b/2.1/core/authproc_scopefromattribute.html @@ -0,0 +1,143 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:ScopeFromAttribute + +

+

+ This filter creates a new attribute based on the scope from a different attribute. +

+

+ Parameters +

+

+ This filter has two parameters, where both parameters are mandatory. +

+
+
+ + sourceAttribute + +
+
+ The attribute we should extract the scope from. +
+
+ + targetAttribute + +
+
+ The name of the new attribute. +
+
+

+ Example +

+

+ Set the + + scope + + attribute to the scope from the + + eduPersonPrincipalName + + attribute: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:ScopeFromAttribute',
+          'sourceAttribute' => 'eduPersonPrincipalName',
+          'targetAttribute' => 'scope',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_statisticswithattribute.html b/2.1/core/authproc_statisticswithattribute.html new file mode 100644 index 0000000..efd07ff --- /dev/null +++ b/2.1/core/authproc_statisticswithattribute.html @@ -0,0 +1,142 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:StatisticsWithAttribute + +

+

+ This filter logs a statistics entry that can be parsed by the statistics module. +

+

+ Parameters +

+
+
+ + attributename + +
+
+ The name of an attribute that should be included in the statistics entry. +
+
+ + type + +
+
+ The type of the statistics entry. +
+
+ + skipPassive + +
+
+ A boolean indicating whether passive requests should be skipped. Defaults to + + false + + , in which case the type tag is prefixed with 'passive-'. +
+
+

+ Example +

+

+ Log the realm of the user: +

+
+ 
  45 => [
+      'class' => 'core:StatisticsWithAttribute',
+      'attributename' => 'realm',
+      'type' => 'saml20-idp-SSO',
+  ],
+
+
+
+ diff --git a/2.1/core/authproc_targetedid.html b/2.1/core/authproc_targetedid.html new file mode 100644 index 0000000..1de413d --- /dev/null +++ b/2.1/core/authproc_targetedid.html @@ -0,0 +1,190 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:TargetedID + +

+

+ This filter generates the + + eduPersonTargetedID + + attribute for the user. +

+

+ This filter will use the contents of the attribute set by the + + identifyingAttribute + + option as the unique user ID. +

+

+ Parameters +

+
+
+ + identifyingAttribute + +
+
+ The name of the attribute we should use for the unique user identifier. +
+ 
Note: only the first value of the specified attribute is being used for the generation of the identifier.
+
+
+
+
+ + nameId + +
+
+ Set this option to + + true + + to generate the attribute as in SAML 2 NameID format. + This can be used to generate an Internet2 compatible + + eduPersonTargetedID + + attribute. + Optional, defaults to + + false + + . +
+
+

+ Examples +

+

+ A custom attribute: +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:TargetedID',
+          'identifyingAttribute' => 'eduPersonPrincipalName'
+      ],
+  ],
+
+
+

+ Internet2 compatible + + eduPersontargetedID + + : +

+
+ 
  /* In saml20-idp-hosted.php. */
+  $metadata['urn:x-simplesamlphp:example-idp'] = [
+      'host' => '__DEFAULT__',
+      'auth' => 'example-static',
+
+      'authproc' => [
+          60 => [
+              'class' => 'core:TargetedID',
+              'nameId' => true,
+          ],
+          90 => [
+              'class' => 'core:AttributeMap',
+              'name2oid',
+          ],
+      ],
+      'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+      'attributeencodings' => [
+          'urn:oid:1.3.6.1.4.1.5923.1.1.1.10' => 'raw', /* eduPersonTargetedID with oid NameFormat. */
+      ],
+  ];
+
+
+
+ diff --git a/2.1/core/authproc_warnshortssointerval.html b/2.1/core/authproc_warnshortssointerval.html new file mode 100644 index 0000000..e037144 --- /dev/null +++ b/2.1/core/authproc_warnshortssointerval.html @@ -0,0 +1,107 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + core:WarnShortSSOInterval + +

+

+ Give a warning to the user when authenticating twice in a short time. +This is mainly intended to prevent redirect loops between the IdP and the SP. +

+

+ Example +

+
+ 
  'authproc' => [
+      50 => [
+          'class' => 'core:WarnShortSSOInterval',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/core/authsource_selector.html b/2.1/core/authsource_selector.html new file mode 100644 index 0000000..9acfea8 --- /dev/null +++ b/2.1/core/authsource_selector.html @@ -0,0 +1,217 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Authentication source selector +

+

+ The Authentication source selector is a special kind of Authentication Source +that delegates the actual authentication to a secondary Authentication Source +based on some form of policy decision. +

+

+ AbstractSourceSelector +

+

+ The AbstractSourceSelector extends from + + \SimpleSAML\Auth\Source + + and as such +act as an Authentication Source. Any derivative classes must implement the +abstract + + selectAuthSource + + method. This method must return the name of the +Authentication Source to use, based on whatever logic is necessary. +

+

+ SourceIPSelector +

+

+ The SourceIPSelector is an implementation of the + + AbstractSourceSelector + + that +uses the client IP to decide what Authentication Source is called. +It works by defining zones with corresponding IP-ranges and Authentication +Sources. The 'default' zone is optional and acts as a fallback when none +of the zones match a client's IP-address. When set to + + null + + a NotFound- +exception will be thrown. +

+

+ An example configuration would look like this: +

+
+ 
    'selector' => [
+        'core:SourceIPSelector',
+
+        'zones' => [
+            'internal' => [
+                'source' => 'ldap',
+                'subnet' => [
+                    '10.0.0.0/8',
+                    '2001:0DB8::/108',
+                ],
+            ],
+
+            'other' => [
+                'source' => 'radius',
+                'subnet' => [
+                    '172.16.0.0/12',
+                    '2002:1234::/108',
+                ],
+            ],
+
+            'default' => 'yubikey',
+        ],
+    ],
+
+
+

+ RequestedAuthnContextSelector +

+

+ The RequestedAuthnContextSelector is an implementation of the + + AbstractSourceSelector + + that +uses the RequestedAuthnContext to decide what Authentication Source is called. +It works by defining AuthnContexts with their corresponding Authentication +Sources. The 'default' key will be used as a default when no RequestedAuthnContext +is passed in the request. +

+

+ An example configuration would look like this: +

+
+ 
    'selector' => [
+        'core:RequestedAuthnContextSelector',
+
+        'contexts' => [
+            10 => [
+                'identifier' => 'urn:x-simplesamlphp:loa1',
+                'source' => 'ldap',
+            ],
+
+            20 => [
+                'identifier' => 'urn:x-simplesamlphp:loa2',
+                'source' => 'radius',
+            ],
+
+            'default' => [
+                'identifier' => 'urn:x-simplesamlphp:loa0',
+                'source' => 'sql',
+            ],
+        ],
+    ],
+
+
+

+ YourCustomSourceSelector +

+

+ If you have a use-case for a custom Authentication source selector, all you +have to do is to create your own class, make it extend + + AbstractSourceSelector + + and make it implement the abstract + + selectAuthSource + + method containing +your own logic. The method should return the name of the Authentication +source to use. +

+
+ diff --git a/2.1/cron/cron.html b/2.1/cron/cron.html new file mode 100644 index 0000000..d8e514f --- /dev/null +++ b/2.1/cron/cron.html @@ -0,0 +1,368 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Cron +

+
+ +
+

+ Introduction +

+

+ The cron module allows you to do tasks regularly, by setting up a cron +job that calls a hook in SimpleSAMLphp. This will invoke + + hooks/hook_cron.php + + in any enabled modules +

+

+ Modules, like e.g. the metarefresh module, that want to invoke tasks +on set times, can register cron hooks for use by this module. You in turn +configure your system's + + cron + + or other time based execution functionality +to periodically trigger this module's endpoint, so all registered hooks +will be executed at that time. This module also takes care of reporting +back the result and provides an interface in SimpleSAMLphp's admin +panel to trigger jobs manually. +

+

+ Preparations +

+

+ You need to enable the module in + + config.php + + and copy the + + config-templates + + files of the module into the global + + config/ + + directory. +

+
+ 
'module.enable' => [
+     'cron' => true,
+     …
+],
+
+
+
+ 
[user@simplesamlphp] cd /var/simplesamlphp
+[user@simplesamlphp simplesamlphp] cp modules/cron/config/module_cron.php.dist config/module_cron.php
+
+
+

+ Configuring the cron module +

+

+ The configuration ( + + config/module_cron.php + + ) should look similar to this: +

+
+ 
$config = [
+   'key' => 'RANDOM_KEY',
+   'allowed_tags' => ['daily', 'hourly', 'frequent'],
+   'debug_message' => true,
+   'sendemail' => true,
+];
+
+
+

+ Bear in mind that the key is used as a security feature, to restrict +access to your cron. Therefore, you need to make sure that the string +here is a random key available to no one but you. Additionally, make +sure that you include here the appropriate tags - for example any tags +that you previously told metarefresh to use in the + + cron + + directive. +

+

+ Triggering Cron +

+

+ You can trigger the cron hooks through HTTP or CLI. The HTTP method +is the original technique, and it is recommended if you don't need to +trigger CPU or memory intensive cron hooks. The CLI option is +recommended if you need more control over memory, CPU limits and +process priority. +

+

+ With HTTP +

+

+ + cron + + functionality can be invoked by making an HTTP request to the +cron module. Use your web browser to go to + + https://YOUR_SERVER/simplesaml/module.php/cron/croninfo.php + + . Make +sure to properly set your server's address, as well as use HTTP or +HTTPS accordingly, and also to specify the correct path to the root of +your SimpleSAMLphp installation. +

+

+ Now, copy the cron configuration suggested on that page: +

+
+ 
# Run cron [daily]
+02 0 * * * curl -sS "https://YOUR_SERVER/simplesaml/module.php/cron/run/daily/RANDOM_KEY"
+# Run cron [hourly]
+01 * * * * curl -sS "https://YOUR_SERVER/simplesaml/module.php/cron/run/hourly/RANDOM_KEY"
+
+
+

+ Finally, add it to your crontab by going back to the terminal, and editing with: +

+
+ 
[user@simplesamlphp config]# crontab -e
+
+
+

+ This will open up your favourite editor. If an editor different than +the one you use normally appears, exit, and configure the + + EDITOR + + variable to tell the command line which editor it should use: +

+
+ 
[user@simplesamlphp config]# export EDITOR=emacs
+
+
+

+ If you want to trigger a job manually, you can do +so by going back to the cron page in the web interface. Then, just +follow the appropriate links to execute the cron jobs you want. The +page will take a while loading, and eventually show a blank page. +

+

+ With CLI +

+

+ You can invoke cron functionality by running + + /var/simplesamlphp/modules/cron/bin/cron.php + + and providing a tag +with the + + -t + + argument. +

+

+ It is strongly recommended that you run the cron cli script as the +same user as the web server. Several cron hooks created files and +those files may have the wrong permissions if you run the job as root. +

+

+ + note: + + Logging behavior in SSP when running from CLI varies by +version. The latest version logs to PHP's error log and ignores any +logging configuration from + + config.php + +

+

+ Below is an example of invoking the script. It will: +

+
    +
  • + Run a command as the + + apache + + user +
      +
    • + + -s + + specifies + + apache + + user's shell, since the default is non-interactive +
      • +
    +
    • +
  • + Override INI entries to increase memory and execution time. +
      +
    • + This allows for processing large metadata files in metarefresh +
      • +
    +
    • +
  • + Run the + + cron.php + + script with the + + hourly + + tag +
    • +
  • + Use + + nice + + to lower the priority below that of web server processes +
    • +
+
+ 
su -s "/bin/sh" \
+   -c "nice -n 10 \
+       php -d max_execution_time=120 -d memory_limit=600M \
+       /var/simplesamlphp/modules/cron/bin/cron.php -t hourly" \
+    apache
+
+
+
+ diff --git a/2.1/index.html b/2.1/index.html new file mode 100644 index 0000000..6eaebe4 --- /dev/null +++ b/2.1/index.html @@ -0,0 +1,262 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Documentation +

+ +
+ diff --git a/2.1/multiauth/multiauth.html b/2.1/multiauth/multiauth.html new file mode 100644 index 0000000..00220da --- /dev/null +++ b/2.1/multiauth/multiauth.html @@ -0,0 +1,303 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ MultiAuth module +

+

+ The MultiAuth module provides a method for users to choose between +a list of authentication sources. There is only one authentication +module: +

+
+
+ + multiauth:MultiAuth + +
+
+ Authenticate the user against a list of authentication sources. +
+
+

+ + multiauth:MultiAuth + +

+

+ This module is useful when you want to let the users decide which +authentication source fits better their needs at any scenario. For +example, they can choose the + + saml + + authentication source in most +cases and then switch to the + + admin + + authentication source when +'saml' is down for some reason. +

+

+ To create a MultiAuth authentication source, open + + config/authsources.php + + in a text editor, and add an entry for the +authentication source: +

+
+ 
  'example-multi' => [
+      'multiauth:MultiAuth',
+
+      /*
+       * The available authentication sources.
+       * They must be defined in this authsources.php file.
+       */
+      'sources' => [
+          'example-saml' => [
+              'text' => [
+                  'en' => 'Log in using a SAML SP',
+                  'es' => 'Entrar usando un SP SAML',
+              ],
+              'css_class' => 'SAML',
+              'AuthnContextClassRef' => ['urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI', 'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract'],
+          ],
+          'example-admin' => [
+              'text' => [
+                  'en' => 'Log in using the admin password',
+                  'es' => 'Entrar usando la contraseña de administrador',
+              ],
+              'AuthnContextClassRef' => 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
+          ],
+      ],
+  ],
+
+  'example-saml' => [
+      'saml:SP',
+      'entityId' => 'https://myapp.example.org',
+      'idp' => 'my-idp',
+  ],
+
+  'example-admin' => [
+      'core:AdminPassword',
+  ],
+
+
+

+ You should update the name of this authentication source +( + + example-multi + + ), and the authentication sources it references, +to have a name which makes sense to your organization. +

+

+ The MultiAuth authentication sources only has one option: the + + sources + + option, and it is required. It is an array of other +authentication sources defined in the + + config/authsources.php + + file. The order in this array does not matter since the user +is the one that decides which one to use. +

+

+ The keys of the sources array are the identifiers of authentication +sources defined in the authsources.php configuration file. The +values are arrays with information used to create the user +interface that will let the user select the authentication source +they want. +

+

+ Each source in the sources array has a key and a value. As +mentioned above the key is the authsource identifier and the value +is another array with optional keys: 'text', 'css_class', 'help', and 'AuthnContextClassRef'. +The text element is another array with localized strings for one +or more languages. These texts will be shown in the selectsource.php +view. Note that you should at least enter the text in the default +language as specified in your config.php file. The css_class +element is a string with the css class that will be applied to +the <li> element in the selectsource.php view. By default the +authtype of the authsource is used as the css class with colons +replaced by dashes. So in the previous example, the css class used +in the 'example-admin' authentication source would be +'core-AdminPassword'. The help element is another array with localized +strings for one or more languages. These texts will be shown in the +selectsource.php view. The AuthnContextClassRef is either a string or +an array of strings containing + + context class ref names + + . +If an SP sets AuthnContextClassRef the list of authsources will be +filtered to only those containing context class refs that are part of the list set by the SP. +If a single authsource results from this filtering the user will be taken directly to the +authentication page for that source, and will never be shown the multiauth select page. +

+

+ It is possible to add the parameter + + source + + to the calling URL, +when accessing a service, to allow the user to preselect the +authsource to be used. This can be handy if you support different +authentication types for different types of users and you want the +users to have a direct link to the service and not want them to +select the correct authentication source. +

+

+ For example: +

+

+ + https://example.com/service/?source=saml + +

+

+ will take you directly to the SAML authentication source, instead +of hitting the multiauth select page, but this works only if you +don't have redirections during the authentication process. +

+

+ You can also use the multiauth:preselect parameter to the login call: +

+
+ 
  $as = new \SimpleSAML\Auth\Simple('my-multiauth-authsource');
+  $as->login([
+      'multiauth:preselect' => 'default-sp',
+  ]);
+
+
+

+ Or add the + + preselect + + option in the filter: +

+
+ 
  'example-multi' => [
+      'multiauth:MultiAuth',
+
+      /*
+       * The available authentication sources.
+       * They must be defined in this authsources.php file.
+       */
+      'sources' => [
+          'example-saml' => [
+          // ...
+          ],
+          'example-admin' => [
+          // ...
+          ],
+      ],
+      'preselect' => 'example-saml',
+  ],
+
+
+

+ The order of priority, in case more than one option was used is: + + source + + url parameter, + + multiauth:preselect + + login state and + + preselect + + filter option. +

+
+ diff --git a/2.1/saml/authproc_authncontextclassref.html b/2.1/saml/authproc_authncontextclassref.html new file mode 100644 index 0000000..9e9bcd8 --- /dev/null +++ b/2.1/saml/authproc_authncontextclassref.html @@ -0,0 +1,111 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:AuthnContextClassRef + +

+

+ IDP-side filter for setting the + + AuthnContextClassRef + + element in the authentication response. +

+

+ Examples +

+
+ 
  'authproc.idp' => [
+    92 => [
+      'class' => 'saml:AuthnContextClassRef',
+      'AuthnContextClassRef' => 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
+    ],
+  ],
+
+
+
+ diff --git a/2.1/saml/authproc_expectedauthncontextclassref.html b/2.1/saml/authproc_expectedauthncontextclassref.html new file mode 100644 index 0000000..6a7f643 --- /dev/null +++ b/2.1/saml/authproc_expectedauthncontextclassref.html @@ -0,0 +1,117 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:ExpectedAuthnContextClassRef + +

+

+ SP side attribute filter to validate AuthnContextClassRef. +

+

+ This filter checks the AuthnContextClassRef in the authentication response, and accepts or denies the access depending on the provided strength measure of authentication from IdP. +

+

+ You can list the accepted authentitcation context values in the Service Provider configuration file. +If the given AuthnContextClassRef does not match any accepted value, the user will be redirected to an error page. It's useful to harmonize the SP's requested AuthnContextClassRef (another authproc filter), but you can accept more authentication strength measures than you requested for. +

+

+ Examples +

+
+ 
  'authproc.sp' => [
+    91 => [
+      'class' => 'saml:ExpectedAuthnContextClassRef',
+      'accepted' => [
+        'urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:3',
+        'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
+      ],
+    ],
+  ],
+
+
+
+ diff --git a/2.1/saml/authproc_pairwiseid.html b/2.1/saml/authproc_pairwiseid.html new file mode 100644 index 0000000..a917e2f --- /dev/null +++ b/2.1/saml/authproc_pairwiseid.html @@ -0,0 +1,130 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:PairwiseID + +

+

+ Filter to insert a pairwise-id that complies with the + + SAML V2.0 Subject Identifier Attributes Profile + + . +

+

+ This filter will take an attribute and a scope as input and transforms this +into a anonymized and scoped identifier that is globally unique for a given +user & service provider combination. +

+

+ Note: +Since the subject-id is specified as single-value attribute, only the first +value of + + identifyingAttribute + + and + + scopeAttribute + + are considered. +

+

+ Examples +

+
+ 
    'authproc' => [
+        50 => [
+            'class' => 'saml:PairwiseID',
+            'identifyingAttribute' => 'uid',
+            'scopeAttribute' => 'scope',
+        ],
+    ],
+
+
+
+ diff --git a/2.1/saml/authproc_subjectid.html b/2.1/saml/authproc_subjectid.html new file mode 100644 index 0000000..336baba --- /dev/null +++ b/2.1/saml/authproc_subjectid.html @@ -0,0 +1,138 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:SubjectID + +

+

+ Filter to insert a subject-id that complies with the + + SAML V2.0 Subject Identifier Attributes Profile + + . +

+

+ This filter will take an attribute and a scope as input and transforms this +into a scoped identifier that is globally unique for a given user. +

+

+ + Note + + If privacy is of your concern, you may want to use the PairwiseID-filter +instead. +

+

+ + Note + + Since the subject-id is specified as single-value attribute, only the first +value of + + identifyingAttribute + + and + + scopeAttribute + + are considered. +

+

+ Examples +

+
+ 
    'authproc' => [
+        50 => [
+            'class' => 'saml:SubjectID',
+            'identifyingAttribute' => 'uid',
+            'scopeAttribute' => 'scope',
+        ],
+    ],
+
+
+
+ diff --git a/2.1/saml/filterscopes.html b/2.1/saml/filterscopes.html new file mode 100644 index 0000000..dcf375b --- /dev/null +++ b/2.1/saml/filterscopes.html @@ -0,0 +1,232 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Scoped Attributes Filtering +

+

+ This document describes the + + FilterScopes + + attribute filter in the saml module. +

+

+ This filter allows a Service Provider to make sure the scopes included in the values +of certain attributes correspond to what the Identity Provider declares in its +metadata. If the IdP includes a list of scopes in the metadata, only those scopes will +be allowed. On the other hand, if no scopes are declared or the scope is not included +in the list of declared scopes, it will be matched against the domain used by the +SAML + + SingleSignOnService + + endpoint. This means the + + example.com + + scope will be +allowed in attributes received from an IdP whose + + SingleSignOnService + + endpoint +is located on the + + example.com + + top domain or any subdomain of that. Such scope will +be rejected though if the match with the IdP's endpoint does not happen at the top +level, like for example with + + example.com.domain.net + + . +

+

+ If you are configuring the metadata of an IdP manually, remember to add an array +to it with the key + + scope + + , containing the list of scopes expected from that entity. +

+

+ Configuration +

+

+ This filter can be configured in the + + config/authsources.php + + file, inside the + + authproc + + array of the corresponding SAML authentication source in use. +

+

+ Note that this filter + + can only be used with SAML authentication sources + + . +

+

+ Here are the options available for the filter: +

+
+
+ + attributes + +
+
+ An array containing a list of attributes that are scoped and therefore should be evaluated. + Defaults to + + eduPersonPrincipalName + + and + + eduPersonScopedAffiliation + + . +
+
+

+ Examples +

+

+ Basic configuration: +

+
+ 
    'authproc' => [
+        90 => [
+            'class' => 'saml:FilterScopes',
+        ],
+    ],
+
+
+

+ Specify + + mail + + and + + eduPersonPrincipalName + + as scoped attributes: +

+
+ 
    'authproc' => [
+        90 => [
+            'class' => 'saml:FilterScopes',
+            'attributes' => [
+                'mail',
+                'eduPersonPrincipalName',
+            ],
+        ],
+    ],
+
+
+

+ Specify the same attributes in OID format: +

+
+ 
    'authproc' => [
+        90 => [
+            'class' => 'saml:FilterScopes',
+            'attributes' => [
+                'urn:oid:0.9.2342.19200300.100.1.3',
+                'urn:oid:1.3.6.1.4.1.5923.1.1.1.6',
+            ],
+        ],
+    ],
+
+
+
+ diff --git a/2.1/saml/keyrollover.html b/2.1/saml/keyrollover.html new file mode 100644 index 0000000..0241bfe --- /dev/null +++ b/2.1/saml/keyrollover.html @@ -0,0 +1,299 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Key rollover with SimpleSAMLphp +

+

+ This document gives a quick guide to doing key rollover with a SimpleSAMLphp service provider or identity provider. +

+

+ Background +

+

+ A key rollover must perform several steps so that authentication does not break while remote SPs and IdPs learn about the new certificate. If you follow this procedure there should be no need for a synchronised switchover moment. It takes the following steps, which are detailed below: +

+
    +
  1. + You generate a new keypair for your entity to use. +
    2. +
  2. + You configure both old and new key in your SimpleSAMLphp config. Your +entity publishes metadata with two certificates in it. Meanwhile it continues to sign with the old key. +
    3. +
  3. + Relying parties (remote SPs or IdPs) refresh your metadata and will hence thereby trust the two listed certs (old and new). If they do not automatically refresh metadata their config needs to be updated manually to trust both the old and new certificate. +
    4. +
  4. + Once all relying parties have updated metadata with both certificates, you remove old certificate from your SimpleSAMLphp configuration, effectively doing the actual key rollover. Your SimpleSAMLphp now signs with the new key. Everything remains working because all relying parties will trust old and new certificate. +
    5. +
  5. + Your SimpleSAMLphp now publishes metadata with only the new cert. Relying parties will refresh metadata and drop the old certificate, not trusting it anymore (or remove the old certificate from their config manually). This last step is essential to ensure that the old certificate is actually distrusted. +
    6. +
+

+ The steps +

+

+ Create the new key and certificate +

+

+ First you must create the new key that you are going to use. +To create a self signed certificate, you may use the following command: +

+
+ 
cd cert
+openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out new.crt -keyout new.pem
+
+
+

+ Add the new key to SimpleSAMLphp +

+

+ Where you add the new key depends on whether you are doing key rollover for a service provider or an identity provider. +If you are doing key rollover for a service provider, the new key must be added to + + config/authsources.php + + . +To do key rollover for an identity provider, you must add the new key to + + metadata/saml20-idp-hosted.php + + . +If you are changing the keys for both an service provider and identity provider at the same time, you must update both locations. +

+

+ The new certificate, private key and private key passphrase are added to the configuration with the prefix + + new_ + + : +

+

+ When the new key is added, SimpleSAMLphp will attempt to use both the new key and the old key for decryption of messages, but only the old key will be used for signing messages. +The metadata will be updated to list the new key for signing and encryption, and the old key will no longer listed as available for encryption. +This ensures that both those entities that use your old metadata and those that use your new metadata will be able to send and receive messages from you. +

+

+ + Examples + + : +

+

+ In + + config/authsources.php + + : +

+
+ 
    'default-sp' => [
+        'saml:SP',
+        'privatekey' => 'old.pem',
+        'certificate' => 'old.crt',
+        // When private key is passphrase protected.
+        'privatekey_pass' => '<old-secret>',
+
+        'new_privatekey' => 'new.pem',
+        'new_certificate' => 'new.crt',
+        // When new private key is passphrase protected.
+        'new_privatekey_pass' => '<new-secret>',
+    ],
+
+
+

+ In + + metadata/saml20-idp-hosted.php + + : +

+
+ 
    $metadata['urn:x-simplesamlphp:idp'] = [
+        'host' => '__DEFAULT__',
+        'auth' => 'example-userpass',
+        'privatekey' => 'old.pem',
+        'certificate' => 'old.crt',
+        // When private key is passphrase protected.
+        'privatekey_pass' => '<old-secret>',
+
+        'new_privatekey' => 'new.pem',
+        'new_certificate' => 'new.crt',
+        // When new private key is passphrase protected.
+        'new_privatekey_pass' => '<new-secret>',
+    ];
+
+
+

+ Distribute your new metadata +

+

+ Now, you need to make sure that all your peers are using your new metadata. +How you go about this depends on how your peers have added your metadata. +If your peers are configured to automatically fetch the metadata directly from you, all you need to do is to wait for all of them to fetch the new metadata. +If you are part of an federation, you would probably either send it to the federation operators or use a federation tool to ask for the metadata to be updated. +

+

+ Once the peers are using your new metadata, they will accept messages from you signed with either your old or your new key. +If they send encrypted messages to you, they will use your new key for encryption. +

+

+ Remove the old key +

+

+ Once you are certain that all your peers are using the new metadata, you must remove the old key. +Replace the existing + + privatekey + + , + + privatekey_pass + + and + + certificate + + values op in your configuration with values from the + + new_privatekey + + , + + new_privatekey_pass + + and + + new_certificate + + , and remove the latter options.. +This will cause your old key to be removed from your metadata. +

+

+ + Examples + + : +

+

+ In + + config/authsources.php + + : +

+
+ 
    'default-sp' => [
+        'saml:SP',
+        'certificate' => 'new.crt',
+        'privatekey' => 'new.pem',
+        // When private key is passphrase protected.
+        'privatekey_pass' => '<new-secret>',
+    ],
+
+In `metadata/saml20-idp-hosted.php`:
+
+```php
+    $metadata['urn:x-simplesamlphp:idp'] = [
+        'host' => '__DEFAULT__',
+        'auth' => 'example-userpass',
+        'certificate' => 'new.crt',
+        'privatekey' => 'new.pem',
+        // When private key is passphrase protected.
+        'privatekey_pass' => '<new-secret>',
+    ];
+
+
+

+ Distribute your final metadata +

+

+ Now you need to update the metadata of all your peers again, so that your old signing certificate is removed. +This will cause those entities to no longer accept messages signed using your old key. +

+
+ diff --git a/2.1/saml/nameid.html b/2.1/saml/nameid.html new file mode 100644 index 0000000..b41688c --- /dev/null +++ b/2.1/saml/nameid.html @@ -0,0 +1,501 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ NameID generation filters +

+

+ This document describes the NameID generation filters in the saml module. +

+

+ Common options +

+
+
+ + NameQualifier + +
+
+ The NameQualifier attribute for the generated NameID. + This can be a string that is used as the value directly. + It can also be + + true + + , in which case we use the IdP entity ID as the NameQualifier. + If it is + + false + + , no NameQualifier will be included. +
+
+ The default is + + false + + , which means that we will not include a NameQualifier by default. +
+
+ + SPNameQualifier + +
+
+ The SPNameQualifier attribute for the generated NameID. + This can be a string that is used as the value directly. + It can also be + + true + + , in which case we use the SP entity ID as the SPNameQualifier. + If it is + + false + + , no SPNameQualifier will be included. +
+
+ The default is + + true + + , which means that we will use the SP entity ID. +
+
+

+ + saml:AttributeNameID + +

+

+ Uses the value of an attribute to generate a NameID. +

+

+ + Options + + : +

+
+
+ + identifyingAttribute + +
+
+ The name of the attribute we should use as the unique user ID. +
+
+ + Format + +
+
+ The + + Format + + attribute of the generated NameID. +
+
+

+ + saml:PersistentNameID + +

+

+ Generates a persistent NameID with the format + + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + + . +The filter will take the user ID from the attribute described in the + + attribute + + option, and hash it with the + + secretsalt + + from + + config.php + + , and the SP and IdP entity ID. +The resulting hash is sent as the persistent NameID. +

+

+ + Options + + : +

+
+
+ + identifyingAttribute + +
+
+ The name of the attribute we should use as the unique user ID. +
+
+

+ + saml:TransientNameID + +

+

+ Generates a transient NameID with the format + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + . +

+

+ No extra options are available for this filter. +

+

+ + saml:SQLPersistentNameID + +

+

+ Generates and stores persistent NameIDs in a SQL database. +

+

+ This filter generates and stores a persistent NameID in a SQL database. +To use this filter, either specify the + + store + + option and a database, +or configure SimpleSAMLphp to use a SQL datastore. +See the + + store.type + + configuration option in + + config.php + + . +

+

+ + Options + + : +

+
+
+ + identifyingAttribute + +
+
+ The name of the attribute we should use as the unique user ID. +
+
+ + allowUnspecified + +
+
+ Whether a persistent NameID should be created if the SP does not specify any NameID format in the request. + The default is + + false + + . +
+
+ + allowDifferent + +
+
+ Whether a persistent NameID should be created if there are only other NameID formats specified in the request or the SP's metadata. + The default is + + false + + . +
+
+ + alwaysCreate + +
+
+ Whether to ignore an explicit + + AllowCreate="false" + + in the authentication request's NameIDPolicy. + The default is + + false + + , which will only create new NameIDs when the SP specifies + + AllowCreate="true" + + in the authentication request. +
+
+ + store + +
+
+ An array of database options passed to + + \SimpleSAML\Database + + , keys prefixed with + + database. + + . + The default is + + [] + + , which uses the global SQL datastore. +
+
+

+ Setting both + + allowUnspecified + + and + + alwaysCreate + + to + + true + + causes + + saml:SQLPersistentNameID + + to behave like + + saml:PersistentNameID + + (and other NameID generation filters), at the expense of creating unnecessary entries in the SQL datastore. +

+

+ + saml:PersistentNameID2TargetedID + +

+

+ Stores a persistent NameID in the + + eduPersonTargetedID + + -attribute. +

+

+ This filter is not actually a NameID generation filter. +Instead, it takes a persistent NameID and adds it as an attribute in the assertion. +This can be used to set the + + eduPersonTargetedID + + -attribute to the same value as the persistent NameID. +

+

+ + Options + + : +

+
+
+ + attribute + +
+
+ The name of the attribute we should store the result in. + The default is + + eduPersonTargetedID + + . +
+
+ + nameId + +
+
+ Whether the generated attribute should be an saml:NameID element. + The default is + + true + + . +
+
+

+ + Example + + : +

+

+ This example makes three NameIDs available: +

+
+ 
  'authproc' => [
+      1 => [
+          'class' => 'saml:TransientNameID',
+      ],
+      2 => [
+          'class' => 'saml:PersistentNameID',
+          'identifyingAttribute' => 'eduPersonPrincipalName',
+      ],
+      3 => [
+          'class' => 'saml:AttributeNameID',
+          'identifyingAttribute' => 'mail',
+          'Format' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+      ],
+  ],
+
+
+

+ Storing persistent NameIDs in a SQL database: +

+
+ 
  'authproc' => [
+      1 => [
+          'class' => 'saml:TransientNameID',
+      ],
+      2 => [
+          'class' => 'saml:SQLPersistentNameID',
+          'identifyingAttribute' => 'eduPersonPrincipalName',
+      ],
+  ],
+
+
+

+ Generating Persistent NameID and eduPersonTargetedID. +

+
+ 
  'authproc' => [
+      // Generate the persistent NameID.
+      2 => [
+          'class' => 'saml:PersistentNameID',
+          'identifyingAttribute' => 'eduPersonPrincipalName',
+      ],
+      // Add the persistent to the eduPersonTargetedID attribute
+      60 => [
+          'class' => 'saml:PersistentNameID2TargetedID',
+          'attribute' => 'eduPersonTargetedID', // The default
+          'nameId' => true, // The default
+      ],
+      // Use OID attribute names.
+      90 => [
+          'class' => 'core:AttributeMap',
+          'name2oid',
+      ],
+  ],
+  // The URN attribute NameFormat for OID attributes.
+  'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+  'attributeencodings' => [
+      'urn:oid:1.3.6.1.4.1.5923.1.1.1.10' => 'raw', /* eduPersonTargetedID with oid NameFormat is a raw XML value */
+  ],
+
+
+
+ diff --git a/2.1/saml/nameidattribute.html b/2.1/saml/nameidattribute.html new file mode 100644 index 0000000..0a764b3 --- /dev/null +++ b/2.1/saml/nameidattribute.html @@ -0,0 +1,239 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:NameIDAttribute + +

+

+ Filter that extracts the NameID we received in the authentication response and adds it as an attribute. +

+

+ Parameters +

+
+
+ + attribute + +
+
+ The name of the attribute we should create. + The default is + + nameid + + . +
+
+ + format + +
+
+ The format string for the attribute. + The default is + + %I!%S!%V + + . +
+
+

+ The format string accepts the following replacements: +

+
    +
  • + + %I + + : The IdP that issued the NameID. + This will be the + + NameQualifier + + element of the NameID if it is present, or the entity ID of the IdP we received the response from if not. +
    • +
  • + + %S + + : The SP the NameID was issued to. + This will be the + + SPNameQualifier + + element of the NameID if it is present, or the entity ID of this SP otherwise. +
    • +
  • + + %V + + : The value of the NameID. +
    • +
  • + + %F + + : The format of the NameID. +
    • +
  • + + %% + + : Will be replaced with a single + + % + + . +
    • +
+

+ Examples +

+

+ Minimal configuration: +

+
+ 
  'default-sp' => [
+      'saml:SP',
+      'authproc' => [
+          20 => 'saml:NameIDAttribute',
+      ],
+  ],
+
+
+

+ Custom attribute name: +

+
+ 
  'default-sp' => [
+      'saml:SP',
+      'authproc' => [
+          20 => [
+              'class' => 'saml:NameIDAttribute',
+              'attribute' => 'someattributename',
+          ],
+      ],
+  ],
+
+
+

+ Only extract the value of the NameID. +

+
+ 
  'default-sp' => [
+      'saml:SP',
+      'authproc' => [
+          20 => [
+              'class' => 'saml:NameIDAttribute',
+              'format' => '%V',
+          ],
+      ],
+  ],
+
+
+

+ See also +

+ +
+ diff --git a/2.1/saml/sp.html b/2.1/saml/sp.html new file mode 100644 index 0000000..e1305f3 --- /dev/null +++ b/2.1/saml/sp.html @@ -0,0 +1,1260 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ + saml:SP + +

+

+ This authentication source is used to authenticate against SAML 2 IdPs. +

+

+ Metadata +

+

+ The metadata for your SP will be available from the federation page on your SimpleSAMLphp installation. +

+

+ SimpleSAMLphp supports generating metadata with the MDUI and MDRPI metadata extensions +and with entity attributes. See the documentation for those extensions for more details: +

+ +

+ + Parameters + + : +

+

+ These are parameters that can be used at runtime to control the authentication. +All these parameters override the equivalent option from the configuration. +

+
+
+ + saml:AuthnContextClassRef + +
+
+ The AuthnContextClassRef that will be sent in the login request. +
+
+ + saml:AuthnContextComparison + +
+
+ The Comparison attribute of the AuthnContext that will be sent in the login request. + This parameter won't be used unless + + saml:AuthnContextClassRef + + is set and contains one or more values. + Possible values: +
+ 
* `SAML2\Constants::COMPARISON_EXACT` (default)
+* `SAML2\Constants::COMPARISON_BETTER`
+* `SAML2\Constants::COMPARISON_MINIMUM`
+* `SAML2\Constants::COMPARISON_MAXIMUM`
+
+
+
+
+ + ForceAuthn + +
+
+ Force authentication allows you to force re-authentication of users even if the user has a SSO session at the IdP. +
+
+ + saml:idp + +
+
+ The entity ID of the IdP we should send an authentication request to. +
+
+ + isPassive + +
+
+ Send a passive authentication request. +
+
+ + IDPList + +
+
+ List of IdP entity ids that should be sent in the AuthnRequest to the IdP in the IDPList element, part of the + Scoping element. +
+
+ + saml:Extensions + +
+
+ The samlp:Extensions (an XML chunk) that will be sent in the login request. +
+
+ + saml:logout:Extensions + +
+
+ The samlp:Extensions (an XML chunk) that will be sent in the logout request. +
+
+ + saml:NameID + +
+
+ Add a Subject element with a NameID to the SAML AuthnRequest for the IdP. + This must be a \SAML2\XML\saml\NameID object. +
+
+ + saml:NameIDPolicy + +
+
+ The format of the NameID we request from the IdP: an array in the form of + + [ 'Format' => the format, 'AllowCreate' => true or false ] + + . + Set to an empty array + + [] + + to omit sending any specific NameIDPolicy element + in the AuthnRequest. +
+
+ + saml:Audience + +
+
+ Add a Conditions element to the SAML AuthnRequest containing an + AudienceRestriction with one or more audiences. +
+
+

+ Authentication data +

+

+ Some SAML-specific attributes are available to the application after authentication. +To retrieve these attributes, the application can use the + + getAuthData() + + -function from the + + SP API + + . +The following attributes are available: +

+
+
+ + saml:sp:IdP + +
+
+ The entityID of the IdP the user is authenticated against. +
+
+ + saml:sp:NameID + +
+
+ The NameID the user was issued by the IdP. + This is a \SAML2\XML\saml\NameID object with the various fields from the NameID. +
+
+ + saml:sp:SessionIndex + +
+
+ The SessionIndex we received from the IdP. +
+
+

+ + Options + + : +

+
+
+ + acs.Bindings + +
+
+ List of bindings the SP should support. If it is unset, all will be added. +
+
+ Possible values: +
+ 
* `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`
+* `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact`
+* `urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser`
+
+
+
+
+ + assertion.encryption + +
+
+ Whether assertions received by this SP must be encrypted. The default value is + + false + + . + If this option is set to + + true + + , unencrypted assertions will be rejected. +
+
+ Note that this option can be overridden for a specific IdP in saml20-idp-remote. +
+
+ + AssertionConsumerService + +
+
+ List of Assertion Consumer Services in the generated metadata. Specified in the array of + arrays format as seen in the + + Metadata endpoints + + documentation. Note that this list is taken at face value, so it's not useful to list + anything here that the SP auth source does not actually support (unless the URLs point + externally). +
+
+ + AssertionConsumerServiceIndex + +
+
+ The Assertion Consumer Service Index to be used in the AuthnRequest in place of the Assertion + Service Consumer URL. +
+
+ + attributes + +
+
+ List of attributes this SP requests from the IdP. + This list will be added to the generated metadata. +
+
+ The attributes will be added without a + + NameFormat + + by default. + Use the + + attributes.NameFormat + + option to specify the + + NameFormat + + for the attributes. +
+
+ An associative array can be used, mixing both elements with and without keys. When a key is + specified for an element of the array, it will be used as the friendly name of the attribute + in the generated metadata. +
+
+ + Note + + : This list will only be added to the metadata if the + + name + + -option is also specified. +
+
+ + attributes.NameFormat + +
+
+ The + + NameFormat + + for the requested attributes. +
+
+ + attributes.index + +
+
+ The + + index + + attribute that is set in the md:AttributeConsumingService element. Integer value that defaults to + + 0 + + . +
+
+ + attributes.isDefault + +
+
+ If present, sets the + + isDefault + + attribute in the md:AttributeConsumingService element. Boolean value, when + unset, the attribute will be omitted. +
+
+ + attributes.required + +
+
+ If you have attributes added you can here specify which should be marked as required. +
+
+ The attributes should still be present in + + attributes + + . +
+
+ + AuthnContextClassRef + +
+
+ The SP can request authentication with one or more specific authentication context classses. + One example of usage could be if the IdP supports both username/password authentication as well as software-PKI. + Set this to a string for one class identifier or an array of requested class identifiers. +
+
+ + AuthnContextComparison + +
+
+ The Comparison attribute of the AuthnContext that will be sent in the login request. + This parameter won't be used unless + + saml:AuthnContextClassRef + + is set and contains one or more values. + Possible values: +
+ 
* `SAML2\Constants::COMPARISON_EXACT` (default)
+* `SAML2\Constants::COMPARISON_BETTER`
+* `SAML2\Constants::COMPARISON_MINIMUM`
+* `SAML2\Constants::COMPARISON_MAXIMUM`
+
+
+
+
+ + authproc + +
+
+ Processing filters that should be run after SP authentication. + See the + + authentication processing filter manual + + . +
+
+ + certData + +
+
+ Base64 encoded certificate data. Can be used instead of the + + certificate + + option. +
+
+ + certificate + +
+
+ File name of certificate for this SP. This certificate will be included in generated metadata. +
+
+ + contacts + +
+
+ Specify contacts in addition to the + + technical + + contact configured through + + config/config.php + + . +
+
+ For example, specifying a support contact: +
+ 
    'contacts' => [
+        [
+            'contactType'       => 'support',
+            'emailAddress'      => 'support@example.org',
+            'givenName'         => 'John',
+            'surName'           => 'Doe',
+            'telephoneNumber'   => '+31(0)12345678',
+            'company'           => 'Example Inc.',
+        ],
+    ],
+
+
+
+
+

+ Valid values for + + contactType + + are: + + technical + + , + + support + + , + + administrative + + , + + billing + + and + + other + + . All + fields, except + + contactType + + are OPTIONAL. +

+
+
+ + description + +
+
+ A description of this SP. + Will be added to the generated metadata, in an AttributeConsumingService element. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated description: +
+ 
    'description' => [
+        'en' => 'A service',
+        'no' => 'En tjeneste',
+    ],
+
+
+
+
+

+ + Note + + : For this to be added to the metadata, you must also specify the + + attributes + + and + + name + + options. +

+
+
+ + disable_scoping + +
+
+ Whether sending of samlp:Scoping elements in authentication requests should be suppressed. The default value is + + false + + . + When set to + + true + + , no scoping elements will be sent. This does not comply with the SAML2 specification, but allows + interoperability with ADFS which + + does not support Scoping elements + + . +
+
+ Note that this option also exists in the IdP remote configuration. An entry + in the IdP-remote metadata overrides this the option in the SP + configuration. +
+
+ + enable_unsolicited + +
+
+ Whether this SP is willing to process unsolicited responses. The default value is + + true + + . +
+
+ + discoURL + +
+
+ Set which IdP discovery service this SP should use. + If this is unset, the IdP discovery service specified in the global option + + idpdisco.url.saml20 + + in + + config/config.php + + will be used. + If that one is also unset, the builtin default discovery service will be used. +
+
+ + encryption.blacklisted-algorithms + +
+
+ Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. +
+
+ Note that this option can be set for each IdP in the + + IdP-remote metadata + + . +
+
+ + entityID + +
+
+ The entity ID this SP should use. (Must be set or an error will be generated.) +
+
+ The entity ID must be a URI, that is unlikely to change for technical or political + reasons. We recommend it to be a domain name, like above, if your organization's main + domain is + + example.org + + and this SP is for the application + + myapp + + . + The URL does not have to resolve to actual content, it's + just an identifier. Hence you don't need to and should not change it if the actual domain + of your application changes. +
+
+ For guidance in picking an entityID, see + + InCommon's best practice + + on the matter. +
+
+ + ForceAuthn + +
+
+ Force authentication allows you to force re-authentication of users even if the user has a SSO session at the IdP. +
+
+ + idp + +
+
+ The entity ID this SP should connect to. +
+
+ If this option is unset, an IdP discovery service page will be shown. +
+
+ + IsPassive + +
+
+ IsPassive allows you to enable passive authentication by default for this SP. +
+
+ + key_name + +
+
+ The name of the certificate. It is possible the IDP requires your certificate to have a name. + If provided, it will be exposed in the SAML 2.0 metadata as + + KeyName + + inside the + + KeyDescriptor + + . This also requires a certificate to be provided. +
+
+ + name + +
+
+ The name of this SP. + Will be added to the generated metadata, in an AttributeConsumingService element. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+ 
    'name' => [
+        'en' => 'A service',
+        'no' => 'En tjeneste',
+    ],,
+
+
+
+
+

+ + Note + + : You must also specify at least one attribute in the + + attributes + + option for this element to be added to the metadata. +

+
+
+ + nameid.encryption + +
+
+ Whether NameIDs sent from this SP should be encrypted. The default + value is + + false + + . +
+
+ Note that this option can be set for each IdP in the + + IdP-remote metadata + + . +
+
+ + NameIDFormat + +
+
+ An array of the format(s) listed in the SP metadata that this SP will accept. Example: +
+ 
    'NameIDFormat' => [
+        \SAML2\Constants::NAMEID_PERSISTENT,
+        \SAML2\Constants::NAMEID_TRANSIENT,
+    ],
+
+
+
+
+ + NameIDPolicy + +
+
+ The format of the NameID we request from the IdP in the AuthnRequest: + an array in the form of + + [ 'Format' => the format, 'AllowCreate' => true or false ] + + . + Set to an empty array + + [] + + to omit sending any specific NameIDPolicy element + in the AuthnRequest. When the entire option or either array key is unset, + the defaults are transient and true respectively. +
+
+ + OrganizationName + + , + + OrganizationDisplayName + + , + + OrganizationURL + +
+
+ The name and URL of the organization responsible for this IdP. + You need to either specify + + all three + + or none of these options. +
+
+ The Name does not need to be suitable for display to end users, the DisplayName should be. + The URL is a website the user can access for more information about the organization. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+ 
    'OrganizationName' => [
+        'en' => 'Voorbeeld Organisatie Foundation b.a.',
+        'nl' => 'Stichting Voorbeeld Organisatie b.a.',
+    ],
+    'OrganizationDisplayName' => [
+        'en' => 'Example organization',
+        'nl' => 'Voorbeeldorganisatie',
+    ],
+    'OrganizationURL' => [
+        'en' => 'https://example.com',
+        'nl' => 'https://example.com/nl',
+    ],
+
+
+
+
+ + privatekey + +
+
+ File name of private key to be used for signing messages and decrypting messages from the IdP. This option is only required if you use encrypted assertions or if you enable signing of messages. +
+
+ + privatekey_pass + +
+
+ The passphrase for the private key, if it is encrypted. If the private key is unencrypted, this can be left out. +
+
+ + ProviderName + +
+
+ Human readable name of the local SP sent with the authentication request. +
+
+ + ProtocolBinding + +
+
+ The binding that should be used for SAML2 authentication responses. + This option controls the binding that is requested through the AuthnRequest message to the IdP. + By default the HTTP-Post binding is used. +
+
+ + redirect.sign + +
+
+ Whether authentication requests, logout requests and logout responses sent from this SP should be signed. The default is + + false + + . + If set, the + + AuthnRequestsSigned + + attribute of the + + SPSSODescriptor + + element in SAML 2.0 metadata will contain its value. This + option takes precedence over the + + sign.authnrequest + + option in any metadata generated for this SP. +
+
+ + redirect.validate + +
+
+ Whether logout requests and logout responses received by this SP should be validated. The default is + + false + + . +
+
+ + RegistrationInfo + +
+
+ Allows to specify information about the registrar of this SP. Please refer to the + + MDRPI extension + + document for further information. +
+
+ + RelayState + +
+
+ The page the user should be redirected to after an IdP initiated SSO. +
+
+ + saml.SOAPClient.certificate + +
+
+ A file with a certificate + + and + + private key that should be used when issuing SOAP requests from this SP. + If this option isn't specified, the SP private key and certificate will be used. +
+
+ This option can also be set to + + false + + , in which case no client certificate will be used. +
+
+ + saml.SOAPClient.privatekey_pass + +
+
+ The passphrase of the privatekey in + + saml.SOAPClient.certificate + + . +
+
+ + saml20.hok.assertion + +
+
+ Enable support for the SAML 2.0 Holder-of-Key SSO profile. + See the documentation for the + + Holder-of-Key profile + + . +
+
+ + sign.authnrequest + +
+
+ Whether to sign authentication requests sent from this SP. If set, the + + AuthnRequestsSigned + + attribute of the + + SPSSODescriptor + + element in SAML 2.0 metadata will contain its value. +
+
+ Note that this option also exists in the IdP-remote metadata, and + any value in the IdP-remote metadata overrides the one configured + in the SP configuration. +
+
+ + sign.logout + +
+
+ Whether to sign logout messages sent from this SP. +
+
+ Note that this option also exists in the IdP-remote metadata, and + any value in the IdP-remote metadata overrides the one configured + in the SP configuration. +
+
+ + signature.algorithm + +
+
+ The algorithm to use when signing any message generated by this service provider. Defaults to RSA-SHA256. +
+
+ Possible values: +
+ 
* `http://www.w3.org/2000/09/xmldsig#rsa-sha1`
+   *Note*: the use of SHA1 is **deprecated** and will be disallowed in the future.
+* `http://www.w3.org/2001/04/xmldsig-more#rsa-sha256`
+  The default.
+* `http://www.w3.org/2001/04/xmldsig-more#rsa-sha384`
+* `http://www.w3.org/2001/04/xmldsig-more#rsa-sha512`
+
+
+
+
+ + SingleLogoutServiceBinding + +
+
+ List of SingleLogoutService bindings the SP will claim support for (can be empty). +
+
+ Possible values: +
+ 
* `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect`
+* `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`
+* `urn:oasis:names:tc:SAML:2.0:bindings:SOAP`
+
+
+
+
+ + SingleLogoutServiceLocation + +
+
+ The Single Logout Service URL published in the generated metadata. +
+
+ + validate.logout + +
+
+ Whether we require signatures on logout messages sent to this SP. +
+
+ Note that this option also exists in the IdP-remote metadata, and + any value in the IdP-remote metadata overrides the one configured + in the IdP metadata. +
+
+ + WantAssertionsSigned + +
+
+ Whether assertions received by this SP must be signed. The default value is + + false + + . + The value set for this option will be used to set the + + WantAssertionsSigned + + attribute of the + + SPSSODescriptor + + element in + the exported SAML 2.0 metadata. +
+
+

+ + Examples + + : +

+

+ Here we will list some examples for this authentication source. +

+

+ Minimal +

+
+ 
  'example-minimal' => [
+      'saml:SP',
+      'entityID' => 'https://myapp.example.org',
+  ],
+
+
+

+ Connecting to a specific IdP +

+
+ 
  'example' => [
+      'saml:SP',
+      'entityID' => 'https://myapp.example.org',
+      'idp' => 'https://example.net/saml-idp',
+  ],
+
+
+

+ Encryption and signing +

+
+ 
  This SP will accept encrypted assertions, and will sign and validate all messages.
+
+  'example-enc' => [
+      'saml:SP',
+      'entityID' => 'https://myapp.example.org',
+
+      'certificate' => 'example.crt',
+      'privatekey' => 'example.key',
+      'privatekey_pass' => 'secretpassword',
+      'redirect.sign' => true,
+      'redirect.validate' => true,
+  ],
+
+
+

+ Specifying attributes and required attributes +

+
+ 
  An SP that wants eduPersonPrincipalName and mail, where eduPersonPrincipalName should be listed as required:
+
+  'example-attributes => [
+      'saml:SP',
+      'entityID' => 'https://myapp.example.org',
+      'name' => [ // Name required for AttributeConsumingService-element.
+          'en' => 'Example service',
+          'no' => 'Eksempeltjeneste',
+      ],
+      'attributes' => [
+          'eduPersonPrincipalName',
+          'mail',
+          // Specify friendly names for these attributes:
+          'sn' => 'urn:oid:2.5.4.4',
+          'givenName' => 'urn:oid:2.5.4.42',
+      ],
+      'attributes.required' => [
+          'eduPersonPrincipalName',
+      ],
+      'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic',
+  ],
+
+
+

+ Limiting supported AssertionConsumerService endpoint bindings +

+
+ 
  'example-acs-limit' => [
+      'saml:SP',
+      'entityID' => 'https://myapp.example.org',
+      'acs.Bindings' => [
+          'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+      ],
+  ],
+
+
+

+ Requesting a specific authentication method +

+
+ 
  $auth = new \SimpleSAML\Auth\Simple('default-sp');
+  $auth->login([
+      'saml:AuthnContextClassRef' => 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
+  ]);
+
+
+

+ Using samlp:Extensions +

+
+ 
  $dom = \SAML2\DOMDocumentFactory::create();
+  $ce = $dom->createElementNS('http://www.example.com/XFoo', 'xfoo:test', 'Test data!');
+  $ext[] = new \SAML2\XML\Chunk($ce);
+
+  $auth = new \SimpleSAML\Auth\Simple('default-sp');
+  $auth->login([
+      'saml:Extensions' => $ext,
+  ]);
+
+
+
+ diff --git a/2.1/simplesamlphp-advancedfeatures.html b/2.1/simplesamlphp-advancedfeatures.html new file mode 100644 index 0000000..14313b0 --- /dev/null +++ b/2.1/simplesamlphp-advancedfeatures.html @@ -0,0 +1,441 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Advanced Features +

+
+ +
+

+ SimpleSAMLphp documentation +

+

+ This document is part of the SimpleSAMLphp documentation suite. +

+ +

+ This document assumes that you already have a installation of +SimpleSAMLphp running, configured and working. This is the next +step :) +

+

+ Bridging between protocols +

+

+ A bridge between two protocols is built using both an IdP and an SP, connected together. +To let a SAML 2.0 SP talk to a SAML 1.1 IdP, you build a SimpleSAMLphp bridge from a SAML 2.0 IdP and a SAML 1.1 SP. +The SAML 2.0 SP talks to the SAML 2.0 IdP, which hands the request over to the SAML 1.1 SP, which forwards it to the SAML 1.1 IdP. +

+

+ If you have followed the instructions for setting up an SP, and have configured an authentication source, all you need to do is to add that authentication source to the IdP. +

+

+ Example of bridge configuration +

+

+ In + + metadata/saml20-idp-hosted.php + + : +

+
+ 
'auth' => 'default-sp',
+
+
+

+ In + + config/authsources.php + + : +

+
+ 
'default-sp' => [
+    'saml:SP',
+],
+
+
+

+ Attribute control +

+

+ Filtering, mapping, etc can be performed by using existing or create new + + Authentication Processing Filters + + . For more information, read: +

+ +

+ Automatic update of SAML 2.0 Metadata XML from HTTPS +

+

+ The + + metarefresh + + module is the preferred method for doing this. +Please see the + + metarefresh documentation + + . +

+

+ Using simpleSAMLphp on a web server requiring the use of a web proxy +

+

+ Some modules in simpleSAMLphp may require fetching HTTP/HTTPS content from external websites (e.g. the metarefresh module needs to fetch the metadata from an external source). +

+

+ simpleSAMLphp can be configured to send HTTP/S requests via such a proxy. The proxy can be configured in the config/config.php option "proxy". Should the proxy require authentication, this can be configured with "proxy.auth". +

+

+ The default is not to use a proxy ('proxy' = null) and no username and password are used ('proxy.auth' = false). +

+

+ Metadata signing +

+

+ SimpleSAMLphp supports signing of the metadata it generates. Metadata signing is configured by four options: +

+
    +
  • + + metadata.sign.enable + + : Whether metadata signing should be enabled or not. Set to + + TRUE + + to enable metadata signing. Defaults to + + FALSE + + . +
    • +
  • + + metadata.sign.privatekey + + : Location of the private key data which should be used to sign the metadata. +
    • +
  • + + metadata.sign.privatekey_pass + + : Passphrase which should be used to open the private key. This parameter is optional, and should be left out if the private key is unencrypted. +
    • +
  • + + metadata.sign.certificate + + : Location of certificate data which matches the private key. +
    • +
  • + + metadata.sign.algorithm + + : The algorithm to use when signing metadata for this entity. Defaults to RSA-SHA256. Possible values: +
      +
    • + + http://www.w3.org/2000/09/xmldsig#rsa-sha1 + + + Note + + : the use of SHA1 is + + deprecated + + and will be disallowed in the future. +
      • +
    • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 + + The default. +
      • +
    • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 + +
      • +
    • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + +
      • +
    +
    • +
+

+ These options can be configured globally in the + + config/config.php + + -file, or per SP/IdP by adding them to the hosted metadata for the SP/IdP. The configuration in the metadata for the SP/IdP takes precedence over the global configuration. +

+

+ There is also an additional fallback for the private key and the certificate. If + + metadata.sign.privatekey + + and + + metadata.sign.certificate + + isn't configured, SimpleSAMLphp will use the + + privatekey + + , + + privatekey_pass + + and + + certificate + + options in the metadata for the SP/IdP. +

+

+ Session checking function +

+

+ Optional session checking function, called on session init and loading, defined with 'session.check_function' in config.php. +

+

+ Example code for the function with GeoIP country check: +

+
+ 
public static function checkSession(\SimpleSAML\Session $session, bool $init = false)
+{
+    $data_type = 'example:check_session';
+    $data_key = 'remote_addr';
+
+    $remote_addr = strval($_SERVER['REMOTE_ADDR']);
+
+    if ($init) {
+        $session->setData(
+            $data_type,
+            $data_key,
+            $remote_addr,
+            \SimpleSAML\Session::DATA_TIMEOUT_SESSION_END
+        );
+        return;
+    }
+
+    if (!function_exists('geoip_country_code_by_name')) {
+        \SimpleSAML\Logger::warning('geoip php module required.');
+        return true;
+    }
+
+    $stored_remote_addr = $session->getData($data_type, $data_key);
+    if ($stored_remote_addr === null) {
+        \SimpleSAML\Logger::warning('Stored data not found.');
+        return false;
+    }
+
+    $country_a = geoip_country_code_by_name($remote_addr);
+    $country_b = geoip_country_code_by_name($stored_remote_addr);
+
+    if ($country_a === $country_b) {
+        if ($stored_remote_addr !== $remote_addr) {
+            $session->setData(
+                $data_type,
+                $data_key,
+                $remote_addr,
+                \SimpleSAML\Session::DATA_TIMEOUT_SESSION_END
+            );
+        }
+
+        return true;
+    }
+
+    return false;
+}
+
+
+

+ Support +

+

+ If you need help to make this work, or want to discuss +SimpleSAMLphp with other users of the software, you are fortunate: +Around SimpleSAMLphp there is a great Open source community, and +you are welcome to join! The forums are open for you to ask +questions, contribute answers other further questions, request +improvements or contribute with code or plugins of your own. +

+ +
+ diff --git a/2.1/simplesamlphp-artifact-idp.html b/2.1/simplesamlphp-artifact-idp.html new file mode 100644 index 0000000..badca85 --- /dev/null +++ b/2.1/simplesamlphp-artifact-idp.html @@ -0,0 +1,265 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Adding HTTP-Artifact support to the IdP +

+

+ This document describes the necessary steps to enable support for the HTTP-Artifact binding on a SimpleSAMLphp IdP: +

+
    +
  1. + Configure SimpleSAMLphp to use memcache to store the session. +
    2. +
  2. + Enable support for sending artifacts in + + saml20-idp-hosted + + . +
    3. +
  3. + Add the webserver certificate to the generated metadata. +
    4. +
+

+ Memcache +

+

+ To enable memcache, you must first install and configure memcache on the server hosting your IdP. +You need both a memcache server and a the PHP memcached client (extension). +

+

+ How this is done depends on the distribution. +If you are running Debian or Ubuntu, you can install this by running: +

+
+ 
apt install memcached php-memcached
+
+
+

+ simpleSAMLphp also supports the legacy + + php-memcache + + (without + + d + + ) variant. +

+

+ + Note + + : For security, you must make sure that the memcache server is inaccessible to other hosts. +The default configuration on Debian is for the memcache server to be accessible to only the local host. +

+

+ Once the memcache server is configured, you can configure simplesamlphp to use it to store sessions. +You can do this by setting the + + store.type + + option in + + config.php + + to + + memcache + + . +If you are running memcache on a different server than the IdP, you must also change the + + memcache_store.servers + + option in + + config.php + + . +

+

+ Enabling artifact on the IdP +

+

+ To enable the IdP to send artifacts, you must add the + + saml20.sendartifact + + option to the + + saml20-idp-hosted + + metadata file: +

+
+ 
$metadata['https://example.org/saml-idp'] = [
+    [....]
+    'auth' => 'example-userpass',
+    'saml20.sendartifact' => true,
+];
+
+
+

+ Add new metadata to SPs +

+

+ After enabling the Artifact binding, your IdP metadata will change to add a ArtifactResolutionService endpoint. +You therefore need to update the metadata for your IdP at your SPs. + + saml20-idp-remote + + metadata for SimpleSAMLphp SPs should contain something like: +

+
+ 
'ArtifactResolutionService' => [
+    [
+        'index' => 0,
+        'Location' => 'https://idp.example.org/simplesaml/saml2/idp/ArtifactResolutionService.php',
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
+    ],
+],
+
+
+

+ SP metadata on the IdP +

+

+ An SP using the HTTP-Artifact binding must have an AssertionConsumerService endpoint supporting that binding. +This means that you must use the complex endpoint format in + + saml20-sp-remote + + metadata. +In general, that should look something like: +

+
+ 
'AssertionConsumerService' => [
+    [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+        'Location' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+        'index' => 0,
+    ],
+    [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
+        'Location' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+        'index' => 2,
+    ],
+],
+
+
+

+ (The specific values of the various fields will vary depending on the SP.) +

+

+ Certificate in metadata +

+

+ Some SPs validates the SSL certificate on the ArtifactResolutionService using the certificates in the metadata. +You may therefore have to add the webserver certificate to the metadata that your IdP generates. +To do this, you need to set the + + https.certificate + + option in the + + saml20-idp-hosted + + metadata file. +That option should refer to a file containing the webserver certificate. +

+
+ 
$metadata['https://example.org/saml-idp'] = [
+    [....]
+    'auth' => 'example-userpass',
+    'saml20.sendartifact' => true,
+    'https.certificate' => '/etc/apache2/webserver.crt',
+];
+
+
+
+ diff --git a/2.1/simplesamlphp-artifact-sp.html b/2.1/simplesamlphp-artifact-sp.html new file mode 100644 index 0000000..65abf19 --- /dev/null +++ b/2.1/simplesamlphp-artifact-sp.html @@ -0,0 +1,139 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Using HTTP-Artifact from a SimpleSAMLphp SP +

+

+ This document describes how to use the HTTP-Artifact binding to receive authentication responses from the IdP. +

+

+ Which binding the IdP should use when sending authentication responses is controlled by the + + ProtocolBinding + + in the SP configuration. +To make your Service Provider (SP) request that the response from the IdP is sent using the HTTP-Artifact binding, this option must be set to the HTTP-Artifact binding. +

+

+ In addition to selecting the binding, you must also add a private key and certificate to your SP. +This is used for SSL client authentication when contacting the IdP. +

+

+ To generate a private key and certificate, you may use the + + openssl + + commandline utility: +

+
+ 
  openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out sp.example.org.crt -keyout sp.example.org.pem
+
+
+

+ You can then add the private key and certificate to the SP configuration. +When this is done, you can add the metadata of your SP to the IdP, and test the authentication. +

+

+ Example configuration +

+
+ 
  'artifact-sp' => [
+      'saml:SP',
+      'ProtocolBinding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
+      'privatekey' => 'sp.example.org.pem',
+      'certificate' => 'sp.example.org.crt',
+  ],
+
+
+

+ See the + + SP configuration reference + + for a description of the options. +

+
+ diff --git a/2.1/simplesamlphp-authproc.html b/2.1/simplesamlphp-authproc.html new file mode 100644 index 0000000..c0e7ffc --- /dev/null +++ b/2.1/simplesamlphp-authproc.html @@ -0,0 +1,808 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Authentication Processing Filters in SimpleSAMLphp +

+
+ +
+

+ In SimpleSAMLphp, there is an API where you can + + do stuff + + at the IdP after authentication is complete, and just before you are sent back to the SP. The same API is available on the SP, after you have received a successful Authentication Response from the IdP and before you are sent back to the SP application. +

+

+ Authentication processing filters postprocess authentication information received from authentication sources. It is possible to use this for additional authentication checks, requesting the user's consent before delivering attributes about the user, modifying the user's attributes, and other things which should be performed before returning the user to the service provider they came from. +

+

+ Examples of neat things to do using Authentication Processing Filters: +

+
    +
  • + Filter out a subset of available attributes that are sent to a SP. +
    • +
  • + Modify the name of attributes. +
    • +
  • + Generate new attributes that are composed of others, for example eduPersonTargetedID. +
    • +
  • + Ask the user for consent, before the user is sent back to a service. +
    • +
  • + Implement basic Access Control on the IdP, limiting access for some users to some SPs. +
    • +
+

+ How to configure Auth Proc Filters +

+

+ + Auth Proc Filters + + can be set globally, or to be specific for only one SP or one IdP. That means there are five locations where you can configure + + Auth Proc Filters + + : +

+
    +
  • + Globally in + + config.php + +
    • +
  • + On the SP: Specific for only the SP in + + authsources.php + +
    • +
  • + On the SP: Specific for only one remote IdP in + + saml20-idp-remote + +
    • +
  • + On the IdP: Specific for only one hosted IdP in + + saml20-idp-hosted + +
    • +
  • + On the IdP: Specific for only one remote SP in + + saml20-sp-remote + +
    • +
+

+ + Note + + : An Auth Proc Filter will not work in the "Test authentication sources" option in the web UI of a SimpleSAMLphp IdP. It will only be triggered in conjunction with an actual SP. So you need to set up an IdP + + and + + and SP when testing your filter. +

+

+ The configuration of + + Auth Proc Filters + + is a list of filters with priority as + + index + + . Here is an example of + + Auth Proc Filters + + configured in + + config.php + + : +

+
+ 
'authproc.idp' => [
+    10 => [
+        'class' => 'core:AttributeMap', 
+        'addurnprefix'
+    ],
+    20 => 'core:TargetedID',
+    50 => 'core:AttributeLimit',
+    90 => [
+        'class' => 'consent:Consent', 
+        'store' => 'consent:Cookie', 
+        'focus' => 'yes', 
+        'checked' => true
+    ],
+],
+
+
+

+ This configuration will execute + + Auth Proc Filters + + one by one, with the priority value in increasing order. When + + Auth Proc Filters + + is configured in multiple places, in example both globally, in the hosted IdP and remote SP metadata, then the list is interleaved sorted by priority. +

+

+ The most important parameter of each item on the list is the + + class + + of the + + Auth Proc Filter + + . The syntax of the class is + + modulename:classname + + . As an example the class definition + + core:AttributeLimit + + will be expanded to look for the class + + \SimpleSAML\Module\core\Auth\Process\AttributeLimit + + . The location of this class file + + must + + then be: + + modules/core/src/Auth/Process/AttributeLimit.php + + . +

+

+ You will see that a bunch of useful filters is included in the + + core + + and + + saml + + modules, but there are +many others published as [SimpleSAMLphp modules)[https://simplesamlphp.org/modules/] you can install. Beyond that, you are +encouraged to create your own filters and share with the community. If you have +created a cool + + Auth Proc Filter + + that does something useful, let us know, and +we may add it on the Modules overview. +

+

+ When you know the class definition of a filter, and the priority, the simple way to configure the filter is: +

+
+ 
20 => 'core:TargetedID',
+
+
+

+ This is analogous to: +

+
+ 
20 => [
+    'class' => 'core:TargetedID'
+],
+
+
+

+ Some + + Auth Proc Filters + + have optional or required + + parameters + + . To send parameters to + + Auth Proc Filters + + , you need to choose the second of the two alternatives above. Here is an example of provided parameters to the consent module: +

+
+ 
90 => [
+    'class' => 'consent:Consent', 
+    'store' => 'consent:Cookie', 
+    'focus' => 'yes', 
+    'checked' => true,
+],
+
+
+

+ Filters in + + config.php + +

+

+ Global + + Auth Proc Filters + + are configured in the + + config.php + + file. You will see that the config template already includes an example configuration. +

+

+ There are two config parameters: +

+
    +
  • + + authproc.idp + + and +
    • +
  • + + authproc.sp + +
    • +
+

+ The filters in + + authproc.idp + + will be executed at the IdP side regardless of which IdP and SP entity that is involved. +

+

+ The filters in + + authproc.sp + + will be executed at the SP side regardless of which SP and IdP entity that is involved. +

+

+ Filters in metadata +

+

+ Filters can be added both in + + hosted + + and + + remote + + metadata. Here is an example of a filter added in a metadata file: +

+
+ 
$metadata['https://example.org/saml-idp'] = [
+    'host' => '__DEFAULT_',
+    'privatekey' => 'example.org.pem',
+    'certificate' => 'example.org.crt',
+    'auth' => 'feide',
+    'authproc' => [
+        40 => 'core:TargetedID',
+    ],
+]
+
+
+

+ The example above is in + + saml20-idp-hosted + + . +

+

+ Preconditional filters +

+

+ Any filter can be configured with a precondition that will determine whether or not a filter should run. +The condition is represented as a string that will be evaluated, similar to the + + core:PHP + + filter. It also has +the + + $attributes + + and + + $state + + variable available for use. +The code must return either + + true + + to run the filter, or + + false + + to skip it. +

+
+ 
'authproc' => [
+    40 => 'core:TargetedID',
+    '%precondition' => 'return $attributes["displayName"] === "John Doe";',
+],
+
+
+

+ Auth Proc Filters included in the SimpleSAMLphp distribution +

+

+ The following filters are included in the SimpleSAMLphp distribution: +

+ +

+ See the + + Third-party modules + + page on the SimpleSAMLphp website +for externally hosted modules that may provide a processing filter. +

+

+ Writing your own Auth Proc Filter +

+

+ Look at the included + + Auth Proc Filters + + as examples. Copy the classes into your own module and start playing around. +

+

+ Authentication processing filters are created by creating a class under + + Auth/Process/ + + in a module. This class is expected to subclass + + \SimpleSAML\Auth\ProcessingFilter + + . A filter must implement at least one function - the + + process(&$request) + + -function. This function can access the + + $request + + -array to add, delete and modify attributes, and can also do more advanced processing based on the SP/IdP metadata (which is also included in the + + $request + + -array). When this function returns, it is assumed that the filter has finished processing. +

+

+ If a filter for some reason needs to redirect the user, for example to show a web page, it should save the current request. Upon completion it should retrieve the request, update it with the changes it is going to make, and call + + \SimpleSAML\Auth\ProcessingChain::resumeProcessing + + . This function will continue processing the next configured filter. +

+

+ Requirements for authentication processing filters: +

+
    +
  • + Must be derived from the + + \SimpleSAML\Auth\ProcessingFilter + + -class. +
    • +
  • + If a constructor is implemented, it must first call the parent constructor, passing along all parameters, before accessing any of the parameters. Only the $config parameter can be accessed. +
    • +
  • + The + + process(array &$state) + + -function must be implemented. If this function completes, it is assumed that processing is completed, and that the $state array has been updated. +
    • +
  • + If the + + process + + -function does not return, it must at a later time call + + \SimpleSAML\Auth\ProcessingChain::resumeProcessing + + with the new request state. The request state must be an update of the array passed to the + + process + + -function. +
    • +
  • + No pages may be shown to the user from the + + process + + -function. Instead, the request state should be saved, and the user should be redirected to a new page. This must be done to prevent unpredictable events if the user for example reloads the page. +
    • +
  • + No state information should be stored in the filter object. It must instead be stored in the request state array. Any changes to variables in the filter object may be lost. +
    • +
  • + The filter object must be serializable. It may be serialized between being constructed and the call to the + + process + + -function. This means that, for example, no database connections should be created in the constructor and later used in the + + process + + -function. +
    • +
+

+ Don't hestitate to ask on the SimpleSAMLphp mailinglist if you have problems or questions, or want to share your + + Auth Proc Filter + + with others. +

+
+ diff --git a/2.1/simplesamlphp-authsource.html b/2.1/simplesamlphp-authsource.html new file mode 100644 index 0000000..e6fd56f --- /dev/null +++ b/2.1/simplesamlphp-authsource.html @@ -0,0 +1,380 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Creating authentication sources +

+

+ All authentication sources are located in the + + src/Auth/Source/ + + directory in a module, and the class name is + + \SimpleSAML\Module\<module>\Auth\Source\<name> + + . +The authentication source must extend the + + \SimpleSAML\Auth\Source + + class or one of its subclasses. +

+

+ The "entry point" of an authentication source is the + + authenticate() + + -function. +Once that function is called, the authentication module can do whatever it wishes to do. +There are only two requirements: +

+
    +
  • +

    + Never show any pages to the user directly from within the + + authenticate() + + -function. + (This will lead to problems if the user decides to reload the page.) +

    +
    • +
  • +

    + Return control to SimpleSAMLphp after authenticating the user. + If the module is able to authenticate the user without doing any redirects, it should just update the state-array and return. + If the module does a redirect, it must call + + \SimpleSAML\Auth\Source::completeAuth() + + with the updated state array. +

    +
    • +
+

+ Everything else is up to the module. +If the module needs to redirect the user, for example because it needs to show the user a page asking for credentials, it needs to save the state array. +For that we have the + + \SimpleSAML\Auth\State + + class. +This is only a convenience class, and you are not required to use it (but its use is encouraged, since it handles some potential pitfalls). +

+

+ Saving state +

+

+ The + + \SimpleSAML\Auth\State + + class has two functions that you should use: + + saveState($state, $stage) + + , and + + loadState($id, $stage) + + . +The + + $stage + + parameter must be an unique identifier for the current position in the authentication. +It is used to prevent a malicious user from taking a state you save in one location, and give it to a different location. +

+

+ The + + saveState() + + -function returns an id, which you should pass to the + + loadState() + + -function later. +

+

+ Username/password authentication +

+

+ Since username/password authentication is quite a common operation, a base class has been created for this. +This is the + + \SimpleSAML\Module\core\Auth\UserPassBase + + class, which is can be found as + + modules/core/lib/Auth/UserPassBase.php + + . +

+

+ The only function you need to implement is the + + login($username, $password) + + -function. +This function receives the username and password the user entered, and is expected to return the attributes of that user. +If the username or password is incorrect, it should throw an error saying so: +

+
+ 
  throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
+
+
+

+ " + + Implementing custom username/password authentication + + " describes how to implement username/password authentication using that base class. +

+

+ Generic rules & requirements +

+
    +
  • +

    + Must be derived from the + + \SimpleSAML\Auth\Source + + -class. +

    +

    + + Rationale + + : +- Deriving all authentication sources from a single base class allows us extend all authentication sources by extending the base class. +

    +
    • +
  • +

    + If a constructor is implemented, it must first call the parent constructor, passing along all parameters, before accessing any of the parameters. + In general, only the $config parameter should be accessed when implementing the authentication source. +

    +

    + + Rationale + + : +- PHP doesn't automatically call any parent constructor, so it needs to be done manually. +- The + + $info + + -array is used to provide information to the + + \SimpleSAML\Auth\Source + + base class, and therefore needs to be included. +- Including the + + $config + + -array makes it possible to add generic configuration options that are valid for all authentication sources. +

    +
    • +
  • +

    + The + + authenticate(array &$state) + + -function must be implemented. + If this function completes, it is assumed that the user is authenticated, and that the + + $state + + -array has been updated with the user's attributes. +

    +

    + + Rationale + + : +- Allowing the + + authenticate() + + -function to return after updating the + + $state + + -array enables us to do authentication without redirecting the user. + This can be used if the authentication doesn't require user input, for example if the authentication can be done based on the IP-address of the user. +

    +
    • +
  • +

    + If the + + authenticate + + -function does not return, it must at a later time call + + \SimpleSAML\Auth\Source::completeAuth + + with the new state array. + The state array must be an update of the array passed to the + + authenticate + + -function. +

    +

    + + Rationale + + : +- Preserving the same state array allows us to save information in that array before the authentication starts, and restoring it when authentication completes. +

    +
    • +
  • +

    + No pages may be shown to the user from the + + authenticate() + + -function. + Instead, the state should be saved, and the user should be redirected to a new page. +

    +

    + + Rationale + + : +- The + + authenticate() + + -function is called in the context of a different PHP page. + If the user reloads that page, unpredictable results may occur. +

    +
    • +
  • +

    + No state information about any authentication should be stored in the authentication source object. + It must instead be stored in the state array. + Any changes to variables in the authentication source object may be lost. +

    +

    + + Rationale + + : +- This saves us from having to save the entire authentication object between requests. + Instead, we can recreate it from the configuration. +

    +
    • +
  • +

    + The authentication source object must be serializable. + It may be serialized between being constructed and the call to the + + authenticate() + + -function. + This means that, for example, no database connections should be created in the constructor and later used in the + + authenticate() + + -function. +

    +

    + + Rationale + + : +- If parsing the configuration and creating the authentication object is shown to be a bottleneck, we can cache an initialized authentication source. +

    +
    • +
+
+ diff --git a/2.1/simplesamlphp-changelog-1.x.html b/2.1/simplesamlphp-changelog-1.x.html new file mode 100644 index 0000000..9278985 --- /dev/null +++ b/2.1/simplesamlphp-changelog-1.x.html @@ -0,0 +1,7193 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp changelog +

+
+ +
+

+ This document lists the changes between versions of SimpleSAMLphp. +See the upgrade notes for specific information about upgrading. +

+

+ Version 1.19.6 +

+

+ Released 2022-07-01 +

+
    +
  • + Fix several translations (#1572, #1573, #1577, #1578, #1603) +
    • +
  • + Fix HTTP status code for error pages (#1585) +
    • +
  • + \SimpleSAML\Utils\HTTP::getFirstPathElement() was marked deprecated +
    • +
  • + Bumped twig and minimist dependencies due to known vulnerabilities (CVE-2022-23614 and CVE-2021-44906) +
    • +
  • + Minor fixes to the old UI (#1632) +
    • +
  • + Fix several translations (#1572, #1573, #1577, #1578) +
    • +
+

+ + saml2 library + +

+
    +
  • + A mis-use of a constant was fixed (#249) that caused an error with HTTP-Artifact binding. +
    • +
+

+ + metarefresh + +

+
    +
  • + Added regex-template config keyword to apply a template to entityIDs matching a pattern. (v0.10) +
    • +
+

+ Version 1.19.5 +

+

+ Released 2021-01-24 +

+
    +
  • + Fix composer-file to prevent warnings +
    • +
  • + Fix database persistence (#1555) +
    • +
  • + Dropped dependency on jquery-ui and selectize +
    • +
+

+ + adfs + +

+
    +
  • + Bump the module version to the 1.0.x branch; the 0.9 branch only works with versions before 1.19 +
    • +
+

+ + saml2 library + +

+
    +
  • + Fix an issue with PHP 7.x support that was introduced in 1.19.4 (#1559) +
    • +
+

+ Version 1.19.4 +

+

+ Released 2021-12-13 +

+

+ + core + +

+
    +
  • + Fix translations for included templates (i.e. metadata not found error) +
    • +
+

+ + ldap + +

+
    +
  • + Added the possibility to escape the additional search filters that were introduced in 1.19.2 +
    • +
+

+ + saml2 library + +

+
    +
  • + The library has been quick-fixed to support PHP 8.1 (#1545) +
    • +
+

+ + metarefresh + +

+
    +
  • + Reverted an unintended update of the module. The v1,0-branch is intended for use with SSP 2.0 (dev-master) only +
    • +
+

+ Version 1.19.3 +

+

+ Released 2021-10-28 +

+
    +
  • + Fixed a wrong variable name introduced in v1.19.2 (#1480) that rendered the PHP session handler useless. +
    • +
+

+ Version 1.19.2 +

+

+ Released 2021-10-27 +

+
    +
  • + Restored PHP 8.0 compatibility (#1461), also on the saml2 library (v4.2.3) +
    • +
  • + Revert #1435; should not have ended up in a bugfix release. If you need the authproc-filters, please install the + simplesamlphp-module-subjectidattrs module. +
    • +
  • + Fixed a bug in the logger that would break encoded urls in the message +
    • +
  • + Return a proper HTTP/405 code when incorrect method is used (#1400) +
    • +
  • + Fixed the 'rememberenabled' config setting of the built-in IdP discovery. +
    • +
  • + Fixed a bug where code from external modules would run even though the module is explicitly enabled (#1463) +
    • +
  • + Fix unsolicited response with no RelayState (#1473) +
    • +
  • + Fix statistics being logged despite a configured loglevel that excludes statistics. +
    • +
  • + Fixed an issue with the PHP session handler (#1480, #1350, #1478) causing superfluous log messages. +
    • +
  • + Fixed the MetaDataStorageHandlerPdo for MySQL backends (#1392) +
    • +
  • + Use getVersion instead of getStats to determine whether a memcache-server is up (#1528) +
    • +
+

+ + adfs + +

+
    +
  • + Fixed several issues that rendered the old UI useless for this module (v0.9.8) +
    • +
+

+ + admin + +

+
    +
  • + Fix warning in FederationController (#1475) +
    • +
  • + Fix displayed metadata for hosted entities differing from actual metadata. +
    • +
+

+ + consent + +

+
    +
  • + Add possibility to set the sameSite flag on cookies set by this module (v0.9.7) +
    • +
+

+ + discopower + +

+
    +
  • + Fixed a dependency issue that caused the module to not install under some PHP-versions (v0.10.0) +
    • +
+

+ + ldap + +

+
    +
  • + Added search-filters to AttributeAddUserGroups and made the return-attribute configurable (v0.9.11) +
    • +
+

+ + negotiate + +

+
    +
  • + Fixed a regression that rendered the new UI useless for this module (v0.9.11) +
    • +
+

+ + sqlauth + +

+
    +
  • + Fixed a bug that rendered the module useless due to missing use-statements. +
    • +
+

+ Version 1.19.1 +

+

+ Released 2021-04-29 +

+
    +
  • + Fixed a bug in the Artifact Resolution Service (#1428) +
    • +
  • + Fixed compatibility with Composer pre 1.8.5 (Debian 10) (#1427) +
    • +
  • + Updated npm dependencies up to February 1, 2021 +
    • +
+

+ + memcacheMonitor + +

+
    +
  • + Fix a bug in the Twig-template that causes an exception on newer Twig-versions +
    • +
+

+ + negotiate + +

+
    +
  • + Fix a bug that was breaking the module when using the old UI +
    • +
+

+ + statistics + +

+
    +
  • + Fix a bug in the Twig-template that causes an exception on newer Twig-versions +
    • +
+

+ Version 1.19.0 +

+

+ Released 2021-01-21 +

+
    +
  • + This version will be the last of the 1.x branch and will provide a migration path to our new + templating system, routing system and translation system. +
    • +
  • + SAML 1 / Shib 1.3 support is now marked deprecated and will be removed in SimpleSAMLphp 2.0. +
    • +
  • + Raised minimum PHP version to 7.1 +
    • +
  • + Dropped support for Symfony 3.x +
    • +
  • + Update the SAML2 library dependency to 4.1.9 +
    • +
  • + Fix a bug where SSP wouldn't write to the tmp-directory if it didn't own it, but could write to it (#1314) +
    • +
  • + Fixed several bugs in saml:NameIDAttribute (#1245) +
    • +
  • + Fix artifact resolution (#1343) +
    • +
  • + Allow additional audiences to be specified (#1345) +
    • +
  • + Allow configurable ProviderName (#1348) +
    • +
  • + Support saml:Extensions in saml:SP authsources (#1349) +
    • +
  • + The + + attributename + + -setting in the core:TargetedID authproc-filter has been deprecated in + favour of the + + identifyingAttribute + + -setting. +
    • +
  • + Filter multiauth authentication sources from SP using AuthnContextClassRef (#1362) +
    • +
  • + Allow easy enabling of SameSite = 'None' (#1382) +
    • +
  • + Do not accept the hashed admin password for authentication (#1418) +
    • +
+

+ Version 1.18.8 +

+

+ Released 2020-09-02 +

+
    +
  • + Fixed Artifact Resolution due to incorrect use of Issuer objects (#1343). +
    • +
  • + Fixed some of the German translations (#1331). Thanks @htto! +
    • +
  • + Harden against CVE-2020-13625; this package is not affected, but 3rd party modules may (#1333). +
    • +
  • + Harden against several JS issues (npm update & npm audit fix) +
    • +
  • + Fixed inconsistent configuration of backtraces logging +
    • +
  • + Support for Symfony 3.x is now deprecated +
    • +
  • + Support for Twig 1.x is now deprecated +
    • +
+

+ + authcrypt + +

+
    +
  • + The dependency for whitehat101/apr1-md5 was moved from the base repository to the module (v0.9.2) +
    • +
+

+ + authx509 + +

+
    +
  • + Restore PHP 5.6 compatibility (v0.9.5) +
    • +
+

+ + cron + +

+
    +
  • + Fixed old-ui (#1248) +
    • +
+

+ + ldap + +

+
    +
  • + Moved array with binary attributes to authsource config (v0.9.9) + Instead of having to edit code, you can now set 'attributes.binary' in the authsource configuration. +
    • +
+

+ + metarefresh + +

+
    +
  • + Add attributewhitelist to support e.g. R&S+Sirtfi (v0.9.5) +
    • +
  • + Restore PHP 5.6 compatibility (v0.9.6) +
    • +
+

+ + negotiate + +

+
    +
  • + Restore PHP 5.6 compatibility (v0.9.8) +
    • +
  • + Fixed a link (v0.9.9) +
    • +
+

+ + saml2 library + +

+
    +
  • + Fixed a bug in the AuthnRequest-class that would raise an InvalidArgumentException when setting + the AssertionConsumerServiceIndex as an integer on an saml:SP authsource. + Thanks to Andrea @ Oracle for reporting this. +
    • +
+

+ Version 1.18.7 +

+

+ Released 2020-05-12 +

+
    +
  • + Fix spurious warnings when session_create_id() fails to create ID (#1291) +
    • +
  • + Fix inconsistency in the way PATH_INFO is being used (#1227). +
    • +
  • + Fix a potential security issue + + CVE-2020-11022 + + by updating jQuery. If any of your custom modules rely on jQuery, + make sure you read the following + + update notes + + , since jQuery has solved this in a non-BC way (#1321). +
    • +
  • + Fix incorrect Polish translations (#1311). +
    • +
  • + Fix a broken migration query in the LogoutStore (#1324). +
    • +
  • + Fix an issue with the SameSite cookie parameter when running on PHP versions older than 7.3 (#1320). +
    • +
+

+ + adfs + +

+
    +
  • + Fixed a broken link to one of the assets (v0.9.6). +
    • +
+

+ + ldap + +

+
    +
  • + Handle binary attributes in a generic way (v0.9.5). +
    • +
+

+ + oauth + +

+
    +
  • + Fix PHP 7.4 incompatibility (v0.9.2). +
    • +
+

+ + preprodwarning + +

+
    +
  • + Fix Dutch translations (v0.9.2). +
    • +
+

+ + sanitycheck + +

+
    +
  • + Fix broken HTML (v0.9.1). +
    • +
+

+ + saml + +

+
    +
  • + Fix several issues in the saml:NameIDAttribute authproc filter (#1325). +
    • +
+

+ + saml2 library + +

+
    +
  • + fixed a standards compliance issue regarding ContactPerson EMail addresses (v3.4.4). +
    • +
  • + fixed an issue parsing very large metadata files (v3.4.3). +
    • +
+

+ Version 1.18.6 +

+

+ Released 2020-04-17 +

+
    +
  • + Fix source code disclosure on case-insensitive file systems. See + + SSPSA 202004-01 + + . +
    • +
  • + Fix spurious error in logs when using a custom theme (#1312). +
    • +
  • + Fix broken metadata converter (#1305). +
    • +
+

+ Version 1.18.5 +

+

+ Released 2020-03-19 +

+
    +
  • + Make the URLs for the cron module work again (#1248). +
    • +
  • + Email error reports now include metadata again (#1269). +
    • +
  • + Fix exampleauth module when using the legacy UI (#1275). +
    • +
  • + Fix authorize module when using custom reject message. +
    • +
  • + Documentation improvements. +
    • +
  • + Fix connection persistence for deployments that switched to memcached. +
    • +
+

+ Version 1.18.4 +

+

+ Released 2020-01-24 +

+
    +
  • + Resolved a security issue in email reports. See + + SSPSA 202001-01 + + . +
    • +
  • + Resolved a security issue with the logging system. See + + SSPSA 202001-02 + + . +
    • +
  • + Fixed SQL store index creation for PostgreSQL. +
    • +
  • + Handle case where cookie 'domain' parameter was not set. +
    • +
  • + Update versions of included JavaScript dependencies. +
    • +
+

+ Version 1.18.3 +

+

+ Released 2019-12-09 +

+
    +
  • + Fixed an issue with several modules being enabled by default (#1257). +
    • +
  • + Fixed an issue with metadata generation for trusted entities (#1247, #1251). +
    • +
+

+ + ldap + +

+
    +
  • + Fixed an issue affecting the installation in case-insensitive file systems (#1253). +
    • +
+

+ Version 1.18.2 +

+

+ Released 2019-11-26 +

+
    +
  • + Fixed an issue with the + + ldap + + module that prevented installing SimpleSAMLphp from the repository (#1241). +
    • +
+

+ Version 1.18.1 +

+

+ Released 2019-11-26 +

+
    +
  • + Fixed an issue that prevented custom themes from working (#1240). +
    • +
  • + Fixed an issue with translations in the discovery service (#1244). +
    • +
  • + Fixed an issue with schema validation. +
    • +
+

+ Version 1.18.0 +

+

+ Released 2019-11-19 +

+
    +
  • + Fixed an issue with warnings being logged when using PHP 7.2 or newer (#1168). +
    • +
  • + Fixed an issue with web server aliases or rewritten URLs not working (#1023, #1093). +
    • +
  • + Fixed an issue that prevented errors to be logged if the log file was not writeable (#1194). +
    • +
  • + Fixed an issue with old-style NameIDPolicy configurations that disallowed creating new NameIDs (#1230). +
    • +
  • + Resolved a security issue that exposed host information to unauthenticated users. See + + SSPSA 201911-02 + + . +
    • +
  • + Replaced custom Email class with the phpmailer library. +
    • +
  • + Allow logging to STDERR in the + + logging.handler + + option by setting it to + + stderr + + . +
    • +
  • + Allow use of stream wrappers (e.g. s3://) in paths. +
    • +
  • + Improved 'update or insert' handling for different SQL drivers. +
    • +
  • + The default algorithm within the TimeLimitedToken class has been bumped from SHA-1 to SHA-256 + as announced by deprecation notice in 1.15-RC1. +
    • +
  • + Most modules have been externalized. They will not be included in our future releases by default, + but will be easily installable using Composer. For now, they are still included in the package. +
    • +
  • + Many minor fixes to code, css, documentation +
    • +
+

+ + metarefresh + +

+
    +
  • + The algorithm to compute the fingerprint of the certificate that signed + metadata can be specified with the new + + validateFingerprintAlgorithm + + configuration option. +
    • +
+

+ + saml + +

+
    +
  • + Make the id of the generated signed metadata only change when metadata content changes. +
    • +
  • + New SP metadata configuration options + + AssertionConsumerService + + and + + SingleLogoutServiceLocation + + to allow overriding the default URL paths. +
    • +
  • + Added support for per-IDP configurable + + AuthnContextClassRef + + / + + AuthnContextComparison + + . +
    • +
+

+ Version 1.17.8 +

+

+ Released 2019-11-20 +

+
    +
  • + Resolved a security issue that exposed host information to unauthenticated users. See + + SSPSA 201911-02 + + . +
    • +
+

+ + consentAdmin + +

+
    +
  • + Fixed an issue with CSS and JavaScript not loading for the module in the new user + interface. +
    • +
+

+ Version 1.17.7 +

+

+ Released 2019-11-06 +

+
    +
  • + Resolved a security issue that allows to bypass signature validation. See + + SSPSA 201911-01 + + . +
    • +
+

+ Version 1.17.6 +

+

+ Released 2019-08-29 +

+
    +
  • + Fixed a regression with logout database initialization when using MySQL (#1177). +
    • +
  • + Fixed an issue with logout when using iframes (#1191). +
    • +
  • + Fixed an issue causing log entries to be logged with incorrect relative order (#1107). +
    • +
+

+ Version 1.17.5 +

+

+ Released 2019-08-02 +

+
    +
  • + Fixed a bug in the SP API where NameID objects weren't taken care of (introduced in 1.17.0). +
    • +
  • + Fixed a regression where MetaDataStorageHandlerPdo::getMetaData() would not return a value (#1165). +
    • +
  • + Fixed an issue with table indexes (#1089). +
    • +
  • + Fixed an issue with table migrations on SQlite (#1169). +
    • +
  • + Fixed an issue with generated eduPersonTargetedID lacking a format specified (#1135). +
    • +
  • + Updated composer dependencies. +
    • +
+

+ Version 1.17.4 +

+

+ Released 2019-07-11 +

+
    +
  • + Fix an issue introduced in 1.17.3 with + + enable.http_post + + . +
    • +
+

+ Version 1.17.3 +

+

+ Released 2019-07-10 +

+
    +
  • + Resolved a security issue that could lead to a reflected XSS. See + + SSPSA 201907-01 + + . +
    • +
  • + Add new options + + session.cookie.samesite + + and + + language.cookie.samesite + + that can be + used to set a specific value for the cookies' SameSite attribute. The default it not + to set it. +
    • +
  • + Upgraded jQuery to version 3.4. +
    • +
  • + HHVM is no longer supported. +
    • +
  • + Fixed a bug (#926) where dynamic metadata records where not loaded from a database. +
    • +
  • + Fixed an issue when an error occurs during a passive authentication request. +
    • +
  • + Handle duplicate insertions for SQL Server. +
    • +
  • + Fix a bug in Short SSO Interval warning filter. +
    • +
  • + Apply a workaround for SIGSEGVs during session creation with PHP-FPM 7.3. +
    • +
+

+ + adfs + +

+
    +
  • + Fixed a missing option to supply a passphrase for the ADFS IDP signing certificate. +
    • +
+

+ + authlinkedin + +

+
    +
  • + This module has been removed now that LinkedIn no longer supports OAuth1. + If you relied on this module, you may consider migrating to the + + authoauth2 module + + . + A migration guide for LinkedIn authentication is included in their README. +
    • +
+

+ Version 1.17.2 +

+

+ Released 2019-04-02 +

+
    +
  • + Fixed that generated metadata was missing some information + when PHP's zend.assertions option is set to < 1. +
    • +
  • + Fixed that MDUI Keywords and Logo were not parsed from metadata. +
    • +
  • + Fixed DiscoPower module tab display. +
    • +
  • + Fixed use group name in Attribute Add Users Groups filter. +
    • +
  • + Add metadatadir setting to the default config template. +
    • +
  • + Fixed exception processing in loadExceptionState(). +
    • +
  • + Fixed preferredidp in built-in 'links'-style discovery. +
    • +
+

+ Version 1.17.1 +

+

+ Released 2019-03-07 +

+
    +
  • + Fixed an issue with composer that made it impossible to install modules + if SimpleSAMLphp was installed itself with the provided package (tar.gz file). +
    • +
+

+ Version 1.17.0 +

+

+ Released 2019-03-07 +

+
    +
  • + Introduce a new experimental user interface based on Twig templates. + The new Twig templates co-exist next to the old ones and come + with a new look-and-feel for SimpleSAMLphp and independent interfaces for + users and administrators. This new interface uses also a new build system + to generate bundled assets. +
    • +
  • + Introduce Symfony-style routing and dependency injection(#966). +
    • +
  • + Generate session IDs complying with PHP config settings when using the PHP + session handler (#569). +
    • +
  • + Update OpenSSL RSA bit length in docs (#993). +
    • +
  • + Update all code, configuration templates and documentation to PHP + short array syntax. +
    • +
  • + All classes moved to namespaces and code reformatted to PSR-2. +
    • +
  • + Use bcrypt for new password hashes, old ones will remain working (#996). +
    • +
  • + Many code cleanups. +
    • +
  • + Update the SAML2 library dependency to 3.2.5. +
    • +
  • + Update the Clipboard.JS library dependency to 2.0.4. +
    • +
  • + Translated to Zulu and Xhosa. +
    • +
  • + Multiple bug fixes and corrections. +
    • +
+

+ Interoperability +

+
    +
  • + The minimum PHP version required is now 5.5. +
    • +
  • + Fixed compatibility with PHP 7.3 and HVVM. +
    • +
  • + SimpleSAMLphp can now be used with applications that use Twig 2 and/or Symfony 4. +
    • +
  • + The SAML2 library now uses getters/setters to manipulate objects properties. +
    • +
+

+ + authfacebook + +

+
    +
  • + Fix Facebook compatibility (query parameters). +
    • +
+

+ + authorize + +

+
    +
  • + Add the possibility to configure a custom rejection message. +
    • +
+

+ + consent + +

+
    +
  • + The module is now disabled by default. +
    • +
+

+ + core + +

+
    +
  • + Allow + + core:PHP + + to manipulate the entire state array. +
    • +
  • + IdP initiated login: add compatibility with Shibboleth parameters. +
    • +
+

+ `multiauth +

+
    +
  • + Added a + + preselect + + configuration option to skip authsource selection (#1005). +
    • +
+

+ + negotiate + +

+
    +
  • + The + + keytab + + setting now allows for relative paths too. +
    • +
+

+ + preprodwarning + +

+
    +
  • + This module is now deprecated. Use the + + production + + configuration + option instead; set it to + + false + + to show a pre-production warning + before authentication. +
    • +
+

+ + saml + +

+
    +
  • + Add initial support for SAML Subject ID Attributes. +
    • +
  • + Allow to specify multiple supported NameIdFormats in IdP hosted and SP + remote metadata. +
    • +
  • + Allow to specify NameIDPolicy Format and AllowCreate in hosted SP + and remote IdP configuration. Restore the possibility to omit it from + AuthnRequests entirely (#984). +
    • +
  • + Add a + + assertion.allowed_clock_skew + + setting to influence how lenient + we should be with the timestamps in received SAML messages. +
    • +
  • + If the Issuer of a SAML response does not match the entity we sent the + request to, log a warning instead of bailing out with an exception. +
    • +
  • + Allow setting the AudienceRestriction in SAML2 requests (#998). +
    • +
  • + Allow disabling the Scoping element in SP and remote IdP configuration with + the + + disable_scoping + + option, for compatibility with ADFS which does not + accept the element (#985). +
    • +
  • + Receiving an eduPersonTargetedID in string form will no longer break + parsing of the assertion. +
    • +
+

+ + sanitycheck + +

+
    +
  • + Translated into several languages. +
    • +
+

+ Version 1.16.3 +

+

+ Released 2018-12-20 +

+
    +
  • + Resolved a security issue that could expose the user's credentials locally. See + + SSPSA 201812-01 + + . +
    • +
  • + Downgraded the level of log messages regarding the + + userid.attribute + + configuration option + from + + warning + + to + + debug + + . +
    • +
  • + Make the + + attr + + configuration option of the + + negotiate + + allow both a string and an array. +
    • +
  • + Look for the + + keytab + + file used by the + + negotiate + + module in the + + cert + + directory, accepting + both absolute and relative paths. +
    • +
  • + Fixed some broken links. +
    • +
  • + Other minor bugfixes. +
    • +
+

+ Version 1.16.2 +

+

+ Released 2018-09-28 +

+
    +
  • + Fixed an issue with PHP sessions in PHP 7.2. +
    • +
  • + Fixed a bug in the OAuth module. +
    • +
  • + Make schema validation work again. +
    • +
  • + Properly document the + + saml:AuthnContextClassRef + + authentication processing filter. +
    • +
  • + Fixed an issue that made it impossible to install the software with composer using the + "stable" minimum-stability setting. +
    • +
  • + Changed the default authentication context class to "PasswordProtectedTransport" by default + when authentication happened on an HTTPS exchange. +
    • +
+

+ Version 1.16.1 +

+

+ Released 2018-09-07 +

+
    +
  • + Fix a bug preventing the consent page from showing. +
    • +
  • + Add Catalan to the list of available languages. +
    • +
+

+ Version 1.16.0 +

+

+ Released 2018-09-06 +

+

+ Changes +

+
    +
  • + Default signature algorithm is now RSA-SHA256. +
    • +
  • + Renamed class + + SimpleSAML_Error_BadUserInnput + + to + + SimpleSAML_Error_BadUserInput + +
    • +
  • + PHP 7.2 compatibility, including removing deprecated use of assert with string. +
    • +
  • + Avoid logging database credentials in backtraces. +
    • +
  • + Fix edge case in getServerPort. +
    • +
  • + Updated Spanish translation. +
    • +
  • + Improvements to documentation, testsuite, code quality and coding style. +
    • +
+

+ + New features + +

+
    +
  • + Added support for SAML "Enhanced Client or Proxy" (ECP) protocol, + IdP side with HTTP Basic Authentication as authentication method. + See the + + ECP IdP documentation + + for details. +
    • +
  • + New option + + sendmail_from + + , the from address for email sent by SSP. +
    • +
  • + New option + + options + + for PDO database connections, e.g. for TLS setup. +
    • +
  • + New option + + search.scope + + for LDAP authsources. +
    • +
  • + Add support for the DiscoHints IPHint metadata property. +
    • +
  • + Add support to specify metadata XML in config with the + + xml + + parameter, + next to the existing + + file + + and + + url + + options. +
    • +
  • + Also support CGI/RewriteRule setups that set the + + REDIRECT_SIMPLESAMLPHP_CONFIG_DIR + + environment variable next to regular + + SIMPLESAMLPHP_CONFIG_DIR + + . +
    • +
  • + Support creating an AuthSource via factory, for example useful in tests. +
    • +
  • + Support preloading of a virtual config file via + + SimpleSAML_Configuration::setPreLoadedConfig + + to allow for dynamic population of authsources.php. +
    • +
  • + Add basic documentation on Nginx configuration. +
    • +
  • + Test authentication: optionally show AuthData array. +
    • +
  • + Improve performance of PDO Metadata Storage handler entity lookup. +
    • +
+

+ + adfs + +

+
    +
  • + Make signature algorithm configurable with + + signature.algorithm + + . +
    • +
  • + Use configuration assertion lifetime when available. +
    • +
  • + Use + + adfs:wreply + + parameter when available. +
    • +
+

+ + authmyspace + +

+
    +
  • + Module removed because service is no longer available. +
    • +
+

+ + cas + +

+
    +
  • + Respect all LDAP options in LDAP call. +
    • +
+

+ + casserver + +

+
    +
  • + Module removed; superseded by externally hosted module. +
    • +
+

+ + consent + +

+
    +
  • + Sort attribute values for consent. +
    • +
  • + Fix table layout for MySQL > 5.6. +
    • +
  • + Rename + + noconsentattributes + + to + + attributes.exclude + + ; the former + is now considered deprecated. +
    • +
+

+ + consentAdmin + +

+
    +
  • + Work better with TargetedIDs when operating as a proxy. +
    • +
  • + Add + + attributes.exclude + + option to correspond to the same option + in the Consent module. +
    • +
+

+ + core + +

+
    +
  • + StatisticsWithAttribute: add + + passive- + + prefix when logging passive + requests, set new option + + skipPassive + + to skip logging these altogether. +
    • +
  • + Replace deprecated + + create_function + + with an anonymous function. +
    • +
  • + New authproc filter Cardinality to enforce attribute cardinality. +
    • +
  • + SQLPermanentStorage: proper expiration of stored values. +
    • +
  • + AttributeLimit: new options + + regex + + and + + ignoreCase + + . +
    • +
  • + AttributeMap: prevent possible infinite loop with some PHP versions. +
    • +
+

+ + ldap + +

+
    +
  • + AttributeAddUsersGroups: if + + attribute.groupname + + is set, use the + configured attribute as the group name rather than the DN. +
    • +
  • + Also base64encode the + + ms-ds-consistencyguid + + attribute. +
    • +
+

+ + metarefresh + +

+
    +
  • + Return XML parser error for better debugging of problems. +
    • +
  • + Only actually parse metadata types that have been enabled. +
    • +
  • + Fix missing translation. +
    • +
+

+ + oauth + +

+
    +
  • + Make module HTTP proxy-aware. +
    • +
  • + Remove unused demo app. +
    • +
+

+ + saml + +

+
    +
  • + AttributeConsumingService: allow to set isDefault and index options. +
    • +
  • + Encrypted attributes in an assertion are now decrypted correctly. +
    • +
  • + Prefer the HTTP-Redirect binding for AuthnRequests if available. +
    • +
+

+ + smartattributes + +

+
    +
  • + Fix to make the + + add_authority + + option work. +
    • +
+

+ + sqlauth + +

+
    +
  • + The module is now disabled by default. +
    • +
+

+ + statistics + +

+
    +
  • + Show a decent error message when no data is available. +
    • +
+

+ Version 1.15.4 +

+

+ Released 2018-03-02 +

+
    +
  • + Resolved a security issue related to signature validation in the SAML2 library. See + + SSPSA 201803-01 + + . +
    • +
+

+ Version 1.15.3 +

+

+ Released 2018-02-27 +

+
    +
  • + Resolved a security issue related to signature validation in the SAML2 library. See + + SSPSA 201802-01 + + . +
    • +
  • + Fixed edge-case scenario where an application uses one of the known LoggingHandlers' name as a defined class +
    • +
  • + Fixed issue #793 in the PHP logging handler. +
    • +
+

+ Version 1.15.2 +

+

+ Released 2018-01-31 +

+
    +
  • + Resolved a Denial of Service security issue when validating timestamps in the SAML2 library. See + + SSPSA 201801-01 + + . +
    • +
  • + Resolved a security issue with the open redirect protection mechanism. See + + SSPSA 201801-02 + + . +
    • +
  • + Fix + + undefined method + + error when using memcacheD. +
    • +
+

+ + authfacebook + +

+
    +
  • + Fix compatibility with Facebook strict URI match. +
    • +
+

+ + consent + +

+
    +
  • + Fix statistics not being gathered. +
    • +
+

+ + sqlauth + +

+
    +
  • + Prevented a security issue with the connection charset used for MySQL backends. See + + SSPSA 201801-03 + + . +
    • +
+

+ Version 1.15.1 +

+

+ Released 2018-01-12 +

+

+ + Bug fixes + +

+
    +
  • + AuthX509 error messages were broken. +
    • +
  • + Properly calculate supported protocols based on config. +
    • +
  • + NameIDAttribute filter: update to use SAML2\XML\saml\NameID. +
    • +
  • + Replace remaining uses of SimpleSAML_Logger with namespace version. +
    • +
  • + Statistics: prevent mixed content errors. +
    • +
  • + Add 'no-store' to the cache-control header to avoid Chrome + caching redirects. +
    • +
+

+ Version 1.15.0 +

+

+ Released 2017-11-20 +

+

+ + New features + +

+
    +
  • + Added support for authenticated web proxies with the + + proxy.auth + + setting. +
    • +
  • + Added new + + AttributeValueMap + + authproc filter. +
    • +
  • + Added attributemaps for OIDs from SIS (Swedish Standards Institute) and + for eduPersonUniqueId, eduPersonOrcid and sshPublicKey. +
    • +
  • + Added an option to specify metadata signing and digest algorithm + + metadata.sign.algorithm + + . +
    • +
  • + Added an option for regular expression matching of trusted.url.domains via new + + trusted.url.regex + + setting. +
    • +
  • + The + + debug + + option is more finegrained and allows one to specify whether + to log full SAML messages, backtraces or schema validations separately. +
    • +
  • + Added a check for the latest SimpleSAMLphp version on the front page. + It can be disabled via the new setting + + admin.checkforupdates + + . +
    • +
  • + Added a warning when there's a probable misconfiguration of PHP sessions. +
    • +
  • + Added ability to define additional attributes on ContactPerson elements + in metadata, e.g. for use in Sirtfi contacts. +
    • +
  • + Added option to set a secure flag also on the language cookie. +
    • +
  • + Added option to specify the base URL for the application protected. +
    • +
  • + Added support for PHP Memcached extension next to Memcache extension. +
    • +
  • + Added Redis as possible session storage mechanism. +
    • +
  • + Added support to specify custom metadata storage handlers. +
    • +
  • + Invalidate opcache after writing a file, so simpleSAMLphp works when + + opcache.validate_timestamps + + is disabled. +
    • +
  • + Metadata converter will deal properly with XML with leading whitespace. +
    • +
  • + Update + + ldapwhoami() + + call for PHP 7.3. +
    • +
  • + Made response POST page compatible with strict Content Security Policy on + calling webpage. +
    • +
  • + Updated Greek, Polish, Traditional Chinese and Spanish translations and + added Afrikaans. +
    • +
+

+ + Bug fixes + +

+
    +
  • + The deprecated OpenIdP has been removed from the metadata template. +
    • +
  • + Trailing slash is no longer required in + + baseurlpath + + . +
    • +
  • + Make redirections more resilient. +
    • +
  • + Fixed empty protocolSupportEnumeration in AttributeAuthorityDescriptor. +
    • +
  • + Other bug fixes and numerous documentation enhancements. +
    • +
  • + Fixed a bug in the Redis store that could lead to incorrect + + duplicate assertion + + errors. +
    • +
+

+ + API and user interface + +

+
    +
  • + Updated to Xmlseclibs 3.0. + Minimum PHP version is now 5.4, mcrypt requirement dropped. +
    • +
  • + Added a PSR-4 autoloader for modules. Now modules can declare their + classes under the SimpleSAML\Module namespace. +
    • +
  • + Added new hook for module loader exception handling + + exception_handler + + . +
    • +
  • + Expose RegistrationInfo in parsed SAML metadata. +
    • +
  • + The AuthnInstant is now available in the state array. +
    • +
  • + Introduced Twig templating for user interface. +
    • +
  • + Lots of refactoring, code cleanup and added many unit tests. +
    • +
+

+ + adfs + +

+
    +
  • + Fixed POST response form parameter encoding. +
    • +
+

+ + authYubiKey + +

+
    +
  • + Fixed PHP 7 support. +
    • +
+

+ + authfacebook + +

+
    +
  • + Updated to work with latest Facebook API. +
    • +
+

+ + authlinkedin + +

+
    +
  • + Added setting + + attributes + + to specify which attributes to request + from LinkedIn. +
    • +
+

+ + authtwitter + +

+
    +
  • + Added support for fetching the user's email address as attribute. +
    • +
+

+ + consent + +

+
    +
  • + Added support for regular expressions in + + consent.disable + + . +
    • +
+

+ + core + +

+
    +
  • + Added logging of + + REMOTE_ADDR + + on successful login. +
    • +
  • + + AttributeMap + + : allow fetching mapping files from modules. +
    • +
  • + + ScopeAttribute + + : added option + + onlyIfEmpty + + to add a scope only if + none was present. +
    • +
  • + + AttributeCopy + + : added option to copy to multiple destination attributes. +
    • +
+

+ + cron + +

+
    +
  • + Allow invocation via PHP command line interface. +
    • +
+

+ + discopower + +

+
    +
  • + Added South Africa tab. +
    • +
+

+ + ldap + +

+
    +
  • + Added + + search.filter + + setting to limit LDAP queries to a custom search + filter. +
    • +
  • + Added OpenLDAP support in AttributeAddUsersGroups. +
    • +
  • + Fixed for using non standard LDAP port numbers. +
    • +
  • + Fixed configuration option of whether to follow LDAP referrals. +
    • +
+

+ + memcacheMonitor + +

+
    +
  • + Fixed several missing strings. +
    • +
+

+ + metarefresh + +

+
    +
  • + Fixed several spurious PHP notices. +
    • +
+

+ + multiauth + +

+
    +
  • + Fixed selected source timeout. +
    • +
+

+ + negotiate + +

+
    +
  • + Fixed authentication failure on empty attributes-array. +
    • +
  • + Fixed PHP notices concerning missing arguments. +
    • +
+

+ + oauth + +

+
    +
  • + Updated library to improve support for OAuth 1.0 Revision A. +
    • +
+

+ + radius + +

+
    +
  • + Improved error messages. +
    • +
  • + Added parameter + + realm + + that will be suffixed to the username entered. +
    • +
+

+ + saml + +

+
    +
  • + Handle instead of reject assertions that do not contain a NameID. +
    • +
  • + Added options to configure + + AllowCreate + + and + + SPNameQualifier + + . +
    • +
  • + Added option + + saml:NameID + + to set the Subject NameID in a SAML AuthnRequest. +
    • +
  • + Added filter + + FilterScopes + + to remove values which are not properly scoped. +
    • +
  • + Make sure we log the user out before reauthenticating. +
    • +
  • + More robust handling of IDPList support in proxy mode. +
    • +
  • + Increased + + _authSource + + field length in Logout Store. +
    • +
  • + We now send the eduPersonTargetedID attribute in the correct + NameID XML form, instead of the incorrect simple string. We will also + refuse to parse an assertion with an eduPersonTargetedID in 'string' format. +
    • +
+

+ + smartattributes + +

+
    +
  • + Fix SmartName authproc that failed to load. +
    • +
+

+ + sqlauth + +

+
    +
  • + Fixed SQL schema for usergroups table. +
    • +
+

+ Version 1.14.17 +

+

+ Released 2017-10-25 +

+ +

+ Version 1.14.16 +

+

+ Released 2017-09-04 +

+ +

+ Version 1.14.15 +

+

+ Released 2017-08-08 +

+
    +
  • + Resolved a security issue with the creation and validation of time-limited tokens. See + + SSPSA 201708-01 + + . +
    • +
  • + Fixed an issue with session handling that could lead to crashes after upgrading from earlier 1.14.x versions. +
    • +
  • + Fixed issue #557 with instances of SimpleSAMLphp installed from the repository as well as custom modules. +
    • +
  • + Fixed issue #648 to properly handle SAML responses being sent to reply the same request, but using different response IDs. +
    • +
  • + Fixed issues #612 and #618 with the mobile view of the web interface. +
    • +
  • + Fixed issue #639 related to IdP names containing special characters not being properly displayed by discopower. +
    • +
  • + Fixed issue #571 causing timeouts when using Active Directory as a backend. +
    • +
  • + Other minor fixes. +
    • +
+

+ Version 1.14.14 +

+

+ Released 2017-05-05 +

+
    +
  • + Resolved a security issue with in the authcrypt module (Htpasswd authentication source) and in SimpleSAMLphp's session validation. See + + SSPSA 201705-01 + + . +
    • +
  • + Resolved a security issue with in the multiauth module. See + + SSPSA 201704-02 + + . +
    • +
+

+ Version 1.14.13 +

+

+ Released 2017-04-27 +

+
    +
  • + Resolved a security issue with unauthenticated encryption in the SimpleSAML\Utils\Crypto class. See + + SSPSA 201704-01 + + . +
    • +
  • + Added requirement for the Multibyte String PHP extension and the corresponding checks. +
    • +
  • + Set a default name for SimpleSAMLphp sessions in the configuration template for the PHP session handler. +
    • +
+

+ Version 1.14.12 +

+

+ Released 2017-03-30 +

+
    +
  • + Resolved a security issue in the authcrypt module (Htpasswd authentication source) and in SimpleSAMLphp's session validation. See + + SSPSA 201703-01 + + . +
    • +
  • + Resolved a security issue with IV generation in the + + SimpleSAML\Utils\Crypto::_aesEncrypt() + + method. See + + SSPSA 201703-02 + + . +
    • +
  • + Fixed an issue with the authfacebook module, broken after a change in Facebook's API. +
    • +
  • + Fixed an issue in the discopower module that ignored the + + hide.from.discovery + + metadata option. +
    • +
  • + Fixed an issue with trusted URLs validation that prevented a URL from being accepted if a standard port was explicitly included but not specified in the configuration. +
    • +
  • + Fixed an issue that prevented detecting a Memcache server being down when fetching Memcache statistics. +
    • +
  • + Fixed an issue with operating system detection that made SimpleSAMLphp identify OSX as Windows. +
    • +
+

+ Version 1.14.11 +

+

+ Released 2016-12-12 +

+
    +
  • + Resolved a security issue involving signature validation of SAML 1.1 messages. See + + SSPSA 201612-02 + + . +
    • +
  • + Fixed an issue when the user identifier used to generate a persistent NameID was missing due to a misconfiguration, causing SimpleSAMLphp to generate the nameID based on the null data type. +
    • +
  • + Fixed an issue when persistent NameIDs were generated out of attributes with empty strings or multiple values. +
    • +
  • + Fixed issue #530. An empty SubjectConfirmation element was causing SimpleSAMLphp to crash. On the other hand, invalid SubjectConfirmation elements were ignored in PHP 7.0. +
    • +
+

+ Version 1.14.10 +

+

+ Released 2016-12-02 +

+
    +
  • + Resolved a security issue involving signature validation. See + + SSPSA 201612-01 + + . +
    • +
  • + Fixed issue #517. A misconfigured session when acting as a service provider was leading to a PHP fatal error. +
    • +
  • + Fixed issue #519. Prevent persistent NameIDs from being generated from empty strings. +
    • +
  • + Fixed issue #520. It was impossible to verify Apache's custom MD5 passwords when using the Htpasswd authentication source. +
    • +
  • + Fixed issue #523. Avoid problems caused by different line-ending strategies in the project files. +
    • +
  • + Other minor fixes and enhancements. +
    • +
+

+ Version 1.14.9 +

+

+ Released 2016-11-10 +

+
    +
  • + Fixed an issue that resulted in PHP 7 errors being masked. +
    • +
  • + Fixed the smartattributes:SmartName authentication processing filter. +
    • +
  • + Fixed issue #500. When parsing metadata, two 'attributes.required' options were generated. +
    • +
  • + Fixed the list of requirements in composer, the documentation, and the configuration page. +
    • +
  • + Fixed issue #479. There were several minor issues with XHTML compliance. +
    • +
  • + Other minor fixes. +
    • +
+

+ Version 1.14.8 +

+

+ Released 2016-08-23 +

+
    +
  • + Fixed an issue in AuthMemCookie causing it to crash when an attribute received contains XML as its value. +
    • +
  • + Fixed an issue in AuthMemCookie that made it impossible to set its own cookie. +
    • +
  • + Fixed an issue when acting as a proxy and receiving attributes that contain XML as their values. +
    • +
  • + Fixed an issue that led to incorrect URL guessing when a script is invoked with a URI that doesn't include its name. +
    • +
+

+ Version 1.14.7 +

+

+ Released 2016-08-01 +

+
    +
  • + Fixed issue #424. Attributes containing XML as their values (like eduPersonTargetedID) were empty. +
    • +
+

+ Version 1.14.6 +

+

+ Released 2016-07-18 +

+
    +
  • + Fixed issue #418. SimpleSAMLphp was unable to obtain the current URL correctly when invoked from third-party applications. +
    • +
+

+ Version 1.14.5 +

+

+ Released 2016-07-12 +

+
    +
  • + Fixed several issues with session handling when cookies couldn't be set for some reason. +
    • +
  • + Fixed an issue that caused wrong URLs to be generated in the web interface under certain circumstances. +
    • +
  • + Fixed the exception handler to be compatible with PHP 7. +
    • +
  • + Fixed an issue in the dropdown IdP selection page that prevented it to work with PHP 5.3. +
    • +
  • + Fixed compatibility with Windows machines. +
    • +
  • + Fixed an issue with the PDO and Serialize metadata storage handlers. +
    • +
  • + Fixed the authwindowslive module. It stopped working after the former API was discontinued. +
    • +
  • + Other minor issues and fixes. +
    • +
+

+ Version 1.14.4 +

+

+ Released 2016-06-08 +

+
    +
  • + Fixed two minor security issues that allowed malicious URLs to be presented to the user in a link. Reported by John Page. +
    • +
  • + Fixed issue #366. The LDAP class was trying to authenticate even when no password was provided (using the CAS module). +
    • +
  • + Fixed issue #401. The authenticate.php script was printing exceptions instead of throwing them for the exception handler to capture them. +
    • +
  • + Fixed issue #399. The size limitation of the TEXT type in MySQL was creating problems in certain setups. +
    • +
  • + Fixed issue #5. Incoherent population of the $_SERVER variable was creating broken links when running PHP with FastCGI. +
    • +
  • + Other typos and minor bugs: #389, #392. +
    • +
+

+ Version 1.14.3 +

+

+ Released 2016-04-19 +

+
    +
  • + Fixed a bug in the login form that prevented the login button to be displayed in mobile devices. +
    • +
  • + Resolved an issue in the PHP session handler that made it impossible to use PHP sessions simultaneously with other applications. +
    • +
+

+ Version 1.14.2 +

+

+ Released 2016-03-11 +

+
    +
  • + Use stable versions of the externalized modules to prevent possible issues when further developing them. +
    • +
+

+ Version 1.14.1 +

+

+ Released 2016-03-08 +

+
    +
  • + Resolved an information leakage security issue in the sanitycheck module. See + + SSPSA 201603-01 + + . +
    • +
+

+ Version 1.14.0 +

+

+ Released 2016-02-15 +

+

+ Security +

+
    +
  • + Resolved a security issue with multiple modules that were not validating the URLs they were redirecting to. +
    • +
  • + Added a security check to disable loading external entities in XML documents. +
    • +
  • + Enforced admin access to the metadata converter tool. +
    • +
  • + Changed + + xmlseclibs + + dependency to point to + + robrichards/xmlseclibs + + version 1.4.1. +
    • +
+

+ + New features + +

+
    +
  • + Allow setting the location of the configuration directory with an environment variable. +
    • +
  • + Added support for the Metadata Query Protocol by means of the new MDX metadata storage handler. +
    • +
  • + Added support for the Sender-Vouches method. +
    • +
  • + Added support for WantAssertionsSigned and AuthnRequestsSigned in SAML 2.0 SP metadata. +
    • +
  • + Added support for file uploads in the metadata converter. +
    • +
  • + Added support for setting the prefix for Memcache keys. +
    • +
  • + Added support for the Hide From Discovery REFEDS Entity Category. +
    • +
  • + Added support for the eduPersonAssurance attribute. +
    • +
  • + Added support for the full SCHAC 1.5.0 schema. +
    • +
  • + Added support for UNIX sockets when configuring memcache servers. +
    • +
  • + Added the SAML NameID to the attributes status page, when available. +
    • +
  • + Added attribute definitions for schacGender (schac), sisSchoolGrade and sisLegalGuardianFor (skolfederation.se). +
    • +
  • + Attributes required in metadata are now taken into account when parsing. +
    • +
+

+ + Bug fixes + +

+
    +
  • + Fixed an issue with friendly names in the attributes released. +
    • +
  • + Fixed an issue with memcache that would result in a push for every fetch, when several servers configured. +
    • +
  • + Fixed an issue with memcache that would result in an endless loop if all servers are down. +
    • +
  • + Fixed an issue with HTML escaping in error reports. +
    • +
  • + Fixed an issue with the 'admin.protectmetadata' option not being enforced for SP metadata. +
    • +
  • + Fixed an issue with SAML 1.X SSO authentications that removed the NameID of the subject from available data. +
    • +
  • + Fixed an issue with the login form that resulted in a + + NOSTATE + + error if the user clicked the login button twice. +
    • +
  • + Fixed an issue with replay detection in IdP-initiated flows. +
    • +
  • + Fixed an issue with SessionNotOnOrAfter that kept moving forward in the future with every SSO authentication. +
    • +
  • + Fixed an issue with the session cookie being set twice for the first time. +
    • +
  • + Fixed an issue with the XXE attack prevention mechanism conflicting with other applications running in the same server. +
    • +
  • + Fixed an issue that prevented the SAML 1.X IdP to restart when the session is lost. +
    • +
  • + Fixed an issue that prevented classes using namespaces to be loaded automatically. +
    • +
  • + Fixed an issue that prevented certain metadata signatures to be verified (fixed upstream in + + xmlseclibs + + ). +
    • +
  • + Other bug fixes and numerous documentation enhancements. +
    • +
+

+ + API and user interface + +

+
    +
  • + Added a new and simple database class to serve as PDO interface for all the database needs. +
    • +
  • + Added the possibility to copy metadata and other elements by clicking a button in the web interface. +
    • +
  • + Removed the old, unused + + pack + + installer tool. +
    • +
  • + Improved usability by telling users the endpoints are not to be accessed directly. +
    • +
  • + Moved the hostname, port and protocol diagnostics tool to the admin directory. +
    • +
  • + Several classes and functions deprecated. +
    • +
  • + Changed the signature of several functions. +
    • +
  • + Deleted old and deprecated code, interfaces and endpoints. +
    • +
  • + Deleted old jQuery remnants. +
    • +
  • + Deleted the undocumented dynamic XML metadata storage handler. +
    • +
  • + Deleted the backwards-compatible authentication source. +
    • +
  • + Updated jQuery to the latest 1.8.X version. +
    • +
  • + Updated translations. +
    • +
+

+ + authcrypt + +

+
    +
  • + Added whitehat101/apr1-md5 as a dependency for Apache htpasswd. +
    • +
+

+ + authX509 + +

+
    +
  • + Added an authentication processing filter to warn about certificate expiration. +
    • +
+

+ + ldap + +

+
    +
  • + Added a new + + port + + configuration option. +
    • +
  • + Better error reporting. +
    • +
+

+ + metaedit + +

+
    +
  • + Removed the + + admins + + configuration option. +
    • +
+

+ + metarefresh + +

+
    +
  • + Added the possibility to specify which types of entities to load. +
    • +
  • + Added the possibility to verify metadata signatures by using the public key present in a certificate. +
    • +
  • + Fix + + certificate + + precedence over + + fingerprint + + in the configuration options when verifying metadata signatures. +
    • +
+

+ + smartnameattribute + +

+
    +
  • + This module was deprecated long time ago and has now been removed. Use the + + smartattributes + + module instead. +
    • +
+

+ Version 1.13.2 +

+

+ Released 2014-11-04 +

+
    +
  • + Solved performance issues when processing large metadata sets. +
    • +
  • + Fix an issue in the web interface when only one language is enabled. +
    • +
+

+ Version 1.13.1 +

+

+ Released 2014-10-27 +

+
    +
  • + Solved an issue with empty fields in metadata to cause SimpleSAMLphp to fail with a translation error. Issues #97 and #114. +
    • +
  • + Added Basque language to the list of known languages. Issue #117. +
    • +
  • + Optimized the execution of redirections by removing an additional, unnecessary function call. +
    • +
  • + Solved an issue that caused SimpleSAMLphp to fail when the RelayState parameter was empty or missing on an IdP-initiated authentication. Issues #99 and # 104. +
    • +
  • + Fixed a certificate check for SubjectConfirmations with Holder of Key methods. +
    • +
+

+ Version 1.13 +

+

+ Released 2014-09-25. +

+
    +
  • + Added the 'remember me' option to the default login page. +
    • +
  • + Improved error reporting. +
    • +
  • + Added a new 'logging.format' option to control the formatting of the logs. +
    • +
  • + Added support for the 'objectguid' binary attribute in LDAP modules. +
    • +
  • + Added support for custom search and private attributes read credentials in all LDAP modules. +
    • +
  • + Added support for the WantAuthnRequestsSigned option in generated SAML metadata. +
    • +
  • + Tracking identifiers are no longer generated based on MD5. +
    • +
  • + Several functions, classes and interfaces marked as deprecated. +
    • +
  • + Bug fixes and documentation enhancements. +
    • +
  • + Updated translations. +
    • +
  • + New language: Basque. +
    • +
+

+ + adfs + +

+
    +
  • + Honour the 'wreply' parameter when redirecting. +
    • +
+

+ + aggregator + +

+
    +
  • + Fixed an issue when regenerating metadata from certain metadata sources. +
    • +
+

+ + discopower + +

+
    +
  • + Bug fix. +
    • +
+

+ + expirycheck + +

+
    +
  • + Translations are now possible for this module. +
    • +
+

+ + metarefresh + +

+
    +
  • + Use cached metadata if something goes wrong when refreshing feeds. +
    • +
+

+ + openidProvider + +

+
    +
  • + Fix for compatibility with versions of PHP greater or equal to 5.4. +
    • +
+

+ + saml + +

+
    +
  • + Make it possible to add friendly names to attributes in SP metadata. +
    • +
  • + The RSA_1.5 (RSA with PKCS#1 v1.5 padding) encryption algorithm is now blacklisted by default for security reasons. +
    • +
  • + Stop checking the 'IDPList' parameter in IdPs. +
    • +
  • + Solved an issue that allowed bypassing authentication status checks when presenting an 'IDPList' parameter. +
    • +
  • + The 'Destination' attribute is now always sent in logout responses issued by an SP. +
    • +
+

+ + sqlauth + +

+
    +
  • + Updated documentation to remove bad practice with regard to password storage. +
    • +
+

+ Version 1.12 +

+

+ Released 2014-03-24. +

+
    +
  • + Removed example authproc filters from configuration template. +
    • +
  • + Stopped using the 'target-densitydpi' option removed from WebKit. +
    • +
  • + The SimpleSAML_Utilities::generateRandomBytesMTrand() function is now deprecated. +
    • +
  • + Removed code for compatibility with PHP versions older than 5.3. +
    • +
  • + Removed the old interface of SimpleSAML_Session. +
    • +
  • + Fixed a memory leak in SimpleSAML_Session regarding serialization and unserialization. +
    • +
  • + Support for RegistrationInfo (MDRPI) elements in the metadata of identity and service providers. +
    • +
  • + Renamed SimpleSAML_Utilities::parseSAML2Time() function to xsDateTimeToTimestamp(). +
    • +
  • + New SimpleSAML_Utilities::redirectTrustedURL() and redirectUntrustedURL() functions. +
    • +
  • + Deprecated the SimpleSAML_Utilities::redirect() function. +
    • +
  • + Improved Russian translation. +
    • +
  • + Added Czech translation. +
    • +
  • + New 'errorreporting' option to enable or disable error reporting feature. +
    • +
  • + Example certificate removed. +
    • +
  • + New SimpleSAML_Configuration::getEndpointPrioritizedByBinding() function. +
    • +
  • + PHP 5.3 or newer required. +
    • +
  • + Started using Composer as dependency manager. +
    • +
  • + Detached the basic SAML2 library and moved to a standalone library in GitHub. +
    • +
  • + Added support for exporting shibmd:Scope metadata with regular expressions. +
    • +
  • + Remember me option in the IdP. +
    • +
  • + New SimpleSAML_Utilities::setCookie wrapper. +
    • +
  • + Custom HTTP codes on error. +
    • +
  • + Added Romanian translation. +
    • +
  • + Bug fixes and documentation enhancements. +
    • +
+

+ + adfs + +

+
    +
  • + Support for exporting metadata. +
    • +
+

+ + aggregator + +

+
    +
  • + Support for RegistrationInfo (MDRPI) elements in the metadata. +
    • +
  • + Fix for HTTP header injection vulnerability. +
    • +
  • + Fix for directory traversal vulnerability. +
    • +
+

+ + aggregator2 + +

+
    +
  • + Support for RegistrationInfo (MDRPI) elements in the metadata. +
    • +
+

+ + aselect + +

+
    +
  • + License changed to LGPL 2.1. +
    • +
+

+ + authfacebook + +

+
    +
  • + Updated extlibinc to 3.2.2. +
    • +
+

+ + authtwitter + +

+
    +
  • + Added 'force_login' configuration option. +
    • +
+

+ + cdc + +

+
    +
  • + Bugfix related to request validation. +
    • +
+

+ + core + +

+
    +
  • + The AttributeAlter filter no longer throws an exception if the attribute was not found. +
    • +
  • + Support for removal of values in the AttributeAlter filter, with '%remove' flag. +
    • +
  • + Support for empty strings and NULL values as a replacement in the AttributeAlter filter. +
    • +
  • + Bugfixes in the AttributeAlter filter. +
    • +
  • + Support for NULL attribute values. +
    • +
  • + Support for limiting values and not only attributes in the AttributeLimit filter. +
    • +
  • + Log a message when a user authenticates successfully. +
    • +
  • + Added %duplicate flag to AttributeMap, to leave original names in place when using map file. +
    • +
  • + Fix infinite loop when overwriting attributes with AttributeMap. +
    • +
+

+ + discopower + +

+
    +
  • + Bugfix for incorrect handling of the 'idpdisco.extDiscoveryStorage' option. +
    • +
+

+ + ldap + +

+
    +
  • + Support for configuring the duplicate attribute handling policy in AttributeAddFromLDAP, 'attribute.policy' option. +
    • +
  • + Support for binary attributes in the AttributeAddFromLDAP filter. +
    • +
  • + Support for multiple attributes in the AttributeAddFromLDAP filter. +
    • +
+

+ + metarefresh + +

+
    +
  • + Support for specifying permissions of the resulting files. +
    • +
+

+ + negotiate + +

+
    +
  • + Added support for "attributes"-parameter. +
    • +
+

+ + oauth + +

+
    +
  • + Bugfix related to authorize URL building. +
    • +
+

+ + openidProvider + +

+
    +
  • + Support for SReg and AX requests. +
    • +
+

+ + saml + +

+
    +
  • + Send 'isPassive' in passive discovery requests. +
    • +
  • + Support for generating NameIDFormat in service providers with NameIDPolicy set. +
    • +
  • + Support for AttributeConsumingService and AssertionConsumingServiceIndex. +
    • +
  • + Support for the HTTP-POST binding in WebSSO profile. +
    • +
  • + Fix for entity ID validation problems when using the IDPList configuration option. +
    • +
+

+ + smartattributes + +

+
    +
  • + New 'add_candidate' option to allow the user to decide whether to prepend or not the candidate attribute name to the resulting value. +
    • +
+

+ + statistics + +

+
    +
  • + Bugfix in statistics aggregator. +
    • +
+

+ Version 1.11 +

+

+ Released 2013-06-05. +

+
    +
  • + Support for RSA_SHA256, RSA_SHA384 and RSA_SHA512 in HTTP Redirect binding. +
    • +
  • + Support for RegistrationInfo element in SAML 2.0 metadata. +
    • +
  • + Support for AuthnRequestsSigned and WantAssertionsSigned when generating metadata. +
    • +
  • + Third party OpenID library updated with a bugfix. +
    • +
  • + Added the Name attribute to EntitiesDescriptor. +
    • +
  • + Removed deprecated option 'session.requestcache' from config-template. +
    • +
  • + Workaround for SSL SNI extension not being correctly set. +
    • +
  • + New language cookie and parameter config options. +
    • +
  • + Add 'module.enable' configuration option for enabling/disabling modules. +
    • +
  • + Check for existence of memcache extension. +
    • +
  • + Initial support for limiting redirects to trusted hosts. +
    • +
  • + Demo example now shows both friendly and canonical name of the attributes. +
    • +
  • + Other minor fixes for bugs and typos. +
    • +
  • + Several translations updated. +
    • +
  • + Added Latvian translation. +
    • +
+

+ + authorize + +

+
    +
  • + Added a logout link to the 403 error page. +
    • +
+

+ + authtwitter + +

+
    +
  • + Updated API endpoint for version 1.1. +
    • +
  • + Fix for oauth_verifier parameter. +
    • +
+

+ + authX509 + +

+
    +
  • + ldapusercert validation made optional. +
    • +
+

+ + consent + +

+
    +
  • + Added support for SQLite databases. +
    • +
+

+ + core + +

+
    +
  • + Fix error propagation in UserPass(Org)Base authentication sources. +
    • +
  • + MCrypt module marked as required. +
    • +
+

+ + discopower + +

+
    +
  • + Get the name of an IdP from mdui:DisplayName. +
    • +
+

+ + expirycheck + +

+
    +
  • + PHP 5.4 compatibility fixes. +
    • +
+

+ + InfoCard + +

+
    +
  • + PHP 5.4 compatibility fixes. +
    • +
+

+ + ldap + +

+
    +
  • + Added an option to disable following referrals. +
    • +
+

+ + metarefresh + +

+
    +
  • + Improved help message. +
    • +
+

+ + oauth + +

+
    +
  • + PHP 5.4 compatibility fixes. +
    • +
+

+ + saml + +

+
    +
  • + Verify that the issuer of an AuthnResponse is the same entity ID we sent a request to. +
    • +
  • + Added separate option to enable Holder of Key support on SP. +
    • +
  • + Fix for HoK profile metadata. +
    • +
  • + New filter for storing persistent NameID in eduPersonTargetedID attribute. +
    • +
  • + Support for UIInfo elements. +
    • +
  • + Bugfix for SAML SP metadata signing. +
    • +
  • + Ignore default technical contact. +
    • +
  • + Support for MDUI elements in SP metadata. +
    • +
  • + Support for more contact types in SP metadata. +
    • +
  • + New information in statistics with the time it took for a login to happen. +
    • +
+

+ + sanitycheck + +

+
    +
  • + Configuration file made optional. +
    • +
+

+ + smartattributes + +

+
    +
  • + New filter: smartattributes:SmartID. +
    • +
  • + New filter: smartattributes:SmartName. +
    • +
+

+ + smartnameattribute + +

+
    +
  • + Deprecated. +
    • +
+

+ + wsfed + +

+
    +
  • + Support for SLO in WS-Fed. +
    • +
+

+ Version 1.10 +

+

+ Released 2012-09-25. +

+
    +
  • + Add support for storing data without expiration timestamp in memcache. +
    • +
  • + Fix for reauthentication in old shib13 authentication handler. +
    • +
  • + Clean up executable-permissions on files. +
    • +
  • + Change encryption to use the rsa-oaep-mgf1p key padding instead of PKCS 1.5. +
    • +
  • + Update translations. +
    • +
  • + Added Serbian translation. +
    • +
+

+ + core + +

+
    +
  • + + core:UserPass(Org)Base + + : Add "remember username" option. +
    • +
+

+ + papi + +

+
    +
  • + New authentication module supporting PAPI protocol. +
    • +
+

+ + radius + +

+
    +
  • + New feature to configure multiple radius servers. +
    • +
+

+ + riak + +

+
    +
  • + New module for storing sessions in a Riak database. +
    • +
+

+ + saml + +

+
    +
  • + Add support for overriding SAML 2.0 SP authentication request generation. +
    • +
  • + Add support for blacklisting encryption algorithms. +
    • +
+

+ Version 1.9.2 +

+

+ Released 2012-08-29 +

+
    +
  • + Fix related to the security issue addressed in version 1.9.1. +
    • +
+

+ Version 1.9.1 +

+

+ Released 2012-08-02. +

+
    +
  • + Fix for a new attack against PKCS 1.5 in XML encryption. +
    • +
+

+ Version 1.9 +

+

+ Released 2012-06-13. +

+
    +
  • + Restructure error templates to share a common base template. +
    • +
  • + Warnings about URL length limits from Suhosin PHP extension. +
    • +
  • + New base class for errors from authentication sources. +
    • +
  • + Support for overriding URL generation when behind a reverse proxy. +
    • +
  • + New languages: Russian, Estonian, Hebrew, Chinese, Indonesian +
    • +
  • + Add getAuthSource()-function to SimpleSAML_Auth_Simple. +
    • +
  • + Add reauthenticate()-function to SimpleSAML_Auth_Source. (Is called when the IdP receives a new authentication request.) +
    • +
  • + iframe logout: Make it possible to skip the "question-page" for code on the IdP. +
    • +
  • + RTL text support. +
    • +
  • + Make SimpleSAMLAuthToken cookie name configurable. +
    • +
  • + Block writing secure cookies when we are on http. +
    • +
  • + Fix state information being unavailable to UserPassOrgBase authentication templates. +
    • +
  • + Make it possible to send POST-messages to http-endpoints without triggering a warning when the IdP supports both http and https. +
    • +
  • + Add IPv6-support to the SimpleSAML_Utilities::ipCIDRcheck()-function. +
    • +
  • + Do not allow users to switch to a language that is not enabled. +
    • +
  • + iframe logout: Add a per-SP timeout option. +
    • +
  • + SimpleSAML_Auth_LDAP: Better logging of the cause of exceptions. +
    • +
  • + SimpleSAML_Auth_State: Add $allowMissing-parameter to loadState(). +
    • +
  • + module.php: More strict URL parsing. +
    • +
  • + Add support for hashed admin passwords. +
    • +
  • + Use openssl_random_pseudo_bytes() for better cross-platform random number generation. +
    • +
  • + Add the current hostname to the error reports. +
    • +
  • + Make the lifetime of SimpleSAML_Auth_State "state-arrays" configurable (via the + + session.state.timeout + + -option). +
    • +
  • + SimpleSAML_Auth_State: Add cloneState()-function. +
    • +
  • + Fix log levels used on Windows. +
    • +
  • + SimpleSAML_Auth_LDAP: Clean up some unused code. +
    • +
  • + core:UserPassOrgBase: Add selected organization to the authentication data that is stored in the session. +
    • +
  • + Do not warn about missing Radius and LDAP PHP extensions unless those modules are enabled. +
    • +
  • + Support for overriding the logic to determine the language. +
    • +
  • + Avoid crashes due to deprecation-warnings issued by PHP. +
    • +
  • + Use case-insensitive matching of language codes. +
    • +
  • + Add X-Frame-Options to prevent other sites from loading the SSP-pages in an iframe. +
    • +
  • + Add SimpleSAML_Utilities::isWindowsOS()-helper function. +
    • +
  • + chmod() generated files to only be accessible to the owner of the files. +
    • +
  • + Fix "re-posting" of POST data containing a key named "submit". +
    • +
  • + Do not attempt to read new sessions from the session handler. +
    • +
  • + Fix some pass-by-reference uses. (Support removed in PHP 5.4.) +
    • +
  • + Warn the user if the secretsalt-option isn't set. +
    • +
  • + A prototype for a new statistics logging core. Provides more structured logging of events, and support for multiple storage backends. +
    • +
  • + Support for arbitrary namespace-prefixed attributes in md:EndpointType-elements. +
    • +
  • + Fix invalid HTML for login pages where username is set. +
    • +
  • + Remove unnecessary check for PHP version >= 5.2 when setting cookies. +
    • +
  • + Better error message when a module is missing a default-enable or default-disable file. +
    • +
  • + Support for validating RSA-SHA256 signatures. +
    • +
  • + Fixes for session expiration handling. +
    • +
+

+ + aselect + +

+
    +
  • + New module that replaces the previous module. +
    • +
  • + Better error handling. +
    • +
  • + Support for request signing. +
    • +
  • + Loses support for A-Select Cross. +
    • +
+

+ + authcrypt + +

+
    +
  • + + authcrypt:Hash + + : New authentication source for checking username & password against a list of usernames and hashed passwords. +
    • +
  • + + authcrypt:Htpasswd + + : New authentication source for checking username & password against a + + .htpasswd + + -file. +
    • +
+

+ + authfacebook + +

+
    +
  • + Update to latest Facebook PHP SDK. +
    • +
+

+ + authorize + +

+
    +
  • + + authorize:Authorize + + : Add flag to change the behaviour from default-deny to default-allow. +
    • +
  • + + authorize:Authorize + + : Add flag to do simple string matching instead of regex-matching. +
    • +
+

+ + authtwitter + +

+
    +
  • + Update to use the correct API endpoint. +
    • +
  • + Propagate "user aborted" errors back to the caller. +
    • +
  • + Changes to error handling, throw more relevant exceptions. +
    • +
  • + Store state information directly in the state array, instead of the session. +
    • +
+

+ + authYubiKey + +

+
    +
  • + Remove deprecated uses of split(). +
    • +
+

+ + cas + +

+
    +
  • + Make it possible for subclasses to override finalState(). +
    • +
+

+ + core + +

+
    +
  • + + core:AttributeCopy + + : New filter to copy attributes. +
    • +
+

+ + consent + +

+
    +
  • + Add a timeout option for the database connection. +
    • +
  • + Fix disabling of consent when the data store is down. +
    • +
  • + Simpler configuration for disabling consent for one SP or one IdP. +
    • +
  • + Do not connect to the database when consent is disabled for the current SP/IdP. +
    • +
+

+ + consentAdmin + +

+
    +
  • + Fix for bridged IdP setup with + + userid.attribute + + set in + + saml20-idp-hosted + + metadata. +
    • +
+

+ + cron + +

+
    +
  • + Set the From-address to be the technical contact email address. +
    • +
+

+ + expirycheck + +

+
    +
  • + + expirycheck:ExpiryDate + + : New module to check account expiration. +
    • +
+

+ + ldap + +

+
    +
  • + Add a base class for authentication processing filters which fetch data from LDAP. +
    • +
  • + + ldap:AttributeAddUsersGroups + + : Authentication processing filter that adds group information from LDAP. +
    • +
+

+ + metarefresh + +

+
    +
  • + Support for blacklisting and whitelisting entities. +
    • +
  • + Support for conditional GET of metadata files. +
    • +
  • + Reuse old metadata when fetching metadata fails. +
    • +
+

+ + multiauth + +

+
    +
  • + Add + + multiauth:preselect + + -parameter, to skip the page to select authentication source. +
    • +
  • + Make it possible to configure the names of the authentication sources. +
    • +
  • + Remember the last selected authentication source. +
    • +
+

+ + negotiate + +

+
    +
  • + New module implementing "negotiate" authentication, which can be used for Kerberos authentication (including Windows SSO). +
    • +
+

+ + oauth + +

+
    +
  • + Update to latest version of the OAuth library. +
    • +
  • + Remove support for older versions of OAuth than OAuth Rev A. +
    • +
+

+ + openid + +

+
    +
  • + Separate linkback URL from page displaying OpenID URL field. +
    • +
  • + Throw more relevant exceptions. +
    • +
  • + Update to latest version of the OpenID library. +
    • +
  • + Support for sending authentication requests via GET requests (with the prefer_http_redirect option). +
    • +
  • + Prevent deprecation warnings from the OpenID library from causing deadlocks in the class loader. +
    • +
+

+ + openidProvider + +

+
    +
  • + Prevent deprecation warnings from the OpenID library from causing deadlocks in the class loader. +
    • +
+

+ + radius + +

+
    +
  • + Support for setting the "NAS-Identifier" attribute. +
    • +
+

+ + saml + +

+
    +
  • + Preserve ID-attributes on elements during signing. (Makes it possible to change the binding for some messages.) +
    • +
  • + Allow SAML artifacts to be received through a POST request. +
    • +
  • + Log more debug information when we are unable to determine the binding a message was sent with. +
    • +
  • + Require HTTP-POST messages to be sent as POST data and HTTP-Redirect messages to be sent as query parameters. +
    • +
  • + Link to download certificates from metadata pages. +
    • +
  • + Fix canonicalization of <md:EntityDescriptor> and <md:EntitiesDescriptor>. +
    • +
  • + Support for receiving and sending extension in authentication request messages. +
    • +
  • + Reuse SimpleSAML_Utilities::postRedirect() to send HTTP-POST messages. +
    • +
  • + Allow ISO8601 durations with subsecond precision. +
    • +
  • + Add support for parsing and serializing the <mdrpi:PublicationInfo> metadata extension. +
    • +
  • + Ignore cacheDuration when validating metadata. +
    • +
  • + Add support for the Holder-of-Key profile, on both the + + SP + + and + + IdP + + . +
    • +
  • + Better error handling when receiving a SAML 2.0 artifact from an unknown entity. +
    • +
  • + Fix parsing of <md:AssertionIDRequestService> metadata elements. +
    • +
  • + IdP: Do not always trigger reauthentication when the authentication request contains a IdPList-element. +
    • +
  • + IdP: Add + + saml:AllowCreate + + to the state array. This makes it possible to access this parameter from authentication processing filters. +
    • +
  • + IdP: Sign the artifact response message. +
    • +
  • + IdP: Allow the "host" metadata option to include more than one path element. +
    • +
  • + IdP: Support for generating metadata with MDUI extension elements. +
    • +
  • + SP: Use the discojuice-module as a discovery service if it is enabled. +
    • +
  • + SP: Add + + saml:idp + + -parameter to trigger login to a specific IdP to as_login.php. +
    • +
  • + SP: Do not display error on duplicate response when we have a valid session. +
    • +
  • + SP: Fix for logout after IdP initiated authentication. +
    • +
  • + SP: Fix handling of authentication response without a saml:Issuer element. +
    • +
  • + SP: Support for specifying required attributes in metadata. +
    • +
  • + SP: Support for limiting the AssertionConsumerService endpoints listed in metadata. +
    • +
  • + SP: Fix session expiration when the IdP limits the session lifetime. +
    • +
  • + + saml:PersistentNameID + + : Fail when the user has more than one value in the user ID attribute. +
    • +
  • + + saml:SQLPersistentNameID + + : Persistent NameID stored in a SQL database. +
    • +
  • + + saml:AuthnContextClassRef + + : New filter to set the AuthnContextClassRef in responses. +
    • +
  • + + saml:ExpectedAuthnContextClassRef + + : New filter to verify that the SP received the correct authentication class from the IdP. +
    • +
+

+ Version 1.8.2 +

+

+ Released 2012-01-10. +

+
    +
  • + Fix for user-assisted cross site scripting on a couple of pages. +
    • +
+

+ Version 1.8.1 +

+

+ Released 2011-10-27. +

+
    +
  • + Fix for key oracle attack against XML encryption on SP. +
    • +
  • + Fix for IdP initiated logout with IdP-initiated SSO. +
    • +
  • + Fix a PHP notice if we are unable to open /dev/urandom. +
    • +
  • + Fix a PHP notice during SAML 1.1 authentication. +
    • +
+

+ Version 1.8 +

+
    +
  • + New authentication modules: + +
    • +
  • + Support for custom error handler, replacing the default display function. +
    • +
  • + Allow error codes to be defined in modules. +
    • +
  • + Better control of logout what we do after logout request. +
      +
    • + This makes it possible for the SP to display a warning when receiving a PartialLogout response from the IdP. +
      • +
    +
    • +
  • + New + + cdc + + module, for setting and reading common domain cookies. +
    • +
+

+ + consent + +

+
    +
  • + Support for disabling consent for some attributes. +
    • +
+

+ + ldap + +

+
    +
  • + + ldap:AttributeAddFromLDAP + + : Extract values from multiple matching entries. +
    • +
+

+ + oauth + +

+
    +
  • + Added support for: +
      +
    • + RSASHA1 signatures +
      • +
    • + consent +
      • +
    • + callbackurl +
      • +
    • + verifier code +
      • +
    • + request parameters +
      • +
    +
    • +
+

+ + openid + +

+
    +
  • + Support for sending custom extension arguments (e.g. UI extensions). +
    • +
+

+ + saml + +

+
    +
  • + Extract Extensions from AuthnRequest for use by custom modules when authenticating. +
    • +
  • + Allow signing of SP metadata. +
    • +
  • + Better control over NameIDPolicy when sending AuthnRequest. +
    • +
  • + Support encrypting/decrypting NameID in LogoutRequest. +
    • +
  • + Option to disable client certificate in SOAP client. +
    • +
  • + Better selection of AssertionConsumerService endpoint based on parameters in AuthnRequest. +
    • +
  • + Set NotOnOrAfter in IdP LogoutRequest. +
    • +
  • + Only return PartialLogout from the IdP. +
    • +
+

+ Version 1.7 +

+
    +
  • + New authentication modules: +
      +
    • + + aselect + +
      • +
    • + + authX509 + +
      • +
    +
    • +
  • + Unified cookie configuration settings. +
    • +
  • + Added protection against session fixation attacks. +
    • +
  • + Error logging when failing to initialize the Session class. +
    • +
  • + New session storage framework. +
      +
    • + Add and use generic key/value store. +
      • +
    • + Support for storing sessions in SQL databases (MySQL, PostgreSQL & SQLite). +
      • +
    • + Support for implementing custom session storage handlers. +
      • +
    • + Allow loading of multiple sessions simultaneously. +
      • +
    +
    • +
  • + Set headers allowing caching of static files. +
    • +
  • + More descriptive error pages: +
      +
    • + Unable to load $state array because the session was lost. +
      • +
    • + Unable to find metadata for the given entityID. +
      • +
    +
    • +
  • + Support for multiple keys in metadata. +
      +
    • + Allow verification with any of the public keys in metadata. +
      • +
    • + Allow key rollower by defining new and old certificate in configuration. +
      • +
    • + Verify with signing keys, encrypt with encryption keys. +
      • +
    +
    • +
  • + Change + + debug + + -option to log messages instead of displaying them in the browser. +
      +
    • + Also logs data before encryption and after decryption. +
      • +
    +
    • +
  • + Support for custom attribute dictionaries. +
    • +
  • + Add support for several authentication sessions within a single session. +
      +
    • + Allows several SPs on a single host. +
      • +
    • + Allows for combining an SP and an IdP on a single host. +
      • +
    +
    • +
  • + HTTP proxy support. +
    • +
+

+ Internal API changes & features removed +

+
    +
  • + The + + saml2 + + module has been removed. +
      +
    • + The + + saml2:SP + + authsource has been removed. +
      • +
    • + The + + sspmod_saml2_Error + + class has been renamed to + + sspmod_saml_Error + + . +
      • +
    • + The + + sspmod_saml2_Message + + class has been renamed to + + sspmod_saml_Message + + . +
      • +
    +
    • +
  • + Moved IdP functions from + + sspmod_saml_Message + + to + + sspmod_saml_IdP_SAML2 + + . +
    • +
  • + Removed several functions and classes that are unused: +
      +
    • + + SimpleSAML_Utilities::strleft + +
      • +
    • + + SimpleSAML_Utilities::array_values_equal + +
      • +
    • + + SimpleSAML_Utilities::getRequestURI + +
      • +
    • + + SimpleSAML_Utilities::getScriptName + +
      • +
    • + + SimpleSAML_Utilities::getSelfProtocol + +
      • +
    • + + SimpleSAML_Utilities::cert_fingerprint + +
      • +
    • + + SimpleSAML_Utilities::generateTrackID + +
      • +
    • + + SimpleSAML_Utilities::buildBacktrace + +
      • +
    • + + SimpleSAML_Utilities::formatBacktrace + +
      • +
    • + + SimpleSAML_Metadata_MetaDataStorageHandlerSAML2Meta + +
      • +
    • + + SimpleSAML_ModifiedInfo + +
      • +
    +
    • +
  • + Moved function from Utilities-class to more appropriate locations. +
      +
    • + + getAuthority + + to + + SimpleSAML_IdP + +
      • +
    • + + generateUserId + + to + + sspmod_saml_IdP_SAML2 + + . +
      • +
    +
    • +
  • + Replaced calls to with throwing an + + SimpleSAML_Error_Error + + exception. +
    • +
  • + Removed metadata send functionality from old SP code. +
    • +
  • + Removed bin/test.php and www/admin/test.php. +
    • +
  • + Removed metashare. +
    • +
  • + Removed www/auth/login-auto.php. +
    • +
  • + Removed www/auth/login-feide.php. +
    • +
  • + Removed optional parameters from + + SimpleSAML_XHTML_Template::getLanguage() + + . +
    • +
  • + Removed functions from + + SAML2_Assertion + + : + + get/setDestination + + , + + get/setInResponseTo + + . + Replaced with + + setSubjectConfirmation + + . +
    • +
  • + Removed several unused files & templates. +
    • +
+

+ + SAML2 IdP + +

+
    +
  • + Support for generation of NameID values via + + processing filters + +
    • +
  • + Obey the NameIDPolicy Format in authentication request. +
    • +
  • + Allow AuthnContextClassRef to be set by processing filters. +
    • +
  • + Rework iframe logout page to not rely on cookies. +
    • +
+

+ + SAML2 SP + +

+
    +
  • + Support SOAP logout. +
    • +
  • + Various fixes to adhere more closely to the specification. +
      +
    • + Allow multiple SessionIndex-elements in LogoutRequest. +
      • +
    • + Handle multiple Assertion-elements in Response. +
      • +
    • + Reject duplicate assertions. +
      • +
    • + Support for encrypted NameID in LogoutRequest. +
      • +
    • + Verify Destination-attribute in LogoutRequest messages. +
      • +
    +
    • +
  • + Add specific options for signing and verifying authentication request and logout messages. +
    • +
  • + + saml:NameIDAttribute + + filter for extracting NameID from authentication response. +
    • +
+

+ + SAML1 IdP + +

+
    +
  • + Add + + urn:mace:shibboleth:1.0 + + as supported protocol in generated metadata. +
    • +
+

+ + SAML1 SP + +

+
    +
  • + Support for IdP initiated authentication. +
    • +
+

+ + aggregator + +

+
    +
  • + Allow metadata generation from command line. +
    • +
+

+ + authfacebook + +

+
    +
  • + Change attribute names. +
    • +
+

+ + casserver + +

+
    +
  • + Support for proxying. +
    • +
  • + Add ttl for tickets. +
    • +
+

+ + core + +

+
    +
  • + + core:AttributeLimit + + : Make it possible to specify a default set of attributes. +
    • +
  • + Make the SP metadata available on the login pages. +
    • +
+

+ + discoPower + +

+
    +
  • + Sort IdPs without a name (where we only have an entityID) last in the list. +
    • +
  • + CDC cookie support. +
    • +
+

+ + exampleAuth + +

+
    +
  • + Add example of integration with external authentication page. +
    • +
+

+ + ldap + +

+
    +
  • + Add + + ldap:AttributeAddFromLDAP + + filter for adding attributes from a LDAP directory. +
    • +
+

+ + metarefresh + +

+
    +
  • + Don't stop updates on the first exception. +
    • +
+

+ + openid + +

+
    +
  • + Don't require access to the PHP session. +
    • +
  • + Remove OpenID test page. (May as well use the normal test pages.) +
    • +
  • + Support for attribute exchange. +
    • +
  • + Add + + target + + option, for directing authentication to a specific OpenID provider. +
    • +
  • + Add + + realm + + option, for specifying the realm we should send to the OpenID provider. +
    • +
+

+ + portal + +

+
    +
  • + Make it possible to register pages from modules, and not only from configuration. +
    • +
+

+ + statistics + +

+
    +
  • + New y-axis scaling algorithm +
    • +
+

+ + twitter + +

+
    +
  • + Change attribute names returned from twitter. +
    • +
+

+ Version 1.6.3 +

+

+ Released 2010-12-17. +

+
    +
  • + Fix for cross site scripting in redirect page. +
    • +
+

+ Version 1.6.2 +

+

+ Released 2010-07-29. +

+
    +
  • + Various security fixes. +
    • +
+

+ Version 1.6.1 +

+

+ Released 2010-06-25. +

+
    +
  • + saml:SP: Fix SingleLogoutService endpoint in SSP-format metadata array. +
    • +
  • + Shib13:IdP: Add urn:mace:shibboleth:1.0 to supported protocols. +
    • +
  • + Fix SAMLParser::parseElement(). +
    • +
  • + SAML2:IdP: Fix persistent NameID generation. +
    • +
  • + Fix scoping on IdP discovery page. +
    • +
  • + metaedit: Fix endpoints parsed from XML. +
    • +
  • + Dictionary update. +
    • +
  • + Documentation fixes. +
    • +
+

+ Version 1.6 +

+

+ Released 2010-05-31. +

+

+ + Upgrade notes + +

+
    +
  • + Detection of cookies disabled on the IdP. +
    • +
  • + New IdP core, which makes it simpler to share code between different IdPs, e.g. between SAML 1.1 and SAML 2.0. +
    • +
  • + Dictionaries moved to JSON format. +
    • +
  • + New authentication module: + + + cas:CAS + + + . +
    • +
  • + All images that doesn't permit non-commercial use have been replaced. +
    • +
  • + Better support for OrganizationName, OrganizationDisplayName and OrganizationURL in metadata. +
    • +
  • + Cookie secure flag no longer automatically set. +
    • +
  • + Cross-protocol logout between ADFS and SAML 2. +
    • +
  • + New experimental module for aggregating metadata: + + + aggregator2 + + +
    • +
  • + Metadata support for multiple endpoints with + + multiple bindings + + . +
    • +
  • + The metadata generation is using a new set of classes. + As a result, all generated metadata elements now have a + + md: + + -prefix. +
    • +
  • + The deprecated functions + + init(...) + + and + + setAuthenticated(...) + + in the + + SimpleSAML_Session + + class have been removed. +
    • +
  • + Configuration check and metadata check was removed, as they were often wrong. +
    • +
+

+ + SAML2 SP + +

+
    +
  • + SAML 2.0 HTTP-Artifact support on the + + SP + + . +
    • +
+

+ + SAML2 IdP + +

+
    +
  • + SAML 2.0 HTTP-Artifact support on the + + IdP + + . +
    • +
  • + Support for sending PartialLogout status code in logout response. +
    • +
  • + Set AuthnInstant to the timestamp for authentication. +
    • +
  • + Combine normal and iframe versions of the logout handlers into a single endpoint. +
    • +
  • + The SessionIndex is now unique per SP. +
    • +
  • + Statistics for logout failures. +
    • +
  • + Better generation of persistent NameID when + + nameid.attribute + + isn't specified. +
    • +
+

+ The SP API +

+
    +
  • + Support for handling errors from the IdP. +
    • +
  • + Support for passing parameters to the authentication module. + This can be used to specify SAML 2 parameters, such as isPassive and ForceAuthn. +
    • +
+

+ + adfs + +

+
    +
  • + Move to new IdP core. +
    • +
+

+ + casserver + +

+
    +
  • + Collect all endpoints in a single file. +
    • +
  • + Fix prefix on the tickets. +
    • +
+

+ + consent + +

+
    +
  • + Support for deactivating consent for specific services. +
    • +
+

+ + consentAdmin + +

+
    +
  • + Support for the SAML SP module. +
    • +
+

+ + core + +

+ +

+ + discoPower + +

+
    +
  • + Support for new scoring algorithm. +
    • +
+

+ + ldap + +

+
    +
  • + SASL support in LDAPMulti +
    • +
+

+ + ldapstatus + +

+
    +
  • + This module was removed, as it was very specific for Feide. +
    • +
+

+ + multiauth + +

+
    +
  • + Support for specifying the target authentication source through a request parameter. +
    • +
+

+ + oauth + +

+
    +
  • + Configurable which authentication source should be used. +
    • +
+

+ + openidProvider + +

+
    +
  • + OpenID 2.0 support. +
    • +
  • + XRDS generation support. +
    • +
+

+ + saml + +

+
    +
  • + Support for specifying parameters for authentication request. +
    • +
  • + Add AttributeConsumingService to generated metadata. +
    • +
  • + The two SPSSODescriptor elements in the metadata has been merged. +
    • +
+

+ Version 1.5.1 +

+

+ Released 2010-01-08. +

+
    +
  • + Fix security vulnerability due to insecure temp file creation: +
      +
    • + statistics: The logcleaner script outputs to a file in /tmp. +
      • +
    • + InfoCard: Saves state directly in /tmp. Changed to the SimpleSAMLphp temp directory. +
      • +
    • + openidProvider: Default configuration saves state information in /tmp. + Changed to '/var/lib/simplesamlphp-openid-provider'. +
      • +
    • + SAML 1 artifact support: Saves certificates temporarily in '/tmp/simplesaml', but directory creation was insecure. +
      • +
    +
    • +
  • + statistics: Handle new year wraparound. +
    • +
  • + Dictionary updates. +
    • +
  • + Fix bridged logout. +
    • +
  • + Some documentation updates. +
    • +
  • + Fix all metadata to use assignments to arrays. +
    • +
  • + Fix $session->getIdP(). +
    • +
  • + Support AuthnContextClassRef in saml-module. +
    • +
  • + Do not attempt to send logout request to an IdP that does not support logout. +
    • +
  • + LDAP: Disallow bind with empty password. +
    • +
  • + LDAP: Assume that LDAP_NO_SUCH_OBJECT is an error due to invalid username/password. +
    • +
  • + statistics: Fix configuration template. +
    • +
  • + Handle missing authority in idp-hosted metadata better. +
    • +
+

+ Version 1.5 +

+

+ Released 2009-11-05. Revision 1937. +

+
    +
  • + New API for SP authentication. +
    • +
  • + Make use of the portal module on the frontpage. +
    • +
  • + SQL datastore. +
    • +
  • + Support for setting timezone in config (instead of php.ini). +
    • +
  • + Logging of PHP errors and notices to SimpleSAMLphp log file. +
    • +
  • + Improve handling of unhandled errors and exceptions. +
    • +
  • + Admin authentication through authentication sources. +
    • +
  • + Various bugfixes & cleanups. +
    • +
  • + Translation updates. +
    • +
  • + Set the dropdown list as default for built in disco service. +
    • +
+

+ + New modules + +

+ +

+ + aggregator + +

+
    +
  • + Add ARP + ARP signing functionality to the aggregator. +
    • +
  • + Improvements to the aggregator module. Added documentation, and re-written more OO-oriented. +
    • +
  • + Add support for reconstructing XML where XML for an entity is already cached. +
    • +
  • + Add support for excluding tags in metadata aggregator. +
    • +
+

+ + AuthMemCookie + +

+
    +
  • + Delete the session cookie when deleting the session. +
    • +
  • + Support for authentication sources. +
    • +
  • + Set expiry time of session data when saving to memcache. +
    • +
  • + Support multiple memcache servers. +
    • +
+

+ + cas + +

+
    +
  • + Added support for attributes in + + . + +
    • +
+

+ + consent + +

+
    +
  • + Support for hiding some attribute values. +
    • +
+

+ + consentAdmin + +

+
    +
  • + Added config option to display description. +
    • +
+

+ + core + +

+
    +
  • + New WarnShortSSOInterval filter. +
    • +
+

+ + discopower + +

+
    +
  • + Live search in discopower-module. +
    • +
+

+ + ldap + +

+
    +
  • + Support for proxy authentication. +
    • +
  • + Add 'debug' and 'timeout' options. +
    • +
  • + Privilege separation for LDAP attribute retrieval. +
    • +
  • + Allow search.base to be an array. +
    • +
  • + (LDAPMulti) Add support for including the organization as part of the username. +
    • +
+

+ + ldapstatus + +

+
    +
  • + Do a connect-test to all ip-addresses for a hostname. +
    • +
  • + Check whether hostname exists before attempting to connect. +
    • +
  • + hobbit output. +
    • +
  • + Check schema version. +
    • +
  • + Add command line tab to single LDAP status page for easier debugging. +
    • +
+

+ + logpeek + +

+
    +
  • + Blockwise reading of logfile for faster execution. +
    • +
+

+ + metarefresh + +

+
    +
  • + Adding support for generating Shibboleth ARP files. +
    • +
  • + Add 'serialize' metadata format. +
    • +
+

+ + preprodwarning + +

+
    +
  • + Don't show warning in passive request. +
    • +
  • + Focus on continue-button. +
    • +
+

+ + saml + +

+
    +
  • + Support for multiple AssertionConsumerService endpoints. +
    • +
  • + SAML 1 artifact support on the SP side. +
    • +
  • + New SAML authentication module. +
    • +
  • + Deprecation of www/saml2/sp & www/shib13/sp. +
    • +
  • + Support for encrypted NameID. +
    • +
  • + NameIDPolicy replaces NameIDFormat. +
    • +
  • + Better support for IdP initiated SSO and bookmarked login pages. +
    • +
  • + Improvements to iframe logout page. +
    • +
  • + Scoping support. +
    • +
  • + New library for SAML 2 messages. +
    • +
  • + Support for transporting errors from the IdP to the SP. +
    • +
  • + Sign both the assertion and the response element by default. +
    • +
  • + Support for sending XML attribute values from the IdP. +
    • +
+

+ + statistics + +

+
    +
  • + Extended Google chart encoding... Add option of alternative compare plot in graph... +
    • +
  • + Added support for Ratio type reports in the statistics module.. +
    • +
  • + Changed default rule to SSO. +
    • +
  • + Added incremental aggregation, independent time resolution from rule def, combined coldefs and more. +
    • +
  • + Add DST support in date handler. Added summary columns per delimiter. Added pie chart. +++ +
    • +
  • + Log first SSO to a service during a session. +
    • +
+

+ Version 1.4 +

+

+ Released 2009-03-12. Revision 1405. +

+

+ Updates to + + config.php + + . Please check for updates in your local modified configuration. +

+
    +
  • + Language updates +
    • +
  • + Documentation update. New authentication source API now default and documented. +
    • +
  • + New authentication source (new API): +
      +
    • + LDAP +
      • +
    • + LDAPMulti +
      • +
    • + YubiKey authentication source. (Separate module) +
      • +
    • + Facebook authentication source. (Separate module) +
      • +
    +
    • +
  • + New Authentication Processing Filter: +
      +
    • + AttributeAlter +
      • +
    • + AttributeFilter +
      • +
    • + AttributeMap +
      • +
    • + Smartname. does it best to guess the full name of the user based on several attributes. +
      • +
    • + Language adaptor: allow adopting UI by preferredLanguage SAML 2.0 Attribute both on the IdP and the SP. And if the user selects a language, this can be sent to the SP as an attribute. +
      • +
    +
    • +
  • + New module: portal, allows you to created tabbed interface for custom pages within SimpleSAMLphp. In example user consent management and attribute viewer. +
    • +
  • + New module: ldapstatus. Used by Feide to monitor connections to a large list of LDAP connections. Contact Feide on details on how to use. +
    • +
  • + ldapstatus also got certificate check capabilities. +
    • +
  • + New module: MemcacheMonitor: Show statistics for memcache servers. +
    • +
  • + New module: DiscoPower. A tabbed discovery service module with a lot of functionality. +
    • +
  • + New module: SAML 2.0 Debugginer. An improved version of the one found on rnd.feide.no earlier is not included in SimpleSAMLphp allowing you to run it locally. +
    • +
  • + New module: Simple Consent Amdin module that have one button to remove all consent for one user. +
    • +
  • + New module: Consent Administration. Contribution from Wayf. +
    • +
  • + We also have a consent administration module that we use in Feide that is not checked in to subversion. +
    • +
  • + New module: logpeek. Lets administrator lookup loglines matching a TRackID. +
    • +
  • + New module: PreprodWarning: Adding a warning to users that access a preprod system. +
    • +
  • + New module: CAS Server +
    • +
  • + New module: Aggregator: Aggregates metadata. Used in Kalmar Union. +
    • +
  • + New module: Metarefresh, download, parses and consumes metadata. +
    • +
  • + New module: SanityCheck. Checks if things looks good and reports bad configuration etc. +
    • +
  • + New module: Cron. Will perform tasks regularly. +
    • +
  • + Module: SAML2.0. SAML 2.0 SP implemented as an module. Yet not documented how to use, but all SAML 2.0 SP functionality may be moved out to this module for better modularization. +
    • +
  • + New module: statistics. Parses STAT log files, and aggregates based on a generic rule system. Output is stored in aggregated text files, and a frontend is included to present statistics with tables and graphs. Used sanitycheck and cron. +
    • +
  • + Added support for IdP initiated SSO. +
    • +
  • + Added support for IdP-initiated SLO with iFrame type logout. +
    • +
  • + Major updates to iFrame AJAX SLO. Improved user experience. +
    • +
  • + iFrame AJAX SLO is not safe against simultaneous update of the session. +
    • +
  • + Added support for bookmarking login pages. By adding enough information in the URL to be able to bootstrap a new IdP-initiated SSO and sending. +
    • +
  • + Major updates to the infocard module. +
    • +
  • + Added some handling of isPassive with authentication processing filters. +
    • +
  • + More localized UI. +
    • +
  • + New login as administrator link on frontpage. +
    • +
  • + Tabbed frontpage. Restructured. +
    • +
  • + Simplifications to the theming and updated documentation on theming SimpleSAMLphp. +
    • +
  • + Attribute presentation hook allows you to tweak attributes before presentation in the attribute viewers. Used by Feide to group orgUnit information in a hieararchy. +
    • +
  • + Verification of the Recipient attribute in the response. Will improve security if for some reason an IdP is not includeding sufficient Audience restrictions. +
    • +
  • + Added hook to let modules tell about themself moduleinfo hook. +
    • +
  • + Improved cron mails +
    • +
  • + Improved sanity check exception handling +
    • +
  • + Preserver line breaks in stack trace UI +
    • +
  • + Improvements to WS-Federation support: dynamic realms, logout etc. +
    • +
  • + Better handling of presentation of JPEG photos as attributes. +
    • +
  • + Support limiting size of attribute retrieved from LDAP. +
    • +
  • + Added notes about how to aggregate and consume metadata. Just a start. +
    • +
  • + Large improvements to Configuration class, and config helper functions. +
    • +
  • + STAT logging is moved into separate authentication processing filter. +
    • +
  • + Fix for NoPassive responses to Google Apps with alternative NameIDFormats. +
    • +
  • + LDAP module allows to search multiple searchbases. +
    • +
  • + All documentation is converted from docbook to markdown format. +
    • +
  • + Added headers to not allow google to index pages. +
    • +
  • + Added check on frontpage for magic quotes +
    • +
  • + Added statistic logging to Consent class. +
    • +
  • + Improvements to Exception handler in LDAP class, and better logging. +
    • +
  • + LDAP class supports turning on LDAP-debug logging. +
    • +
  • + Much improvements to SAML 2.0 Metadata generation and parsing. +
    • +
  • + Adding more recent jQuery library. +
    • +
  • + Generic interface for including jQuery dependencies in template headers. +
    • +
  • + Improved UI on default theme +
    • +
  • + Fix for session duration in the Conditions element in the Assertion (SAML 2.0). +
    • +
  • + Updated with new Feide IdP metadata in metadata-templates +
    • +
+

+ Version 1.3 +

+

+ Released 2008-11-04. Revision 973. +

+

+ Configuration file + + config.php + + should not include significant changes, except one language added. +

+

+ + New features + +

+
    +
  • + Documentation update +
    • +
  • + Added new language. Now there are two different portuguese + dialects. +
    • +
  • + Consent "module" modified. Now added support for preselecting the + checkbox by a configuration parameter. Consent module supports + including attributes values (possible to configure). +
    • +
  • + CSS and look changed. Removed transparency to fix problem for some + browsers. +
    • +
  • + The login-admin authentication module does not ask for username any + more. +
    • +
  • + Added support for persistent NameID Format. (Added by Hans + ZAndbelt) +
    • +
  • + Added experimental SAML 2.0 SP AuthSource module. +
    • +
  • + More readable XML output formatting. In example metadata. +
    • +
  • + Better support for choosing whether or not to sign authnrequest. + Possible to specify both at SP hosted and IdP remote. +
    • +
  • + Adding more example metadata in metadata-templates. +
    • +
  • + Improved e-mails sent from SimpleSAMLphp. Now both plain text and + html. +
    • +
  • + Configuration class may return information about what version. +
    • +
  • + iFrame AJAX SLO improved. Now with non-JavaScript fallback + handling. +
    • +
+

+ + Bug fixes + +

+
    +
  • + Fixed warning with XML validator. +
    • +
  • + Improved loading of private/public keys in XML/Signer. +
    • +
  • + Improvements to CAS module. +
    • +
  • + Fixed memcache stats. +
    • +
+

+ Version 1.2 +

+

+ Released 2008-09-26. Revision 899. +

+

+ There are some changes in the configuration files from version 1.1 to 1.2. + + /simplesaml/admin/config.php + + should be used to check what options have changed. +

+

+ When you upgrade from an previous version you should copy + + authsources.php + + from + + config-templates + + into + + config + + directory. +

+

+ There are also some changes to the templates. If you have any custom templates, they should be updated to match the ones included. Of notable changes is that the + + t(...) + + -functtes, they should be updated to match the ones included. Of notable changes is that the + + t(...) + + -function has been simplified, and takes far fewer parameters. It is backwardscompatible, but will write a warning to the log until updated. The backwards compatibility will be removed in a future version. +

+

+ + New features + +

+
    +
  • + Experimental support for modules. Currently modules can contain + custom authentication sources, authentication processing filters + and themes. +
    • +
  • + An generic SQL authentication module added for those who store their + users in an SQL database. +
    • +
  • + Limited support for validating against a CA root certificate. The + current implementation only supports cases where the certificate is + directly signed by the CA. +
    • +
  • + Allow an IdP to have multiple valid certificate fingerprints, to + allow for easier updating of certificates. +
    • +
  • + Shibboleth 1.3 authentication for Auth MemCookie. +
    • +
  • + Support for link to privacy policy on consent-pages. +
    • +
  • + Customizable initial focus on consent-page. +
    • +
  • + Almost all pages should be translatable. +
    • +
  • + Allow SAML 2.0 SP to handle error replies from IdP. +
    • +
  • + PostgreSQL support for consent storage. +
    • +
  • + Add support for encrypted private keys. +
    • +
  • + Proof-of-concept MetaShare service, for easy publishing and sharing + of metadata. +
    • +
+

+ + Bug fixes + +

+
    +
  • + Fixed generated SAML 2.0 metadata to be correct. +
    • +
  • + Fixed logout for Auth MemCookie. +
    • +
  • + Sign SAML 2.0 authentication response on failure (such as NoPassive). +
    • +
  • + Fixes for IsPassive in the SAML 2.0 IdP. +
    • +
  • + Fix default syslog configuration on Windows. +
    • +
  • + Fix order of signing and encryption of SAML 2.0 responses +
    • +
  • + Fix generated metadata for Shib 1.3 +
    • +
  • + Fix order of elements in encrypted assertions to be schema compliant. +
    • +
  • + Fix session index sent to SAML 2.0 SPs. +
    • +
  • + Remember SAML 2.0 NameID sent to SPs, and include it in logout requests. +
    • +
+

+ Version 1.1 +

+

+ Released 2008-06-19. Revision 673. +

+

+ When upgrading to version 1.1 from version 1.0, you should update the configuration files. Many options have been added, and some have moved or removed. The new configuration check page: + + /simplesaml/admin/config.php + + may be useful for determining what should be updated. Also note that the + + language.available + + option in + + config.php + + should be updated to reflect the new languages which have been added. +

+

+ There are also several changes to the template files. If you have done any customizations to these, you should test them to make sure that they still work. Some changes, such as allowing the users to save the IdP choice they make in the discovery service, will not work without updating the templates. +

+

+ New localizations in version 1.1: Sami, Svenska (swedish), Suomeksi (finnish), Nederlands, Luxembourgish, Slovenian, Hrvatski (Croatian), Magyar (Hungarian). +

+

+ + New features + +

+
    +
  • + Add support for saving the users choice of IdP in the IdP discovery + service. +
    • +
  • + Add a config option for whether the Response element or the + Assertion element in the response should be signed. +
    • +
  • + Make it easier to add attribute alteration functions. +
    • +
  • + Added support for multiple languages in metadata name and + description (for IdP discovery service). +
    • +
  • + Added configuration checker for checking if configuration files + should be updated. +
    • +
  • + Add support for icons in IdP discovery service. +
    • +
  • + Add support for external IdP discovery services. +
    • +
  • + Support password encrypted private keys. +
    • +
  • + Added PHP autoloading as the preferred way of loading the + SimpleSAMLphp library. +
    • +
  • + New error report script which will report errors to the + + technicalcontact_email + + address. +
    • +
  • + Support lookup of the DN of the user who is logging in by searching + for an attribute when using the LDAP authentication module. +
    • +
  • + Add support for fetching name and description of entities from XML + metadata files. +
    • +
  • + Support for setting custom AttributeNameFormats. +
    • +
  • + Support for signing generated metadata. +
    • +
  • + Support for signature validation of metadata. +
    • +
  • + Added consent support for Shib 1.3 logging. +
    • +
  • + Added errorlog logging handler for logging to the default Apache + error log. +
    • +
  • + Added support for WS-Federation single signon. +
    • +
  • + Allow + + session_save_path + + to be overridden by setting the + + session.phpsession.savepath + + option in + + config.php + + . +
    • +
  • + Add support for overriding autogenerated metadata values, such as + the + + AssertionConsumerService + + address. +
    • +
  • + Added IsPassive support in the SAML 2.0 IdP. +
    • +
  • + Add attribute filter for generating eduPersonTargetedID attribute. +
    • +
  • + Add support for validation of sent and received messages and + metadata. +
    • +
  • + Add support for dynamic metadata loading with cache. +
    • +
  • + Add support for dynamic generation of entityid and metadata. +
    • +
  • + Added wayf.dk login module. +
    • +
  • + Add support for encrypting and decrypting assertions. +
    • +
  • + CAS authentication module: Add support for serviceValidate. +
    • +
  • + CAS authentication module: Add support for getting attributes from + response by specifying XPath mappings. +
    • +
  • + Add support for specifying a certificate in the + + saml20-idp-remote + + metadata instead of a fingerprint. +
    • +
  • + Add an attribute alter function for dynamic group generation. +
    • +
  • + Add support for attribute processing in SAML 2 SP. +
    • +
  • + Added tlsclient authentication module. +
    • +
  • + Allow the templates to override the header and footer of pages. +
    • +
  • + Major improvements to the Feide authentication module. +
    • +
  • + Add support for ForceAuthn in the SAML 2.0 IdP. +
    • +
  • + Choose language based on the languages the user has selected in the + web browser. +
    • +
  • + Added fallback to base language if translation isn't found. +
    • +
+

+ + Bug fixes + +

+
    +
  • + Modified IdP discovery service to support Shibboleth 2.0 SP. +
    • +
  • + Fix setcookie warning for PHP version \< 5.2. +
    • +
  • + Fix logout not being performed for Auth MemCache sometimes. +
    • +
  • + Preserve case of attribute names during LDAP attribute retrieval. +
    • +
  • + Fix IdP-initiated logout. +
    • +
  • + Ensure that changed sessions with changed SP associations are + written to memcache. +
    • +
  • + Prevent infinite recursion during logging. +
    • +
  • + Don't send the relaystate from the SP which initiated the logout to + other SPs during logout. +
    • +
  • + Prevent consent module from revealing DB password when an error + occurs. +
    • +
  • + Fix logout with memcache session handler. +
    • +
  • + Allow new session to be created in login modules. +
    • +
  • + Removed the strict parameter from base64_decode for PHP 5.1 + compatibility. +
    • +
+

+ Version 1.0 +

+

+ Released 2008-03-28. Revision 470. +

+

+ Version 0.5 +

+

+ Released 2007-10-15. Revision 28. +

+

+ Warning +

+

+ Both + + config.php + + and metadata format are changed. Look at the +templates to understand the new format. +

+
    +
  • + Documentation is updated! +
    • +
  • + Metadata files made tidier. Unused entries removed. Look at the new + templates on how to change your existing metadata. +
    • +
  • + Support for sending metadata by mail to Feide. Automatically + detecting whether you have configured Feide as the default IdP or + not. +
    • +
  • + Improved SAML 2.0 Metadata generation +
    • +
  • + Added support for Shibboleth 1.3 IdP functionality (beta, contact + me if any problems) +
    • +
  • + Added RADIUS authentication backend +
    • +
  • + Added support for HTTP-Redirect debugging when enable + + debug=true + +
    • +
  • + SAML 2.0 SP example now contains a logout page. +
    • +
  • + Added new authentication backend with support for multiple LDAP + based on which organization the user selects. +
    • +
  • + Added SAML 2.0 Discovery Service +
    • +
  • + Initial 'proof of concept' implementation of "User consent on + attribute release" +
    • +
  • + Fixed some minor bugs. +
    • +
+

+ Version 0.4 +

+

+ Released 2007-09-14. Revision X. +

+
    +
  • + Improved documentation +
    • +
  • + Authentication plugin API. Only LDAP authentication plugin is + included, but it is now easier to implement your own plugin. +
    • +
  • + Added support for SAML 2.0 IdP to work with Google Apps for + Education. Tested. +
    • +
  • + Initial implementation of SAML 2.0 Single Log Out functionality + both for SP and IdP. Seems to work, but not yet well-tested. +
    • +
  • + Added support for bridging SAML 2.0 to SAML 2.0. +
    • +
  • + Added some time skew offset to the NotBefore timestamp on the + assertion, to allow some time skew between the SP and IdP. +
    • +
  • + Fixed Browser/POST page to automatically submit, and have fall back + functionality for user agents with no JavaScript support. +
    • +
  • + Fixed some bug with warning traversing Shibboleth 1.3 Assertions. +
    • +
  • + Fixed tabindex on the login page of the LDAP authentication module + to allow you to tab from username, to password and then to submit. +
    • +
  • + Fixed bug on autodiscovering hostname in multihost environments. +
    • +
  • + Cleaned out some debug messages, and added a debug option in the + configuration file. This debug option let's you turn on the + possibility of showing all SAML messages to users in the web + browser, and manually submit them. +
    • +
  • + Several minor bugfixes. +
    • +
+
+ diff --git a/2.1/simplesamlphp-changelog.html b/2.1/simplesamlphp-changelog.html new file mode 100644 index 0000000..be2ac57 --- /dev/null +++ b/2.1/simplesamlphp-changelog.html @@ -0,0 +1,624 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp changelog +

+
+ +
+

+ This document lists the changes between versions of SimpleSAMLphp. +See the upgrade notes for specific information about upgrading. +

+

+ Version 2.1.0 +

+

+ Released 2023-07-31 +

+
    +
  • + Functionality that before was provided by the sanitycheck-module is now implicit. + The module has been archived and should no longer be used. (#1843) +
    • +
  • + Add support for conditional authproc-filters (#1836) +
    • +
  • + Add support for TLS configuration for Redis Store (#1828) +
    • +
  • + Add support for Metadata Deployment Profile for errorURL (#1841) +
    • +
  • + Raised minimum Symfony version to 6.0 +
    • +
  • + Raise minimum PHP version to 8.0 +
    • +
  • + Specified the allowed HTTP methods for each route +
    • +
  • + Our dependency on + + composer/composer + + was dropped in favour of a packaged phar-file (#1857) +
    • +
  • + The + + bin/pwgen.php + + script was improved to used stronger encryption (#1849) +
    • +
  • + Fixed a missing Accept-header for metadata queries (#1865) +
    • +
  • + Changed the UNIQUE constraint for the SP LogoutStore database to PRIMARY KEY to + prevent confusing warnings in Drupal (#1862) +
    • +
  • + Add Accept HTTP headers to MDQ queries (#1865) +
    • +
+

+ Chores +

+
    +
  • + The custom error- and exception handlers were moved to their very own classes (#1858) +
    • +
+

+ Version 2.0.6 +

+

+ Released 2023-09-07 +

+
    +
  • + Fixed a legacy endpoint causing to break iframe-logout (#1846) +
    • +
  • + Fixed an incorrect return-type in RunnableResponse +
    • +
  • + Fix for admin.protectmetadata=true - it would show a blank page +
    • +
  • + Fix default for entity attributes NameFormat in XML metadata to be 'URI'. +
    • +
  • + Fix error message when invoking SSO endpoint without the required parameters. +
    • +
  • + Security header regression +
    • +
  • + Fixed a regression that made it impossible to configure metadata-signing on individual hosted IdP's (#1792) +
    • +
+

+ Version 2.0.5 +

+

+ Released 2023-07-31 +

+
    +
  • + Fixed link pointing to legacy endpoint (#1833) +
    • +
  • + Updated German translations (#1814) +
    • +
  • + Do not drop UIInfo from SSP array style metadata (#1808) +
    • +
  • + Fixed incorrect return types +
    • +
  • + Added removeEntry-method to MetadataStorageHandlerPdo (#1823) +
    • +
  • + Fixed SLO with signed response (#1812) +
    • +
  • + Fixed broken MetaDataStorageHandlerSerialize +
    • +
  • + Usernames are now trimmed (#1829) +
    • +
  • + Never expose the cron-API if secret is not properly configured (#1831) +
    • +
  • + Fixed a bug where IdP-initiated SLO using the HTTP-POST binding wasn't properly dealt with +
    • +
+

+ + admin + +

+
    +
  • + Updated French translations (#1824) +
    • +
+

+ + cron + +

+
    +
  • + Log a warning if secret is not properly configured (#1831) +
    • +
+

+ + metarefresh + +

+
    +
  • + Added support for PDO storage (v0.11.0) +
    • +
+

+ Version 2.0.4 +

+

+ Released 2023-05-12 +

+
    +
  • + The source that was selected by the SourceSelector is now available in the state. +
    • +
  • + The zone that was selected by the SourceIPSelector is now available in the state. +
    • +
  • + The defaultSource for the SourceIPSelector can now be set to + + null + + . If none of the zones + are matched, a NotFound exception will be thrown. +
    • +
  • + It is now possible to set a default AuthnContext in the RequestedAuthnContextSelector. +
    • +
  • + Fixed a bug in MDQ metadata expiration +
    • +
  • + Resolved a possible object injection vulnerability in MDQ metadata cache +
    • +
  • + Restored the possibility to use HTTP-Artifact binding on AuthnRequests +
    • +
  • + Removed unused private method MetaDataStorageSource::getDynamicHostedUrl (leftover from entityid generation) +
    • +
  • + Bumped simplesamlphp-assets-base +
    • +
+

+ + ldap + +

+
    +
  • + Fixed loading the options-array from configuration (v2.1.6) +
    • +
  • + Properly escape user-input in ldap filters (v2.1.7) +
    • +
+

+ + saml2 + +

+
    +
  • + Fixed a static call to a non-static function that caused a broken artifact binding (v4.6.8) +
    • +
+

+ Version 2.0.3 +

+

+ Released 2023-03-29 +

+
    +
  • + Fix exception when translation-file does not exist +
    • +
  • + Correct host in generated URLS for IdPs with 'host' config in admin/federation (#1774, #1781) +
    • +
  • + Restore dev-autoloader (#1795) +
    • +
+

+ + authyubikey + +

+
    +
  • + The module wasn't fully compatible with SSP 2.0 yet (v2.0.1) +
    • +
+

+ + cas + +

+
    +
  • + Fixed a broken controller (simplesamlphp/simplesamlphp-module-cas#6) (v1.1.2) +
    • +
+

+ + saml2debug + +

+
    +
  • + Fixed a broken controller (simplesamlphp/simplesamlphp-module-saml2debug#4) (v1.0.5) +
    • +
+

+ Version 2.0.2 +

+

+ Released 2023-03-10 +

+
    +
  • + Fixed the broken 2.0.1 release by restoring an accidentally removed file +
    • +
+

+ Version 2.0.1 +

+

+ Released 2023-03-10 +

+
    +
  • + The language-menu on mobile devices was fixed +
    • +
  • + Fix some issues with logout (#1776, #1780, #1785) +
    • +
  • + The + + loginpage_links + + functionality for authsources was restored and documented (#1770, #1773) +
    • +
  • + Several issues regarding the use of the back-button were fixed (#1720) +
    • +
  • + Many fixes in documentation +
    • +
  • + Fixed config/authsources.php.dist so you can just rename it for new deployments to get you started (#1771) +
    • +
  • + Fixed UTF-8 encoding for metadata output +
    • +
  • + Fixed incompatibility with SSP 2.0 for the following modules; +
      +
    • + consent +
      • +
    • + consentadmin +
      • +
    • + consentsimpleadmin +
      • +
    • + exampleattributeserver +
      • +
    • + expirycheck +
      • +
    • + memcachemonitor +
      • +
    • + memcookie +
      • +
    • + metaedit +
      • +
    • + negotiate +
      • +
    • + negotiateext +
      • +
    • + preprodwarning +
      • +
    • + saml2debug +
      • +
    • + sanitycheck +
      • +
    • + sqlauth +
      • +
    +
    • +
+

+ + authtwitter + +

+
    +
  • + A legacy route was added for backwards compatibility +
    • +
  • + Docs have been updated +
    • +
+

+ + ldap + +

+
    +
  • + Fixed the possibility to return ALL attributes (simplesamlphp/simplesamlphp-module-ldap#39) +
    • +
  • + Restored the possibility to use anonymous bind (simplesamlphp/simplesamlphp-module-ldap#41) +
    • +
+

+ + negotiate + +

+
    +
  • + Added support for multi-realm environments +
    • +
+

+ + statistics + +

+
    +
  • + Fixed missing script-tag to load jQuery +
    • +
  • + Fixed static calls to SSP utilities +
    • +
  • + Docs have been updated +
    • +
+

+ Version 2.0.0 +

+

+ Released 2023-02-23 +

+
    +
  • + Many changes, upgrades and improvements since the 1.x series. +
    • +
  • + Most notably the new templating system based on Twig, a new + localization system based on gettext. +
    • +
  • + Most modules have been moved out of the core package but can + easily be installed on-demand as required via composer. +
    • +
  • + Better conformance by default to the SAML2INT standard. +
    • +
  • + Code cleanups, improvements and simplifications. +
    • +
  • + Improved test coverage and more use of standard libraries. +
    • +
  • + Compatibility with modern versions of PHP. +
    • +
  • + Various new features, including: +
      +
    • + SAML SubjectID and Pairwise ID support +
      • +
    • + Accepting unsolicited responses can be disabled by setting + + enable_unsolicited + + to + + false + + in the SP authsource. +
      • +
    • + Certificates and private keys can now be retrieved from a database +
      • +
    • + Support for Redis sentinel was added. +
      • +
    +
    • +
  • + Please read the upgrade notes for 2.0 because this release breaks + backwards compatibility in a number of places. +
    • +
+
+ diff --git a/2.1/simplesamlphp-customauth.html b/2.1/simplesamlphp-customauth.html new file mode 100644 index 0000000..b632c09 --- /dev/null +++ b/2.1/simplesamlphp-customauth.html @@ -0,0 +1,689 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Implementing custom username/password authentication +

+

+ This is a step-by-step guide for creating a custom username/password + + authentication source + + for SimpleSAMLphp. +An authentication source is responsible for authenticating the user, typically by getting a username and password, and looking it up in some sort of database. +

+
+ +
+

+ Create a custom module +

+

+ All custom code for SimpleSAMLphp should be contained in a + + module + + . +This ensures that you can upgrade your SimpleSAMLphp installation without overwriting your own code. +In this example, we will call the module + + mymodule + + . +It will be located under + + modules/mymodule + + . +

+

+ First we need to create the module directory: +

+
+ 
cd modules
+mkdir mymodule
+
+
+

+ Since this is a custom module, it should always be enabled in the configuration. +Now that we have our own module, we can move on to creating an authentication source. +

+

+ Creating a basic authentication source +

+

+ Authentication sources are implemented using PHP classes. +We are going to create an authentication source named + + mymodule:MyAuth + + . +It will be implemented in the file + + modules/mymodule/src/Auth/Source/MyAuth.php + + . +

+

+ To begin with, we will create a very simple authentication source, where the username and password is hardcoded into the source code. +Create the file + + modules/mymodule/src/Auth/Source/MyAuth.php + + with the following contents: +

+
+ 
<?php
+
+namespace SimpleSAML\Module\mymodule\Auth\Source;
+
+class MyAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
+{
+    protected function login($username, $password)
+    {
+        if ($username !== 'theusername' || $password !== 'thepassword') {
+            throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
+        }
+
+        return [
+            'uid' => ['theusername'],
+            'displayName' => ['Some Random User'],
+            'eduPersonAffiliation' => ['member', 'employee'],
+        ];
+    }
+}
+
+
+

+ Some things to note: +

+
    +
  • +

    + The classname is + + \SimpleSAML\Module\mymodule\Auth\Source\MyAuth + + . + This tells SimpleSAMLphp to look for the class in + + modules/mymodule/src/Auth/Source/MyAuth.php + + . +

    +
    • +
  • +

    + Our authentication source subclasses + + \SimpleSAML\Module\core\Auth\UserPassBase + + . + This is a helper-class that implements much of the common code needed for username/password authentication. +

    +
    • +
  • +

    + The + + login + + function receives the username and password the user enters. + It is expected to authenticate the user. + If the username or password is correct, it must return a set of attributes for the user. + Otherwise, it must throw the + + \SimpleSAML\Error\Error('WRONGUSERPASS'); + + exception. +

    +
    • +
  • +

    + Attributes are returned as an associative array of + + name => values + + pairs. + All attributes can have multiple values, so the values are always stored in an array. +

    +
    • +
+

+ Configuring our authentication source +

+

+ Before we can test our authentication source, we must add an entry for it in + + config/authsources.php + + . + + config/authsources.php + + contains an list of enabled authentication sources. +

+

+ The entry looks like this: +

+
+ 
'myauthinstance' => [
+    'mymodule:MyAuth',
+],
+
+
+

+ You can add it to the beginning of the list, so that the file looks something like this: +

+
+ 
<?php
+
+$config = [
+    'myauthinstance' => [
+        'mymodule:MyAuth',
+    ],
+    /* Other authentication sources follow. */
+];
+
+
+

+ + myauthinstance + + is the name of this instance of the authentication source. +(You are allowed to have multiple instances of an authentication source with different configuration.) +The instance name is used to refer to this authentication source in other configuration files. +

+

+ The first element of the configuration of the authentication source must be + + 'mymodule:MyAuth' + + . +This tells SimpleSAMLphp to look for the + + \SimpleSAML\Module\mymodule\Auth\Source\MyAuth + + class. +

+

+ Testing our authentication source +

+

+ Now that we have configured the authentication source, we can test it by accessing "authentication"-page of the SimpleSAMLphp web interface. +By default, the web interface can be found on + + http://yourhostname.com/simplesaml/ + + . +(Obviously, "yourhostname.com" should be replaced with your real hostname.) +

+

+ Then select the "Authentication"-tab, and choose "Test configured authentication sources". +You should then receive a list of authentication sources from + + config/authsources.php + + . +Select + + myauthinstance + + , and log in using "theusername" as the username, and "thepassword" as the password. +You should then arrive on a page listing the attributes we return from the + + login + + function. +

+

+ Next, you should log out by following the log out link. +

+

+ Using our authentication source in an IdP +

+

+ To use our new authentication source in an IdP we just need to update the IdP configuration to use it. +Open + + metadata/saml20-idp-hosted.php + + . +In that file you should locate the + + auth + + -option for your IdP, and change it to + + myauthinstance + + : +

+
+ 
<?php
+
+/* ... */
+$metadata['https://example.org/saml-idp'] = [
+    /* ... */
+    /*
+     * Authentication source to use. Must be one that is configured in
+     * 'config/authsources.php'.
+     */
+    'auth' => 'myauthinstance',
+    /* ... */
+];
+
+
+

+ You can then test logging in to the IdP. +If you have logged in previously, you may need to log out first. +

+

+ Adding configuration to our authentication source +

+

+ Instead of hardcoding options in our authentication source, they should be configurable. +We are now going to extend our authentication source to allow us to configure the username and password in + + config/authsources.php + + . +

+

+ First, we need to define the properties in the class that should hold our configuration: +

+
+ 
private $username;
+private $password;
+
+
+

+ Next, we create a constructor for the class. +The constructor is responsible for parsing the configuration and storing it in the properties. +

+
+ 
public function __construct($info, $config)
+{
+    parent::__construct($info, $config);
+
+    if (!is_string($config['username'])) {
+        throw new Exception('Missing or invalid username option in config.');
+    }
+    $this->username = $config['username'];
+
+    if (!is_string($config['password'])) {
+        throw new Exception('Missing or invalid password option in config.');
+    }
+    $this->password = $config['password'];
+}
+
+
+

+ We can then use the properties in the + + login + + function. +The complete class file should look like this: +

+
+ 
<?php
+
+class MyAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
+{
+    private $username;
+    private $password;
+
+    public function __construct($info, $config)
+    {
+        parent::__construct($info, $config);
+        if (!is_string($config['username'])) {
+            throw new Exception('Missing or invalid username option in config.');
+        }
+        $this->username = $config['username'];
+
+        if (!is_string($config['password'])) {
+            throw new Exception('Missing or invalid password option in config.');
+        }
+        $this->password = $config['password'];
+    }
+
+    protected function login($username, $password)
+    {
+        if ($username !== $this->username || $password !== $this->password) {
+            throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
+        }
+
+        return [
+            'uid' => [$this->username],
+            'displayName' => ['Some Random User'],
+            'eduPersonAffiliation' => ['member', 'employee'],
+        ];
+    }
+}
+
+
+

+ We can then update our entry in + + config/authsources.php + + with the configuration options: +

+
+ 
'myauthinstance' => [
+    'mymodule:MyAuth',
+    'username' => 'theconfigusername',
+    'password' => 'theconfigpassword',
+],
+
+
+

+ Next, you should go to the "Test configured authentication sources" page again, and test logging in. +Note that we have updated the username & password to "theconfigusername" and "theconfigpassword". +(You may need to log out first before you can log in again.) +

+

+ A more complete example - custom database authentication +

+

+ The + + sqlauth:SQL + + authentication source can do simple authentication against SQL databases. +However, in some cases it cannot be used, for example because the database layout is too complex, or because the password validation routines cannot be implemented in SQL. +What follows is an example of an authentication source that fetches an user from a database, and validates the password using a custom function. +

+

+ This code assumes that the database contains a table that looks like this: +

+
+ 
CREATE TABLE userdb (
+    username VARCHAR(32) PRIMARY KEY NOT NULL,
+    password_hash VARCHAR(64) NOT NULL,
+    full_name TEXT NOT NULL);
+
+
+

+ An example user (with password "secret"): +

+
+ 
INSERT INTO userdb (username, password_hash, full_name)
+    VALUES('exampleuser', 'QwVYkvlrAMsXIgULyQ/pDDwDI3dF2aJD4XeVxg==', 'Example User');
+
+
+

+ In this example, the + + password_hash + + contains a base64 encoded SSHA password. +A SSHA password is created like this: +

+
+ 
$password = 'secret';
+$numSalt = 8; /* Number of bytes with salt. */
+$salt = '';
+for ($i = 0; $i < $numSalt; $i++) {
+    $salt .= chr(mt_rand(0, 255));
+}
+$digest = sha1($password . $salt, true);
+$password_hash = base64_encode($digest . $salt);
+
+
+

+ The class follows: +

+
+ 
<?php
+
+class MyAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
+{
+    /* The database DSN.
+     * See the documentation for the various database drivers for information about the syntax:
+     *     http://www.php.net/manual/en/pdo.drivers.php
+     */
+    private $dsn;
+
+    /* The database username, password & options. */
+    private $username;
+    private $password;
+    private $options;
+
+    public function __construct($info, $config)
+    {
+        parent::__construct($info, $config);
+
+        if (!is_string($config['dsn'])) {
+            throw new Exception('Missing or invalid dsn option in config.');
+        }
+        $this->dsn = $config['dsn'];
+
+        if (!is_string($config['username'])) {
+            throw new Exception('Missing or invalid username option in config.');
+        }
+        $this->username = $config['username'];
+
+        if (!is_string($config['password'])) {
+            throw new Exception('Missing or invalid password option in config.');
+        }
+        $this->password = $config['password'];
+
+        if (isset($config['options']) {
+            if (!is_array($config['options'])) {
+                throw new Exception('Missing or invalid options option in config.');
+            }
+            $this->options = $config['options'];
+        }
+    }
+
+    /**
+     * A helper function for validating a password hash.
+     *
+     * In this example we check a SSHA-password, where the database
+     * contains a base64 encoded byte string, where the first 20 bytes
+     * from the byte string is the SHA1 sum, and the remaining bytes is
+     * the salt.
+     */
+    private function checkPassword($passwordHash, $password)
+    {
+        $passwordHash = base64_decode($passwordHash);
+        $digest = substr($passwordHash, 0, 20);
+        $salt = substr($passwordHash, 20);
+
+        $checkDigest = sha1($password . $salt, true);
+        return $digest === $checkDigest;
+    }
+
+    protected function login($username, $password)
+    {
+        /* Connect to the database. */
+        $db = new PDO($this->dsn, $this->username, $this->password, $this->options);
+        $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+        /* Ensure that we are operating with UTF-8 encoding.
+         * This command is for MySQL. Other databases may need different commands.
+         */
+        $db->exec("SET NAMES 'utf8'");
+
+        /* With PDO we use prepared statements. This saves us from having to escape
+         * the username in the database query.
+         */
+        $st = $db->prepare('SELECT username, password_hash, full_name FROM userdb WHERE username=:username');
+
+        if (!$st->execute(['username' => $username])) {
+            throw new Exception('Failed to query database for user.');
+        }
+
+        /* Retrieve the row from the database. */
+        $row = $st->fetch(PDO::FETCH_ASSOC);
+        if (!$row) {
+            /* User not found. */
+            SimpleSAML\Logger::warning('MyAuth: Could not find user ' . var_export($username, true) . '.');
+            throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
+        }
+
+        /* Check the password. */
+        if (!$this->checkPassword($row['password_hash'], $password)) {
+            /* Invalid password. */
+            SimpleSAML\Logger::warning('MyAuth: Wrong password for user ' . var_export($username, true) . '.');
+            throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
+        }
+
+        /* Create the attribute array of the user. */
+        $attributes = [
+            'uid' => [$username],
+            'displayName' => [$row['full_name']],
+            'eduPersonAffiliation' => ['member', 'employee'],
+        ];
+
+        /* Return the attributes. */
+        return $attributes;
+    }
+}
+
+
+

+ And configured in + + config/authsources.php + + : +

+
+ 
'myauthinstance' => [
+    'mymodule:MyAuth',
+    'dsn' => 'mysql:host=sql.example.org;dbname=userdatabase',
+    'username' => 'db_username',
+    'password' => 'secret_db_password',
+],
+
+
+
+ diff --git a/2.1/simplesamlphp-database.html b/2.1/simplesamlphp-database.html new file mode 100644 index 0000000..78800c8 --- /dev/null +++ b/2.1/simplesamlphp-database.html @@ -0,0 +1,256 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAML\Database +

+
+ +
+

+ Purpose +

+

+ This document covers the SimpleSAML\Database class and is only relevant to anyone writing code for SimpleSAMLphp, including modules, that require a database connection. +

+

+ The Database class provides a single class that can be used to connect to a database which can be shared by anything within SimpleSAMLphp. +

+

+ Getting Started +

+

+ If you are just using the already configured database, which would normally be the case, all you need to do is get the global instance of the Database class. +

+
+ 
$db = \SimpleSAML\Database::getInstance();
+
+
+

+ If there is a requirement to connect to an alternate database server (ex. authenticating users that exist on a different SQL server or database) you can specify an alternate configuration. +

+
+ 
$config = new \SimpleSAML\Configuration($myconfigarray, "mymodule/lib/Auth/Source/myauth.php");
+$db = \SimpleSAML\Database::getInstance($config);
+
+
+

+ That will create a new instance of the database, separate from the global instance, specific to the configuration defined in $myconfigarray. If you are going to specify an alternate config, your configuration array must contain the same keys that exist in the primary config (database.dsn, database.username, database.password, database.prefix, etc). +

+

+ Database Prefix +

+

+ Administrators can add a prefix to all the table names that this database classes accesses and you should take that in account when querying. Assuming that a prefix has been configured as "sp_": +

+
+ 
$table = $db->applyPrefix("saml20_idp_hosted");
+
+
+

+ $table would be set to "sp_saml20_idp_hosted" +

+

+ Querying The Database +

+

+ You can query the database through two public functions read() and write() which are fairly self-explanitory when it comes to determining which one to use when querying. +

+

+ Writing to The Database +

+

+ Since the database class allows administrators to configure primary and secondary database servers, the write function will always use the primary database connection. +

+

+ The write function takes 2 parameters: SQL, params. +

+
+ 
$table = $db->applyPrefix("test");
+$values = [
+    'id' => 20,
+    'data' => 'Some data',
+];
+
+$query = $db->write("INSERT INTO $table (id, data) VALUES (:id, :data)", $values);
+
+
+

+ The values specified in the $values array will be bound to the placeholders and will be executed on the primary. By default, values are binded as PDO::PARAM_STR. If you need to override this, you can specify it in the values array. +

+
+ 
$table = $db->applyPrefix("test");
+$values = [
+    'id' => [20, PDO::PARAM_INT],
+    'data' => 'Some data',
+];
+
+$query = $db->write("INSERT INTO $table (id, data) VALUES (:id, :data)", $values);
+
+
+

+ You can also skip usage of prepared statements. You should + + only + + use this if you have a statement that has no user input (ex. CREATE TABLE). If the params variable is explicitly set to false, it will skip usage of prepared statements. This is only available when writing to the database. +

+
+ 
$table = $db->applyPrefix("test");
+$query = $db->write("CREATE TABLE IF NOT EXISTS $table (id INT(16) NOT NULL, data TEXT NOT NULL)", false);
+
+
+

+ Reading The Database +

+

+ Since the database class allows administrators to configure primary and secondary database servers, the read function will randomly select a secondary server to query. If no secondaries are configured, it will read from the primary. +

+

+ The read function takes 2 parameters: SQL, params. +

+
+ 
$table = $db->applyPrefix("test");
+$values = [
+    'id' => 20,
+];
+
+$query = $db->read("SELECT * FROM $table WHERE id = :id", $values);
+
+
+

+ The values specified in the $values array will be bound to the placeholders and will be executed on the selected secondary. By default, values are binded as PDO::PARAM_STR. If you need to override this, you can specify it in the values array. +

+
+ 
$table = $db->applyPrefix("test");
+$values = [
+    'id' => [20, PDO::PARAM_INT],
+];
+
+$query = $db->read("SELECT * FROM $table WHERE id = :id", $values);
+
+
+
+ diff --git a/2.1/simplesamlphp-ecp-idp.html b/2.1/simplesamlphp-ecp-idp.html new file mode 100644 index 0000000..c7c4435 --- /dev/null +++ b/2.1/simplesamlphp-ecp-idp.html @@ -0,0 +1,210 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Adding Enhanced Client or Proxy (ECP) Profile support to the IdP +

+

+ This document describes the necessary steps to enable support for the + + SAML V2.0 Enhanced Client or Proxy Profile Version 2.0 + + on a simpleSAMLphp Identity Provider (IdP). +

+

+ The SAML V2.0 Enhanced Client or Proxy (ECP) profile is a SSO profile for use with HTTP, and clients with the capability to directly contact a principal's identity provider(s) without requiring discovery and redirection by the service provider, as in the case of a browser. It is particularly useful for desktop or server-side HTTP clients. +

+

+ Limitations +

+
    +
  • + Authentication must be done via + + HTTP Basic authentication + + . +
    • +
  • + Authentication must not require user interaction (e.g. auth filters that require user input). +
    • +
  • + Channel Bindings are unsupported. +
    • +
  • + "Holder of Key" Subject Confirmation is unsupported. +
    • +
+

+ This feature has been tested to work with Microsoft Office 365, but other service providers may require features of the ECP profile that are currently unsupported! +

+

+ Enabling ECP Profile on the IdP +

+

+ To enable the IdP to send ECP assertions you must add the + + saml20.ecp + + option to the + + saml20-idp-hosted + + metadata file: +

+
+ 
$metadata['https://example.org/saml-idp'] = [
+    [....]
+    'auth' => 'example-userpass',
+    'saml20.ecp' => true,
+];
+
+
+

+ Note: authentication filters that require interaction with the user will not work with ECP. +

+

+ Add new metadata to SPs +

+

+ After enabling the ECP Profile your IdP metadata will change. An additional ECP + + SingleSignOnService + + endpoint is added. +You therefore need to update the metadata for your IdP at your SPs. +The + + saml20-idp-remote + + metadata for simpleSAMLphp SPs should contain something like the following code: +

+
+ 
'SingleSignOnService' => [
+    0 => [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+        'Location' => 'https://idp.example.org/simplesaml/saml2/idp/SSOService.php',
+    ],
+    1 => [
+        'index' => 0,
+        'Location' => 'https://didp.example.org/simplesaml/saml2/idp/SSOService.php',
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
+    ],
+],
+
+
+

+ SP metadata on the IdP +

+

+ A SP using the ECP Profile must have an + + AssertionConsumerService + + endpoint supporting that profile. +This means that you have to use the complex endpoint format in + + saml20-sp-remote + + metadata. +In general, this should look like the following code: +

+
+ 
'AssertionConsumerService' => [
+    0 => [
+      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+      'Location' => 'https://sp.example.org/Shibboleth.sso/SAML2/POST',
+      'index' => 1,
+    ],
+    1 => [
+      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:PAOS',
+      'Location' => 'https://sp.example.org/ECP',
+      'index' => 2,
+    ],
+],
+
+
+
+ diff --git a/2.1/simplesamlphp-errorhandling.html b/2.1/simplesamlphp-errorhandling.html new file mode 100644 index 0000000..f11b114 --- /dev/null +++ b/2.1/simplesamlphp-errorhandling.html @@ -0,0 +1,640 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Exception and error handling in SimpleSAMLphp +

+
+ +
+

+ This document describes the way errors and exceptions are handled in authentication sources and authentication processing filters. +The basic goal is to be able to throw an exception during authentication, and then have that exception transported back to the SP in a way that the SP understands. +

+

+ This means that internal SimpleSAMLphp exceptions must be mapped to transport specific error codes for the various transports that are supported by SimpleSAMLphp. +E.g.: When a + + \SAML2\Exception\Protocol\NoPassiveException + + error is thrown by an authentication processing filter in a SAML 2.0 IdP, we want to map that exception to the + + urn:oasis:names:tc:SAML:2.0:status:NoPassive + + status code. +That status code should then be returned to the SP. +

+

+ Throwing exceptions +

+

+ How you throw an exception depends on where you want to throw it from. +The simplest case is if you want to throw it during the + + authenticate() + + -method in an authentication module or during the + + process() + + -method in a processing filter. +In those methods, you can just throw an exception: +

+
+ 
public function process(array &$state): void
+{
+    if ($state['something'] === false) {
+        throw new \SimpleSAML\Error\Exception('Something is wrong...');
+    }
+}
+
+
+

+ Exceptions thrown at this stage will be caught and delivered to the appropriate error handler. +

+

+ If you want to throw an exception outside of those methods, i.e. after you have done a redirect, you need to use the + + \SimpleSAML\Auth\State::throwException() + + function: +

+
+ 
<?php
+
+$id = $_REQUEST['StateId'];
+$state = \SimpleSAML\Auth\State::loadState($id, 'somestage...');
+\SimpleSAML\Auth\State::throwException(
+    $state,
+    new \SimpleSAML\Error\Exception('Something is wrong...')
+);
+
+
+

+ The + + \SimpleSAML\Auth\State::throwException + + function will then transfer your exception to the appropriate error handler. +

+

+ + Note + +

+

+ Note that we use the + + \SimpleSAML\Error\Exception + + class in both cases. +This is because the delivery of the exception may require a redirect to a different web page. +In those cases, the exception needs to be serialized. +The normal + + Exception + + class in PHP isn't always serializable. +

+

+ If you throw an exception that isn't a subclass of the + + \SimpleSAML\Error\Exception + + class, your exception will be converted to an instance of + + \SimpleSAML\Error\UnserializableException + + . +The + + \SimpleSAML\Auth\State::throwException + + function does not accept any exceptions that does not subclass the + + \SimpleSAML\Error\Exception + + class. +

+

+ Returning specific SAML 2 errors +

+

+ By default, all thrown exceptions will be converted to a generic SAML 2 error. +In some cases, you may want to convert the exception to a specific SAML 2 status code. +For example, the + + \SAML2\Exception\Protocol\NoPassiveException + + exception should be converted to a SAML 2 status code with the following properties: +

+
    +
  • + The top-level status code should be + + urn:oasis:names:tc:SAML:2.0:status:Responder + + . +
    • +
  • + The second-level status code should be + + urn:oasis:names:tc:SAML:2.0:status:NoPassive + + . +
    • +
  • + The status message should contain the cause of the exception. +
    • +
+

+ The + + \SimpleSAML\Module\saml\Error + + class represents SAML 2 errors. +It represents a SAML 2 status code with three elements: the top-level status code, the second-level status code and the status message. +The second-level status code and the status message is optional, and can be + + NULL + + . +

+

+ The + + \SimpleSAML\Module\saml\Error + + class contains a helper function named + + fromException + + . +The + + fromException() + + function is used to return SAML 2 errors to the SP. +The function contains a list which maps various exceptions to specific SAML 2 errors. +If it is unable to convert the exception, it will return a generic SAML 2 error describing the original exception in its status message. +

+

+ To return a specific SAML 2 error, you should: +

+
    +
  • + Create a new exception class for your error. This exception class must subclass + + \SimpleSAML\Error\Exception + + . +
    • +
  • + Add that exception to the list in + + fromException() + + . +
    • +
  • + Consider adding the exception to + + toException() + + in the same file. (See the next section.) +
    • +
+

+ + Note + +

+

+ While it is possible to throw SAML 2 errors directly from within authentication sources and processing filters, this practice is discouraged. +Throwing SAML 2 errors will tie your code directly to the SAML 2 protocol, and it may be more difficult to use with other protocols. +

+

+ Converting SAML 2 errors to normal exceptions +

+

+ On the SP side, we want to convert SAML 2 errors to SimpleSAMLphp exceptions again. +This is handled by the + + toException() + + method in + + \SimpleSAML\Module\saml\Error + + . +The assertion consumer script of the SAML 2 authentication source ( + + modules/saml2/sp/acs.php + + ) uses this method. +The result is that generic exceptions are thrown from that authentication source. +

+

+ For example, + + NoPassive + + errors will be converted back to instances of + + \SAML2\Exception\Protocol\NoPassiveException + + . +

+

+ Other protocols +

+

+ The error handling code has not yet been added to other protocols, but the framework should be easy to adapt for other protocols. +To eventually support other protocols was a goal when designing this framework. +

+

+ Technical details +

+

+ This section attempts to describe the internals of the error handling framework. +

+

+ + \SimpleSAML\Error\Exception + +

+

+ The + + \SimpleSAML\Error\Exception + + class extends the normal PHP + + Exception + + class. +It makes the exceptions serializable by overriding the + + __sleep() + + method. +The + + __sleep() + + method returns all variables in the class which should be serialized when saving the class. +

+

+ To make sure that the class is serializable, we remove the + + $trace + + variable from the serialization. +The + + $trace + + variable contains the full stack trace to the point where the exception was instantiated. +This can be a problem, since the stack trace also contains the parameters to the function calls. +If one of the parameters in unserializable, serialization of the exception will fail. +

+

+ Since preserving the stack trace can be useful for debugging, we save a variant of the stack trace in the + + $backtrace + + variable. +This variable can be accessed through the + + getBacktrace() + + method. +It returns an array with one line of text for each function call in the stack, ending on the point where the exception was created. +

+

+ Note +

+

+ Since we lose the original + + $trace + + variable during serialization, PHP will fill it with a new stack trace when the exception is unserialized. +This may be confusing since the new stack trace leads into the + + unserialize() + + function. +It is therefore recommended to use the getBacktrace() method. +

+

+ + \SimpleSAML\Auth\State + +

+

+ There are two methods in this class that deals with exceptions: +

+
    +
  • + + throwException($state, $exception) + + , which throws an exception. +
    • +
  • + + loadExceptionState($id) + + , which restores a state containing an exception. +
    • +
+

+ + throwException + +

+

+ This method delivers the exception to the code that initialized the exception handling in the authentication state. +To configure how and where the exception should be delivered, there are two fields in the state-array which can be set: +

+
    +
  • + + \SimpleSAML\Auth\State::EXCEPTION_HANDLER_FUNC + + , in which case the exception will be delivered by a function call to the function specified in that field. +
    • +
  • + + \SimpleSAML\Auth\State::EXCEPTION_HANDLER_URL + + , in which case the exception will be delivered by a redirect to the URL specified in that field. +
    • +
+

+ If the exception is delivered by a function call, the function will be called with two parameters: The exception and the state array. +

+

+ If the exception is delivered by a redirect, \SimpleSAML\Auth\State will save the exception in a field in the state array, pass a parameter with the id of the state array to the URL. +The + + \SimpleSAML\Auth\State::EXCEPTION_PARAM + + constant contains the name of that parameter, while the + + \SimpleSAML\Auth\State::EXCEPTION_DATA + + constant holds the name of the field where the exception is saved. +

+

+ + loadException + +

+

+ To retrieve the exception, the application should check for the state parameter in the request, and then retrieve the state array by calling + + \SimpleSAML\Auth\State::loadExceptionState() + + . +The exception can be located in a field named + + \SimpleSAML\Auth\State::EXCEPTION_DATA + + . +The following code illustrates this behaviour: +

+
+ 
if (array_key_exists(\SimpleSAML\Auth\State::EXCEPTION_PARAM, $_REQUEST)) {
+    $state = \SimpleSAML\Auth\State::loadExceptionState();
+    $exception = $state[\SimpleSAML\Auth\State::EXCEPTION_DATA];
+
+    /* Process exception. */
+}
+
+
+

+ + \SimpleSAML\Auth\ProcessingChain + +

+

+ This class requires the caller to add the error handler to the state array before calling the + + processState() + + function. +Exceptions thrown by the processing filters will be delivered directly to the caller of + + processState() + + if possible. +However, if one of the filters in the processing chain redirected the user away from the caller, exceptions will be delivered through the error handler saved in the state array. +

+

+ This is the same behaviour as normal processing filters. +The result will be delivered directly if it is possible, but if not, it will be delivered through a redirect. +

+

+ The code for handling this becomes something like: +

+
+ 
if (array_key_exists(\SimpleSAML\Auth\State::EXCEPTION_PARAM, $_REQUEST)) {
+    $state = \SimpleSAML\Auth\State::loadExceptionState();
+    $exception = $state[\SimpleSAML\Auth\State::EXCEPTION_DATA];
+
+    /* Handle exception... */
+    [...]
+}
+
+$procChain = [...];
+
+$state = [
+    'ReturnURL' => \SimpleSAML\Utils\HTTP::getSelfURLNoQuery(),
+    \SimpleSAML\Auth\State::EXCEPTION_HANDLER_URL => \SimpleSAML\Utils\HTTP::getSelfURLNoQuery(),
+    [...],
+]
+
+try {
+    $procChain->processState($state);
+} catch (\SimpleSAML\Error\Exception $e) {
+    /* Handle exception. */
+    [...];
+}
+
+#### Note
+
+An exception which isn't a subclass of `\SimpleSAML\Error\Exception` will be converted to the `\SimpleSAML\Error\UnserializedException` class.
+This happens regardless of whether the exception is delivered directly or through the error handler.
+This is done to be consistent in what the application receives - now it will always receive the same exception, regardless of whether it is delivered directly or through a redirect.
+
+## Custom error show function
+
+Optional custom error show function, called from \SimpleSAML\Error\Error::show, is defined with 'errors.show_function' in config.php.
+
+Example code for this function, which implements the same functionality as \SimpleSAML\Error\Error::show, looks something like:
+
+```php
+public static function show(\SimpleSAML\Configuration $config, array $data)
+{
+    $t = new \SimpleSAML\XHTML\Template($config, 'error.twig', 'errors');
+    $t->data = array_merge($t->data, $data);
+    $t->send();
+    exit;
+}
+
+
+
+ diff --git a/2.1/simplesamlphp-googleapps.html b/2.1/simplesamlphp-googleapps.html new file mode 100644 index 0000000..bf610c3 --- /dev/null +++ b/2.1/simplesamlphp-googleapps.html @@ -0,0 +1,605 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Setting up a SimpleSAMLphp SAML 2.0 IdP to use with Google Workspace for Education +

+
+ +
+

+ Introduction +

+

+ This article describes how to configure a Google Workspace (formerly G Suite, formerly Google Apps) +instance as a service provider to use with a SimpleSAMLphp identity provider. +This article assumes that you have already read the SimpleSAMLphp installation manual, and installed +a version of SimpleSAMLphp at your server. +

+

+ In this example we will setup this server as an IdP for Google Workspace: +

+

+ dev2.andreas.feide.no +

+

+ Enabling the Identity Provider functionality +

+

+ Edit + + config.php + + , and enable the SAML 2.0 IdP: +

+
+ 
'enable.saml20-idp' => true,
+
+
+

+ Setting up a signing certificate +

+

+ You must generate a certificate for your IdP. +Here is an example of an openssl command to generate a new key and a self signed certificate to use for signing SAML messages: +

+
+ 
openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out googleworkspaceidp.crt -keyout googleworkspaceidp.pem
+
+
+

+ The certificate above will be valid for 10 years. +

+

+ Here is an example of typical user input when creating a certificate request: +

+
+ 
Country Name (2 letter code) [AU]: NO
+State or Province Name (full name) [Some-State]: Trondheim
+Locality Name (eg, city) []: Trondheim
+Organization Name (eg, company) [Internet Widgits Pty Ltd]: UNINETT
+Organizational Unit Name (eg, section) []:
+Common Name (eg, YOUR name) []: dev2.andreas.feide.no
+Email Address []:
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+
+
+

+ + Note + + : SimpleSAMLphp will only work with RSA and not DSA certificates. +

+

+ Authentication source +

+

+ The next step is to configure the way users authenticate on your IdP. Various modules in the + + modules/ + + directory provides methods for authenticating your users. This is an overview of those that are included in the SimpleSAMLphp distribution: +

+
+
+ + exampleauth:UserPass + +
+
+ Authenticate against a list of usernames and passwords. +
+
+ + exampleauth:Static + +
+
+ Automatically log in as a user with a set of attributes. +
+
+ + + ldap:LDAP + + +
+
+ Authenticates an user to a LDAP server. +
+
+

+ For more authentication modules, see + + SimpleSAMLphp Identity Provider QuickStart + + . +

+

+ In this guide, we will use the + + exampleauth:UserPass + + authentication module. This module does not have any dependencies, and is therefore simple to set up. +

+

+ After you have successfully tested that everything is working with the simple + + exampleauth:UserPass + + , you are encouraged to setup SimpleSAMLphp IdP towards your user storage, such as an LDAP directory. (Use the links on the authentication sources above to read more about these setups. + + ldap:LDAP + + is the most common authentication source.) +

+

+ Configuring the authentication source +

+

+ The + + exampleauth:UserPass + + authentication module is part of the + + exampleauth + + module. This module isn't enabled by default, so you will have to enable it. In + + config.php + + , search for the + + module.enable + + key and set + + exampleauth + + to true: +

+
+ 
'module.enable' => [
+    'exampleauth' => true,
+    …
+],
+
+
+

+ The next step is to create an authentication source with this module. An authentication source is an authentication module with a specific configuration. Each authentication source has a name, which is used to refer to this specific configuration in the IdP configuration. Configuration for authentication sources can be found in + + config/authsources.php + + . +

+

+ In this example we will use + + example-userpass + + , and hence that section is what matters and will be used. +

+
+ 
<?php
+
+$config = [
+    'example-userpass' => [
+        'exampleauth:UserPass',
+        'student:studentpass' => [
+            'uid' => ['student'],
+        ],
+        'employee:employeepass' => [
+            'uid' => ['employee'],
+        ],
+    ],
+];
+
+
+

+ This configuration creates two users - + + student + + and + + employee + + , with the passwords + + studentpass + + and + + employeepass + + . The username and password are stored in the array index + + student:studentpass + + for the + + student + + -user. The attributes (only + + uid + + in this example) will be returned by the IdP when the user logs on. +

+

+ Configuring metadata for an SAML 2.0 IdP +

+

+ If you want to setup a SAML 2.0 IdP for Google Workspace, you need to configure two metadata files: + + saml20-idp-hosted.php + + and + + saml20-sp-remote.php + + . +

+

+ Configuring SAML 2.0 IdP Hosted metadata +

+

+ This is the configuration of the IdP itself. Here is some example config: +

+
+ 
// The SAML entity ID is the index of this config.
+$metadata['https://example.org/saml-idp'] => [
+    // The hostname of the server (VHOST) that this SAML entity will use.
+    'host' => '__DEFAULT__',
+
+    // X.509 key and certificate. Relative to the cert directory.
+    'privatekey'   => 'googleworkspaceidp.pem',
+    'certificate'  => 'googleappsidp.crt',
+
+    'auth' => 'example-userpass',
+]
+
+
+

+ + Note + + : You can only have one entry in the file with host equal to + + __DEFAULT__ + + , therefore you should replace the existing entry with this one, instead of adding this entry as a new entry in the file. +

+

+ Configuring SAML 2.0 SP Remote metadata +

+

+ In the + + saml20-sp-remote.php + + file we will configure an entry for Google Workspace for Education. There is already an entry for Google Workspace in the template, but we will change the domain name: +

+
+ 
/*
+ * This example shows an example config that works with Google Workspace for education.
+ * You send the email address that identifies the user from your IdP in the SAML Name ID.
+ */
+$metadata['https://www.google.com/a/g.feide.no'] => [
+    'AssertionConsumerService' => 'https://www.google.com/a/g.feide.no/acs',
+    'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+    'simplesaml.attributes' => false,
+    'authproc' => [
+        1 => [
+          'class' => 'saml:AttributeNameID',
+          'identifyingAttribute' => 'mail',
+          'Format' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+        ],
+    ],
+];
+
+
+

+ You should modify the entityID above and the + + AssertionConsumerService + + to +include your Google Workspace domain name instead of + + g.feide.no + + . +

+

+ (It is also possible to send only the local part of the email address to Google. E.g. +for an e-mail address at GW + + student@g.feide.no + + , sending an attribute with the +value + + student + + .) +

+

+ Configure Google Workspace +

+

+ Start by logging in to our Google Workspace for education account panel. +Then select "Advanced tools": +

+

+ Figure 1. + + We go to advanced tools + +

+

+ We go to advanced tools +

+

+ Then select "Set up single sign-on (SSO)": +

+

+ Figure 2. + + We go to setup SSO + +

+

+ We go to setup SSO + Upload a certificate, such as the googleworkspaceidp.crt created above: +

+

+ Figure 3. + + Uploading certificate + +

+

+ Uploading certificate + Fill out the remaining fields: +

+

+ The most important field is the Sign-in page URL. You can find the +correct value in your IdP metadata. Browse to your simpleSAMLphp installation, +go to the "Federation" tab, under "SAML 2.0 IdP Metadata" select "show metadata". +

+

+ You will find in the metadata the XML tag + + <md:SingleSignOnService> + + which contains the right URL to input in the field, it will look something +like this: +

+

+ + https://dev2.andreas.feide.no/simplesaml/saml2/idp/SSOService.php + +

+

+ The Sign-out page or change password URL can be static pages on your server. +(Google does not support SAML Single Log Out.) +

+

+ The network mask determines which IP addresses will be asked for SSO login. +IP addresses not matching this mask will be presented with the normal Google Workspace login page. +It is normally best to leave this field empty to enable authentication for all URLs. +

+

+ Figure 4. + + Fill out the remaining fields + +

+

+ Fill out the remaining fields +

+

+ Add a user in Google Workspace that is known to the IdP +

+

+ Before we can test login, a new user must be defined in Google Workspace. This user must have a mail field matching the email from the attribute as described above in the metadata section. +

+

+ Test to login to G Suite for education +

+

+ Go to the URL of your mail account for this domain, the URL is similar to the following: +

+

+ + http://mail.google.com/a/yourgoogleworkspacedomain.com + +

+

+ replacing the last part with your own Google Workspace domain name. +

+

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other users of the software, you are fortunate: Around SimpleSAMLphp there is a great Open source community, and you are welcome to join! The forums are open for you to ask questions, contribute answers other further questions, request improvements or contribute with code or plugins of your own. +

+ +
+ diff --git a/2.1/simplesamlphp-hok-idp.html b/2.1/simplesamlphp-hok-idp.html new file mode 100644 index 0000000..f89bd3c --- /dev/null +++ b/2.1/simplesamlphp-hok-idp.html @@ -0,0 +1,213 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Adding Holder-of-Key Web Browser SSO Profile support to the IdP +

+

+ This document describes the necessary steps to enable support for the + + SAML V2.0 Holder-of-Key (HoK) Web Browser SSO Profile + + on a SimpleSAMLphp Identity Provider (IdP). +

+

+ The SAML V2.0 HoK Web Browser SSO Profile is an alternate version of the standard SAML Web Browser SSO Profile. Its primary benefit is the enhanced security of the SSO process +while preserving maximum compatibility with existing deployments on client and server side. +

+

+ When using this profile the communication between the user and the IdP is required to be protected by the TLS protocol. Additionally, the user needs a TLS client certificate. +This certificate is usually selfsigned and stored in the certificate store of the browser or the underlying operating system. +

+

+ Configuring Apache +

+

+ The IdP requests a client certificate from the user agent during the TLS handshake. This behaviour is enabled with the following Apache webserver configuration: +

+
+ 
SSLEngine on
+SSLCertificateFile /etc/openssl/certs/server.crt
+SSLCertificateKeyFile /etc/openssl/private/server.key
+SSLVerifyClient optional_no_ca
+SSLOptions +ExportCertData
+
+
+

+ If the user agent can successfully prove possession of the private key associated to the public key from the certificate, the received certificate is stored in the +environment variable + + SSL_CLIENT_CERT + + of the webserver. The IdP embeds the client certificate into the created HoK assertion. +

+

+ Enabling HoK SSO Profile on the IdP +

+

+ To enable the IdP to send HoK assertions you must add the + + saml20.hok.assertion + + option to the + + saml20-idp-hosted + + metadata file: +

+
+ 
$metadata['https://example.org/saml-idp'] = [
+    [....]
+    'auth' => 'example-userpass',
+    'saml20.hok.assertion' => true,
+];
+
+
+

+ Add new metadata to SPs +

+

+ After enabling the Holder-of-Key Web Browser SSO Profile your IdP metadata will change. An additional HoK + + SingleSignOnService + + endpoint is added. +You therefore need to update the metadata for your IdP at your SPs. +The + + saml20-idp-remote + + metadata for SimpleSAMLphp SPs should contain something like the following code: +

+
+ 
'SingleSignOnService' => [
+    [
+        'hoksso:ProtocolBinding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser',
+        'Location' => 'https://idp.example.org/simplesaml/saml2/idp/SSOService.php',
+    ],
+    [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+        'Location' => 'https://idp.example.org/simplesaml/saml2/idp/SSOService.php',
+    ],
+],
+
+
+

+ SP metadata on the IdP +

+

+ A SP using the HoK Web Browser SSO Profile must have an + + AssertionConsumerService + + endpoint supporting that profile. +This means that you have to use the complex endpoint format in + + saml20-sp-remote + + metadata. +In general, this should look like the following code: +

+
+ 
'AssertionConsumerService' => [
+    [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+        'Location' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+        'index' => 0,
+    ],
+    [
+        'Binding' => 'urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser',
+        'Location' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+        'index' => 4,
+    ],
+],
+
+
+

+ (The specific values of the various fields will vary depending on the SP.) +

+
+ diff --git a/2.1/simplesamlphp-hok-sp.html b/2.1/simplesamlphp-hok-sp.html new file mode 100644 index 0000000..64fab6d --- /dev/null +++ b/2.1/simplesamlphp-hok-sp.html @@ -0,0 +1,158 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Using Holder-of-Key Web Browser SSO Profile on a SimpleSAMLphp SP +

+

+ This document describes how to enable the + + SAML V2.0 Holder-of-Key (HoK) Web Browser SSO Profile + + on a SimpleSAMLphp Service Provider (SP). +

+

+ The SAML V2.0 HoK Web Browser SSO Profile is an alternate version of the standard SAML Web Browser SSO Profile. Its primary benefit is the enhanced security of the SSO process +while preserving maximum compatibility with existing deployments on client and server side. +

+

+ When using this profile the communication between the user and the SP is required to be protected by the TLS protocol. Additionally, the user needs a TLS client certificate. +This certificate is usually selfsigned and stored in the certificate store of the browser or the underlying operating system. +

+

+ Configuring Apache +

+

+ The SP requests a client certificate from the user agent during the TLS handshake. This behaviour is enabled with the following Apache webserver configuration: +

+
+ 
  SSLEngine on
+  SSLCertificateFile /etc/openssl/certs/server.crt
+  SSLCertificateKeyFile /etc/openssl/private/server.key
+  SSLVerifyClient optional_no_ca
+  SSLOptions +ExportCertData
+
+
+

+ If the user agent can successfully prove possession of the private key associated to the public key from the certificate, the received certificate is stored in the +environment variable + + SSL_CLIENT_CERT + + of the webserver. +

+

+ Enable HoK on SP +

+

+ To enable support for the HoK SSO Profile in the SP, the + + saml20.hok.assertion + + option must be set to TRUE in the SP configuration. +This option can also be enabled in the + + saml20-idp-remote + + metadata file, but in that case the endpoint will not be added to the SP metadata. +You must also send authentication requests specifying the Holder-of-Key profile to the IdP. This is controlled by the + + ProtocolBinding + + option in the SP configuration. +

+
+ 
  'hok-sp' => [
+      'saml:SP',
+      'saml20.hok.assertion' => TRUE,
+      'ProtocolBinding' => 'urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser',
+  ],
+
+
+

+ When this is done, you can add the metadata of your SP to the IdP and test the authentication. +

+
+ diff --git a/2.1/simplesamlphp-idp-more.html b/2.1/simplesamlphp-idp-more.html new file mode 100644 index 0000000..f8bab0b --- /dev/null +++ b/2.1/simplesamlphp-idp-more.html @@ -0,0 +1,314 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Identity Provider Advanced Topics +

+
+ +
+

+ AJAX iFrame Single Log-Out +

+

+ If you have read about the AJAX iFrame Single Log-Out approach at Andreas' blog and want to enable it, edit your saml20-idp-hosted.php metadata, and add this configuration line for the IdP: +

+
+ 
'logouttype' => 'iframe',
+
+
+ +

+ The attribute release consent is documented in a + + separate document + + . +

+

+ Support for bookmarking the login page +

+

+ Most SAML software crash fatally when users bookmark the login page and return later on when the cached session information is lost. This is natural as the login page happens in the middle of a SAML transaction, and the SAML software needs some references to the original request in order to be able to produce the SAML Response. +

+

+ SimpleSAMLphp has implemented a graceful fallback to tackle this situation. When SimpleSAMLphp is not able to lookup a session during the login process, it falls back to the + + IdP-first flow + + , described in the next section, where the reference to the request is not needed. +

+

+ What happens in the IdP-first flow is that a + + SAML unsolicited response + + is sent directly to the SP. An + + unsolicited response + + is a SAML Response with no reference to a SAML Request (no + + InReplyTo + + field). +

+

+ When a SimpleSAMLphp IdP falls back to IdP-first flow, the + + RelayState + + parameter sent by the SP in the SAML request is also lost. The RelayState information contain a reference key for the SP to lookup where to send the user after successful authentication. The SimpleSAMLphp Service Provider supports configuring a static URL to redirect the user after a unsolicited response is received. See more information about the + + RelayState + + parameter in the next section: + + IdP-first flow + + . +

+

+ IdP-first flow +

+

+ If you do not want to start the SSO flow at the SP, you may use the IdP-first setup. To do this, redirect the user to the SSOService endpoint on the IdP with a + + spentityid + + parameter that matches the SP EntityID that the user should be authenticated for. +

+

+ Here is an example of such a URL: +

+

+ + https://idp.example.org/simplesaml/saml2/idp/SSOService.php?spentityid=urn:mace:feide.no:someservice + +

+

+ You can also add a + + RelayState + + parameter to the IdP-first URL: +

+

+ + https://idp.example.org/simplesaml/saml2/idp/SSOService.php?spentityid=urn:mace:feide.no:someservice&RelayState=https://sp.example.org/somepage + +

+

+ The + + RelayState + + parameter is often used to carry the URL the SP should redirect to after authentication. It is also possible to specify the Assertion +Consumer URL with the + + ConsumerURL + + parameter. +

+

+ For compatibility with certain SPs, SimpleSAMLphp will also accept the + + providerId + + , + + target + + and + + shire + + parameters as aliases for + + spentityid + + , + + RelayState + + and + + ConsumerURL + + , respectively. +

+

+ IdP-initiated logout +

+

+ IdP-initiated logout can be initiated by visiting the URL: +

+

+ + https://idp.example.org/simplesaml/saml2/idp/SingleLogoutService.php?ReturnTo=<URL to return to after logout> + +

+

+ It will send a logout request to each SP, and afterwards return the user to the URL specified in the + + ReturnTo + + parameter. Bear in mind that IdPs might disallow redirecting to URLs other than those of their own for security reasons, so in order to get the redirection to work, it might be necessary to ask the IdP to whitelist the URL we are planning to redirect to. +

+

+ Adding links to the login page +

+

+ If you want to add some helpful links to the login page, you can add +the following to the + + authsources.php + + config of the authentication +source you are using: +

+
+ 
    'example-userpass' => [
+        ...
+        'core:loginpage_links' => [
+            [
+                'href' => 'https://example.com/reset',
+                'text' => 'Forgot your password?',
+            ],
+            [
+                'href' => 'https://example.com/news',
+                'text' => 'Latest news about us',
+            ],
+        ],
+        ...
+    ],
+
+
+

+ The given text will also be translated via SimpleSAMLphp's translation +system if translations are available in the messages catalog. +

+
+ diff --git a/2.1/simplesamlphp-idp.html b/2.1/simplesamlphp-idp.html new file mode 100644 index 0000000..9b67afc --- /dev/null +++ b/2.1/simplesamlphp-idp.html @@ -0,0 +1,699 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Identity Provider QuickStart +

+
+ +
+

+ This guide will describe how to configure SimpleSAMLphp as an identity provider (IdP). You should previously have installed SimpleSAMLphp as described in + + the SimpleSAMLphp installation instructions + +

+

+ Enabling the Identity Provider functionality +

+

+ The first that must be done is to enable the identity provider functionality. This is done by editing + + config/config.php + + . The option + + enable.saml20-idp + + controls whether SAML 2.0 IdP support is enabled. Enable it by assigning + + true + + to them: +

+
+ 
'enable.saml20-idp' => true,
+
+
+

+ Authentication module +

+

+ The next step is to configure the way users authenticate on your IdP. Various modules in the + + modules/ + + directory provides methods for authenticating your users. This is an overview of those that are included in the SimpleSAMLphp distribution: +

+
+
+ + + authcrypt:Hash + + +
+
+ Username & password authentication with hashed passwords. +
+
+ + + authcrypt:Htpasswd + + +
+
+ Username & password authentication against .htpasswd file. +
+
+ + + authX509:authX509userCert + + +
+
+ Authenticate against a LDAP database with a SSL client certificate. +
+
+ + exampleauth:UserPass + +
+
+ Authenticate against a list of usernames and passwords. +
+
+ + exampleauth:Static + +
+
+ Automatically log in as a user with a set of attributes. +
+
+ + + ldap:LDAP + + +
+
+ Authenticates an user to a LDAP server. +
+
+ + + ldap:LDAPMulti + + +
+
+ Authenticates an user to one of several LDAP server. + The user can choose the LDAP server from a dropdown list. +
+
+ + + sqlauth:SQL + + +
+
+ Authenticate an user against a database. +
+
+ + + radius:Radius + + +
+
+ Authenticates an user to a Radius server. +
+
+ + + multiauth:MultiAuth + + +
+
+ Allow the user to select from a list of authentication sources. +
+
+ + + saml:SP + + +
+
+ Authenticate against a SAML IdP. Can be used for bridging. +
+
+ + authYubiKey:YubiKey + +
+
+ Authenticate with + + a YubiKey + + . +
+
+ + + authtwitter:Twitter + + +
+
+ Authenticate with your Twitter account using the Twitter OAuth API. +
+
+ + + papi:PAPI + + +
+
+ Authenticate by means of the PAPI protocol. +
+
+

+ In this guide, we will use the + + exampleauth:UserPass + + authentication module. This module does not have any dependencies, and is therefore simple to set up. +

+

+ Configuring the authentication module +

+

+ The + + exampleauth:UserPass + + authentication module is part of the + + exampleauth + + module. This module isn't enabled by default, so you will have to enable it. In + + config.php + + , search for the + + module.enable + + key and set + + exampleauth + + to true: +

+
+ 
'module.enable' => [
+    'exampleauth' => true,
+    …
+],
+
+
+

+ The next step is to create an authentication source with this module. An authentication source is an authentication module with a specific configuration. Each authentication source has a name, which is used to refer to this specific configuration in the IdP configuration. Configuration for authentication sources can be found in + + config/authsources.php + + . +

+

+ In this setup, this file should contain a single entry: +

+
+ 
<?php
+
+$config = [
+    'example-userpass' => [
+        'exampleauth:UserPass',
+        'student:studentpass' => [
+            'uid' => ['student'],
+            'eduPersonAffiliation' => ['member', 'student'],
+        ],
+        'employee:employeepass' => [
+            'uid' => ['employee'],
+            'eduPersonAffiliation' => ['member', 'employee'],
+        ],
+    ],
+];
+
+
+

+ This configuration creates two users - + + student + + and + + employee + + , with the passwords + + studentpass + + and + + employeepass + + . The username and password are stored in the array index ( + + student:studentpass + + for the + + student + + -user). The attributes for each user are configured in the array referenced by the index. So for the student user, these are: +

+
+ 
[
+    'uid' => ['student'],
+    'eduPersonAffiliation' => ['member', 'student'],
+],
+
+
+

+ The attributes will be returned by the IdP when the user logs on. +

+

+ Creating a self signed certificate +

+

+ The IdP needs a certificate to sign its SAML assertions with. Here is an example of an + + openssl + + -command which can be used to generate a new private key key and the corresponding self-signed certificate. The private key and certificate go into the directory defined in the certdir setting (defaults to + + cert/ + + ) +

+

+ This key and certificate can be used to sign SAML messages: +

+
+ 
openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out example.org.crt -keyout example.org.pem
+
+
+

+ The certificate above will be valid for 10 years. +

+

+ + Note + + : +

+

+ SimpleSAMLphp will only work with RSA certificates. DSA certificates are not supported. +

+

+ Configuring the IdP +

+

+ The SAML 2.0 IdP is configured by the metadata stored in + + metadata/saml20-idp-hosted.php + + . +This is a minimal configuration: +

+
+ 
<?php
+
+$metadata['https://example.org/saml-idp'] = [
+    /*
+     * The hostname for this IdP. This makes it possible to run multiple
+     * IdPs from the same configuration. '__DEFAULT__' means that this one
+     * should be used by default.
+     */
+    'host' => '__DEFAULT__',
+
+    /*
+     * The private key and certificate to use when signing responses.
+     * These can be stored as files in the cert-directory or retrieved
+     * from a database.
+     */
+    'privatekey' => 'example.org.pem',
+    'certificate' => 'example.org.crt',
+
+    /*
+     * The authentication source which should be used to authenticate the
+     * user. This must match one of the entries in config/authsources.php.
+     */
+    'auth' => 'example-userpass',
+];
+
+
+

+ For more information about available options in the idp-hosted metadata +files, see the + + IdP hosted reference + + . +

+

+ Using the + + uri + + NameFormat on attributes +

+

+ The + + interoperable SAML 2 profile + + specifies that attributes should be delivered using the + + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + + NameFormat. +We therefore recommended enabling this in new installations. +This can be done by adding the following to the saml20-idp-hosted configuration: +

+
+ 
'attributes.NameFormat' => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+'authproc' => [
+    // Convert LDAP names to oids.
+    100 => ['class' => 'core:AttributeMap', 'name2oid'],
+],
+
+
+

+ Adding SPs to the IdP +

+

+ The identity provider you are configuring needs to know about the service providers you are going to connect to it. +This is configured by metadata stored in + + metadata/saml20-sp-remote.php + + . +This is a minimal example of a + + metadata/saml20-sp-remote.php + + metadata file for a SimpleSAMLphp SP: +

+
+ 
<?php
+
+$metadata['https://sp.example.org/simplesaml/module.php/saml/sp/metadata.php/default-sp'] = [
+    'AssertionConsumerService' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
+    'SingleLogoutService' => 'https://sp.example.org/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp',
+];
+
+
+

+ Note that the URI in the entityID and the URLs to the AssertionConsumerService and SingleLogoutService endpoints change between different service providers. +If you have the metadata of the remote SP as an XML file, you can use the built-in XML to SimpleSAMLphp metadata converter, which by default is available as + + /module.php/admin/federation/metadata-converter + + in your SimpleSAMLphp installation. +

+

+ For more information about available options in the sp-remote metadata files, see the + + SP remote reference + + . +

+

+ Adding this IdP to other SPs +

+

+ The method for adding this IdP to a SP varies between different types of SPs. In general, most SPs need some metadata from the IdP. This should be available from + + /saml2/idp/metadata.php + + . +

+

+ Testing the IdP +

+

+ The simplest way to test the IdP is to configure a SimpleSAMLphp SP +on the same machine. See the instructions for + + configuring SimpleSAMLphp as an SP + + . +

+

+ + Note + + : +

+

+ When running a SimpleSAMLphp IdP and a SimpleSAMLphp SP on the same computer, the SP and IdP + + MUST + + be configured with different hostnames. This prevents cookies from the SP to interfere with cookies from the IdP. +

+

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other users of the software, you are fortunate: Around SimpleSAMLphp there is a great Open source community, and you are welcome to join! The forums are open for you to ask questions, contribute answers other further questions, request improvements or contribute with code or plugins of your own. +

+ +

+ IdP-first setup +

+

+ If you do not want to start the SSO flow at the SP, you may use the IdP-first setup. To do this, redirect the user to the SSOService endpoint on the IdP with one parameter + + spentityid + + that match the SP EntityId that the user should be logged into. +

+

+ Here is an example of such a URL: +

+

+ + https://idp.example.org/simplesaml/saml2/idp/SSOService.php?spentityid=sp.example.org + +

+

+ If the SP is a SimpleSAMLphp SP, you must also specify a + + RelayState + + parameter for the SP. +This must be set to a URL the user should be redirected to after authentication. +The + + RelayState + + parameter can be specified in the + + SP configuration + + , or it can be sent from the IdP. +To send the RelayState parameter from a SimpleSAMLphp IdP, specify it in the query string to SSOService.php: +

+

+ + https://idp.example.org/simplesaml/saml2/idp/SSOService.php?spentityid=sp.example.org&RelayState=https://sp.example.org/welcome.php + +

+

+ To set it in the SP configuration, add it to + + authsources.php + + : +

+
+ 
'default-sp' => [
+    'saml:SP',
+    'RelayState' => 'https://sp.example.org/welcome.php',
+],
+
+
+
+ diff --git a/2.1/simplesamlphp-install-repo.html b/2.1/simplesamlphp-install-repo.html new file mode 100644 index 0000000..2e02eea --- /dev/null +++ b/2.1/simplesamlphp-install-repo.html @@ -0,0 +1,166 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Installing SimpleSAMLphp from the repository +

+

+ These are some notes about running SimpleSAMLphp from the repository. +

+

+ Installing from git +

+

+ Go to the directory where you want to install SimpleSAMLphp: +

+
+ 
cd /var
+
+
+

+ Then do a git clone: +

+
+ 
git clone git@github.com:simplesamlphp/simplesamlphp.git simplesamlphp
+
+
+

+ Initialize configuration and metadata: +

+
+ 
cd /var/simplesamlphp
+cp config/config.php.dist config/config.php
+cp config/authsources.php.dist config/authsources.php
+cp metadata/saml20-idp-hosted.php.dist metadata/saml20-idp-hosted.php
+cp metadata/saml20-idp-remote.php.dist metadata/saml20-idp-remote.php
+cp metadata/saml20-sp-remote.php.dist metadata/saml20-sp-remote.php
+
+
+

+ Install the external dependencies with Composer (you can refer to + + getcomposer.org + + to get detailed +instructions on how to install Composer itself): +

+
+ 
php composer.phar install
+
+
+

+ When installing on Windows, use: +

+
+ 
php composer.phar install --ignore-platform-req=ext-posix
+
+
+

+ Upgrading +

+

+ Go to the root directory of your SimpleSAMLphp installation: +

+
+ 
cd /var/simplesamlphp
+
+
+

+ Ask git to update to the latest version: +

+
+ 
git fetch origin
+git pull origin master
+
+
+

+ Install or upgrade the external dependencies with Composer: +

+
+ 
php composer.phar install
+
+
+
+ diff --git a/2.1/simplesamlphp-install.html b/2.1/simplesamlphp-install.html new file mode 100644 index 0000000..89453bd --- /dev/null +++ b/2.1/simplesamlphp-install.html @@ -0,0 +1,1266 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Installation and Configuration +

+
+ +
+

+ This document is part of the SimpleSAMLphp documentation suite. +

+ +

+ This document covers the installation of the latest stable version of SimpleSAMLphp. +If you want to install the development version, take a look at the instructions for + + installing SimpleSAMLphp from the +repository + + . +

+

+ Prerequisites +

+
    +
  • + A web server capable of executing PHP scripts. +
    • +
  • + PHP version >= 8.0.0. +
    • +
  • + Support for the following PHP extensions: +
      +
    • + Always required: + + date + + , + + dom + + , + + fileinfo + + , + + filter + + , + + hash + + , + + intl + + , + + json + + , + + libxml + + , + + mbstring + + , + + openssl + + , + + pcre + + , + + session + + , + + simplexml + + , + + sodium + + , + + SPL + + and + + zlib + +
      • +
    • + When running on Linux: + + posix + +
      • +
    • + When automatically checking for latest versions, and used by some modules: + + cURL + +
      • +
    • + When authenticating against an LDAP server: + + ldap + +
      • +
    • + When authenticating against a RADIUS server: + + radius + +
      • +
    • + When using the native PHP session handler: + + session + +
      • +
    • + When saving session information to a memcache server: + + memcache + +
      • +
    • + When using databases: +
        +
      • + Always required: + + PDO + +
        • +
      • + Database driver: ( + + mysql + + , + + pgsql + + , ...) +
        • +
      +
      • +
    +
    • +
  • + Support for the following PHP packages: +
      +
    • + When saving session information to a Redis server: + + predis + +
      • +
    +
    • +
+

+ What actual packages are required for the various extensions varies between different platforms and distributions. +

+

+ Download and install SimpleSAMLphp +

+

+ The most recent release of SimpleSAMLphp can always be found at + + https://simplesamlphp.org/download + + . +

+

+ Go to the directory where you want to install SimpleSAMLphp and extract the archive file you just downloaded: +

+
+ 
cd /var
+tar xzf simplesamlphp-x.y.z.tar.gz
+mv simplesamlphp-x.y.z simplesamlphp
+
+
+

+ Upgrading from a previous version of SimpleSAMLphp +

+

+ Before starting the upgrade, review the relevant + + upgrade notes + + for any relevant +changes. +

+

+ Extract the new version: +

+
+ 
cd /var
+tar xzf simplesamlphp-x.y.z.tar.gz
+
+
+

+ Copy the configuration files from the previous version (in case the configuration directory is inside SimpleSAMLphp, +keep reading for other alternatives): +

+
+ 
cd /var/simplesamlphp-x.y.z
+rm -rf config metadata
+cp -rv ../simplesamlphp/config config
+cp -rv ../simplesamlphp/metadata metadata
+
+
+

+ If you have installed any + + third-party modules + + or + + customised the theme + + , +you should check whether your third-party modules need upgrading and then copy or replace those directories too. +

+

+ Replace the old version with the new version: +

+
+ 
cd /var
+mv simplesamlphp simplesamlphp.old
+mv simplesamlphp-x.y.z simplesamlphp
+
+
+

+ If the format of the config files or metadata has changed from your previous version of SimpleSAMLphp (check the +upgrade notes), you may have to update your configuration and metadata after updating the SimpleSAMLphp code. +

+

+ Upgrading configuration files +

+

+ A good approach is to run a + + diff + + between your previous + + config.php + + file and the new + + config.php.dist + + file located +the same directory, and apply relevant modifications to the new template. This will ensure that all new +entries in the latest version of config.php are included, as well as preserve your local modifications. +

+

+ Upgrading metadata files +

+

+ Most likely the metadata format is backwards compatible. If not, you should receive a very clear error message at +startup indicating how and what you need to update. You should look through the metadata in the + + metadata-templates + + directory after the upgrade to see whether recommended defaults have been changed. +

+

+ Configuration +

+

+ Location of configuration files +

+

+ By default, SimpleSAMLphp looks for its configuration in the + + config + + directory in the root of its own directory. This +has some drawbacks, like making it harder to update SimpleSAMLphp or to install it as a composer dependency, or to +package it for different operating systems. +

+

+ In order to avoid this limitations, it is possible to specify an alternative location for the configuration directory +by setting the + + SIMPLESAMLPHP_CONFIG_DIR + + environment variable to point to this location. This way, the configuration +directory doesn't need to be inside the library's directory, making it easier to manage and to update. The simplest way +to set this environment variable is to set it in your web server's configuration. See the next section for more +information. +

+

+ Configuring Apache {#section_4} +

+

+ Examples below assume that SimpleSAMLphp is installed in the default location, + + /var/simplesamlphp + + . You may choose +another location, but this requires a path update in a few files. See Appendix + + Installing SimpleSAMLphp +in alternative locations + + for more details. +

+

+ The only subdirectory of + + SimpleSAMLphp + + that needs to be accessible from the web is + + public + + . There are several ways of +exposing SimpleSAMLphp depending on the way web sites are structured on your Apache web server. The following is just +one possible configuration. +

+

+ Find the Apache configuration file for the virtual hosts where you want to run SimpleSAMLphp. The configuration may +look like this: +

+
+ 
<VirtualHost *>
+    ServerName service.example.com
+    DocumentRoot /var/www/service.example.com
+
+    SetEnv SIMPLESAMLPHP_CONFIG_DIR /var/simplesamlphp/config
+
+    Alias /simplesaml /var/simplesamlphp/public
+
+    <Directory /var/simplesamlphp/public>
+        Require all granted
+    </Directory>
+</VirtualHost>
+
+
+

+ Note the + + Alias + + directive, which gives control to SimpleSAMLphp for all urls matching + + http(s)://service.example.com/simplesaml/* + + . SimpleSAMLphp makes several SAML interfaces available on the web; all of +them are accessible through the + + public + + subdirectory of your SimpleSAMLphp installation. You can name the alias +whatever you want, but the name must be specified in the + + baseurlpath + + configuration option in the + + config.php + + file of +SimpleSAMLphp as described in + + the section called “SimpleSAMLphp configuration: config.php” + + . +Here is an example of how this configuration may look like in + + config.php + + : +

+
+ 
$config = [
+    [...]
+    'baseurlpath' => 'simplesaml/',
+    [...]
+]
+
+
+

+ Note also the + + SetEnv + + directive in the Apache configuration. It sets the + + SIMPLESAMLPHP_CONFIG_DIR + + environment +variable, in this case, to the default location for the configuration directory. You can omit this environment +variable, and SimpleSAMLphp will then look for the + + config + + directory inside its own directory. If you need to move +your configuration to a different location, you can use this environment variable to tell SimpleSAMLphp where to look +for configuration files. This works only for the + + config + + directory. If you need your metadata to be in a different +directory too, use the + + metadatadir + + configuration option to specify the location. +

+

+ This is just the basic configuration to get things working. For a checklist +further completing your documentation, please see + + Maintenance and configuration: Apache + + . +

+

+ Configuring Nginx +

+

+ Examples below assume that SimpleSAMLphp is installed in the default location, + + /var/simplesamlphp + + . You may choose +another location, but this requires a path update in a few files. See Appendix + + Installing SimpleSAMLphp +in alternative locations + + for more details. +

+

+ The only subdirectory of + + SimpleSAMLphp + + that needs to be accessible from the web is + + public + + . There are several ways of +exposing SimpleSAMLphp depending on the way web sites are structured on your Nginx web server. The following is just +one possible configuration. +

+

+ Find the Nginx configuration file for the virtual hosts where you want to run SimpleSAMLphp. The configuration may +look like this: +

+
+ 
server {
+    listen 443 ssl;
+    server_name idp.example.com;
+
+    ssl_certificate        /etc/pki/tls/certs/idp.example.com.crt;
+    ssl_certificate_key    /etc/pki/tls/private/idp.example.com.key;
+    ssl_protocols          TLSv1.3 TLSv1.2;
+    ssl_ciphers            EECDH+AESGCM:EDH+AESGCM;
+
+    location ^~ /simplesaml {
+        alias /var/simplesamlphp/public;
+
+        location ~^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
+            include          fastcgi_params;
+            fastcgi_pass     $fastcgi_pass;
+            fastcgi_param SCRIPT_FILENAME $document_root$phpfile;
+
+            # Must be prepended with the baseurlpath
+            fastcgi_param SCRIPT_NAME /simplesaml$phpfile;
+
+            fastcgi_param PATH_INFO $pathinfo if_not_empty;
+        }
+    }
+}
+
+
+

+ SimpleSAMLphp configuration: config.php {#section_6} +

+

+ There are a few steps that you should complete in the main configuration file, + + config.php + + , right away: +

+
    +
  • + Set the + + baseurlpath + + configuration option. Make it point to the canonical URL of your deployment, where + SimpleSAMLphp can be reached: +
    • +
+
+ 
'baseurlpath' => 'https://your.canonical.host.name/simplesaml/',
+
+
+
+ 
Please note that your canonical URL should always use HTTPS in order to protect your users. Additionally, if you
+are running behind a **reverse proxy** and you are offloading TLS to it, the proper way to tell SimpleSAMLphp that
+its base URL should use HTTPS is to set the `baseurlpath` configuration option properly. SimpleSAMLphp deliberately
+**ignores** the `X-Forwarded-*` set of headers that your proxy might be setting, so **do not rely on those**.
+
+
+
    +
  • +

    + Set an administrator password. This is needed to access some of the pages in your SimpleSAMLphp installation web + interface. +

    +

    + Hashed passwords can also be used here. See the + + + authcrypt + + + documentation +for more information. +

    +
    • +
+
+ 
'auth.adminpassword' => 'setnewpasswordhere',
+
+
+
    +
  • + Set a secret salt. This should be a random string. Some parts of the SimpleSAMLphp needs this salt to generate + cryptographically secure hashes. SimpleSAMLphp will give an error if the salt is not changed from the default value. + The command below can help you to generated a random string on (some) unix systems: +
    • +
+
+ 
tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz' </dev/urandom | dd bs=32 count=1 2>/dev/null;echo
+
+
+

+ Here is an example of the configuration option: +

+
+ 
'secretsalt' => 'randombytesinsertedhere',
+
+
+

+ + Please note that changing the secret salt may break access to services for your users + + . +

+
    +
  • +

    + Configure your data storage. You can do this by editing the + + store.type + + configuration option, and setting it to + one of the supported values. Now configure the backend of your choice with the relevant options, if needed. +

    +
    • +
  • +

    + Configure your sessions. You have to configure your sessions with the appropriate parameters so that the cookies + used by SimpleSAMLphp to track users are always delivered to the software. You may do this by editing the + + session.* + + configuration options. Note that if you are using the + + phpsession + + data storage, the cookie-related + configuration options are configured in the + + session.phpsession.* + + options. +

    +
    • +
  • +

    + Set technical contact information. This information will be available in the generated metadata. The e-mail address + will also be used for receiving error reports sent automatically by SimpleSAMLphp. Here is an example: +

    +
    • +
+
+ 
'technicalcontact_name' => 'John Smith',
+'technicalcontact_email' => 'john.smith@example.com',
+
+
+
    +
  • + If you use SimpleSAMLphp in a country where English is not widespread, you may want to change the default language + from English to something else: +
    • +
+
+ 
'language.default' => 'no',
+
+
+
    +
  • + Set your timezone +
    • +
+
+ 
'timezone' => 'Europe/Oslo',
+
+
+

+ You can see + + a list of Supported Timezones at php.net + + . +

+

+ Configuring PHP +

+

+ Sending e-mails from PHP +

+

+ Some parts of SimpleSAMLphp will allow you to send e-mails. For example, sending error reports to the technical admin. If +you want to make use of this functionality, you should make sure your PHP installation is configured to be able to +send e-mails. +

+

+ By default SimpleSAMLphp uses the PHP + + mail() + + function, which you can configure via + + php.ini + + . +For more advanced configuration, including using a remote SMTP server, see the + + mail.* + + options in + + config.php + + . +

+

+ Enabling and disabling modules +

+

+ If you want to enable some of the modules that are installed with SimpleSAMLphp, but are disabled by default, you +can do that in the configuration: +

+
+ 
'module.enable' => [
+    'exampleauth' => true, // Setting to TRUE enables.
+    'saml' => false, // Setting to FALSE disables.
+    'core' => null, // Unset or NULL uses default for this module.
+],
+
+
+

+ Set to + + true + + the modules you want to enable, and to + + false + + those that you want to disable. +

+

+ Prior to SSP V2 you could enable or disable modules by setting empty files with names ( + + enable + + , + + disable + + , + + default-enable + + ) in the module's root directory. You need to now use the + + module.enable + + config option. +

+

+ The SimpleSAMLphp admin interface +

+

+ After installing SimpleSAMLphp, you can access the homepage of your installation, which by default does +not show much information: +

+

+ + https://service.example.org/simplesaml/ + +

+

+ The exact URL depends on how you set it up with your web server, and of course on your hostname. +If this works, you can now also acceas the admin module by adding + + admin/ + + to your base URL: +

+

+ + https://service.example.org/simplesaml/admin/ + +

+

+ + Warning + + : before you can actually use SimpleSAMLphp for something useful, you need to configure it either as a +Service Provider or as an Identity Provider, depending on your use case. +

+

+ Here is an example screenshot of what the SimpleSAMLphp page looks like: +

+

+ Screenshot of the SimpleSAMLphp installation page. +

+

+ Check your PHP environment +

+

+ At the bottom of the admin page there are some green lights. SimpleSAMLphp runs some tests to see whether the +required and recommended prerequisites are met. If any of the lights are red, you may have to install some PHP +extensions or external PHP packages (e.g. you need the PHP LDAP extension to use the LDAP authentication module). +

+

+ Next steps +

+

+ You have now successfully installed SimpleSAMLphp, and the next steps depend on whether you want to setup a Service +Provider (in order to protect access to an existing application) or an Identity Provider (which you would connect to +a user database where your users can authenticate). Documentation on bridging between federation protocols is found +in a separate document. +

+ +

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other users of the software, you are +in luck: there is a great Open Source community around SimpleSAMLphp, and you are welcome to join! The forums are open +for you to ask questions, help others by answering their questions, request improvements or contribute with +code or plugins of your own. +

+ +

+ Appendix: Installing SimpleSAMLphp in alternative locations +

+

+ There may be several reasons why you want to install SimpleSAMLphp in an alternative way. +

+
    +
  • +

    + You are installing SimpleSAMLphp in a hosted environment where you do not have root access, and cannot change + Apache configuration. You can still install SimpleSAMLphp, keep on reading! +

    +
    • +
  • +

    + You have full permissions to the server, but cannot edit web server configuration for some reason like internal + policies. +

    +
    • +
+

+ The SimpleSAMLphp package contains one folder named + + simplesamlphp-x.y.z + + (where + + x.y.z + + is the version number). In +this folder there are a lot of subfolders for library, metadata, configuration, etc. One of these folders is named + + public + + . + + Only this folder should be exposed on the web + + . The recommended configuration is to put the whole + + simplesamlphp + + folder outside the web root, and then link to the + + public + + folder by using the + + Alias + + directive, as +described in + + the section called “Configuring Apache” + + . This is not the only +possible way, though. +

+

+ As an example, let's see how you can install SimpleSAMLphp in your home directory on a shared hosting server. +

+
    +
  1. +

    + Extract the SimpleSAMLphp archive in your home directory: +

    +
    + 
    cd ~
+tar xzf simplesamlphp-1.x.y.tar.gz
+mv simplesamlphp-1.x.y simplesamlphp
+
    +
    +
    2. +
  2. +

    + Then you can try to make a symlink into the + + public_html + + directory. +

    +
    + 
    cd ~/public_html
+ln -s ../simplesamlphp/public simplesaml
+
    +
    +
    3. +
  3. +

    + Next, you need to set the + + baseurlpath + + configuration option with the URL pointing to the + + simplesaml + + link you + just created in your + + public_html + + directory. For example, if your home directory is reachable in + + https://host.example/~myaccount/ + + , set the base URL path accordingly: +

    +
    + 
    'baseurlpath' => 'https://host.example/~myaccount/simplesaml/',
+
    +
    +

    + Now, you can go to the URL of your installation and check if things work: +

    +

    + + https://host.example/~myaccount/simplesaml/ + +

    +
    4. +
+

+ Tip +

+

+ Symlinking may fail, because some Apache configurations do not allow you to link to files from outside the + + public_html + + folder. If so, you can move the + + public + + folder instead of symlinking it: +

+
+ 
cd ~/public_html
+mv ../simplesamlphp/public simplesaml
+
+
+

+ Now you have the following directory structure. +

+
    +
  • +

    + + ~/simplesamlphp + +

    +
    • +
  • +

    + + ~/public_html/simplesaml + + where + + simplesaml + + is the + + public + + directory from the + + simplesamlphp + + installation directory, + either moved or a symlink. +

    +
    • +
+

+ Now, we need to make a few configuration changes. First, let's edit + + ~/public_html/simplesaml/_include.php + + : +

+

+ Change the two lines from: +

+
+ 
require_once(dirname(_FILE__, 2) . '/lib/_autoload.php');
+
+
+

+ to something like: +

+
+ 
require_once(dirname(__FILE__, 3) . '/lib/_autoload.php');
+
+
+

+ + Warning + + : note that this will make upgrading SimpleSAMLphp much more difficult, since you will need to move the + + public + + directory and manually edit files every time you upgrade. It is also possible that this method does not work in +future versions of SimpleSAMLphp, and therefore it is discouraged and should be used only as a last resort. +

+
+ diff --git a/2.1/simplesamlphp-maintenance.html b/2.1/simplesamlphp-maintenance.html new file mode 100644 index 0000000..48d4e3b --- /dev/null +++ b/2.1/simplesamlphp-maintenance.html @@ -0,0 +1,961 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Maintenance +

+
+ +
+

+ SimpleSAMLphp news and documentation +

+

+ Please check the following sources of information to stay up to date with regard to SimpleSAMLphp: +

+ +

+ Session management +

+

+ SimpleSAMLphp has an abstraction layer for session management. That means it is possible to choose between different kind of session stores, as well as write new session store plugins. +

+

+ The + + store.type + + configuration option in + + config.php + + allows you to select which method SimpleSAMLphp should use to store the session information. Currently, three session handlers are included in the distribution: +

+
    +
  • + + phpsession + + uses the built in session management in PHP. This is the default, and is simplest to use. It will not work in a load-balanced environment in most configurations. +
    • +
  • + + memcache + + uses the memcache software to cache sessions in memory. Sessions can be distributed and replicated among several memcache servers, enabling both load-balancing and fail-over. +
    • +
  • + + sql + + stores the session in an SQL database. +
    • +
  • + + redis + + stores the session in Redis. +
    • +
+
+ 
'store.type' => 'phpsession',
+
+
+

+ Configuring PHP sessions +

+

+ To use the PHP session handler, set the + + store.type + + configuration option in + + config.php + + : +

+
+ 
'store.type' => 'phpsession',
+
+
+

+ Keep in mind that + + PHP does not allow two sessions to be open at the same time + + . This means if you are using PHP sessions both in your +application and in SimpleSAMLphp at the same time, + + they need to have different names + + . When using the PHP session handler in +SimpleSAMLphp, it is configured with different options than for other session handlers: +

+
+ 
'session.phpsession.cookiename' => null,
+'session.phpsession.savepath' => null,
+'session.phpsession.httponly' => true,
+
+
+

+ Make sure to set + + session.phpsession.cookiename + + to a name different than the one in use by any other applications. If you are using +SimpleSAMLphp as an Identity Provider, or any other applications using it are not using the default session name, you can use the default +settings by leaving these options unset or setting them to + + null + + . +

+

+ If you need to restore your session's application after calling SimpleSAMLphp, you can do it by calling the + + cleanup() + + method of the + + \SimpleSAML\Session + + class, like described + + here + + . +

+

+ Configuring memcache +

+

+ To use the memcache session handler, set the + + store.type + + parameter in + + config.php + + : +

+
+ 
'store.type' => 'memcache',
+
+
+

+ memcache allows you to store multiple redundant copies of sessions on different memcache servers. +

+

+ The configuration parameter + + memcache_store.servers + + is an array of server groups. Every data item will be mirrored in every server group. +

+

+ Each server group is an array of servers. The data items will be load-balanced between all servers in each server group. +

+

+ Each server is an array of parameters for the server. The following options are available: +

+

+ + hostname + + : +Host name or ip address where the memcache server runs, or specify other transports like + + unix:///path/ssp.sock + + to +use UNIX domain sockets. In that case, port will be ignored and forced to + + 0 + + . +

+

+ This is the only required option. +

+

+ + port + + : +Port number of the memcache server. If not set, the + + memcache.default_port + + ini setting is used. This is 11211 by +default. +

+

+ The port will be forced to + + 0 + + when a UNIX domain socket is specified in + + hostname + + . +

+

+ + weight + + : +Weight of this server in this server group. + + http://php.net/manual/en/function.Memcache-addServer.php + + has more information about the weight option. +

+

+ + timeout + + : +Timeout for this server. By default, the timeout is 3 +seconds. +

+

+ Here are two examples of configuration of memcache session handling: +

+

+ Example 1. Example of redundant configuration with load balancing +

+

+ Example of redundant configuration with load balancing: This configuration makes it possible to lose both servers in the a-group or both servers in the b-group without losing any sessions. Note that sessions will be lost if one server is lost from both the a-group and the b-group. +

+
+ 
'memcache_store.servers' => [
+    [
+        ['hostname' => 'mc_a1'],
+        ['hostname' => 'mc_a2'],
+    ],
+    [
+        ['hostname' => 'mc_b1'],
+        ['hostname' => 'mc_b2'],
+    ],
+],
+
+
+

+ Example 2. Example of simple configuration with only one memcache server +

+

+ Example of simple configuration with only one memcache server, running on the same computer as the web server: Note that all sessions will be lost if the memcache server crashes. +

+
+ 
'memcache_store.servers' => [
+    [
+        ['hostname' => 'localhost'],
+    ],
+],
+
+
+

+ The expiration value ( + + memcache_store.expires + + ) is the duration for which data should be retained in memcache. Data are dropped from the memcache servers when this time expires. The time will be reset every time the data is written to the memcache servers. +

+

+ This value should always be larger than the + + session.duration + + option. Not doing this may result in the session being deleted from the memcache servers while it is still in use. +

+

+ Set this value to 0 if you don't want data to expire. +

+

+ + Note + +

+

+ The oldest data will always be deleted if the memcache server runs +out of storage space. +

+

+ Example 3. Example of configuration setting for session expiration +

+

+ Here is an example of this configuration parameter: +

+
+ 
'memcache_store.expires' =>  36 * (60*60), // 36 hours.
+
+
+

+ Memcache PHP configuration +

+

+ Configure memcache to not do internal failover. This parameter is +configured in + + php.ini + + . +

+
+ 
memcache.allow_failover = Off
+
+
+

+ Environmental configuration +

+

+ Setup a firewall restricting access to the memcache server. +

+

+ Because SimpleSAMLphp uses a timestamp to check which session is most recent in a fail-over setup, it is very important to run synchronized clocks on all web servers where you run SimpleSAMLphp. +

+

+ Configuring SQL storage +

+

+ To store session to a SQL database, set the + + store.type + + option to + + sql + + . +SimpleSAMLphp uses + + PDO + + when accessing the database server, so the database source is configured as with a DSN. +The DSN is stored in the + + store.sql.dsn + + option. See the + + PDO driver manual + + for the DSN syntax used by the different databases. +Username and password for accessing the database can be configured in the + + store.sql.username + + and + + store.sql.password + + options. +

+

+ The required tables are created automatically. If you are storing data from multiple separate SimpleSAMLphp installations in the same database, you can use the + + store.sql.prefix + + option to prevent conflicts. +

+

+ Configuring Redis storage +

+

+ To store sessions in Redis, set the + + store.type + + option to + + redis + + . +

+

+ By default SimpleSAMLphp will attempt to connect to Redis on the + + localhost + + at port + + 6379 + + . These can be configured via the + + store.redis.host + + and + + store.redis.port + + options, respectively. You may also set a key prefix with the + + store.redis.prefix + + option. +

+

+ For Redis instances that + + require authentication + + : +

+
    +
  • + If authentication is managed with the + + requirepass + + directive (legacy password protection): use the + + store.redis.password + + option +
    • +
  • + If authentication is managed with + + ACL's + + (which are recommended as of Redis 6): use the + + store.redis.password + + and + + store.redis.username + + options +
    • +
+

+ Redis-Sentinel +

+

+ If your Redis servers are controlled by + + Redis-Sentinel + + , then configure your sentinels by setting + + store.redis.sentinels + + to +

+
+ 
[
+    'tcp://[yoursentinel1]:[port]',
+    'tcp://[yoursentinel2]:[port]',
+    'tcp://[yoursentinel3]:[port]',
+]
+
+
+

+ If your sentinels are password-protected and use the same password as your Redis servers, then setting + + store.redis.password + + is enough. However if your sentinels use a different password than that of your Redis servers, then set the password of each sentinel: +

+
+ 
[
+    'tcp://[yoursentinel1]:[port]?password=[password1]',
+    'tcp://[yoursentinel2]:[port]?password=[password2]',
+    'tcp://[yoursentinel3]:[port]?password=[password3]',
+]
+
+
+

+ Configure your master group by setting + + store.redis.mastergroup + + ( + + mymaster + + by default). +

+

+ Metadata storage +

+

+ Several metadata storage backends are available by default, including + + flatfile + + , + + serialize + + , + + mdq + + and + + + pdo + + + . Here you have an +example configuration of different metadata sources in use at the same time: +

+
+ 
'metadata.sources' => [
+    ['type' => 'flatfile'],
+    ['type' => 'flatfile', 'directory' => 'metadata/metarefresh-kalmar'],
+    ['type' => 'serialize', 'directory' => 'metadata/metarefresh-ukaccess'],
+],
+
+
+

+ You may also implement your own metadata storage handler, in a very similar way to how you would implement +your own session handler. Your class + + must + + extend the + + \SimpleSAML\Metadata\MetaDataStorageSource + + class +and override the methods needed to change the backend used. This class + + must + + also be located in the + + src/MetadataStore/ + + directory of your custom module. +

+

+ Bear in mind that + + your class name must follow the PSR-4 autoloading standard + + . This means it needs to be +properly namespaced. For example, if your module is named + + mymodule + + and your class is named + + MyMetadataHandler + + , +you should define it like this: +

+
+ 
<?php
+namespace SimpleSAML\Module\mymodule\MetadataStore;
+
+class MyMetadataHandler extends \SimpleSAML\Metadata\MetaDataStorageSource
+{
+    ...
+
+
+

+ If you would like to see an example of how a custom handler could be implemented in your own module, take +a look at the + + cassandrastore + + module. +

+

+ Logging and statistics +

+

+ SimpleSAMLphp supports standard + + syslog + + logging. As an +alternative, you may log to flat files. +

+

+ Apache configuration +

+

+ Basic Apache configuration is described in + + SimpleSAMLphp Installation + + . +However, your IdP or SP is most likely a valuable website that you want to configure securely. Here are some checks. +

+
    +
  • + Make sure you use HTTPS with a proper certificate. The best way is to not + serve anything over plain HTTP, except for a possible redirect to https. +
    • +
  • + Configure your TLS/SSL to be secure. Mozilla has an easy way to generate + + Recommended Server Configurations + + . + Verify your SSL settings, e.g. with the + + SSLLabs SSLtest + + . +
    • +
  • + In your Apache configuration, add headers that further secure your site. + A good check with hints on what to add is + + Mozilla Observatory + + . +
    • +
+

+ PHP configuration +

+

+ Secure cookies (if you run HTTPS). +

+

+ Turn off PHPSESSID in query string. +

+

+ Getting ready for production +

+

+ Here are some checkpoints +

+
    +
  1. + Remove all entities in metadata files that you do not trust. It is easy to forget about some of the entities that were used for test. +
    2. +
  2. + If you during testing have been using a certificate that has been exposed (notably: the one found in the SimpleSAMLphp distribution): Obtain and install a new one. +
    3. +
  3. + Make sure you have installed the latest security upgrades for your OS. +
    4. +
  4. + Make sure to use HTTPS rather than HTTP. +
    5. +
  5. + Block access to your servers on anything except port 443. SimpleSAMLphp only uses plain HTTP(S), so there is no need to open ports for SOAP or other communication. +
    6. +
+

+ Error handling, error reporting and metadata reporting +

+

+ SimpleSAMLphp supports allowing the user when encountering errors to send an e-mail to the administrator. You can turn off this feature in the config.php file. +

+

+ Multi-language support +

+

+ To add support for a new language, add your new language to the + + language.available + + configuration parameter in + + config.php + + : +

+
+ 
/*
+ * Languages available and which language is default
+ */
+'language.available' => ['en', 'no', 'da', 'es', 'xx'],
+'language.default'   => 'en',
+
+
+

+ Please use the standardized two-character + + language codes as specified in ISO-639-1 + + . +

+

+ You also can set the default language. You should ensure that the default language is complete, as it is used as a fallback when a text is not available in the language selected by the user. +

+

+ All strings that can be localized are found in the files + + dictionaries/ + + . Add a new entry for each string, with your language code, like this: +

+
+ 
'user_pass_header' => [
+    'en' => 'Enter your username and password',
+    'no' => 'Skriv inn brukernavn og passord',
+    'xx' => 'Pooa jujjique jamba',
+],
+
+
+

+ You can translate as many of the texts as you would like; a full translation is not required unless you want to make this the default language. From the end users point of view, it looks best if all text fragments used in a given screen or form is in one single language. +

+

+ Customizing the web frontend with themes +

+

+ Documentation on theming is moved + + to a separate document + + . +

+

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other users of the software, you are fortunate: Around SimpleSAMLphp there is a great Open source community, and you are welcome to join! The forums are open for you to ask questions, contribute answers other further questions, request improvements or contribute with code or plugins of your own. +

+ +
+ diff --git a/2.1/simplesamlphp-metadata-endpoints.html b/2.1/simplesamlphp-metadata-endpoints.html new file mode 100644 index 0000000..64ef497 --- /dev/null +++ b/2.1/simplesamlphp-metadata-endpoints.html @@ -0,0 +1,240 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Metadata endpoints +

+

+ This document gives a short introduction to the various methods forms metadata endpoints can take in SimpleSAMLphp. +

+

+ The endpoints we have are: +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ Endpoint + + Indexed + + Default binding +
+ + ArtifactResolutionService + + + Y + + SOAP +
+ + AssertionConsumerService + + + Y + + HTTP-POST +
+ + SingleLogoutService + + + N + + HTTP-Redirect +
+ + SingleSignOnService + + + N + + HTTP-Redirect +
+

+ The various endpoints can be specified in three different ways: +

+
    +
  • + A single string. +
    • +
  • + Array of strings. +
    • +
  • + Array of arrays. +
    • +
+

+ A single string +

+
+ 
  'AssertionConsumerService' => 'https://sp.example.org/ACS',
+
+
+

+ This is the simplest endpoint format. +It can be used when there is only a single endpoint that uses the default binding. +

+

+ Array of strings +

+
+ 
  'AssertionConsumerService' => [
+      'https://site1.example.org/ACS',
+      'https://site2.example.org/ACS',
+  ],
+
+
+

+ This endpoint format can be used to represent multiple endpoints, all of which use the default binding. +

+

+ Array of arrays +

+
+ 
  'AssertionConsumerService' => [
+      [
+          'index' => 1,
+          'isDefault' => true,
+          'Location' => 'https://sp.example.org/ACS',
+          'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+      ],
+      [
+          'index' => 2,
+          'Location' => 'https://sp.example.org/ACS',
+          'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
+      ],
+  ],
+
+
+

+ This endpoint format allows for specifying multiple endpoints with different bindings. +It can also be used to specify the ResponseLocation attribute on endpoints, e.g. on + + SingleLogoutService + + : +

+
+ 
  'SingleLogoutService' => [
+      [
+          'Location' => 'https://sp.example.org/LogoutRequest',
+          'ResponseLocation' => 'https://sp.example.org/LogoutResponse',
+          'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+      ],
+  ],
+
+
+
+ diff --git a/2.1/simplesamlphp-metadata-extensions-attributes.html b/2.1/simplesamlphp-metadata-extensions-attributes.html new file mode 100644 index 0000000..74c3fa7 --- /dev/null +++ b/2.1/simplesamlphp-metadata-extensions-attributes.html @@ -0,0 +1,325 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SAML V2.0 Metadata Attribute Extensions +

+
+ +
+

+ This is a reference for the SimpleSAMLphp implementation of the + + SAML +V2.0 Attribute Extensions + + defined by OASIS. A common use case is adding entity attributes +to the generated metadata. +

+

+ For an IdP + + metadata/saml20-idp-hosted.php + + entries are used to define the +metadata extension items; for an SP they can be added to + + config/authsources.php + + . +An example of this is: +

+
+ 
  <?php
+  $metadata['entity-id-1'] = [
+      /* ... */
+      'EntityAttributes' => [
+          'urn:simplesamlphp:v1:simplesamlphp' => ['is', 'really', 'cool'],
+          '{urn:simplesamlphp:v1}foo'          => ['bar'],
+      ],
+      /* ... */
+  ];
+
+
+

+ The OASIS specification primarily defines how to include arbitrary + + Attribute + + and + + Assertion + + elements within the metadata for an entity. +

+

+ + Note + + : SimpleSAMLphp does not support + + Assertion + + elements within the +metadata at this time. +

+

+ Defining Attributes +

+

+ The + + EntityAttributes + + key is used to define the attributes in the +metadata. Each item in the + + EntityAttributes + + array defines a new + + <Attribute> + + item in the metadata. The value for each key must be an +array. Each item in this array produces a separate + + <AttributeValue> + + element within the + + <Attribute> + + element. +

+
+ 
  'EntityAttributes' => [
+      'urn:simplesamlphp:v1:simplesamlphp' => ['is', 'really', 'cool'],
+  ],
+
+
+

+ This generates: +

+
+ 
    <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="urn:simplesamlphp:v1:simplesamlphp" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+      <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">is</saml:AttributeValue>
+      <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">really</saml:AttributeValue>
+      <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">cool</saml:AttributeValue>
+    </saml:Attribute>
+
+
+

+ Each + + <Attribute> + + element requires a + + NameFormat + + attribute. This is +specified using curly braces at the beginning of the key name: +

+
+ 
  'EntityAttributes' => [
+      '{urn:simplesamlphp:v1}foo' => ['bar'],
+  ],
+
+
+

+ This generates: +

+
+ 
    <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="foo" NameFormat="urn:simplesamlphp:v1">
+      <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">bar</saml:AttributeValue>
+    </saml:Attribute>
+
+
+

+ When the curly braces are omitted, the NameFormat is automatically set +to "urn:oasis:names:tc:SAML:2.0:attrname-format:uri". +

+

+ Examples +

+

+ If given the following configuration... +

+
+ 
  $metadata['https://example.com/saml-idp'] = [
+      'host' => 'www.example.com',
+      'certificate' => 'example.com.crt',
+      'privatekey' => 'example.com.pem',
+      'auth' => 'example-userpass',
+
+      'EntityAttributes' => [
+          'urn:simplesamlphp:v1:simplesamlphp' => ['is', 'really', 'cool'],
+          '{urn:simplesamlphp:v1}foo' => ['bar'],
+      ],
+  ];
+
+
+

+ ... will generate the following XML metadata: +

+
+ 
  <?xml version="1.0"?>
+  <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://example.com/saml-idp">
+    <md:Extensions>
+      <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
+        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="urn:simplesamlphp:v1:simplesamlphp" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+          <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">is</saml:AttributeValue>
+          <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">really</saml:AttributeValue>
+          <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">cool</saml:AttributeValue>
+        </saml:Attribute>
+        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="foo" NameFormat="urn:simplesamlphp:v1">
+          <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">bar</saml:AttributeValue>
+        </saml:Attribute>
+      </mdattr:EntityAttributes>
+    </md:Extensions>
+    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+      <md:KeyDescriptor use="signing">
+        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:X509Data>
+            ...
+
+
+

+ An example configuration to declare Géant Data Protection Code of Conduct +entity category support for a service provider in + + authsources.php + + : +

+
+ 
  'saml:SP' => [
+      ...
+      'EntityAttributes' => [
+          'http://macedir.org/entity-category' => [
+              '{urn:oasis:names:tc:SAML:2.0:attrname-format:uri}http://www.geant.net/uri/dataprotection-code-of-conduct/v1'
+          ]
+      ],
+      'UIInfo' =>[
+              'DisplayName' => [
+                  'en' => 'English name',
+                  'es' => 'Nombre en Español',
+              ],
+              'Description' => [
+                  'en' => 'English description',
+                  'es' => 'Descripción en Español',
+              ],
+              'InformationURL' => [
+                  'en' => 'http://example.com/info/en',
+                  'es' => 'http://example.com/info/es',
+              ],
+              'PrivacyStatementURL' => [
+                  'en' => 'http://example.com/privacy/en',
+                  'es' => 'http://example.com/privacy/es',
+              ],
+      ]
+  ],
+
+
+
+ diff --git a/2.1/simplesamlphp-metadata-extensions-rpi.html b/2.1/simplesamlphp-metadata-extensions-rpi.html new file mode 100644 index 0000000..a54d86d --- /dev/null +++ b/2.1/simplesamlphp-metadata-extensions-rpi.html @@ -0,0 +1,301 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SAML V2.0 Metadata Extensions for Registration and Publication Information +

+
+ +
+

+ This is a reference for the SimpleSAMLphp implementation of the + + SAML +V2.0 Metadata Extensions for Registration and Publication Information + + defined by OASIS. +

+

+ This extension aims to provide information about the registrars and publishers of the metadata themselves, and it is therefore +available through different endpoints and modules that provide metadata all along SimpleSAMLphp. More specifically, this +extension can be used for: +

+ +

+ Currently, only the + + <mdrpi:RegistrationInfo> + + element is supported. +

+

+ Depending on the metadata set you want to add this extension to, you will have to configure it on the corresponding +configuration file: +

+
    +
  • + + metadata/saml20-idp-hosted.php + + for hosted identity providers. +
    • +
  • + + config/authsources.php + + for hosted service providers. +
    • +
  • + + config/module_aggregator2.php + + for the + + aggregator2 + + module. +
    • +
+

+ RegistrationInfo Items +

+

+ The configuration is the same for all the different files, and consists of a single directive called + + RegistrationInfo + + , which + + must + + be an indexed array with the following options: +

+
+
+ + authority + +
+
+ A string containing an identifier of the authority who has registered this metadata. This parameter is + + mandatory + + . +
+
+ + instant + +
+
+ A string containing the instant when the entity or entities where registered by the authority. This parameter is + optional, and must be expressed in the UTC timezone with the + + zulu + + ( + + Z + + ) timezone identifier. If omitted, there will be no + + registrationInstant + + in the resulting metadata, except in the + + aggregator2 + + module, which will use the instant when the metadata + was generated. +
+
+ + policies + +
+
+ An indexed array containing URLs pointing to the policy under which the entity or entities where registered. Each + index must be the language code corresponding to the language of the URL. This parameter is optional, and will be omitted in the + resulting metadata if not configured. +
+
+

+ Examples +

+

+ Service Provider: +

+
+ 
  'default-sp' => [
+      'saml:SP',
+      'entityID' => NULL,
+      ...
+      'RegistrationInfo' => [
+          'authority' => 'urn:mace:sp.example.org',
+          'instant' => '2008-01-17T11:28:03.577Z',
+          'policies' => ['en' => 'http://sp.example.org/policy', 'es' => 'http://sp.example.org/politica'],
+      ],
+  ],
+
+
+

+ Identity Provider: +

+
+ 
  $metadata['https://example.org/saml-idp'] = [
+      'host' => '__DEFAULT__',
+      ...
+      'RegistrationInfo' => [
+          'authority' => 'urn:mace:idp.example.org',
+          'instant' => '2008-01-17T11:28:03.577Z',
+      ],
+  ];
+
+
+

+ + aggregator2 + + module: +

+
+ 
  $config = [
+      'example.org' => [
+          'sources' => [
+              ...
+          ],
+          'RegistrationInfo' => [
+              'authority' => 'urn:mace:example.federation',
+              'policies' => ['en' => 'http://example.org/federation_policy', 'es' => 'https://example.org/politica_federacion'],
+          ],
+      ],
+  ];
+
+
+
+ diff --git a/2.1/simplesamlphp-metadata-extensions-ui.html b/2.1/simplesamlphp-metadata-extensions-ui.html new file mode 100644 index 0000000..7a2d16d --- /dev/null +++ b/2.1/simplesamlphp-metadata-extensions-ui.html @@ -0,0 +1,529 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SAML V2.0 Metadata Extensions for Login and Discovery User Interface +

+
+ +
+

+ This is a reference for the SimpleSAMLphp implementation of the + + SAML +V2.0 Metadata Extensions for Login and Discovery User Interface + + defined by OASIS. +

+

+ The metadata extensions are available to both IdP and SP usage of +SimpleSAMLphp. For an IdP, the entries are placed in + + metadata/saml20-idp-hosted.php + + , for an SP, they are put inside +the relevant entry in + + authsources.php + + . +

+

+ An example for an IdP: +

+
+ 
  <?php
+  $metadata['entity-id-1'] = [
+      /* ... */
+      'UIInfo' => [
+          'DisplayName' => [
+              'en' => 'English name',
+              'es' => 'Nombre en Español',
+          ],
+          'Description' => [
+              'en' => 'English description',
+              'es' => 'Descripción en Español',
+          ],
+          'InformationURL' => [
+              'en' => 'http://example.com/info/en',
+              'es' => 'http://example.com/info/es',
+          ],
+          'PrivacyStatementURL' => [
+              'en' => 'http://example.com/privacy/en',
+              'es' => 'http://example.com/privacy/es',
+          ],
+          'Keywords' => [
+              'en' => ['communication', 'federated session'],
+              'es' => ['comunicación', 'sesión federated'],
+          ],
+          'Logo' => [
+              [
+                  'url'    => 'http://example.com/logo1.png',
+                  'height' => 200,
+                  'width'  => 400,
+                  'lang'   => 'en',
+              ],
+              [
+                  'url'    => 'http://example.com/logo2.png',
+                  'height' => 201,
+                  'width'  => 401,
+              ],
+          ],
+      ],
+      'DiscoHints' => [
+          'IPHint'          => ['130.59.0.0/16', '2001:620::0/96'],
+          'DomainHint'      => ['example.com', 'www.example.com'],
+          'GeolocationHint' => ['geo:47.37328,8.531126', 'geo:19.34343,12.342514'],
+      ],
+      /* ... */
+  ];
+
+
+

+ And for an SP it could look like this: +

+
+ 
  <?php
+  $config = [
+
+      'default-sp' => [
+          'saml:SP',
+
+          'UIInfo' => [
+              'DisplayName' => [
+                  'en' => 'English name',
+                  'es' => 'Nombre en Español'
+              ],
+              'Description' => [
+                  'en' => 'English description',
+                  'es' => 'Descripción en Español'
+              ],
+          ],
+          /* ... */
+      ],
+  ];
+
+
+

+ The OASIS specification primarily defines how an entity can communicate +metadata related to IdP or service discovery and identification. There +are two different types of +extensions defined. There are the + + <mdui:UIInfo> + + elements that define +how an IdP or SP should be displayed and there are the + + <mdui:DiscoHints> + + elements that define when an IdP should be chosen/displayed. +

+

+ UIInfo Items +

+

+ These elements are used for IdP and SP discovery to determine what to display +about an IdP or SP. These properties are all children of the + + UIInfo + + key. +

+

+ + Note + + : Most elements are localized strings that specify the language +using the array key as the language-code: +

+
+ 
          'DisplayName' => [
+              'en' => 'English name',
+              'es' => 'Nombre en Español',
+          ],
+
+
+
+
+ + DisplayName + +
+
+ The localized list of names for this entity +
+ 
        'DisplayName' => [
+            'en' => 'English name',
+            'es' => 'Nombre en Español',
+        ],
+
+
+
+
+ + Description + +
+
+ The localized list of statements used to describe this entity +
+ 
        'Description' => [
+            'en' => 'English description',
+            'es' => 'Descripción en Español',
+        ],
+
+
+
+
+ + InformationURL + +
+
+ A localized list of URLs where more information about the entity is + located. +
+ 
        'InformationURL' => [
+            'en' => 'http://example.com/info/en',
+            'es' => 'http://example.com/info/es',
+        ],
+
+
+
+
+ + PrivacyStatementURL + +
+
+ A localized list of URLs where the entity's privacy statement is + located. +
+ 
        'PrivacyStatementURL' => [
+            'en' => 'http://example.com/privacy/en',
+            'es' => 'http://example.com/privacy/es',
+        ],
+
+
+
+
+ + Keywords + +
+
+ A localized list of keywords used to describe the entity +
+ 
        'Keywords' => [
+            'en' => ['communication', 'federated session'],
+            'es' => ['comunicación', 'sesión federated'],
+        ],
+
+
+
+
+

+ + Note + + : The + + + + + (plus) character is forbidden by specification from + being part of a Keyword. +

+
+
+ + Logo + +
+
+ The logos used to represent the entity +
+ 
        'Logo' => [
+            [
+                'url'    => 'http://example.com/logo1.png',
+                'height' => 200,
+                'width'  => 400,
+                'lang'   => 'en',
+            ],
+            [
+                'url'    => 'http://example.com/logo2.png',
+                'height' => 201,
+                'width'  => 401,
+            ],
+        ],
+
+
+
+
+

+ An optional + + lang + + key containing a language-code is supported for + localized logos. +

+
+
+

+ DiscoHints Items +

+

+ These elements are only relevant when operating in the IdP role; they +assist IdP discovery to determine when to choose or +present an IdP. These properties are all children of the + + DiscoHints + + key. +

+
+
+ + IPHint + +
+
+ This is a list of both IPv4 and IPv6 addresses in CIDR notation + services by or associated with this entity. +
+ 
        'IPHint' => ['130.59.0.0/16', '2001:620::0/96'],
+
+
+
+
+ + DomainHint + +
+
+ This specifies a list of domain names serviced by or associated with + this entity. +
+ 
        'DomainHint' => ['example.com', 'www.example.com'],
+
+
+
+
+ + GeolocationHint + +
+
+ This specifies a list of geographic coordinates associated with, or + serviced by, the entity. Coordinates are given in URI form using the + geo URI scheme + + RFC5870 + + . +
+ 
        'GeolocationHint' => ['geo:47.37328,8.531126', 'geo:19.34343,12.342514'],
+
+
+
+
+

+ Generated XML Metadata Examples +

+

+ If given the following configuration... +

+
+ 
  $metadata['https://example.com/saml-idp'] = [
+      'host' => 'www.example.com',
+      'certificate' => 'example.com.crt',
+      'privatekey' => 'example.com.pem',
+      'auth' => 'example-userpass',
+
+      'UIInfo' => [
+          'DisplayName' => [
+              'en' => 'English name',
+              'es' => 'Nombre en Español',
+          ],
+          'Description' => [
+              'en' => 'English description',
+              'es' => 'Descripción en Español',
+          ],
+          'InformationURL' => [
+              'en' => 'http://example.com/info/en',
+              'es' => 'http://example.com/info/es',
+          ],
+          'PrivacyStatementURL' => [
+              'en' => 'http://example.com/privacy/en',
+              'es' => 'http://example.com/privacy/es',
+          ],
+          'Keywords' => [
+              'en' => ['communication', 'federated session'],
+              'es' => ['comunicación', 'sesión federated'],
+          ],
+          'Logo' => [
+              [
+                  'url'    => 'http://example.com/logo1.png',
+                  'height' => 200,
+                  'width'  => 400,
+              ],
+              [
+                  'url'    => 'http://example.com/logo2.png',
+                  'height' => 201,
+                  'width'  => 401,
+              ],
+          ],
+      ],
+      'DiscoHints' => [
+          'IPHint'          => ['130.59.0.0/16', '2001:620::0/96'],
+          'DomainHint'      => ['example.com', 'www.example.com'],
+          'GeolocationHint' => ['geo:47.37328,8.531126', 'geo:19.34343,12.342514'],
+      ],
+  ];
+
+
+

+ ... will generate the following XML metadata: +

+
+ 
  <?xml version="1.0"?>
+  <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://example.com/saml-idp">
+    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+      <md:Extensions>
+        <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+          <mdui:DisplayName xml:lang="en">English name</mdui:DisplayName>
+          <mdui:DisplayName xml:lang="es">Nombre en Espa&#xF1;ol</mdui:DisplayName>
+          <mdui:Description xml:lang="en">English description</mdui:Description>
+          <mdui:Description xml:lang="es">Descripci&#xF3;n en Espa&#xF1;ol</mdui:Description>
+          <mdui:InformationURL xml:lang="en">http://example.com/info/en</mdui:InformationURL>
+          <mdui:InformationURL xml:lang="es">http://example.com/info/es</mdui:InformationURL>
+          <mdui:PrivacyStatementURL xml:lang="en">http://example.com/privacy/en</mdui:PrivacyStatementURL>
+          <mdui:PrivacyStatementURL xml:lang="es">http://example.com/privacy/es</mdui:PrivacyStatementURL>
+          <mdui:Keywords xml:lang="en">communication federated+session</mdui:Keywords>
+          <mdui:Keywords xml:lang="es">comunicaci&#xF3;n sesi&#xF3;n+federated</mdui:Keywords>
+          <mdui:Logo width="400" height="200" xml:lang="en">http://example.com/logo1.png</mdui:Logo>
+          <mdui:Logo width="401" height="201">http://example.com/logo2.png</mdui:Logo>
+        </mdui:UIInfo>
+        <mdui:DiscoHints xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+          <mdui:IPHint>130.59.0.0/16</mdui:IPHint>
+          <mdui:IPHint>2001:620::0/96</mdui:IPHint>
+          <mdui:DomainHint>example.com</mdui:DomainHint>
+          <mdui:DomainHint>www.example.com</mdui:DomainHint>
+          <mdui:GeolocationHint>geo:47.37328,8.531126</mdui:GeolocationHint>
+          <mdui:GeolocationHint>geo:19.34343,12.342514</mdui:GeolocationHint>
+        </mdui:DiscoHints>
+      </md:Extensions>
+      <md:KeyDescriptor use="signing">
+        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <ds:X509Data>
+          ...
+
+
+
+ diff --git a/2.1/simplesamlphp-metadata-pdostoragehandler.html b/2.1/simplesamlphp-metadata-pdostoragehandler.html new file mode 100644 index 0000000..21b73b1 --- /dev/null +++ b/2.1/simplesamlphp-metadata-pdostoragehandler.html @@ -0,0 +1,256 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ PDO Metadata Storage Handler +

+ +
+ +
+

+ Introduction +

+

+ If you want to run a clustered SimpleSAMLphp IdP service and you would like to have centralized storage for metadata, you can use the PDO metadata storage handler. +

+

+ The present document explains how to configure SimpleSAMLphp and your database. +

+

+ Preparations +

+

+ You will need to have the appropriate PDO drivers for your database and you will have to configure the database section within the config/config.php file. +

+

+ Configuring SimpleSAMLphp +

+

+ You will first need to configure a PDO metadata source. +

+
+ 
[root@simplesamlphp simplesamlphp]# vi config/config.php
+
+
+

+ Here is an example of flatfile plus PDO: +

+
+ 
'metadata.sources' => [
+    ['type' => 'flatfile'],
+    ['type' => 'pdo'],
+],
+
+
+

+ Initializing the Database +

+

+ Once you have configured your metadata sources to include a PDO source, you will need to initialize the database. This process will create tables in the database for each type of metadata set (saml20-idp-hosted, saml20-idp-remote, saml20-sp-remote, etc). +

+
+ 
[root@simplesamlphp simplesamlphp]# php bin/initMDSPdo.php
+
+
+

+ If you connect to your database, you will see 11 new empty tables; one for each metadata set. +

+

+ Adding Metadata +

+

+ With the PDO metadata storage handler, metadata is stored in the table for the appropriate set and is stored in JSON format. +

+

+ As an example, here is the saml20_idp_hosted table: +

+ + + + + + + + + + + + + +
+ entity_id + + entity_data +
+ + __DEFAULT:1__ + + + {"host":"__DEFAULT__","privatekey":"idp.key","certificate":"idp.crt","auth":"example-ldap","identifyingAttribute":"uid"} +
+

+ Another example is the saml20_idp_remote table: +

+ + + + + + + + + + + + + +
+ entity_id + + entity_data +
+ + https://openidp.feide.no + + + {"name":{"en":"Feide OpenIdP - guest users","no":"Feide Gjestebrukere"},"description":"Here you can login with your account on Feide RnD OpenID. If you do not already have an account on this identity provider, you can create a new one by following the create new account link and follow the instructions.","SingleSignOnService":"https:\/\/openidp.feide.no\/simplesaml\/saml2\/idp\/SSOService.php","SingleLogoutService":"https:\/\/openidp.feide.no\/simplesaml\/saml2\/idp\/SingleLogoutService.php","certFingerprint":"c9ed4dfb07caf13fc21e0fec1572047eb8a7a4cb"} +
+

+ There is an included script in the + + bin + + directory that will import all flatfile metadata files and store them in the database, but you can use an external tool to maintain the metadata in the database. This document will only cover adding metadata using the included utility, but the tables above should provide enough information if you would like to create a utility to manage your metadata externally. +

+

+ To import all flatfile metadata files into the PDO database, run the following script +

+
+ 
[root@simplesamlphp simplesamlphp]# php bin/importPdoMetadata.php
+
+
+

+ In the event that you import a metadata for an entity id that already exists in the database, it will be overwritten. +

+
+ diff --git a/2.1/simplesamlphp-modules.html b/2.1/simplesamlphp-modules.html new file mode 100644 index 0000000..ca10bf2 --- /dev/null +++ b/2.1/simplesamlphp-modules.html @@ -0,0 +1,598 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp modules +

+ +
+ +
+

+ This document describes how the module system in SimpleSAMLphp +works. It describes what types of modules there are, how they are +configured, and how to write new modules. +

+

+ Overview +

+

+ There are currently three parts of SimpleSAMLphp which can be stored in +modules - authentication sources, authentication processing filters and +themes. There is also support for defining hooks - functions run at +specific times. More than one thing can be stored in a single module. +There is also support for storing supporting files, such as templates +and dictionaries, in modules. +

+

+ The different functionalities which can be created as modules will be +described in more detail in the following sections; what follows is a +short introduction to what you can do with them: +

+
    +
  • + Authentication sources implement different methods for + authenticating users, for example simple login forms which + authenticate against a database backend, or login methods which use + client-side certificates. +
    • +
  • + Authentication processing filters perform various tasks after the + user is authenticated and has a set of attributes. They can add, + remove and modify attributes, do additional authentication checks, + ask questions of the user, +++. +
    • +
  • + Themes allow you to package custom templates for multiple modules + into a single module. +
    • +
+

+ Module layout +

+

+ Each SimpleSAMLphp module is stored in a directory under the + + modules + + -directory. The module directory contains the following +directories and files: +

+
+
+ locales +
+
+ This directory contains dictionaries which belong to this + module. To use a dictionary stored in a module, the extended tag + names can be used: + + {<module name>:<dictionary name>:<tag name>} + + For + example, + + {example:login:hello} + + will look up + + hello + + in + + modules/example/locales/<lang>/login.po + + . +
+
+ It is also possible to specify + + <module name>:<dictionary name> + + as the default + dictionary when instantiating the + + \SimpleSAML\XHTML\Template + + class. +
+
+ hooks +
+
+ This directory contains hook functions for this module. Each + file in this directory represents a single function. See the + hook-section in the documentation for more information. +
+
+ src +
+
+ This directory contains classes which belong to this module. + All classes must be named in the following pattern: + + \SimpleSAML\Module\<module name>\<class name> + + When looking up the filename of + a class, SimpleSAMLphp will search for + + <class name> + + in the + + src + + directory. Underscores in the class name will be translated into + slashes. +
+
+ Thus, if SimpleSAMLphp needs to load a class named + + \SimpleSAML\Module\example\Auth\Source\Example + + , it will load the file named + + modules/example/src/Auth/Source/Example.php + + . +
+
+ templates +
+
+ These are module-specific templates. To use one of these + templates, specify + + <module name>:<template file>.twig + + as the template file in the constructor of + + \SimpleSAML\XHTML\Template + + . For example, + + example:login-form.twig + + is translated to the file + + modules/example/templates/default/login-form.twig + + . Note that + + default + + in the previous example is defined by the + + theme.use + + configuration option. +
+
+ themes +
+
+ This directory contains themes the module defines. A single + module can define multiple themes, and these themes may override + all templates in all modules. Each subdirectory of + + themes + + defines + a theme. The theme directory contains a subdirectory for each + module. The templates stored under + + simplesamlphp/templates + + can be + overridden by a directory named + + default + + . +
+
+ To use a theme provided by a module, the + + theme.use + + configuration option should be set to + + <module name>:<theme name> + + . +
+
+ When using the theme + + example:blue + + , the template + + templates/default/login.twig + + will be overridden by + + modules/example/themes/blue/default/login.twig + + , while the template + + modules/core/templates/default/loginuserpass.twig + + will be + overridden by + + modules/example/themes/blue/core/loginuserpass.twig + + . +
+
+ public +
+
+ All files stored in this directory will be available by + accessing the URL + + https://.../simplesamlphp/module.php/<module name>/<file name> + + . + For example, if a script named + + login.php + + is stored in + + modules/example/public/ + + , it can be accessed by the URL + + https://.../simplesamlphp/module.php/example/login.php + + . +
+
+ To retrieve this URL, the + + SimpleSAML\Module::getModuleURL($resource) + + -function can be used. + This function takes in a resource on the form + + <module>/<file> + + . + This function will then return a URL to the given file in the + + public + + -directory of + + module + + . +
+
+

+ Authentication sources +

+

+ An authentication source is used to authenticate a user and receive a +set of attributes belonging to this user. In a single-signon setup, the +authentication source will only be called once, and the attributes +belonging to the user will be cached until the user logs out. +

+

+ Authentication sources are defined in + + config/authsources.php + + . This +file contains an array of + + name => configuration + + pairs. The name is +used to refer to the authentication source in metadata. When +configuring an IdP to authenticate against an authentication source, +\the + + auth + + option should be set to this name. The configuration for an +authentication source is an array. The first element in the array +identifies the class which implements the authentication source. The +remaining elements in the array are configuration entries for the +authentication source. +

+

+ A typical configuration entry for an authentication source looks like +this: +

+
+ 
  'example-static' => [
+      /* This maps to modules/exampleauth/src/Auth/Source/Static.php */
+      'exampleauth:StaticSource',
+
+      /* The following is configuration which is passed on to
+       * the exampleauth:StaticSource authentication source. */
+      'uid' => 'testuser',
+      'eduPersonAffiliation' => ['member', 'employee'],
+      'cn' => ['Test User'],
+  ],
+
+
+

+ To use this authentication source in a SAML 2.0 IdP, set the + + auth + + -option of the IdP to + + 'example-static' + + : +

+
+ 
  'https://example.org/saml-idp' => [
+      'host' => '__DEFAULT__',
+      'privatekey' => 'example.org.pem',
+      'certificate' => 'example.org.crt',
+      'auth' => 'example-static',
+  ],
+
+
+

+ Creating authentication sources +

+

+ This is described in a separate document: +

+ +

+ Authentication processing filters +

+

+ + Authentication processing filters + + is explained in a separate document: +

+ +

+ Themes +

+

+ This feature allows you to collect all your custom templates in one +place. The directory structure is like this: + + modules/<thememodule>/themes/<theme>/<module>/<template> + + + thememodule + + is the module where you store your theme, while + + theme + + is the name of the theme. A theme is activated by setting the + + theme.use + + configuration option to + + <thememodule>:<theme> + + . + + module + + is the module the template belongs to, and + + template + + is the template +in that module. +

+

+ For example, + + modules/example/themes/test/core/loginuserpass.php + + replaces + + modules/core/templates/default/loginuserpass.php + + . + + modules/example/themes/test/default/frontpage.php + + replaces + + templates/default/frontpage.php + + . This theme can be activated by +setting + + theme.use + + to + + example:test + + . +

+

+ Hook interface +

+

+ The hook interface allows you to call a hook function in all enabled +modules which define that hook. Hook functions are stored in a +directory called 'hooks' in each module directory. Each hook is +stored in a file named + + hook_<hook name>.php + + , and each file defines a +function named + + <module name>_hook_<hook name> + + . +

+

+ Each hook function accepts a single argument. This argument will be +passed by reference, which allows each hook to update that argument. +

+

+ For an example of hook usage, see the cron module, which adds a link +to its information page in the Configuration section of the admin +module, through the file + + modules/cron/hooks/hook_configpage.php + + . +

+
+ diff --git a/2.1/simplesamlphp-nostate.html b/2.1/simplesamlphp-nostate.html new file mode 100644 index 0000000..0669ba7 --- /dev/null +++ b/2.1/simplesamlphp-nostate.html @@ -0,0 +1,424 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Debugging "State Information Lost" errors +

+

+ + "State Information Lost" + + ( + + \SimpleSAML\Error\NoState: NOSTATE + + ) +

+

+ This is one of the most common errors that you can encounter when configuring +SimpleSAMLphp. Unfortunately, it is also a generic error that can have many +possible causes. This document will attempt to describe what this error +actually means, and some of the situations that can cause it. +

+
+ +
+

+ What is "state information"? +

+

+ The "state information" is data that SimpleSAMLphp stores in association with a +request. The request is typically a SAML 2.0 authentication request sent to +the IdP, but it can also be other requests. +

+

+ This state information is given a random ID, e.g. +" + + _2da56e07840b59191d9797442b6b665d67d855cf77 + + ", and is saved in the session of +the user. +

+

+ What does it mean that it was lost? +

+

+ This means that we tried to load state information with a specified ID, but +were unable to find it in the session of the user. +

+

+ What can cause it to be lost? +

+

+ There are several ways that this can happen, but most of them have to do +with session storage. Here we will outline some generic alternatives, and +possible solutions. +

+

+ The domain name changed during authentication +

+

+ The domain name the IdP sends the response to is configured in the metadata of +the IdP. This means that it may not match up with the domain name the user +accessed. For example we may have the following scenario: +

+
    +
  1. + The user accesses + + https://www.example.org/ + + . A session is created for the user, and the session cookie is set for the current domain (www.example.org). +
    2. +
  2. + The user needs to be authenticated. We therefore save some information about the current status in the state array, create a SAML 2.0 authentication request, and send it to the IdP. +
    3. +
  3. + The user logs in on the IdP. The IdP then sends a response to the SP at + + example.org + + . However, the metadata for the SP that is registered at the IdP uses + + https://example.org/ + + (without + + www + + ) as the domain the response should be sent to. The authentication response is therefore sent to that domain. +
    4. +
  4. + The SP (now at + + https://example.org/ + + ) tries to load the state information associated with the authentication response it received. But, because the domain name has changed, we do not receive the session cookie of the user. We are therefore unable to find the session of the user. When we attempt to load the state information from the session we are therefore unable to find it. +
    5. +
+

+ There are several ways to solve this. One of the simplest is often to configure +your webserver to only use one domain, and redirect all accesses to the other +domain to the correct domain. +

+

+ A different solution is to change the session cookie settings, so that they are +set for the " + + example.org + + " domain. If you are using PHP sessions, you should +change this in + + php.ini + + . If not, you should change it with the +' + + session.cookie.domain + + ' option in + + config/config.php + + . In either case, it should +be set to the top-level domain with a "dot" in front of it. E.g.: +

+
+ 
  'session.cookie.domain' => '.example.org',
+
+
+

+ Or in php.ini: +

+
+ 
  session.cookie_domain = ".example.org"
+
+
+

+ Note that if you use PHP sessions, you will also have to make sure that your +application uses the same domain when it sets the cookie. How that is done +depends on your application. (See the section about mismatch between +application PHP session settings and SimpleSAMLphp session settings.) +

+

+ Hopping between http and https +

+

+ If a cookie is set during a HTTPS session, it is not available when the same +URL is later accessed over http. If your site is available over both http and +https, check that you're using https consistently throughout the configuration. +The best and most secure is to make your complete site available on https only, +and redirect any http requests to https. +

+

+ Mismatch between PHP session settings for the application and SimpleSAMLphp +

+

+ If both the application you are trying to add SAML 2.0 support to and +SimpleSAMLphp uses PHP session for session storage, and they don't agree on all +the parameters, you can end up with this error. By default, SimpleSAMLphp uses +the settings from + + php.ini + + , but these can be overridden in + + config/config.php + + . +

+

+ If this is the cause of your error, you have two choices: either change +SimpleSAMLphp to use a different session storage method (e.g. memcache or sql), +or change the session settings to match between the application and +SimpleSAMLphp. In many cases it is simplest to adjust the session storage. +

+

+ If you decide to make the session settings match, you should change the +settings in + + php.ini + + . This is to make sure that the settings apply to everything +that uses the default settings. The following options in + + php.ini + + must match the +settings used by the application: +

+
    +
  • + + session.save_handler + + : This is the method that is used to store the session. The default is " + + files + + ". +
    • +
  • + + session.save_path + + : This is the location the session files are saved. The default depends on your PHP installation. +
    • +
  • + + session.name + + : This is the name of the session cookie. The default is " + + PHPSESSID + + ". +
    • +
  • + + session.cookie_path + + : The path that the session cookie is limited to. The default is " + + / + + ", which means that it is available to all pages on your domain. +
    • +
  • + + session.cookie_domain + + : This is the domain the session cookie is limited to. The default is unset, which makes the cookie available only to the current domain. +
    • +
+

+ What those settings should be set to depends on the application. The simplest +way to determine it may be to look for calls to + + session_set_cookie_params + + in +the application, and look at what parameters it uses. +

+

+ Browsers with SameSite=Lax as default +

+

+ Some browsers, notably Chrome, will default the cookie SameSite attribute to "Lax" if it +is not set. Specifically in the context of SAML this means that cookies will not be sent +when a POST request is performed between websites, which is typical for the SAML WebSSO +flow. The lack of cookies will cause SimpleSAMLphp's session to be lost when receiving an +assertion via the HTTP-POST binding. +

+

+ To resolve this, you can set the + + session.cookie.samesite + + attribute in + + config.php + + to + + None + + . Starting with SimpleSAMLphp 1.19, the config template contains a way to +set this dynamically based on the user's browser support for this attribute. +You also need to enable the + + session.cookie.secure + + setting. +

+

+ A generic problem saving sessions +

+

+ Sometimes the problem is caused by SimpleSAMLphp being unable to load and/or save +sessions. This can be caused by the session settings being incorrect, or by a +failure of some service required by the session storage. For example, if you +are using memcache for session storage, you need to ensure that the memcache +server is running and that the web server is able to connect to it. The same +applies if you are saving the sessions to a SQL database. +

+

+ You may want to check your web server error log. If the PHP session handler +fails, it may log an error message there. +

+
+ diff --git a/2.1/simplesamlphp-reference-idp-hosted.html b/2.1/simplesamlphp-reference-idp-hosted.html new file mode 100644 index 0000000..98be7d2 --- /dev/null +++ b/2.1/simplesamlphp-reference-idp-hosted.html @@ -0,0 +1,1193 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ IdP hosted metadata reference +

+
+ +
+

+ This is a reference for the metadata file + + metadata/saml20-idp-hosted.php + + . +The file has the following format: +

+
+ 
<?php
+/* The index of the array is the entity ID of this IdP. */
+$metadata['entity-id-1'] = [
+    'host' => 'idp.example.org',
+    /* Configuration options for the first IdP. */
+];
+$metadata['entity-id-2'] = [
+    'host' => '__DEFAULT__',
+    /* Configuration options for the default IdP. */
+];
+/* ... */
+
+
+

+ The entity ID must be a URI, that is unlikely to change for technical or +political reasons. We recommend it to be a domain name you own. +The URL does not have to resolve to actual content, it's +just an identifier. If your organization's domain is + + example.org + + : +

+

+ + https://example.org/saml-idp + +

+

+ For guidance in picking an entityID, see + + InCommon's best practice + + on the matter. +

+

+ The + + host + + option is the hostname of the IdP, and will be used to +select the correct configuration. One entry in the metadata-list can +have the host + + __DEFAULT__ + + . This entry will be used when no other +entry matches. +

+

+ Common options +

+
+
+ + auth + +
+
+ Which authentication module should be used to authenticate users on + this IdP. +
+
+ + authproc + +
+
+ Used to manipulate attributes, and limit access for each SP. See + the + + authentication processing filter manual + + . +
+
+ + certificate + +
+
+ Location of certificate data which should be used by this IdP, in PEM format. +
+
+ + contacts + +
+
+ Specify contacts in addition to the technical contact configured through config/config.php. + For example, specifying a support contact: +
+
+
+ 
'contacts' => [
+    [
+        'contactType'       => 'support',
+        'emailAddress'      => 'support@example.org',
+        'givenName'         => 'John',
+        'surName'           => 'Doe',
+        'telephoneNumber'   => '+31(0)12345678',
+        'company'           => 'Example Inc.',
+    ],
+],
+
+
+
+
+

+ If you have support for a trust framework that requires extra attributes on the contact person element in your IdP metadata (for example, SIRTFI), you can specify an array of attributes on a contact. +

+
+
+
+ 
'contacts' => [
+    [
+        'contactType'       => 'other',
+        'emailAddress'      => 'mailto:abuse@example.org',
+        'givenName'         => 'John',
+        'surName'           => 'Doe',
+        'telephoneNumber'   => '+31(0)12345678',
+        'company'           => 'Example Inc.',
+        'attributes'        => [
+            'xmlns:remd'        => 'http://refeds.org/metadata',
+            'remd:contactType'  => 'http://refeds.org/metadata/contactType/security',
+        ],
+    ],
+],
+
+
+
+
+ + errorURL + +
+
+ Overrides the errorURL in the IDP's published metadata. +
+
+ + host + +
+
+ The hostname for this IdP. One IdP can also have the + + host + + -option + set to + + __DEFAULT__ + + , and that IdP will be used when no other + entries in the metadata matches. +
+
+ + logouttype + +
+
+ The logout handler to use. Either + + iframe + + or + + traditional + + . + + traditional + + is the default. +
+
+ + OrganizationName + + , + + OrganizationDisplayName + + , + + OrganizationURL + +
+
+ The name and URL of the organization responsible for this IdP. + You need to either specify + + all three + + or none of these options. +
+
+ The Name does not need to be suitable for display to end users, the DisplayName should be. + The URL is a website the user can access for more information about the organization. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+
+
+ 
'OrganizationName' => [
+    'en' => 'Voorbeeld Organisatie Foundation b.a.',
+    'nl' => 'Stichting Voorbeeld Organisatie b.a.',
+],
+'OrganizationDisplayName' => [
+    'en' => 'Example organization',
+    'nl' => 'Voorbeeldorganisatie',
+],
+'OrganizationURL' => [
+    'en' => 'https://example.com',
+    'nl' => 'https://example.com/nl',
+],
+
+
+
+
+ + privatekey + +
+
+ Location of private key data for this IdP, in PEM format. +
+
+ + privatekey_pass + +
+
+ Passphrase for the private key. Leave this option out if the + private key is unencrypted. +
+
+ + scope + +
+
+ An array with scopes for this IdP. + The scopes will be added to the generated XML metadata. + A scope can either be a domain name or a regular expression + matching a number of domains. +
+
+

+ SAML 2.0 options +

+

+ The following SAML 2.0 options are available: +

+
+
+ + assertion.encryption + +
+
+ Whether assertions sent from this IdP should be encrypted. The default + value is + + FALSE + + . +
+
+ Note that this option can be set for each SP in the SP-remote metadata. +
+
+ + attributeencodings + +
+
+ What encoding should be used for the different attributes. This is + an array which maps attribute names to attribute encodings. There + are three different encodings: +
+
+
    +
  • + + string + + : Will include the attribute as a normal string. This is + the default. +
    • +
+
+
+
    +
  • + + base64 + + : Store the attribute as a base64 encoded string. +
    • +
+
+
+
    +
  • + + raw + + : Store the attribute without any modifications. This + makes it possible to include raw XML in the response. +
    • +
+
+
+

+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +

+
+
+ + attributes.NameFormat + +
+
+ What value will be set in the Format field of attribute + statements. This parameter can be configured multiple places, and + the actual value used is fetched from metadata by the following + priority: +
+
+
    +
  1. + SP Remote Metadata +
    2. +
+
+
+
    +
  1. + IdP Hosted Metadata +
    2. +
+
+
+

+ The default value is: + + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + +

+
+
+

+ Some examples of values specified in the SAML 2.0 Core + Specification: +

+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified + +
    • +
+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + + (The default + in Shibboleth 2.0, mandatory as per SAML2INT) +
    • +
+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:basic + + (The + default in Sun Access Manager) +
    • +
+
+
+

+ You can also define your own value. +

+
+
+

+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +

+
+
+ + encryption.blacklisted-algorithms + +
+
+ Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. +
+
+ Note that this option can be set for each SP in the + + SP-remote metadata + + . +
+
+ The RSA encryption algorithm with PKCS#1 v1.5 padding is blacklisted by default for security reasons. Any assertions + encrypted with this algorithm will therefore fail to decrypt. You can override this limitation by defining an empty + array in this option (or blacklisting any other algorithms not including that one). However, it is strongly + discouraged to do so. For your own safety, please include the string 'http://www.w3.org/2001/04/xmlenc#rsa-1_5' if + you make use of this option. +
+
+ + https.certificate + +
+
+ The certificate used by the webserver when handling connections. + This certificate will be added to the generated metadata of the IdP, + which is required by some SPs when using the HTTP-Artifact binding. +
+
+ + nameid.encryption + +
+
+ Whether NameIDs sent from this IdP should be encrypted. The default + value is + + FALSE + + . +
+
+ Note that this option can be set for each SP in the + + SP-remote metadata + + . +
+
+ + NameIDFormat + +
+
+ The format(s) of the NameID supported by this IdP, as either an array or a string. If an array is given, the first + value is used as the default if the incoming request does not specify a preference. Defaults to the + + transient + + format if unspecified. +
+
+ This parameter can be configured in multiple places, and the actual value used is fetched from metadata with + the following priority: +
+
+
    +
  1. + SP Remote Metadata +
    2. +
+
+
+
    +
  1. + IdP Hosted Metadata +
    2. +
+
+
+

+ The three most commonly used values are: +

+
+
+
    +
  1. + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + +
    2. +
+
+
+
    +
  1. + + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + +
    2. +
+
+
+
    +
  1. + + urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + +
    2. +
+
+
+

+ The + + transient + + format will generate a new unique ID every time + the user logs in. +

+
+
+

+ To properly support the + + persistent + + and + + emailAddress + + formats, + you should configure + + NameID generation filters + + on your IdP. +

+
+
+

+ Note that the value(s) set here will be added to the metadata generated for this IdP, + in the + + NameIDFormat + + element. +

+
+
+ + RegistrationInfo + +
+
+ Allows to specify information about the registrar of this SP. Please refer to the + + MDRPI extension + + document for further information. +
+
+ + saml20.ecp + +
+
+ Set to + + true + + to enable the IdP to receive AuthnRequests and send responses according the Enhanced Client or Proxy (ECP) Profile. Note: authentication filters that require interaction with the user will not work with ECP. + Defaults to + + false + + . +
+
+ + saml20.hok.assertion + +
+
+ Set to + + TRUE + + to enable the IdP to send responses according the + + Holder-of-Key Web Browser SSO Profile + + . + Defaults to + + FALSE + + . +
+
+ + saml20.sendartifact + +
+
+ Set to + + TRUE + + to enable the IdP to send responses with the HTTP-Artifact binding. + Defaults to + + FALSE + + . +
+
+ Note that this requires a configured memcache server. +
+
+ + saml20.sign.assertion + +
+
+ Whether + + <saml:Assertion> + + elements should be signed. + Defaults to + + TRUE + + . +
+
+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +
+
+ + saml20.sign.response + +
+
+ Whether + + <samlp:Response> + + messages should be signed. + Defaults to + + TRUE + + . +
+
+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +
+
+ + signature.algorithm + +
+
+ The algorithm to use when signing any message generated by this identity provider. Defaults to RSA-SHA256. +
+
+ Possible values: +
+
+
    +
  • + + http://www.w3.org/2000/09/xmldsig#rsa-sha1 + + + Note + + : the use of SHA1 is + + deprecated + + and will be disallowed in the future. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 + + The default. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 + +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + +
    • +
+
+
+ + sign.logout + +
+
+ Whether to sign logout messages sent from this IdP. +
+
+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +
+
+ + SingleSignOnService + +
+
+ Override the default URL for the SingleSignOnService for this + IdP. This is an absolute URL. The default value is + + <SimpleSAMLphp-root>/saml2/idp/SSOService.php + +
+
+ Note that this only changes the values in the generated + metadata and in the messages sent to others. You must also + configure your webserver to deliver this URL to the correct PHP + page. +
+
+ + SingleSignOnServiceBinding + +
+
+ List of SingleSignOnService bindings that the IdP will claim support for. +
+
+ Possible values: +
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect + +
    • +
  • + + urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST + +
    • +
+
+
+ Defaults to HTTP-Redirect binding. Please note that the order + specified will be kept in the metadata, making the first binding + the default one. +
+
+ + SingleLogoutService + +
+
+ Override the default URL for the SingleLogoutService for this + IdP. This is an absolute URL. The default value is + + <SimpleSAMLphp-root>/saml2/idp/SingleLogoutService.php + +
+
+ Note that this only changes the values in the generated + metadata and in the messages sent to others. You must also + configure your webserver to deliver this URL to the correct PHP + page. +
+
+ + SingleLogoutServiceBinding + +
+
+ List of SingleLogoutService bindings the IdP will claim support for. +
+
+ Possible values: +
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect + +
    • +
  • + + urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST + +
    • +
+
+
+ Defaults to HTTP-Redirect binding. Please note that the order + specified will be kept in the metadata, making the first binding + the default one. +
+
+ + validate.authnrequest + +
+
+ Whether we require signatures on authentication requests sent to this IdP. + Set it to: +
+
+ true: authnrequest must be signed (and signature will be validated) +
+
+ null: authnrequest may be signed, if it is, signature will be validated +
+
+ false: authnrequest signature is never checked +
+
+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +
+
+ + validate.logout + +
+
+ Whether we require signatures on logout messages sent to this IdP. +
+
+ Note that this option also exists in the SP-remote metadata, and + any value in the SP-remote metadata overrides the one configured + in the IdP metadata. +
+
+

+ Fields for signing and validating messages +

+

+ SimpleSAMLphp only signs authentication responses by default. +Signing of logout requests and logout responses can be enabled by +setting the + + redirect.sign + + option. Validation of received messages +can be enabled by the + + redirect.validate + + option. +

+

+ These options set the default for this IdP, but options for each SP +can be set in + + saml20-sp-remote + + . Note that you need to add a +certificate for each SP to be able to validate signatures on +messages from that SP. +

+
+
+ + redirect.sign + +
+
+ Whether logout requests and logout responses sent from this IdP + should be signed. The default is + + FALSE + + . +
+
+ + redirect.validate + +
+
+ Whether authentication requests, logout requests and logout + responses received sent from this IdP should be validated. The + default is + + FALSE + +
+
+

+ + Example: Configuration for signed messages + + : +

+
+ 
'redirect.sign' => true,
+
+
+

+ Metadata extensions +

+

+ SimpleSAMLphp supports generating metadata with the MDUI, MDRPI and EntityAttributes metadata extensions. +See the documentation for those extensions for more details: +

+ +

+ For other metadata extensions, you can use the + + saml:Extensions + + option: +

+
+
+ + saml:Extensions + +
+
+ An array of + + \SAML2\XML\Chunk + + s to include in the IdP metadata extensions, at the same level as + + EntityAttributes + + . +
+
+

+ + Examples + + : +

+

+ These are some examples of IdP metadata +

+

+ Minimal SAML 2.0 IdP +

+
+ 
<?php
+
+$metadata['https://example.org/saml-idp'] = [
+    /*
+     * We use '__DEFAULT__' as the hostname so we won't have to
+     * enter a hostname.
+     */
+    'host' => '__DEFAULT__',
+
+    /* The private key and certificate used by this IdP. */
+    'certificate' => 'example.org.crt',
+    'privatekey' => 'example.org.pem',
+
+    /*
+     * The authentication source for this IdP. Must be one
+     * from config/authsources.php.
+     */
+    'auth' => 'example-userpass',
+];
+
+
+

+ A custom metadata extension (eduGAIN republish request) +

+
+ 
<?php
+
+$dom = \SAML2\DOMDocumentFactory::create();
+$republishRequest = $dom->createElementNS('http://eduid.cz/schema/metadata/1.0', 'eduidmd:RepublishRequest');
+$republishTarget = $dom->createElementNS('http://eduid.cz/schema/metadata/1.0', 'eduidmd:RepublishTarget', 'http://edugain.org/');
+$republishRequest->appendChild($republishTarget);
+$ext = [new \SAML2\XML\Chunk($republishRequest)];
+
+$metadata['https://example.org/saml-idp'] = [
+    'host' => '__DEFAULT__',
+    'certificate' => 'example.org.crt',
+    'privatekey' => 'example.org.pem',
+    'auth' => 'example-userpass',
+
+    /*
+     * The custom metadata extensions.
+     */
+    'saml:Extensions' => $ext,
+];
+
+
+

+ this generates the following metadata: +

+
+ 
<EntityDescriptor entityID="...">
+  <Extensions xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+    <eduidmd:RepublishRequest xmlns:eduidmd="http://eduid.cz/schema/metadata/1.0">
+      <eduidmd:RepublishTarget>http://edugain.org/</eduidmd:RepublishTarget>
+    </eduidmd:RepublishRequest>
+  </Extensions>
+  <!-- rest of metadata -->
+</EntityDescriptor>
+
+
+
+ diff --git a/2.1/simplesamlphp-reference-idp-remote.html b/2.1/simplesamlphp-reference-idp-remote.html new file mode 100644 index 0000000..0d7574d --- /dev/null +++ b/2.1/simplesamlphp-reference-idp-remote.html @@ -0,0 +1,771 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ IdP remote metadata reference +

+
+ +
+

+ This is a reference for metadata options available for + + metadata/saml20-idp-remote.php + + . The file has the following format: +

+
+ 
<?php
+/* The index of the array is the entity ID of this IdP. */
+$metadata['entity-id-1'] = [
+    /* Configuration options for the first IdP. */
+];
+$metadata['entity-id-2'] = [
+    /* Configuration options for the second IdP. */
+];
+/* ... */
+
+
+

+ Options +

+
+
+ + AuthnContextClassRef + +
+
+ The AuthnContextClassRef that will be sent in the login request. +
+
+ Note that this option also exists in the SP configuration. This + entry in the IdP-remote metadata overrides the option in the + + SP configuration + + . +
+
+ + AuthnContextComparison + +
+
+

+ The Comparison attribute of the AuthnContext that will be sent in the login request. This parameter won't be used unless AuthnContextClassRef is set and contains one or more values. Possible values: +

+
+
+
    +
  • + SAML2\Constants::COMPARISON_EXACT (default) +
    • +
  • + SAML2\Constants::COMPARISON_BETTER +
    • +
  • + SAML2\Constants::COMPARISON_MINIMUM +
    • +
  • + SAML2\Constants::COMPARISON_MAXIMUM +
    • +
+
+
+ Note that this option also exists in the SP configuration. This + entry in the IdP-remote metadata overrides the option in the + + SP configuration + + . +
+
+ + authproc + +
+
+ Used to manipulate attributes, and limit access for each IdP. See the + + authentication processing filter manual + + . +
+
+ + base64attributes + +
+
+ Whether attributes received from this IdP should be base64 decoded. The default is + + FALSE + + . +
+
+ + certData + +
+
+ The base64 encoded certificate for this IdP. This is an alternative to storing the certificate in a file on disk and specifying the filename in the + + certificate + + -option. +
+
+ + certificate + +
+
+ Location of certificate data for this IdP. +
+
+ + description + +
+
+ A description of this IdP. Will be used by various modules when they need to show a description of the IdP to the user. +
+
+ This option can be translated into multiple languages in the same way as the + + name + + -option. +
+
+ + disable_scoping + +
+
+ Whether sending of samlp:Scoping elements in authentication requests should be suppressed. The default value is + + FALSE + + . + When set to + + TRUE + + , no scoping elements will be sent. This does not comply with the SAML2 specification, but allows + interoperability with ADFS which + + does not support Scoping elements + + . +
+
+ Note that this option also exists in the SP configuration. This + entry in the IdP-remote metadata overrides the option in the + + SP configuration + + . +
+
+ + encryption.blacklisted-algorithms + +
+
+ Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. +
+
+ Note that this option also exists in the SP configuration. This + entry in the IdP-remote metadata overrides the option in the + + SP configuration + + . +
+
+ The RSA encryption algorithm with PKCS#1 v1.5 padding is blacklisted by default for security reasons. Any assertions + encrypted with this algorithm will therefore fail to decrypt. You can override this limitation by defining an empty + array in this option (or blacklisting any other algorithms not including that one). However, it is strongly + discouraged to do so. For your own safety, please include the string 'http://www.w3.org/2001/04/xmlenc#rsa-1_5' if + you make use of this option. +
+
+ + hide.from.discovery + +
+
+ Whether to hide hide this IdP from the local discovery or not. Set to true to hide it. Defaults to false. +
+
+ + icon + +
+
+ A logo which will be shown next to this IdP in the discovery service. +
+
+ + IDPList + +
+
+ The IdP is allowed to respond to an + + AuthNRequest + + originally sent to entityIDs in this list. +
+
+ + name + +
+
+ The name of this IdP. Will be used by various modules when they need to show a name of the SP to the user. +
+
+ If this option is unset, the organization name will be used instead (if it is available). +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+
+
+ 
'name' => [
+    'en' => 'A service',
+    'no' => 'En tjeneste',
+],
+
+
+
+
+ + nameid.encryption + +
+
+ Whether NameIDs sent to this IdP should be encrypted. The default + value is + + FALSE + + . +
+
+ Note that this option also exists in the SP configuration. This + entry in the IdP-remote metadata overrides the option in the + + SP configuration + + . +
+
+ + NameIDPolicy + +
+
+ The format of the NameID we request from this IdP: an array in the form of + + [ 'Format' => the format, 'AllowCreate' => true or false ] + + . + Set to an empty array + + [] + + to omit sending any specific NameIDPolicy element + in the AuthnRequest. When the entire option or either array key is unset, + the defaults are transient and true respectively. +
+
+ + OrganizationName + +
+
+ The name of the organization responsible for this SPP. + This name does not need to be suitable for display to end users. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+
+
+ 
'OrganizationName' => [
+    'en' => 'Example organization',
+    'no' => 'Eksempel organisation',
+],
+
+
+
+
+

+ + Note + + : If you specify this option, you must also specify the + + OrganizationURL + + option. +

+
+
+ + OrganizationDisplayName + +
+
+ The name of the organization responsible for this IdP. + This name must be suitable for display to end users. + If this option isn't specified, + + OrganizationName + + will be used instead. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name. +
+
+ + Note + + : If you specify this option, you must also specify the + + OrganizationName + + option. +
+
+ + OrganizationURL + +
+
+ A URL the end user can access for more information about the organization. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated URL. +
+
+ + Note + + : If you specify this option, you must also specify the + + OrganizationName + + option. +
+
+ + scope + +
+
+ An array with scopes valid for this IdP. + The IdP will send scopes in scoped attributes, that is, attributes containing a value with an + + @ + + sign and a domain name + after it. +
+
+ When the + + saml:FilterScopes + + authentication processing filter is used, this list of scopes will determine the valid + scopes for attributes. +
+
+ + signature.algorithm + +
+
+ The algorithm to use when signing any message sent to this specific identity provider. Defaults to RSA-SHA256. +
+
+ Note that this option also exists in the SP configuration. + This value in the IdP remote metadata overrides the value in the SP configuration. +
+
+ Possible values: +
+
+
    +
  • + + http://www.w3.org/2000/09/xmldsig#rsa-sha1 + + + Note + + : the use of SHA1 is + + deprecated + + and will be disallowed in the future. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 + + The default. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 + +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + +
    • +
+
+
+ + sign.authnrequest + +
+
+ Whether to sign authentication requests sent to this IdP. +
+
+ Note that this option also exists in the SP configuration. + This value in the IdP remote metadata overrides the value in the SP configuration. +
+
+ + sign.logout + +
+
+ Whether to sign logout messages sent to this IdP. +
+
+ Note that this option also exists in the SP configuration. + This value in the IdP remote metadata overrides the value in the SP configuration. +
+
+ + SingleLogoutService + +
+
+ Endpoint URL for logout requests and responses. You should obtain this from the IdP. Users who log out from your service is redirected to this URL with the LogoutRequest using HTTP-REDIRECT. +
+
+ The value of this option is specified in one of several + + endpoint formats + + . +
+
+ + SingleLogoutServiceResponse + +
+
+ Endpoint URL for logout responses. Overrides the + + SingleLogoutService + + -option for responses. +
+
+ + SingleSignOnService + +
+
+ Endpoint URL for sign on. You should obtain this from the IdP. For SAML 2.0, SimpleSAMLphp will use the HTTP-Redirect binding when contacting this endpoint. +
+
+ The value of this option is specified in one of several + + endpoint formats + + . +
+
+ + SPNameQualifier + +
+
+ This corresponds to the SPNameQualifier in the SAML 2.0 specification. It allows to give subjects a SP specific namespace. This option is rarely used, so if you don't need it, leave it out. When left out, SimpleSAMLphp assumes the entityID of your SP as the SPNameQualifier. +
+
+ + validate.logout + +
+
+ Whether we require signatures on logout messages sent from this IdP. +
+
+ Note that this option also exists in the SP configuration. + This value in the IdP remote metadata overrides the value in the SP configuration. +
+
+

+ Decrypting assertions +

+

+ It is possible to decrypt the assertions received from an IdP. Currently the only algorithm supported is + + AES128_CBC + + or + + RIJNDAEL_128 + + . +

+

+ There are two modes of encryption supported by SimpleSAMLphp. One is symmetric encryption, in which case both the SP and the IdP needs to share a key. The other mode is the use of public key encryption. In that mode, the public key of the SP is extracted from the certificate of the SP. +

+
+
+ + assertion.encryption + +
+
+ Whether assertions received from this IdP must be encrypted. The default value is + + FALSE + + . + If this option is set to + + TRUE + + , assertions from the IdP must be encrypted. + Unencrypted assertions will be rejected. +
+
+ Note that this option overrides the option with the same name in the SP configuration. +
+
+ + sharedkey + +
+
+ Symmetric key which should be used for decryption. This should be a 128-bit, 192-bit or 256-bit key based on the algorithm used. If this option is not specified, public key encryption will be used instead. +
+
+ + sharedkey_algorithm + +
+
+ Algorithm which should be used for decryption. Possible values are: +
+
+
    +
  • + + http://www.w3.org/2001/04/xmlenc#aes128-cbc + +
    • +
  • + + http://www.w3.org/2001/04/xmlenc#aes192-cbc + +
    • +
  • + + http://www.w3.org/2001/04/xmlenc#aes256-cbc + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes128-gcm + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes192-gcm + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes256-gcm + +
    • +
+

+ Fields for signing and validating messages +

+

+ SimpleSAMLphp only signs authentication responses by default. Signing of authentication request, logout requests and logout responses can be enabled by setting the + + redirect.sign + + option. Validation of received messages can be enabled by the + + redirect.validate + + option. +

+
+
+ + redirect.sign + +
+
+ Whether authentication request, logout requests and logout responses sent to this IdP should be signed. The default is + + FALSE + + . +
+
+ + redirect.validate + +
+
+ Whether logout requests and logout responses received from this IdP should be validated. The default is + + FALSE + + . +
+
+

+ + Example: Configuration for validating messages + + : +

+
+ 
'redirect.validate' => true,
+'certificate' => 'example.org.crt',
+
+
+
+ diff --git a/2.1/simplesamlphp-reference-sp-remote.html b/2.1/simplesamlphp-reference-sp-remote.html new file mode 100644 index 0000000..ff870f1 --- /dev/null +++ b/2.1/simplesamlphp-reference-sp-remote.html @@ -0,0 +1,1065 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SP remote metadata reference +

+
+ +
+

+ This is a reference for metadata options available for + + metadata/saml20-sp-remote.php + + . The file has the following format: +

+
+ 
<?php
+/* The index of the array is the entity ID of this SP. */
+$metadata['entity-id-1'] = [
+    /* Configuration options for the first SP. */
+];
+$metadata['entity-id-2'] = [
+    /* Configuration options for the second SP. */
+];
+/* ... */
+
+
+

+ Common options +

+

+ The following options can be set: +

+
+
+ + attributes + +
+
+ This should indicate which attributes an SP should receive. It is + used by for example the + + consent:Consent + + module to tell the user + which attributes the SP will receive, and the + + core:AttributeLimit + + module to limit which attributes are sent to the SP. +
+
+ + authproc + +
+
+ Used to manipulate attributes, and limit access for each SP. See + the + + authentication processing filter manual + + . +
+
+ + description + +
+
+ A description of this SP. Will be used by various modules when they + need to show a description of the SP to the user. +
+
+ This option can be translated into multiple languages in the same + way as the + + name + + -option. +
+
+ + name + +
+
+ The name of this SP. Will be used by various modules when they need + to show a name of the SP to the user. +
+
+ If this option is unset, the organization name will be used instead (if it is available). +
+
+ This option can be translated into multiple languages by specifying + the value as an array of language-code to translated name: +
+
+
+ 
'name' => [
+    'en' => 'A service',
+    'no' => 'En tjeneste',
+],
+
+
+
+
+ + OrganizationName + +
+
+ The name of the organization responsible for this SPP. + This name does not need to be suitable for display to end users. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name: +
+
+
+ 
'OrganizationName' => [
+    'en' => 'Example organization',
+    'no' => 'Eksempel organisation',
+],
+
+
+
+
+

+ + Note + + : If you specify this option, you must also specify the + + OrganizationURL + + option. +

+
+
+ + OrganizationDisplayName + +
+
+ The name of the organization responsible for this IdP. + This name must be suitable for display to end users. + If this option isn't specified, + + OrganizationName + + will be used instead. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated name. +
+
+ + Note + + : If you specify this option, you must also specify the + + OrganizationName + + option. +
+
+ + OrganizationURL + +
+
+ A URL the end user can access for more information about the organization. +
+
+ This option can be translated into multiple languages by specifying the value as an array of language-code to translated URL. +
+
+ + Note + + : If you specify this option, you must also specify the + + OrganizationName + + option. +
+
+ + AssertionConsumerService + +
+
+ The URL of the AssertionConsumerService endpoint for this SP. + This option is required - without it you will not be able to send + responses back to the SP. +
+
+ The value of this option is specified in one of several + + endpoint formats + + . +
+
+ + attributeencodings + +
+
+ What encoding should be used for the different attributes. This is + an array which maps attribute names to attribute encodings. There + are three different encodings: +
+
+
    +
  • + + string + + : Will include the attribute as a normal string. This is + the default. +
    • +
+
+
+
    +
  • + + base64 + + : Store the attribute as a base64 encoded string. +
    • +
+
+
+
    +
  • + + raw + + : Store the attribute without any modifications. This + makes it possible to include raw XML in the response. +
    • +
+
+
+ + attributes.NameFormat + +
+
+ What value will be set in the Format field of attribute + statements. This parameter can be configured multiple places, and + the actual value used is fetched from metadata by the following + priority: +
+
+
    +
  1. + SP Remote Metadata +
    2. +
  2. + IdP Hosted Metadata +
    3. +
+
+
+

+ The default value is: + + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + +

+
+
+

+ Some examples of values specified in the SAML 2.0 Core + Specification: +

+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified + +
    • +
+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + + (The default in Shibboleth 2.0, mandatory as per SAML2INT) +
    • +
+
+
+
    +
  • + + urn:oasis:names:tc:SAML:2.0:attrname-format:basic + + (The default in Sun Access Manager) +
    • +
+
+
+

+ You can also define your own value. +

+
+
+

+ Note that this option also exists in the IdP-hosted metadata. This + entry in the SP-remote metadata overrides the option in the + IdP-hosted metadata. +

+
+
+ + audience + +
+
+ An array of additional entities to be added to the AudienceRestriction. By default the only audience is the SP's entityID. +
+
+ + certData + +
+
+ The base64 encoded certificate for this SP. This is an alternative to storing the certificate in a file on disk and specifying the filename in the + + certificate + + -option. +
+
+ + certificate + +
+
+ Location of certificate data for this SP. The certificate is used to + verify the signature of messages received from the SP (if + + redirect.validate + + is set to + + TRUE + + ), and to encrypting assertions + (if + + assertion.encryption + + is set to TRUE and + + sharedkey + + is + unset.) +
+
+ + encryption.blacklisted-algorithms + +
+
+ Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. +
+
+ Note that this option also exists in the IdP-hosted metadata. This + entry in the SP-remote metadata overrides the option in the + + IdP-hosted metadata + + . +
+
+ The RSA encryption algorithm with PKCS#1 v1.5 padding is blacklisted by default for security reasons. Any assertions + encrypted with this algorithm will therefore fail to decrypt. You can override this limitation by defining an empty + array in this option (or blacklisting any other algorithms not including that one). However, it is strongly + discouraged to do so. For your own safety, please include the string 'http://www.w3.org/2001/04/xmlenc#rsa-1_5' if + you make use of this option. +
+
+ + ForceAuthn + +
+
+ Set this + + TRUE + + to force the user to reauthenticate when the IdP + receives authentication requests from this SP. The default is + + FALSE + + . +
+
+ + NameIDFormat + +
+
+ The + + NameIDFormat + + this SP should receive. This may be specified as either a string or an array. +
+
+ The three most commonly used values are: +
+
+
    +
  1. + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + +
    2. +
  2. + + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + +
    3. +
  3. + + urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + +
    4. +
+
+
+

+ The + + transient + + format will generate a new unique ID every time + the SP logs in. +

+
+
+

+ To properly support the + + persistent + + and + + emailAddress + + formats, + you should configure + + NameID generation filters + + on your IdP. +

+
+
+ + nameid.encryption + +
+
+ Whether NameIDs sent to this SP should be encrypted. The default + value is + + FALSE + + . +
+
+ Note that this option also exists in the IdP-hosted metadata. This + entry in the SP-remote metadata overrides the option in the + + IdP-hosted metadata + + . +
+
+ + saml20.sign.response + +
+
+ Whether + + <samlp:Response> + + messages should be signed. + Defaults to + + TRUE + + . +
+
+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +
+
+ + saml20.sign.assertion + +
+
+ Whether + + <saml:Assertion> + + elements should be signed. + Defaults to + + TRUE + + . +
+
+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +
+
+ + signature.algorithm + +
+
+ The algorithm to use when signing any message sent to this specific service provider. Defaults to RSA-SHA256. +
+
+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +
+
+ Possible values: +
+
+
    +
  • + + http://www.w3.org/2000/09/xmldsig#rsa-sha1 + + + Note + + : the use of SHA1 is + + deprecated + + and will be disallowed in the future. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 + + The default. +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 + +
    • +
  • + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + +
    • +
+
+
+ + signature.privatekey + +
+
+ Location of private key data for this IdP, in PEM format. +
+
+ Note that this option also exists in the IdP-hosted metadata. This entry in the SP-remote metadata overrides the option + + privatekey + + in the IdP-hosted metadata. +
+
+ + signature.privatekey_pass + +
+
+ Passphrase for the private key. Leave this option out if the private key is unencrypted. +
+
+ Note that this option only is used if + + signature.privatekey + + is present. +
+
+ + signature.certificate + +
+
+ Location of certificate data included by IdP for KeyInfo within the signature for the SP, in PEM format. +
+
+ If + + signature.privatekey + + is present and + + signature.certificate + + is left blank, X509Certificate will not be included with the signature. +
+
+ + sign.logout + +
+
+ Whether to sign logout messages sent to this SP. +
+
+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +
+
+ + simplesaml.attributes + +
+
+ Whether the SP should receive any attributes from the IdP. The + default value is + + TRUE + + . +
+
+ + SingleLogoutService + +
+
+ The URL of the SingleLogoutService endpoint for this SP. + This option is required if you want to implement single logout for + this SP. If the option isn't specified, this SP will not be logged + out automatically when a single logout operation is initialized. +
+
+ The value of this option is specified in one of several + + endpoint formats + + . +
+
+ + SingleLogoutServiceResponse + +
+
+ The URL logout responses to this SP should be sent. If this option + is unspecified, the + + SingleLogoutService + + endpoint will be used as + the recipient of logout responses. +
+
+ + SPNameQualifier + +
+
+ SP NameQualifier for this SP. If not set, the IdP will set the + SPNameQualifier to be the SP entity ID. +
+
+ + validate.authnrequest + +
+
+ Whether we require signatures on authentication requests sent from this SP. + Set it to: +
+
+
    +
  • + true: authnrequest must be signed (and signature will be validated) +
    • +
+
+
+
    +
  • + null: authnrequest may be signed, if it is, signature will be validated +
    • +
+
+
+
    +
  • + false: authnrequest signature is never checked +
    • +
+
+
+

+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +

+
+
+ + validate.logout + +
+
+ Whether we require signatures on logout messages sent from this SP. +
+
+ Note that this option also exists in the IdP-hosted metadata. + The value in the SP-remote metadata overrides the value in the IdP-hosted metadata. +
+
+ + skipEndpointValidationWhenSigned + +
+
+ Whether to skip validating that the AssertionConsumerServiceURL sent in authentication + requests exist in SP metadata. Only allowed for signed requests. + This option must be a simple boolean (true/false - although a value of false essentially has + no effect) or a callable. When used as a callable, the static class method must accept the + SP metadata config as a parameter and return a boolean. +
+
+

+ Encrypting assertions +

+

+ It is possible to encrypt the assertions sent to a SP. Currently the +only algorithm supported is + + AES128_CBC + + or + + RIJNDAEL_128 + + . +

+

+ There are two modes of encryption supported by SimpleSAMLphp. One is +symmetric encryption, in which case both the SP and the IdP needs to +share a key. The other mode is the use of public key encryption. In +that mode, the public key of the SP is extracted from the certificate +of the SP. +

+
+
+ + assertion.encryption + +
+
+ Whether assertions sent to this SP should be encrypted. The default + value is + + FALSE + + . +
+
+ Note that this option also exists in the IdP-hosted metadata. This + entry in the SP-remote metadata overrides the option in the + IdP-hosted metadata. +
+
+ + sharedkey + +
+
+ Symmetric key which should be used for encryption. This should be a + 128-bit, 192-bit or 256-bit key based on the algorithm used. + If this option is not specified, public key encryption will be used instead. +
+
+ + sharedkey_algorithm + +
+
+ Algorithm which should be used for encryption. Possible values are: +
+
+
    +
  • + + http://www.w3.org/2001/04/xmlenc#aes128-cbc + +
    • +
  • + + http://www.w3.org/2001/04/xmlenc#aes192-cbc + +
    • +
  • + + http://www.w3.org/2001/04/xmlenc#aes256-cbc + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes128-gcm + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes192-gcm + +
    • +
  • + + http://www.w3.org/2009/xmlenc11#aes256-gcm + +
    • +
+

+ Fields for signing and validating messages +

+

+ SimpleSAMLphp only signs authentication responses by default. +Signing of logout requests and logout responses can be enabled by +setting the + + redirect.sign + + option. Validation of received messages +can be enabled by the + + redirect.validate + + option. +

+

+ These options overrides the options set in + + saml20-idp-hosted + + . +

+
+
+ + redirect.sign + +
+
+ Whether logout requests and logout responses sent to this SP should + be signed. The default is + + FALSE + + . +
+
+ + redirect.validate + +
+
+ Whether authentication requests, logout requests and logout + responses received from this SP should be validated. The default is + + FALSE + +
+
+

+ Example: Configuration for validating messages +

+
+ 
'redirect.validate' => true,
+'certificate' => 'example.org.crt',
+
+
+

+ Fields for scoping +

+

+ Only relevant if you are a proxy/bridge and wants to limit the idps this +sp can use. +

+
+
+ + IDPList + +
+
+ The list of scoped IdPs, i.e. the list of entityids for IdPs that are +relevant for this SP. It will override any list set in the IdP's +metadata. +
+
+

+ Example: Configuration for scoping +

+
+ 
'IDPList' => ['https://idp1.wayf.dk', 'https://idp2.wayf.dk'],
+
+
+
+ diff --git a/2.1/simplesamlphp-scoping.html b/2.1/simplesamlphp-scoping.html new file mode 100644 index 0000000..fdc4a96 --- /dev/null +++ b/2.1/simplesamlphp-scoping.html @@ -0,0 +1,284 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Scoping +

+
+ +
+

+ Scoping allows a service provider to specify a list of identity providers in an +authnRequest to a proxying identity provider. This is an indication to the +proxying identity provider that the service will only deal with the identity +providers specified. +

+

+ A common use is for a service provider in a hub-and-spoke architecture to +manage its own discovery service and being able to tell the hub/proxy-IdP which +(backend-end) identity provider to use. The standard discovery service in +SimpleSAMLphp will show the intersection of all the known IdPs and the IdPs +specified in the scoping element. If this intersection only contains one IdP, +then the request is automatically forwarded to that IdP. +

+

+ Scoping is a SAML 2.0 specific option. +

+

+ Options +

+

+ SimpleSAMLphp supports scoping by allowing the following options: +

+
+
+ + ProxyCount + +
+
+ Specifies the number of proxying indirections permissible +between the identity provider receiving the request and the identity provider +who ultimately authenticates the user. A count of zero permits no proxying. If +ProxyCount is unspecified the number of proxy indirections is not limited. +
+
+ + IDPList + +
+
+ The list of trusted IdPs, i.e. the list of entityIDs for identity providers +that are relevant for a service provider in an authnRequest. +
+
+

+ + Note + + : SimpleSAMLphp does not support specifying the GetComplete option. +

+

+ Usage +

+

+ The ProxyCount and IDPList option can be specified in the following places: +

+
    +
  • + as a state parameter to the authentication source +
    • +
  • + in the saml:SP authentication source configuration +
    • +
  • + in the saml20-idp-remote metadata +
    • +
  • + in the saml20-sp-remote metadata +
    • +
+

+ Example configuration: +

+
+ 
  # Add the IDPList
+  'IDPList' => [
+      'IdPEntityID1',
+      'IdPEntityID2',
+      'IdPEntityID3',
+  ],
+
+  # Set ProxyCount
+  'ProxyCount' => 2,
+
+
+

+ Retrieving information +

+

+ RequesterID element +

+

+ To allow an identity provider to identify the original requester and the +proxying identity providers, SimpleSAMLphp adds the RequesterID element to +the request and if necessary the scoping element even if explicit scoping is +not used. +

+

+ The RequesterId elements are available from the state array as an array, for +instance via the authenticate method on an authentication source. +

+
+ 
  $requesterIDs = $state['saml:RequesterID'];
+
+
+

+ AuthenticatingAuthority element +

+

+ To allow a service provider to identify the authentication authorities that +were involved in the authentication of the user, SimpleSAMLphp adds the +AuthenticatingAuthority elements. +

+

+ The list of authenticating authorities (the AuthenticatingAuthority element) +can be retrieved as an array from the authentication data. +

+
+ 
  # Get the authentication source.
+  $as = new \SimpleSAML\Auth\Simple();
+
+  # Get the AuthenticatingAuthority
+  $aa = $as->getAuthData('saml:AuthenticatingAuthority');
+
+
+

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other users of the software, you are fortunate: Around SimpleSAMLphp there is a great Open source community, and you are welcome to join! The forums are open for you to ask questions, contribute answers other further questions, request improvements or contribute with code or plugins of your own. +

+ +
+ diff --git a/2.1/simplesamlphp-sp-api.html b/2.1/simplesamlphp-sp-api.html new file mode 100644 index 0000000..b507554 --- /dev/null +++ b/2.1/simplesamlphp-sp-api.html @@ -0,0 +1,706 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp SP API reference +

+
+ +
+

+ This document describes the \SimpleSAML\Auth\Simple API. +This is the preferred API for integrating SimpleSAMLphp with other applications. +

+

+ + Note on PHP sessions and SimpleSAMLphp API calls + + : +Some SimpleSAMLphp calls replace the current active PHP session. If you previously started a session and wish to write to it, then you must cleanup the SimpleSAMLphp session before you can write to your session. If you do not need to modify your own session, then you can leave the cleanup call out; however, forgetting to call cleanup is a common source of hard to find bugs. +

+
+ 
session_start();
+// ...
+$auth = new \SimpleSAML\Auth\Simple('default-sp');
+$auth->isAuthenticated(); // Replaces our session with the SimpleSAMLphp one
+// $_SESSION['key'] = 'value'; // This would save to the SimpleSAMLphp session which isn't what we want
+\SimpleSAML\Session::getSessionFromRequest()->cleanup(); // Reverts to our PHP session
+// Save to our session
+$_SESSION['key'] = 'value';
+
+
+

+ Constructor +

+
+ 
new \SimpleSAML\Auth\Simple(string $authSource)
+
+
+

+ The constructor initializes a \SimpleSAML\Auth\Simple object. +

+

+ + Parameters + + : +

+

+ It has a single parameter, which is the ID of the authentication source that should be used. +This authentication source must exist in + + config/authsources.php + + . +

+

+ + Example + + : +

+
+ 
$auth = new \SimpleSAML\Auth\Simple('default-sp');
+
+
+

+ isAuthenticated +

+
+ 
bool isAuthenticated()
+
+
+

+ Check whether the user is authenticated with this authentication source. + + TRUE + + is returned if the user is authenticated, + + FALSE + + if not. +

+

+ + Example + + : +

+
+ 
if (!$auth->isAuthenticated()) {
+    \SimpleSAML\Session::getSessionFromRequest()->cleanup();
+    /* Show login link. */
+    print('<a href="/login">Login</a>');
+}
+
+
+

+ requireAuth +

+
+ 
void requireAuth(array $params = [])
+
+
+

+ Make sure that the user is authenticated. +This function will only return if the user is authenticated. +If the user isn't authenticated, this function will start the authentication process. +

+

+ + Parameters + + : +

+

+ + $params + + is an associative array with named parameters for this function. +See the documentation for the + + login + + -function for a description of the parameters. +

+

+ + Example 1 + + : +

+
+ 
$auth->requireAuth();
+\SimpleSAML\Session::getSessionFromRequest()->cleanup();
+print("Hello, authenticated user!");
+
+
+

+ + Example 2 + + : +

+
+ 
/*
+ * Return the user to the frontpage after authentication, don't post
+ * the current POST data.
+ */
+$auth->requireAuth([
+    'ReturnTo' => 'https://sp.example.org/',
+    'KeepPost' => FALSE,
+]);
+\SimpleSAML\Session::getSessionFromRequest()->cleanup();
+print("Hello, authenticated user!");
+
+
+

+ login +

+
+ 
void login(array $params = [])
+
+
+

+ Start a login operation. +This function will always start a new authentication process. +

+

+ + Parameters + + : +

+

+ The following global parameters are supported: +

+
+
+ + ErrorURL + + ( + + string + + ) +
+
+

+ A URL to a page which will receive errors that may occur during authentication. +

+
+
+ + KeepPost + + ( + + bool + + ) +
+
+

+ If set to + + TRUE + + , the current POST data will be submitted again after authentication. + The default is + + TRUE + + . +

+
+
+ + ReturnTo + + ( + + string + + ) +
+
+

+ The URL the user should be returned to after authentication. + The default is to return the user to the current page. +

+
+
+ + ReturnCallback + + ( + + array + + ) +
+
+

+ The function we should call when the user finishes authentication. +

+
+
+

+ The + + + saml:SP + + + authentication source also defines some parameters. +

+

+ + Example + + : +

+
+ 
# Send a passive authentication request.
+$auth->login([
+    'isPassive' => true,
+    'ErrorURL' => 'https://.../error_handler.php',
+]);
+\SimpleSAML\Session::getSessionFromRequest()->cleanup();
+
+
+

+ logout +

+
+ 
void logout(mixed $params = null)
+
+
+

+ Log the user out. +After logging out, the user will either be redirected to another page, or a function will be called. +This function never returns. +

+

+ + Parameters + + : +

+
+
+ + $params + +
+
+ Parameters for the logout operation. +
+
+ This can either be a simple string, in which case it is interpreted as the URL the user should be redirected to after logout, or an associative array with logout parameters. +
+
+ If this parameter isn't specified, we will redirect the user to the current URL after logout. +
+
+ If the parameter is an an array, it can have the following options: +
+
+
    +
  • + + ReturnTo + + : The URL the user should be returned to after logout. +
    • +
  • + + ReturnCallback + + : The function that should be called after logout. +
    • +
  • + + ReturnStateParam + + : The parameter we should return the state in when redirecting. +
    • +
  • + + ReturnStateStage + + : The stage the state array should be saved with. +
    + 
    The `ReturnState` parameters allow access to the result of the logout operation after it completes.
+
    +
    +
    • +
+

+ + Example 1 + + : +

+

+ Logout, and redirect to the specified URL. +

+
+ 
$auth->logout('https://sp.example.org/logged_out.php');
+\SimpleSAML\Session::getSessionFromRequest()->cleanup();
+
+
+

+ + Example 2 + + : +

+

+ Same as the previous, but check the result of the logout operation afterwards. +

+
+ 
$auth->logout([
+    'ReturnTo' => 'https://sp.example.org/logged_out.php',
+    'ReturnStateParam' => 'LogoutState',
+    'ReturnStateStage' => 'MyLogoutState',
+]);
+\SimpleSAML\Session::getSessionFromRequest()->cleanup();
+
+
+

+ And in logged_out.php: +

+
+ 
$state = \SimpleSAML\Auth\State::loadState((string)$_REQUEST['LogoutState'], 'MyLogoutState');
+$ls = $state['saml:sp:LogoutStatus']; /* Only works for SAML SP */
+if ($ls['Code'] === 'urn:oasis:names:tc:SAML:2.0:status:Success' && !isset($ls['SubCode'])) {
+    /* Successful logout. */
+    echo("You have been logged out.");
+} else {
+    /* Logout failed. Tell the user to close the browser. */
+    echo("We were unable to log you out of all your sessions. To be completely sure that you are logged out, you need to close your web browser.");
+}
+
+
+

+ getAttributes +

+
+ 
array getAttributes()
+
+
+

+ Retrieve the attributes of the current user. +If the user isn't authenticated, an empty array will be returned. +

+

+ The attributes will be returned as an associative array with the name of the attribute as the key and the value as an array of one or more strings: +

+
+ 
[
+    'uid' => ['testuser'],
+    'eduPersonAffiliation' => ['student', 'member'],
+]
+
+
+

+ + Example + + : +

+
+ 
$attrs = $auth->getAttributes();
+if (!isset($attrs['displayName'][0])) {
+    throw new Exception('displayName attribute missing.');
+}
+$name = $attrs['displayName'][0];
+
+print('Hello, ' . htmlspecialchars($name));
+
+
+

+ getAuthData +

+
+ 
mixed getAuthData(string $name)
+
+
+

+ Retrieve the specified authentication data for the current session. +NULL is returned if the user isn't authenticated. +

+

+ The available authentication data depends on the module used for authentication. +See the + + + saml:SP + + + reference for information about available SAML authentication data. +

+

+ + Example + + : +

+
+ 
$idp = $auth->getAuthData('saml:sp:IdP');
+$nameID = $auth->getAuthData('saml:sp:NameID')->getValue();
+printf('You are %s, logged in from %s', htmlspecialchars($nameID), htmlspecialchars($idp));
+
+
+

+ getLoginURL +

+
+ 
string getLoginURL(string $returnTo = null)
+
+
+

+ Retrieve a URL that can be used to start authentication. +

+

+ + Parameters + + : +

+
+
+ + $returnTo + +
+
+

+ The URL the user should be returned to after authentication. + The default is the current page. +

+
+
+

+ + Example + + : +

+
+ 
$url = $auth->getLoginURL();
+
+print('<a href="' . htmlspecialchars($url) . '">Login</a>');
+
+
+

+ + Note + + : +The URL returned by this function is static, and will not change. +You can easily create your own links without using this function. +The URL should be: +

+

+ + .../simplesaml/module.php/core/login/<authentication source>?ReturnTo=<return URL> + +

+

+ getLogoutURL +

+
+ 
string getLogoutURL(string $returnTo = NULL)
+
+
+

+ Retrieve a URL that can be used to trigger logout. +

+

+ + Parameters + + : +

+
+
+ + $returnTo + +
+
+

+ The URL the user should be returned to after logout. + The default is the current page. +

+
+
+

+ + Example + + : +

+
+ 
$url = $auth->getLogoutURL();
+
+print('<a href="' . htmlspecialchars($url) . '">Logout</a>');
+
+
+

+ + Note + + : +The URL returned by this function is static, and will not change. +You can easily create your own links without using this function. +The URL should be: +

+

+ + .../simplesaml/module.php/core/logout/<authentication source>?ReturnTo=<return URL> + +

+
+ diff --git a/2.1/simplesamlphp-sp.html b/2.1/simplesamlphp-sp.html new file mode 100644 index 0000000..d00c67b --- /dev/null +++ b/2.1/simplesamlphp-sp.html @@ -0,0 +1,588 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Service Provider QuickStart +

+
+ +
+

+ This guide will describe how to configure SimpleSAMLphp as a service +provider (SP). You should previously have installed SimpleSAMLphp as +described in the + + SimpleSAMLphp installation instructions + + . +

+

+ Configuring the SP +

+

+ The SP is configured by an entry in + + config/authsources.php + + . +

+

+ This is a minimal + + authsources.php + + for a SP: +

+
+ 
<?php
+$config = [
+
+    /* This is the name of this authentication source, and will be used to access it later. */
+    'default-sp' => [
+        'saml:SP',
+        'entityID' => 'https://myapp.example.org/',
+    ],
+];
+
+
+

+ The entity ID must be a URI, that is unlikely to change for technical or +political reasons. We recommend it to be a domain name that you own. +Like above, if your organization's main domain is + + example.org + + and this SP is +for the application + + myapp + + . The URL does not have to resolve to actual +content, it's just an identifier. Hence you don't need to and should not change +it if the actual domain of your application changes. +

+

+ For guidance in picking an entityID, see + + InCommon's best practice + + on the matter. +

+

+ For more information about additional options available for the SP, +see the + + + saml:SP + + reference + + . +

+

+ If you want multiple Service Providers in the same site and installation, +you can add more entries in the + + authsources.php + + configuration. If so +remember to set the EntityID explicitly. Here is an example: +

+
+ 
    'sp1' => [
+        'saml:SP',
+        'entityID' => 'https://myapp.example.org/',
+    ],
+    'sp2' => [
+        'saml:SP',
+        'entityID' => 'https://myotherapp.example.org/',
+    ],
+
+
+

+ Enabling a certificate for your Service Provider +

+

+ Some Identity Providers / Federations may require that your Service Providers +holds a certificate. If you enable a certificate for your Service Provider, +it may be able to sign requests and response sent to the Identity Provider, +as well as receiving encrypted responses. +

+

+ Create a self-signed certificate in the + + cert/ + + directory. +

+
+ 
cd cert
+openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out saml.crt -keyout saml.pem
+
+
+

+ Then edit your + + authsources.php + + entry, and add references to your certificate: +

+
+ 
    'default-sp' => [
+        'saml:SP',
+        'entityID' => 'https://myapp.example.org/',
+        'privatekey' => 'saml.pem',
+        'certificate' => 'saml.crt',
+    ],
+
+
+

+ Adding IdPs to the SP +

+

+ The service provider you are configuring needs to know about the identity +providers you are going to connect to it. This is configured by metadata +stored in + + metadata/saml20-idp-remote.php + + . +

+

+ This is a minimal example of a + + metadata/saml20-idp-remote.php + + metadata file: +

+
+ 
<?php
+$metadata['https://example.org/saml-idp'] = [
+    'SingleSignOnService'  => 'https://example.org/simplesaml/saml2/idp/SSOService.php',
+    'SingleLogoutService'  => 'https://example.org/simplesaml/saml2/idp/SingleLogoutService.php',
+    'certificate'          => 'example.pem',
+];
+
+
+

+ + example.pem + + under your + + cert/ + + directory contains the certificate the +identity provider uses for signing assertions. +

+

+ For more information about available options in the idp-remote metadata +files, see the + + IdP remote reference + + . +

+

+ If you have the metadata of the remote IdP as an XML file, you can use the +built-in XML to SimpleSAMLphp metadata converter, which by default is +available at + + /module.php/admin/federation/metadata-converter + + in +your SimpleSAMLphp installation. +

+

+ Note that the idp-remote file lists all IdPs you trust. +You should remove all IdPs that you don't use. +

+

+ Setting the default IdP +

+

+ An option in the authentication source allows you to configure which IdP should +be used. This is the + + idp + + option. +

+
+ 
<?php
+$config = [
+
+    'default-sp' => [
+        'saml:SP',
+
+        /*
+         * The entity ID of the IdP this should SP should contact.
+         * Can be NULL/unset, in which case the user will be shown a list of available IdPs.
+         */
+        'idp' => 'https://example.org/saml-idp',
+    ],
+];
+
+
+

+ Exchange metadata with the IdP +

+

+ In order to complete the connection between your SP and an IdP, you must +exchange the metadata of your SP with the IdP. The metadata of your SP can be +found in the + + Federation + + tab of the web interface. Copy the SAML 2.0 XML +Metadata document automatically generated by SimpleSAMLphp and send it to the +administrator of the IdP. You can also send them the dedicated URL of your +metadata, so that they can fetch it periodically and obtain automatically any +changes that you may perform to your SP. +

+

+ You will also need to add the metadata of the IdP. Ask them to provide you with +their metadata, and parse it using the + + XML to SimpleSAMLphp metadata converter + + tool available also in the + + Federation + + tab of the web interface. Copy the +resulting parsed metadata and paste it with a text editor into the + + metadata/saml20-idp-remote.php + + file in your SimpleSAMLphp directory. +

+

+ If you intend to add your SP to a federation, the procedure for managing trust +in federations will differ, but the common part is that you would need to +provide the + + SAML 2.0 metadata of your SP + + , and register that with the +federation administration. You will probably be required too to consume +the federation metadata periodically. Read more about + + automated metadata management + + to learn more about that. +

+

+ Test the SP +

+

+ After the metadata is configured on the IdP, you should be able to test the +configuration. The admin module of SimpleSAMLphp has a tab to test +authentication sources. There you should a list of authentication sources, +including the one you have created for the SP. +

+

+ After you click the link for that authentication source, you will be +redirected to the IdP. After entering your credentials, you should be +redirected back to the test page. +The test page should contain a list of your attributes: +

+

+ Screenshot of the status page after a user has successfully authenticated +

+

+ For a better looking, more advanced Discovery Service with tabs and live +search, you may want to use the + + discopower + + module. +

+

+ Integrating authentication with your own application +

+

+ The API is documented in + + the SP API reference + + . +

+

+ For those web resources you want to protect, you must add a few +lines of PHP code: +

+
    +
  • + Register the SimpleSAMLphp classes with the PHP autoloader. +
    • +
  • + Require authentication of the user for those places it is required. +
    • +
  • + Access the users attributes. +
    • +
+

+ Example code: +

+

+ We start off with loading a file which registers the SimpleSAMLphp classes +with the autoloader. +

+
+ 
require_once('../../src/_autoload.php');
+
+
+

+ We select our authentication source: +

+
+ 
$as = new \SimpleSAML\Auth\Simple('default-sp');
+
+
+

+ We then require authentication: +

+
+ 
$as->requireAuth();
+
+
+

+ And print the attributes: +

+
+ 
$attributes = $as->getAttributes();
+print_r($attributes);
+
+
+

+ Each attribute name can be used as an index into $attributes to obtain the +value. Every attribute value is an array - a single-valued attribute is an +array of a single element. +

+

+ We can also request authentication with a specific IdP: +

+
+ 
$as->login([
+    'saml:idp' => 'https://example.org/saml-idp',
+]);
+
+
+

+ Other options are also available. +Take a look in the documentation for the + + SP module + + for a list +of all parameters. +

+

+ If we are using PHP sessions in SimpleSAMLphp and in the application we are +protecting, SimpleSAMLphp will close any existing session when invoked for the +first time, and its own session will prevail afterwards. If you want to restore +your own session after calling SimpleSAMLphp, you can do so by cleaning up the +session like this: +

+
+ 
$session = \SimpleSAML\Session::getSessionFromRequest();
+$session->cleanup();
+
+
+

+ If you don't cleanup SimpleSAMLphp's session and try to use $_SESSION +afterwards, you won't be using your own session and all your data is +likely to get lost or inaccessible. +

+

+ Note that if your application uses a + + custom session handler + + , +SimpleSAMLphp will use it as well. This can lead to problems because +SimpleSAMLphp's stand-alone web UI uses the default PHP session handlers. +Therefore, you may need to unset the custom handler before making any calls to SimpleSAMLphp: +

+
+ 
// use custom save handler
+session_set_save_handler($handler);
+session_start();
+
+// close session and restore default handler
+session_write_close();
+session_set_save_handler(new SessionHandler(), true);
+
+// use SimpleSAML\Session
+$session = \SimpleSAML\Session::getSessionFromRequest();
+$session->cleanup();
+session_write_close();
+
+// back to custom save handler
+session_set_save_handler($handler);
+session_start();
+
+
+

+ Support +

+

+ If you need help to make this work, or want to discuss SimpleSAMLphp with other +users of the software, you are fortunate: Around SimpleSAMLphp there is a great +Open source community, and you are welcome to join! The forums are open for you +to ask questions, contribute answers other further questions, request +improvements or contribute with code or plugins of your own. +

+ +
+ diff --git a/2.1/simplesamlphp-theming.html b/2.1/simplesamlphp-theming.html new file mode 100644 index 0000000..1a7549b --- /dev/null +++ b/2.1/simplesamlphp-theming.html @@ -0,0 +1,469 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Theming the user interface in SimpleSAMLphp +

+
+ +
+

+ In SimpleSAMLphp every part that needs to interact with the user by using a web page, uses templates to present the HTML. SimpleSAMLphp comes with a default set of templates that presents an anonymous look. +

+

+ You may create your own theme, where you add one or more template files that will override the default ones. This document explains how to achieve that. +

+

+ How themes work +

+

+ If you want to customize the UI, the right way to do that is to create a new + + theme + + . A theme is a set of templates that can be configured to override the default templates. Themes are a special type of SimpleSAMLphp module. +

+

+ Configuring which theme to use +

+

+ In + + config.php + + there is a configuration option that controls theming. You need to set that option and also add the module that contains the theme to the list of enabled modules. Here is an example: +

+
+ 
'module.enable' => [
+    ...
+    'mymodule' => true,
+],
+
+'theme.use' => 'mymodule:fancytheme',
+
+
+

+ The + + theme.use + + parameter points to which theme that will be used. If some functionality in SimpleSAMLphp needs to present UI in example with the + + logout.twig + + template, it will first look for + + logout.twig + + in the + + theme.use + + theme, and if not found it will all fallback to look for the base templates. +

+

+ Override only specific templates +

+

+ The SimpleSAMLphp templates are derived from a base template and include other templates as building blocks. You only need to override the templates or building blocks needed for your change. +SimpleSAMLphp allows themes to override the included templates files only, if needed. That means you can create a new theme + + fancytheme + + that includes only a header and footer template. These templates may refer to your own CSS files, which means that a simple way of making a new look on SimpleSAMLphp is to create a new theme, and copy the existing header, but point to your own CSS instead of the default CSS. This means that for many theme requirements, you only need to specify a new header and footer template, and leave all other templates to SimpleSAMLphp's base versions. +

+

+ Creating your first theme +

+

+ The first thing you need to do is having a SimpleSAMLphp module to place your theme in. If you do not have a module already, create a new one: +

+
+ 
cd modules
+mkdir mymodule
+
+
+

+ Then within this module, you can create a new theme named + + fancytheme + + . +

+
+ 
cd modules/mymodule
+mkdir -p themes/fancytheme/default/
+
+
+

+ Now, in + + config.php + + , add the module to the list of enabled modules, and configure SimpleSAMLphp to actually use your new theme: +

+
+ 
'module.enable' => [
+    ...
+    'mymodule' => true,
+],
+'theme.use' => 'mymodule:fancytheme',
+
+
+

+ Next, we copy the header file from the base theme: +

+
+ 
cp templates/_header.twig modules/mymodule/themes/fancytheme/default/
+
+
+

+ In the + + modules/mymodule/themes/fancytheme/default/_header.twig + + file, type in something and go to the SimpleSAMLphp front page to see that your new theme is in use. +

+

+ Adding resource files +

+

+ You can put resource files within the + + public/assets + + folder of your module, to make your module completely independent with included css, icons etc. +

+
+ 
modules
+└───mymodule
+    └───src
+    └───themes
+    └───public
+        └───assets
+            └───logo.svg
+            └───style.css
+
+
+

+ Reference these resources in your custom templates under + + themes/fancytheme + + by using a generator for the URL. +Example for a custom CSS stylesheet file: +

+
+ 
{% block preload %}
+<link rel="stylesheet" href="{{ asset('style.css', 'mymodule') }}">
+{% endblock %}
+
+
+

+ A custom theme controller +

+

+ If you have very specific requirements for your theme, you can define a custom theme controller +in + + config.php + + : +

+
+ 
'theme.controller' => '\SimpleSAML\Module\mymodule\FancyThemeController',
+
+
+

+ This requires you to implement + + \SimpleSAML\XHTML\TemplateControllerInterface.php + + in your module's + + src + + -directory. +The class can then modify the Twig Environment and the variables passed to the theme's templates. In short, this allows you to set additional global variables and to write your own Twig filters and functions. +

+

+ An example to put in + + src/FancyThemeController.php + + : +

+
+ 
<?php
+
+namespace SimpleSAML\Module\mymodule;
+
+use Twig\Environment;
+use SimpleSAML\XHTML\TemplateControllerInterface;
+
+class FancyThemeController implements TemplateControllerInterface
+{
+    /**
+     * Modify the twig environment after its initialization (e.g. add filters or extensions).
+     *
+     * @param \Twig\Environment $twig The current twig environment.
+     * @return void
+     */
+    public function setUpTwig(Environment &$twig): void
+    {
+    }
+
+    /**
+     * Add, delete or modify the data passed to the template.
+     *
+     * This method will be called right before displaying the template.
+     *
+     * @param array $data The current data used by the template.
+     * @return void
+     */
+    public function display(array &$data): void
+    {
+        $data['extra_info'] = 'Extra information to use in your template';
+    }
+}
+
+
+

+ See the + + Twig documentation + + for more information on using variables and expressions in Twig templates, and the SimpleSAMLphp wiki for + + our conventions + + . +

+

+ Migrating to Twig templates +

+

+ For existing themes that have been created before SimpleSAMLphp 2.0, you may need to upgrade them to the Twig +templating engine to be compatible with SimpleSAMLphp 2.0. +

+

+ Twig works by extending a base template, which can itself include other partial templates. Some of the content of the old + + includes/header.php + + template is now located in a separate + + _header.twig + + file. This can be customized by copying it from the base template: +

+
+ 
cp templates/_header.twig modules/mymodule/themes/fancytheme/default/
+
+
+

+ If you need to make more extensive customizations to the base template, you should copy it from the base theme: +

+
+ 
cp templates/base.twig modules/mymodule/themes/fancytheme/default/
+
+
+

+ Any references to + + $this->data['baseurlpath'] + + in old-style templates can be replaced with + + {{baseurlpath}} + + in Twig templates. Likewise, references to + + \SimpleSAML\Module::getModuleURL() + + can be replaced with + + {{baseurlpath}}module.php/mymodule/... + + or the + + asset() + + function like shown above. +If you want to use the + + asset() + + function, you need to move the asserts from + + public/ + + to + + public/assets/ + + . +

+

+ Within templates each module is defined as a separate namespace matching the module name. This allows one template to reference templates from other modules using Twig's + + @namespace_name/template_path + + notation. For instance, a template in + + mymodule + + can include the widget template from the + + yourmodule + + module using the notation + + @yourmodule/widget.twig + + . A special namespace, + + __parent__ + + , exists to allow theme developers to more easily extend a module's stock template. +

+

+ The wiki also includes some information on + + migrating translations + + and + + migrating templates + + . +

+
+ diff --git a/2.1/simplesamlphp-translation.html b/2.1/simplesamlphp-translation.html new file mode 100644 index 0000000..ba1c793 --- /dev/null +++ b/2.1/simplesamlphp-translation.html @@ -0,0 +1,93 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpleSAMLphp Translation +

+

+ TODO: please complete this doc on how to translate SimpleSAMLphp +

+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.10.html b/2.1/simplesamlphp-upgrade-notes-1.10.html new file mode 100644 index 0000000..f4a3217 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.10.html @@ -0,0 +1,99 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.10 +

+
    +
  • + The default encryption key padding scheme has been changed to + + http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p + + . This may cause problems if the recipient of messages do not support this padding scheme. +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.11.html b/2.1/simplesamlphp-upgrade-notes-1.11.html new file mode 100644 index 0000000..5b3b8b7 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.11.html @@ -0,0 +1,108 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.11 +

+
    +
  • + Support for the Holder-of-Key profile in the SAML 2.0 SP has been disabled by default. + To enable it, set + + saml20.hok.assertion + + to + + TRUE + + in + + config/authsources.php + + . +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.12.html b/2.1/simplesamlphp-upgrade-notes-1.12.html new file mode 100644 index 0000000..4c7dddc --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.12.html @@ -0,0 +1,95 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.12 +

+
    +
  • + PHP version 5.3 is now required. +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.13.html b/2.1/simplesamlphp-upgrade-notes-1.13.html new file mode 100644 index 0000000..3c71d51 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.13.html @@ -0,0 +1,110 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.13 +

+
    +
  • + The RSA_1.5 (RSA with PKCS#1 v1.5 padding) algorithm is now longer allowed by default. This means messages received + that use this algorithm will fail to decrypt. +
    • +
  • + Several functions, classes and interfaces are now deprecated. Please check your code if you are using the API. +
    • +
  • + A workaround related to performance issues when processing large metadata sets was included in + + 1.13.2 + + . + + This workaround is experimental and could have unexpected side effects + + . +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.14.html b/2.1/simplesamlphp-upgrade-notes-1.14.html new file mode 100644 index 0000000..88f7334 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.14.html @@ -0,0 +1,970 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.14 +

+

+ The + + mcrypt + + extension is no longer required by SimpleSAMLphp, so if no signatures or encryption are being used, it +can be skipped. It is still a requirement for + + xmlseclibs + + though, so for those verifying or creating signed +documents, or using encryption, it is still needed. +

+

+ The + + mbstring + + extension is now required starting on SimpleSAMLphp 1.14.12. +

+

+ PHP session cookies are now set to HTTP-only by default. This relates to the + + session.phpsession.httponly + + configuration option. +

+

+ The default value for the 'trusted.url.domains' option in the config file has been changed from null to an empty array, +making SimpleSAMLphp secure to open redirection attacks by default. Setting it explicitly to null will re-allow +insecure redirections. +

+

+ The jQuery version in use has been bumped to the latest 1.8.X version. +

+

+ Service Providers using the eduPersonTargetedID attribute, will get a DOMNodeList object instead of the NameID value. In +order to process the NameID, a SAML2_XML_saml_NameID object can be used: +

+
+ 
$attributes = $as->getAttributes();
+$eptid = $attributes['eduPersonTargetedID'][0]->item(0);
+$nameID = new SAML2_XML_saml_NameID($eptid);
+
+
+

+ The following deprecated files, directories and endpoints have been removed: +

+
    +
  • + + bin/pack.php + +
    • +
  • + + docs/pack.txt + +
    • +
  • + + docs/simplesamlphp-features.txt + +
    • +
  • + + docs/simplesamlphp-reference-sp-hosted.txt + +
    • +
  • + + docs/simplesamlphp-subversion.txt + +
    • +
  • + + lib/SimpleSAML/Auth/BWC.php + + ( + + SimpleSAML_Auth_BWC + + ) +
    • +
  • + + lib/SimpleSAML/MemcacheStore.php + + ( + + SimpleSAML_MemcacheStore + + ) +
    • +
  • + + lib/SimpleSAML/Metadata/MetaDataStorageHandlerDynamicXML.php + + ( + + SimpleSAML_Metadata_MetaDataStorageHandlerDynamicXML + + ) +
    • +
  • + + modules/aselect/www/linkback.php + +
    • +
  • + + modules/core/lib/ModuleDefinition.php + + ( + + sspmod_core_ModuleDefinition + + ) +
    • +
  • + + modules/core/lib/ModuleInstaller.php + + ( + + sspmod_core_ModuleInstaller + + ) +
    • +
  • + + modules/core/www/bwc_resumeauth.php + +
    • +
  • + + modules/core/www/idp/resumeauth.php + +
    • +
  • + + modules/oauth/lib/OauthSignatureMethodRSASHA1.php + + ( + + sspmod_oauth_OauthSignatureMethodRSASHA1 + + ) +
    • +
  • + + modules/oauth/www/accessToken.php + +
    • +
  • + + modules/oauth/www/authorize.php + +
    • +
  • + + modules/oauth/www/requestToken.php + +
    • +
  • + + modules/smartnameattribute/ + +
    • +
  • + + www/resources/jquery.js + +
    • +
  • + + www/resources/jquery-ui.js + +
    • +
  • + + www/resources/uitheme/ + +
    • +
  • + + www/shib13/sp/ + +
    • +
  • + + www/saml2/idp/idpInitSingleLogoutServiceiFrame.php + +
    • +
  • + + www/saml2/idp/SingleLogoutServiceiFrame.php + +
    • +
  • + + www/saml2/idp/SingleLogoutServiceiFrameResponse.php + +
    • +
  • + + www/saml2/sp/ + +
    • +
  • + + www/wsfed/ + +
    • +
  • + + www/example-simple/ + +
    • +
  • + + www/auth/ + +
    • +
+

+ The following deprecated methods and constants have been removed: +

+
    +
  • + + SimpleSAML_AuthMemCookie::getLoginMethod() + +
    • +
  • + + SimpleSAML_Session::DATA_TIMEOUT_LOGOUT + +
    • +
  • + + SimpleSAML_Session::expireDataLogout() + +
    • +
  • + + SimpleSAML_Session::get_sp_list() + +
    • +
  • + + SimpleSAML_Session::getAttribute() + +
    • +
  • + + SimpleSAML_Session::getAttributes() + +
    • +
  • + + SimpleSAML_Session::getAuthnInstant() + +
    • +
  • + + SimpleSAML_Session::getAuthnRequest() + +
    • +
  • + + SimpleSAML_Session::getAuthority() + +
    • +
  • + + SimpleSAML_Session::getIdP() + +
    • +
  • + + SimpleSAML_Session::getInstance() + +
    • +
  • + + SimpleSAML_Session::getLogoutState() + +
    • +
  • + + SimpleSAML_Session::getNameID() + +
    • +
  • + + SimpleSAML_Session::getSessionIndex() + +
    • +
  • + + SimpleSAML_Session::getSize() + +
    • +
  • + + SimpleSAML_Session::isAuthenticated() + +
    • +
  • + + SimpleSAML_Session::remainingTime() + +
    • +
  • + + SimpleSAML_Session::setAttribute() + +
    • +
  • + + SimpleSAML_Session::setAttributes() + +
    • +
  • + + SimpleSAML_Session::setAuthnRequest() + +
    • +
  • + + SimpleSAML_Session::setIdP() + +
    • +
  • + + SimpleSAML_Session::setLogoutState() + +
    • +
  • + + SimpleSAML_Session::setNameID() + +
    • +
  • + + SimpleSAML_Session::setSessionDuration() + +
    • +
  • + + SimpleSAML_Session::setSessionIndex() + +
    • +
  • + + SimpleSAML_Utilities::generateRandomBytesMTrand() + +
    • +
+

+ The following methods have changed their signature. Refer to the code for the updated signatures: +

+
    +
  • + + SimpleSAML_Auth_Default::initLogin() + +
    • +
  • + + SimpleSAML_Metadata_MetaDataStorageHandler::getGenerated() + +
    • +
  • + + SimpleSAML_Metadata_MetaDataStorageHandler::getMetaData() + +
    • +
  • + + SimpleSAML_Metadata_MetaDataStorageHandler::getMetaDataCurrent() + +
    • +
  • + + SimpleSAML_Metadata_MetaDataStorageHandler::getMetaDataCurrentEntityID() + +
    • +
  • + + SimpleSAML_Session::doLogout() + +
    • +
  • + + SimpleSAML_Session::getAuthState() + +
    • +
  • + + SimpleSAML_Session::registerLogoutHandler() + +
    • +
  • + + SimpleSAML_Utilities::generateRandomBytes() + +
    • +
  • + + SimpleSAML_XML_Shib13_AuthnRequest::createRedirect() + +
    • +
+

+ The following methods and classes have been deprecated. Refer to the code for alternatives: +

+
    +
  • + + SimpleSAML_Auth_Default + + , together with all the + + SimpleSAML_Auth_Default.* + + keys in the state array. +
    • +
  • + + SimpleSAML_Auth_Default::extractPersistentAuthState() + +
    • +
  • + + SimpleSAML_Auth_Default::handleUnsolicitedAuth() + +
    • +
  • + + SimpleSAML_Auth_Default::initLogin() + +
    • +
  • + + SimpleSAML_Auth_Default::initLogout() + +
    • +
  • + + SimpleSAML_Auth_Default::initLogoutReturn() + +
    • +
  • + + SimpleSAML_Auth_Default::loginCompleted() + +
    • +
  • + + SimpleSAML_Auth_Default::logoutCallback() + +
    • +
  • + + SimpleSAML_Auth_Default::logoutCompleted() + +
    • +
  • + + SimpleSAML_Utilities + +
    • +
  • + + SimpleSAML_Utilities::addURLParameter() + +
    • +
  • + + SimpleSAML_Utilities::aesDecrypt() + +
    • +
  • + + SimpleSAML_Utilities::aesEncrypt() + +
    • +
  • + + SimpleSAML_Utilities::arrayize() + +
    • +
  • + + SimpleSAML_Utilities::checkCookie() + +
    • +
  • + + SimpleSAML_Utilities::checkDateConditions() + +
    • +
  • + + SimpleSAML_Utilities::checkURLAllowed() + +
    • +
  • + + SimpleSAML_Utilities::createHttpPostRedirectLink() + +
    • +
  • + + SimpleSAML_Utilities::createPostRedirectLink() + +
    • +
  • + + SimpleSAML_Utilities::debugMessage() + +
    • +
  • + + SimpleSAML_Utilities::doRedirect() + +
    • +
  • + + SimpleSAML_Utilities::fatalError() + +
    • +
  • + + SimpleSAML_Utilities::fetch() + +
    • +
  • + + SimpleSAML_Utilities::formatDOMElement() + +
    • +
  • + + SimpleSAML_Utilities::formatXMLString() + +
    • +
  • + + SimpleSAML_Utilities::generateID() + +
    • +
  • + + SimpleSAML_Utilities::generateRandomBytes() + +
    • +
  • + + SimpleSAML_Utilities::generateTimestamp() + +
    • +
  • + + SimpleSAML_Utilities::getAcceptLanguage() + +
    • +
  • + + SimpleSAML_Utilities::getAdminLogoutURL() + +
    • +
  • + + SimpleSAML_Utilities::getBaseURL() + +
    • +
  • + + SimpleSAML_Utilities::getDefaultEndpoint() + +
    • +
  • + + SimpleSAML_Utilities::getDOMChildren() + +
    • +
  • + + SimpleSAML_Utilities::getDOMText() + +
    • +
  • + + SimpleSAML_Utilities::getFirstPathElement() + +
    • +
  • + + SimpleSAML_Utilities::getLastError() + +
    • +
  • + + SimpleSAML_Utilities::getSecretSalt() + +
    • +
  • + + SimpleSAML_Utilities::getSelfHost() + +
    • +
  • + + SimpleSAML_Utilities::getSelfHostWithPath() + +
    • +
  • + + SimpleSAML_Utilities::getTempDir() + +
    • +
  • + + SimpleSAML_Utilities::initTimezone() + +
    • +
  • + + SimpleSAML_Utilities::ipCIDRcheck() + +
    • +
  • + + SimpleSAML_Utilities::isAdmin() + +
    • +
  • + + SimpleSAML_Utilities::isDOMElementOfType() + +
    • +
  • + + SimpleSAML_Utilities::isHTTPS() + +
    • +
  • + + SimpleSAML_Utilities::isWindowsOS() + +
    • +
  • + + SimpleSAML_Utilities::loadPrivateKey() + +
    • +
  • + + SimpleSAML_Utilities::loadPublicKey() + +
    • +
  • + + SimpleSAML_Utilities::maskErrors() + +
    • +
  • + + SimpleSAML_Utilities::normalizeURL() + +
    • +
  • + + SimpleSAML_Utilities::parseAttributes() + +
    • +
  • + + SimpleSAML_Utilities::parseDuration() + +
    • +
  • + + SimpleSAML_Utilities::parseQueryString() + +
    • +
  • + + SimpleSAML_Utilities::parseStateID() + +
    • +
  • + + SimpleSAML_Utilities::popErrorMask() + +
    • +
  • + + SimpleSAML_Utilities::postRedirect() + +
    • +
  • + + SimpleSAML_Utilities::redirect() + +
    • +
  • + + SimpleSAML_Utilities::redirectTrustedURL() + +
    • +
  • + + SimpleSAML_Utilities::redirectUntrustedURL() + +
    • +
  • + + SimpleSAML_Utilities::requireAdmin() + +
    • +
  • + + SimpleSAML_Utilities::resolveCert() + +
    • +
  • + + SimpleSAML_Utilities::resolvePath() + +
    • +
  • + + SimpleSAML_Utilities::resolveURL() + +
    • +
  • + + SimpleSAML_Utilities::selfURL() + +
    • +
  • + + SimpleSAML_Utilities::selfURLHost() + +
    • +
  • + + SimpleSAML_Utilities::selfURLNoQuery() + +
    • +
  • + + SimpleSAML_Utilities::setCookie() + +
    • +
  • + + SimpleSAML_Utilities::stringToHex() + +
    • +
  • + + SimpleSAML_Utilities::transposeArray() + +
    • +
  • + + SimpleSAML_Utilities::validateCA() + +
    • +
  • + + SimpleSAML_Utilities::validateXML() + +
    • +
  • + + SimpleSAML_Utilities::validateXMLDocument() + +
    • +
  • + + SimpleSAML_Utilities::writeFile() + +
    • +
+

+ The following modules will no longer be shipped with the next version of SimpleSAMLphp: +

+
    +
  • + + aggregator + +
    • +
  • + + aggregator2 + +
    • +
  • + + aselect + +
    • +
  • + + autotest + +
    • +
  • + + casserver + +
    • +
  • + + consentSimpleAdmin + +
    • +
  • + + discojuice + +
    • +
  • + + InfoCard + +
    • +
  • + + logpeek + +
    • +
  • + + metaedit + +
    • +
  • + + modinfo + +
    • +
  • + + papi + +
    • +
  • + + oauth + +
    • +
  • + + openid + +
    • +
  • + + openidProvider + +
    • +
  • + + saml2debug + +
    • +
  • + + themefeidernd + +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.15.html b/2.1/simplesamlphp-upgrade-notes-1.15.html new file mode 100644 index 0000000..ba6a1e3 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.15.html @@ -0,0 +1,151 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.15 +

+

+ The minimum required PHP version is now 5.4. The dependency on mcrypt has been +dropped. +

+

+ A new templating system based on Twig has been introduced. The old templating +system is still available but should be considered deprecated. Custom themes +may need to be updated to include Twig-style templates as well. See the + + theming documentation + + . +

+

+ A new internationalization system based on Gettext has been introduced. While +old templates can use either the old or the new system (refer to the +"language.i18n.backend" configuration option for more information on how to +choose the internationalization backend), new Twig templates can only use the +new Gettext internationalization system. +

+

+ The integrated + + Auth Memcookie + + support is now deprecated and will no longer +be available starting in SimpleSAMLphp 2.0. Please use the new + + memcookie module + + instead. +

+

+ The option to specify a SAML certificate by its fingerprint, + + certFingerprint + + has been deprecated and will be removed in a future release. Please use the +full certificate in + + certData + + instead. +

+

+ The + + core:AttributeRealm + + authproc filter has been deprecated. +Please use + + core:ScopeFromAttribute + + , which is a generalised version of this. +

+

+ simpleSAMLphp will now send the eduPersonTargetedID attribute in the correct +NameID XML form, instead of the incorrect simple string. It will also refuse +to parse an assertion with an eduPersonTargetedID in 'string' format. +

+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.16.html b/2.1/simplesamlphp-upgrade-notes-1.16.html new file mode 100644 index 0000000..1070e03 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.16.html @@ -0,0 +1,147 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.16 +

+

+ The default signature algorithm is now SHA-256 (SHA-1 has been considered +obsolete since 2014). For entities that need it, you can switch back to +SHA-1 by setting the + + signature.algorithm + + option in the remote entity +metadata. +

+

+ In the Consent module, the + + noconsentattributes + + has been renamed to + + attributes.exclude + + . The old name continues to work but is considered +deprecated. +

+

+ The class + + SimpleSAML_Error_BadUserInnput + + has been renamed to + + SimpleSAML_Error_BadUserInput + + . +

+

+ The + + authmyspace + + module has been removed since the service is no longer +available. +

+

+ The + + casserver + + module has been removed because it was an outdated version, +the up to date module is maintained in the + + simplesamlphp-module-casserver + + repository. It can be installed with composer: +

+
+ 
composer require simplesamlphp/simplesamlphp-module-casserver
+
+
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.17.html b/2.1/simplesamlphp-upgrade-notes-1.17.html new file mode 100644 index 0000000..99a1803 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.17.html @@ -0,0 +1,146 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.17 +

+

+ The minimum PHP version required is now PHP 5.5. +

+

+ All (remaining) classes have been changed to namespaces. There are mappings +from the legacy names so calling code should remain working. Custom code +(e.g. modules) that test for class names, e.g. when catching specific +exceptions, may need to be changed. +

+

+ The possibility has been reintroduced to omit the NameIdPolicy from SP +AuthnRequests by setting NameIDPolicy to + + false + + . The preferred way is +to configure it as an array + + [ 'Format' => format, 'AllowCreate' => true/false ] + + , +which is now also the format used in the + + saml:NameIDPolicy + + variable +in + + $state + + . +

+

+ The code, config and documentation have switched to using the modern PHP +array syntax. This should not have an impact as both will remain working +equally, but the code examples and config templates look slightly different. +The following are equivalent: +

+
+ 
// Old style array syntax
+$config = array(
+    'authproc' => array(
+        60 => 'class:etc'
+    ),
+    'other example' => 1
+);
+
+// Current style array syntax
+$config = [
+    'authproc' => [
+        60 => 'class:etc'
+    ],
+    'other example' => 1
+];
+
+
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.18.html b/2.1/simplesamlphp-upgrade-notes-1.18.html new file mode 100644 index 0000000..616046f --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.18.html @@ -0,0 +1,183 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.18 +

+

+ The minimum PHP version required is now PHP 5.6. +

+

+ Deprecations +

+
    +
  • +

    + The use of the PHP + + memcache + + extension was deprecated in favour of + + memcached + + . +In order to keep using memcache functionality you have to move to the PHP + + memcached + + extension, +which is available from PECL; see + + memcached + + . The former is considered abandoned +and it's safe use can no longer be guaranteed. +

    +

    + There are a few options here: +

    +
      +
    • + Depending on your distribution, the package may just be available for you to install +
      • +
    • + You could use the package from the + + REMI repository + + if you're on RHEL. +
      • +
    • + Download the source from + + memcached + + and + + compile + + the source as a PHP-extension manually. +
      • +
    +
    • +
  • +

    + Support for SAML1.1 / Shibboleth 1.3 will be discontinued in a future release. +

    +
    • +
  • + The class + + SimpleSAML\Auth\TimeLimitedToken + + is now deprecated and will be removed in a future release + If your custom module relies on this class, be sure to make a copy into your repository and + make sure to also copy the unit tests that come along. +
    • +
  • + Setting + + privacypolicy + + in metadata files will be removed in a future release. It was only used + by the consent module, which supports + + UIInfo + + 's + + PrivacyStatementURL + + . + See + + Metadata extensions + + on how to configure this. +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.19.html b/2.1/simplesamlphp-upgrade-notes-1.19.html new file mode 100644 index 0000000..e319476 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.19.html @@ -0,0 +1,93 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.19 +

+

+ The minimum PHP version required is now PHP 7.0. +

+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.5.html b/2.1/simplesamlphp-upgrade-notes-1.5.html new file mode 100644 index 0000000..bfae196 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.5.html @@ -0,0 +1,173 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.5 +

+
    +
  • +

    + + SimpleSAML_Session::isValid() + +

    +

    + If your code calls + + $session->isValid() + + without an argument, you will now have to update it to pass an argument (probably + + saml2 + + ). +The reason for this change is that calling + + $session->isValid() + + without an argument can easily create a security hole. +

    +
    • +
  • +

    + We have introduced a new module for SAML authentication. + This authentication module supports both SAML 1.1 and SAML 2.0 IdPs. +

    +

    + We have also added a new authentication framework which should replace the previous redirects to the initSSO-scripts. +Relating to this change, we have also deprecated the + + initSSO + + -scripts for SAML 1.1 and SAML 2.0 authentication. +The old methods will still be supported for a while, but new code should probably use the new code. +

    +

    + See the + + migration guide + + for more information about this. +

    +
    • +
  • +

    + The + + request.signing + + option has been removed. + That option was replaced with the + + redirect.sign + + and + + redirect.validate + + options, and has been deprecated for one year. +

    +
    • +
  • +

    + The + + aggregator + + module's configuration file has changed name. + It was changed from + + aggregator.php + + to + + module_aggregator.php + + . +

    +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.6.html b/2.1/simplesamlphp-upgrade-notes-1.6.html new file mode 100644 index 0000000..6a55315 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.6.html @@ -0,0 +1,170 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.6 +

+
    +
  • +

    + This release requires PHP version >= 5.2.0, as that was the first version to include + + json_decode() + + . + It is possible that it may work with version of PHP >= 5.1.2 if the + + JSON PECL extension + + is enabled, but this is untested. +

    +
    • +
  • +

    + The secure-flag is no longer automatically set on the session cookie. + This was changed to avoid hard to diagnose session problems. + There is a new option + + session.cookie.secure + + in + + config.php + + , which can be used to enable secure cookies. +

    +
    • +
  • +

    + Dictionaries have moved to JSON format. + The PHP format is still supported, but all dictionaries included with SimpleSAMLphp are in JSON format. +

    +
    • +
  • +

    + The iframe-specific logout endpoints on the IdP have been merged into the normal logout endpoints. + This means that the metadata no longer needs to be changed when switching between logout handlers. + The old iframe logout endpoints are now deprecated, and the generated metadata will only include the normal logout endpoint. +

    +
    • +
  • +

    + As a result of the changed metadata classes, all metadata elements now have a + + md: + + -prefix. + This does not change the content of the metadata, just its expression. +

    +
    • +
  • +

    + The deprecated functions + + init(...) + + and + + setAuthenticated(...) + + in the + + SimpleSAML_Session + + class have been removed. + Code which relies on those functions should move to using + + SimpleSAML_Session::getInstance() + + and + + $session->doLogin(...) + + . +

    +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.7.html b/2.1/simplesamlphp-upgrade-notes-1.7.html new file mode 100644 index 0000000..5ed2be8 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.7.html @@ -0,0 +1,113 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.7 +

+
    +
  • + The attribute names generated by the twitter and facebook authentication sources have changed. +
    • +
  • + Several new options have been added to config.php, and some have been renamed. + The old options should still work, but it is suggested that you look at the config.php file in config-templates, and compare it to your own. +
    • +
  • + There have been several changes to the internal API. + Most of the changes will not be noticed by the application using SimpleSAMLphp. + See the changelog for more details about the changes. +
    • +
  • + Relative redirects are no longer supported. + If your application passes relative URL's to the + + SimpleSAML_Utilities::redirect() + + -function, it will no longer work. + This also applies if you pass relative URL's to other functions that do redirects. +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.8.html b/2.1/simplesamlphp-upgrade-notes-1.8.html new file mode 100644 index 0000000..a29f51e --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.8.html @@ -0,0 +1,103 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.8 +

+
    +
  • + The IdP now sends the NotOnOrAfter attribute in LogoutRequest messages. +
    • +
  • + We now have full support for selecting the correct AssertionConsumerService endpoint based on parameters in the authentication request. + As a side effect of this, an IdP may start sending responses to a new AssertionConsumerService endpoint after upgrade. + (This should only happen in the case where it sent the response to the wrong endpoint before.) +
    • +
  • + The SP no longer incorrectly returns PartialLogout as a status code in a LogoutResponse after the local session has expired. +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-1.9.html b/2.1/simplesamlphp-upgrade-notes-1.9.html new file mode 100644 index 0000000..0982f7e --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-1.9.html @@ -0,0 +1,132 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 1.9 +

+
    +
  • + The OpenID client "linkback" URL has changed from + + .../module.php/openid/consumer.php + + to + + .../module.php/openid/linkback.php + + . +
    • +
  • + Support for CA path validation has been removed from SAML 2.0. +
    • +
  • + The X-Frame-Options has been added to the default templates, to prevent the pages from being loaded in iframes. +
    • +
  • + Access permissions of generated files are now restricted to the current user. +
    • +
  • + The code to set cookies now requires PHP version >= 5.2. (PHP version 5.2.0 or newer has been the only supported version for a while, but it has in some cases been possible to run SimpleSAMLphp with older versions.) +
    • +
  • + It used to be possible to set an array of endpoints for the SingleSignOnService in + + saml20-idp-hosted.php + + . That is no longer supported. +
    • +
  • + The + + aselect + + module has been replaced with a new module. The new module gives us better error handling and support for request signing, but we lose support for A-Select Cross. +
    • +
  • + There has been various fixes in the session expiration handling. As a result of this, sessions may get a shorter lifetime (if the IdP places a limit on the lifetime, this limit will now be honored). +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-2.0.html b/2.1/simplesamlphp-upgrade-notes-2.0.html new file mode 100644 index 0000000..6c2c396 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-2.0.html @@ -0,0 +1,648 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 2.0 +

+

+ SimpleSAMLphp 2.0 is a major new release which has cleaned up support for a +lot of things that have been marked deprecated in previous SimpleSAMLphp +releases. The following changes are relevant for installers and/or developers. +

+

+ Software requirements +

+
    +
  • + The minimum PHP version required is now PHP 7.4. +
    • +
  • + Dropped support for Symfony 4 and Twig 2. +
    • +
+

+ Not all modules included by default +

+

+ The set of modules included in the base installation has been reduced. +If you used some of the modules that were shipped with SimpleSAMLphp, you now have to manually install them using Composer. +For example, to use the LDAP module: +

+
+ 
composer require simplesamlphp/simplesamlphp-module-ldap --update-no-dev
+
+
+

+ Functional changes +

+
    +
  • + Modules must be enabled through the + + module.enable + + option in + + config.php + + . Modules can no longer be enabled by having + a file named + + enable + + or + + default-enable + + in the module's root directory. +
    • +
  • + The base URL of the SimpleSAMLphp installation no longer provides an admin menu. Instead this is now at the location + + <simpleSAMLphp base URL>/admin + + . The + + admin + + module needs to be enabled for this to work. +
    • +
  • + SAML AuthnRequests that are signed will have their signature validated unless specifically disabled + by setting + + validate.authnrequest + + to + + false + + . If unset (or set to + + true + + ) signatures will be + validated if present and requests not passing validation will be refused. +
    • +
  • + The default value for attrname-format was changed to 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'. +
    • +
  • + In the core:TargetedID authproc-filter, the + + attributename + + setting has been renamed to + + identifyingAttribute + + . + Similarly, in the saml:AttributeNameID, saml:PersistentNameID and saml:SQLPersistentNameId authproc-filters, the + + attribute + + setting has been renamed to + + identifyingAttribute + + for consistency with other NameID filters. +
    • +
  • + The default encryption algorithm is set from + + AES128_CBC + + to + + AES128_GCM + + . + It is possible to switch back via the + + sharedkey_algorithm + + . + Note however that CBC is vulnerable to the Padding oracle attack. +
    • +
  • + All support for the Shibboleth 1.3 / SAML 1.1 protocol has been removed. +
    • +
  • + Sessions are no longer backwards compatible with previous versions. Make sure to clear your session cache during + the upgrade process. How to do this depends on your session backend. +
    • +
  • + EntityIDs are no longer auto-generated. Make sure to set something sensible in the array-keys in + + metadata/saml20-idp-hosted.php + + and for any saml:SP in + + config/authsources.php + + (or to the existing entityIDs when + upgrading an existing installation). + If you are using a database to store metadata, make sure to replace any + + __DYNAMIC:<n>__ + + entityID's with + a real value manually. Dynamic records are no longer loaded from the database. +
    • +
+

+ Configuration changes +

+

+ Our assets have been moved from the + + www + + to the + + public + + directory. You will have to update your webserver to reflect this change. +

+

+ Quite some options have been changed or removed. We recommend to start with a fresh +template from + + config/config.php.dist + + and migrate the settings you require to the new +config file manually. +

+

+ The date formatting when specifying a custom logging string has been changed from PHP's +deprecated + + strftime() + + format to PHP's + + date() + + format. +

+

+ The format of the + + NameIDPolicy + + option has been changed: to omit sending the +element entirely, you can no longer specify + + false + + but need to set it to +an empty array ( + + [] + + ). +

+

+ Configuration options that have been removed: +

+
    +
  • + + simplesaml.nameidattribute + + . Use the appropriate authproc-filters instead. +
    • +
  • + + languages[priorities] + + . No replacement. +
    • +
  • + + attributes.extradictionaries + + . Add an attributes.po to your configured theme instead. +
    • +
  • + + admin.protectindexpage + + . Replaced by the admin module which always requires login. +
    • +
  • + + base64attributes + + . Obsolete functionality, individual attributes can still be en/decoded + with the existing attributeencodings feature. +
    • +
  • + + database.slaves + + . This is now called + + database.secondaries + + . +
    • +
  • + + metadata.handler + + . Since a long time the preferred option is + + metadata.sources + + . +
    • +
+

+ Changes relevant for (module) developers +

+

+ The following changes are relevant for those having custom developed modules, authentication +processing filters, themes, or that interface with the SimpleSAMLphp development API. +

+
    +
  • + We expect your source files to exist in the + + src/ + + directory within your module. This used to be the + + lib/ + + directory, so you have to rename the directory and for composer-modules you have to update + your + + composer.json + + file (specifically the + + psr-0 + + and + + psr-4 + + entries if you have them). +
    • +
  • + We expect your module assets to exist in the + + public/ + + directory within your module (was: + + www/ + + ). +
    • +
  • + Old JSON-formatted dictionaries have been replaced by gettext / .po-files; see + + migration guide + +
    • +
  • + Old PHP templates have been replaced by Twig-templates; see + + migration guide + +
    • +
  • + The source was completely typehinted; if you have custom authsources or authproc filters, + make sure you change them to reflect the method signatures of the base classes. +
    • +
  • + Some hooks are no longer called: +
      +
    • + + frontpage + + : replace with + + configpage + +
      • +
    • + + htmlinject + + : use a Twig template override instead. +
      • +
    • + + metadata_hosted + + : no replacement +
      • +
    +
    • +
  • +

    + The following classes have been migrated to non-static: +

    +
      +
    • + + \SimpleSAML\Utils\Arrays + +
      • +
    • + + \SimpleSAML\Utils\Attributes + +
      • +
    • + + \SimpleSAML\Utils\Auth + +
      • +
    • + + \SimpleSAML\Utils\Config + +
      • +
    • + + \SimpleSAML\Utils\Crypto + +
      • +
    • + + \SimpleSAML\Utils\EMail + +
      • +
    • + + \SimpleSAML\Utils\HTTP + +
      • +
    • + + \SimpleSAML\Utils\Net + +
      • +
    • + + \SimpleSAML\Utils\Random + +
      • +
    • + + \SimpleSAML\Utils\System + +
      • +
    • + + \SimpleSAML\Utils\Time + +
      • +
    • + + \SimpleSAML\Utils\XML + +
      • +
    +

    + If you use any of these classes in your modules or themes, you will now have to instantiate them so that: +

    +
    • +
+
+ 
// Old style
+$x = \SimpleSAML\Utils\Arrays::arrayize($someVar)
+
+
+
+ 
becomes:
+
+
+
+ 
  // New style
+  $arrayUtils = new \SimpleSAML\Utils\Arrays();
+  $x = $arrayUtils->arrayize($someVar);
+
+
+
    +
  • +

    + Database table schemes have been flattened. Upgrade paths are: +

    +
      +
    • + Generic KVStore: 1.16+ > 2.0 +
      • +
    • + Logout store: 1.18+ > 2.0 +
      • +
    +
    • +
  • +

    + Data stores have been refactored: +

    +
      +
    • + + lib/SimpleSAML/Store.php + + has been renamed to + + lib/SimpleSAML/Store/StoreFactory.php + + and is now solely a Factory-class +
      • +
    • + All store implementations now implement + + \SimpleSAML\Store\StoreInterface + + : +
        +
      • + + lib/SimpleSAML/Store/SQL.php + + has been renamed to + + lib/SimpleSAML/Store/SQLStore.php + +
        • +
      • + + lib/SimpleSAML/Store/Memcache.php + + has been renamed to + + lib/SimpleSAML/Store/MemcacheStore.php + +
        • +
      • + + lib/SimpleSAML/Store/Redis.php + + has been renamed to + + lib/SimpleSAML/Store/RedisStore.php + +
        • +
      +
      • +
    +
    • +
  • +

    + The following methods have had their signature changed: +

    +
      +
    • + + Configuration::getValue + +
      • +
    • + + Configuration::getBoolean + +
      • +
    • + + Configuration::getString + +
      • +
    • + + Configuration::getInteger + +
      • +
    • + + Configuration::getIntegerRange + +
      • +
    • + + Configuration::getValueValidate + +
      • +
    • + + Configuration::getArray + +
      • +
    • + + Configuration::getArrayize + +
      • +
    • + + Configuration::getArrayizeString + +
      • +
    • + + Configuration::getConfigItem + +
      • +
    • + + Configuration::getLocalizedString + +
      • +
    +

    + All of these methods no longer accept a default as their last parameter. Use their getOptional* counterparts instead. +

    +
    • +
+
+ diff --git a/2.1/simplesamlphp-upgrade-notes-2.1.html b/2.1/simplesamlphp-upgrade-notes-2.1.html new file mode 100644 index 0000000..d8b9036 --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes-2.1.html @@ -0,0 +1,114 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ Upgrade notes for SimpleSAMLphp 2.1 +

+

+ SimpleSAMLphp 2.1 is a minor new release which bumps some +of the minimum requirements to be able to run SimpleSAMLphp. +The following changes are relevant for installers and/or developers. +

+

+ Software requirements +

+
    +
  • + The minimum PHP version required is now PHP 8.0. +
    • +
  • + Dropped support for Symfony 5.4. +
    • +
+

+ Two builds +

+

+ As of SimpleSAMLphp 2.1 two builds are created for every release. +The 'slim' build is a lightweight build without any modules other than the core modules installed (alike the 2.0 build). +A new 'full' build is added that will come with the most used modules pre-installed. +

+
+ diff --git a/2.1/simplesamlphp-upgrade-notes.html b/2.1/simplesamlphp-upgrade-notes.html new file mode 100644 index 0000000..89bde5b --- /dev/null +++ b/2.1/simplesamlphp-upgrade-notes.html @@ -0,0 +1,178 @@ + + + + + + + + + + + SimpleSAMLphp Documentation + + + + + +
+ + + +
+
+
+

+ SimpeSAMLphp Upgrade Notes +

+

+ See the following pages for important information for users upgrading +from older versions of SimpleSAMLphp: +

+ +

+ A detailed list of changes in each release can be found in the + + Changelog + + . +

+
+ diff --git a/contrib_modules/adfs/adfs.html b/contrib_modules/adfs/adfs.html index b905173..acab763 100644 --- a/contrib_modules/adfs/adfs.html +++ b/contrib_modules/adfs/adfs.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/authX509/authX509.html b/contrib_modules/authX509/authX509.html index 3f90b25..a1af1b0 100644 --- a/contrib_modules/authX509/authX509.html +++ b/contrib_modules/authX509/authX509.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/authcrypt/authcrypt.html b/contrib_modules/authcrypt/authcrypt.html index 24070de..6f600a6 100644 --- a/contrib_modules/authcrypt/authcrypt.html +++ b/contrib_modules/authcrypt/authcrypt.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/authorize/authorize.html b/contrib_modules/authorize/authorize.html index 525b8d6..7b33b9f 100644 --- a/contrib_modules/authorize/authorize.html +++ b/contrib_modules/authorize/authorize.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/authtwitter/oauthtwitter.html b/contrib_modules/authtwitter/oauthtwitter.html index 216e175..aaf4d7f 100644 --- a/contrib_modules/authtwitter/oauthtwitter.html +++ b/contrib_modules/authtwitter/oauthtwitter.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/cas/cas.html b/contrib_modules/cas/cas.html index f9110e5..93d6490 100644 --- a/contrib_modules/cas/cas.html +++ b/contrib_modules/cas/cas.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/casserver/ChangeLog.html b/contrib_modules/casserver/ChangeLog.html index 2f0f8f1..6cdf794 100644 --- a/contrib_modules/casserver/ChangeLog.html +++ b/contrib_modules/casserver/ChangeLog.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/consent/consent.html b/contrib_modules/consent/consent.html index 91f35fc..8a61ecc 100644 --- a/contrib_modules/consent/consent.html +++ b/contrib_modules/consent/consent.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/consentadmin/consentAdmin.html b/contrib_modules/consentadmin/consentAdmin.html index ae21a6b..01779b0 100644 --- a/contrib_modules/consentadmin/consentAdmin.html +++ b/contrib_modules/consentadmin/consentAdmin.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/discopower/discopower.html b/contrib_modules/discopower/discopower.html index 3881c0c..1ee8d0a 100644 --- a/contrib_modules/discopower/discopower.html +++ b/contrib_modules/discopower/discopower.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/expirycheck/expirycheck.html b/contrib_modules/expirycheck/expirycheck.html index ff79573..5ecfd6a 100644 --- a/contrib_modules/expirycheck/expirycheck.html +++ b/contrib_modules/expirycheck/expirycheck.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/fticks/authproc_fticks.html b/contrib_modules/fticks/authproc_fticks.html index fadf467..9786895 100644 --- a/contrib_modules/fticks/authproc_fticks.html +++ b/contrib_modules/fticks/authproc_fticks.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/ldap/ldap.html b/contrib_modules/ldap/ldap.html index 1ae2556..17d4582 100644 --- a/contrib_modules/ldap/ldap.html +++ b/contrib_modules/ldap/ldap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html b/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html index 56e4ef9..02088f0 100644 --- a/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html +++ b/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/negotiate/negotiate.html b/contrib_modules/negotiate/negotiate.html index e76d0d1..310468d 100644 --- a/contrib_modules/negotiate/negotiate.html +++ b/contrib_modules/negotiate/negotiate.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/negotiateext/negotiateext.html b/contrib_modules/negotiateext/negotiateext.html index 287c8f6..01a43e9 100644 --- a/contrib_modules/negotiateext/negotiateext.html +++ b/contrib_modules/negotiateext/negotiateext.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/radius/radius.html b/contrib_modules/radius/radius.html index 8c9aadc..769fc54 100644 --- a/contrib_modules/radius/radius.html +++ b/contrib_modules/radius/radius.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/smartattributes/smartattributes.html b/contrib_modules/smartattributes/smartattributes.html index 2cc9175..c4fd583 100644 --- a/contrib_modules/smartattributes/smartattributes.html +++ b/contrib_modules/smartattributes/smartattributes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/sqlauth/sql.html b/contrib_modules/sqlauth/sql.html index 2dd5c2d..1d6881a 100644 --- a/contrib_modules/sqlauth/sql.html +++ b/contrib_modules/sqlauth/sql.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/statistics/statistics.html b/contrib_modules/statistics/statistics.html index 518cdad..b608aa0 100644 --- a/contrib_modules/statistics/statistics.html +++ b/contrib_modules/statistics/statistics.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contrib_modules/webauthn/tested_tokens.html b/contrib_modules/webauthn/tested_tokens.html index c7defd6..6117edf 100644 --- a/contrib_modules/webauthn/tested_tokens.html +++ b/contrib_modules/webauthn/tested_tokens.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/contributed_modules.html b/contributed_modules.html index df470ec..1b1875d 100644 --- a/contributed_modules.html +++ b/contributed_modules.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributeadd.html b/devel/core/authproc_attributeadd.html index 5a9205f..f2e5a90 100644 --- a/devel/core/authproc_attributeadd.html +++ b/devel/core/authproc_attributeadd.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributealter.html b/devel/core/authproc_attributealter.html index 83ffa26..ce3eeb4 100644 --- a/devel/core/authproc_attributealter.html +++ b/devel/core/authproc_attributealter.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributecopy.html b/devel/core/authproc_attributecopy.html index fc74935..a3a4eda 100644 --- a/devel/core/authproc_attributecopy.html +++ b/devel/core/authproc_attributecopy.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributelimit.html b/devel/core/authproc_attributelimit.html index 4475a34..2661c10 100644 --- a/devel/core/authproc_attributelimit.html +++ b/devel/core/authproc_attributelimit.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributemap.html b/devel/core/authproc_attributemap.html index 0b3a7ed..6eb3d59 100644 --- a/devel/core/authproc_attributemap.html +++ b/devel/core/authproc_attributemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_attributevaluemap.html b/devel/core/authproc_attributevaluemap.html index 9c5497a..827e516 100644 --- a/devel/core/authproc_attributevaluemap.html +++ b/devel/core/authproc_attributevaluemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_cardinality.html b/devel/core/authproc_cardinality.html index aba5443..1f8e9da 100644 --- a/devel/core/authproc_cardinality.html +++ b/devel/core/authproc_cardinality.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_cardinalitysingle.html b/devel/core/authproc_cardinalitysingle.html index 7756aff..f326684 100644 --- a/devel/core/authproc_cardinalitysingle.html +++ b/devel/core/authproc_cardinalitysingle.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_generategroups.html b/devel/core/authproc_generategroups.html index 88c28aa..1f5b678 100644 --- a/devel/core/authproc_generategroups.html +++ b/devel/core/authproc_generategroups.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_languageadaptor.html b/devel/core/authproc_languageadaptor.html index 259cd27..7213b31 100644 --- a/devel/core/authproc_languageadaptor.html +++ b/devel/core/authproc_languageadaptor.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_php.html b/devel/core/authproc_php.html index 6cce4de..ee267c4 100644 --- a/devel/core/authproc_php.html +++ b/devel/core/authproc_php.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_scopeattribute.html b/devel/core/authproc_scopeattribute.html index d4f66bf..ff69bf4 100644 --- a/devel/core/authproc_scopeattribute.html +++ b/devel/core/authproc_scopeattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_scopefromattribute.html b/devel/core/authproc_scopefromattribute.html index e1ca367..ce43a44 100644 --- a/devel/core/authproc_scopefromattribute.html +++ b/devel/core/authproc_scopefromattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_statisticswithattribute.html b/devel/core/authproc_statisticswithattribute.html index d6ee544..efd07ff 100644 --- a/devel/core/authproc_statisticswithattribute.html +++ b/devel/core/authproc_statisticswithattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_targetedid.html b/devel/core/authproc_targetedid.html index d02cefd..1de413d 100644 --- a/devel/core/authproc_targetedid.html +++ b/devel/core/authproc_targetedid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authproc_warnshortssointerval.html b/devel/core/authproc_warnshortssointerval.html index 1c36cd4..e037144 100644 --- a/devel/core/authproc_warnshortssointerval.html +++ b/devel/core/authproc_warnshortssointerval.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/core/authsource_selector.html b/devel/core/authsource_selector.html index f80d196..9acfea8 100644 --- a/devel/core/authsource_selector.html +++ b/devel/core/authsource_selector.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/cron/cron.html b/devel/cron/cron.html index 212d9a0..d8e514f 100644 --- a/devel/cron/cron.html +++ b/devel/cron/cron.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/index.html b/devel/index.html index d0fdecf..6eaebe4 100644 --- a/devel/index.html +++ b/devel/index.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/multiauth/multiauth.html b/devel/multiauth/multiauth.html index d23cb9b..00220da 100644 --- a/devel/multiauth/multiauth.html +++ b/devel/multiauth/multiauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/authproc_authncontextclassref.html b/devel/saml/authproc_authncontextclassref.html index cb9789c..9e9bcd8 100644 --- a/devel/saml/authproc_authncontextclassref.html +++ b/devel/saml/authproc_authncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/authproc_expectedauthncontextclassref.html b/devel/saml/authproc_expectedauthncontextclassref.html index 0e9e53a..6a7f643 100644 --- a/devel/saml/authproc_expectedauthncontextclassref.html +++ b/devel/saml/authproc_expectedauthncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/authproc_pairwiseid.html b/devel/saml/authproc_pairwiseid.html index 5de060f..a917e2f 100644 --- a/devel/saml/authproc_pairwiseid.html +++ b/devel/saml/authproc_pairwiseid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/authproc_subjectid.html b/devel/saml/authproc_subjectid.html index 21dd6cb..336baba 100644 --- a/devel/saml/authproc_subjectid.html +++ b/devel/saml/authproc_subjectid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/filterscopes.html b/devel/saml/filterscopes.html index fdbfcc0..dcf375b 100644 --- a/devel/saml/filterscopes.html +++ b/devel/saml/filterscopes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/keyrollover.html b/devel/saml/keyrollover.html index c6f2983..0241bfe 100644 --- a/devel/saml/keyrollover.html +++ b/devel/saml/keyrollover.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/nameid.html b/devel/saml/nameid.html index 7fec72c..b41688c 100644 --- a/devel/saml/nameid.html +++ b/devel/saml/nameid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/nameidattribute.html b/devel/saml/nameidattribute.html index 4ed10f3..0a764b3 100644 --- a/devel/saml/nameidattribute.html +++ b/devel/saml/nameidattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/saml/sp.html b/devel/saml/sp.html index 4090dd9..3493be0 100644 --- a/devel/saml/sp.html +++ b/devel/saml/sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-advancedfeatures.html b/devel/simplesamlphp-advancedfeatures.html index 7ea8e02..14313b0 100644 --- a/devel/simplesamlphp-advancedfeatures.html +++ b/devel/simplesamlphp-advancedfeatures.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-artifact-idp.html b/devel/simplesamlphp-artifact-idp.html index 9fd88fe..badca85 100644 --- a/devel/simplesamlphp-artifact-idp.html +++ b/devel/simplesamlphp-artifact-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-artifact-sp.html b/devel/simplesamlphp-artifact-sp.html index b9b1e6f..65abf19 100644 --- a/devel/simplesamlphp-artifact-sp.html +++ b/devel/simplesamlphp-artifact-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-authproc.html b/devel/simplesamlphp-authproc.html index b0577b7..0ac0906 100644 --- a/devel/simplesamlphp-authproc.html +++ b/devel/simplesamlphp-authproc.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-authsource.html b/devel/simplesamlphp-authsource.html index 6fd7ebe..58ea6df 100644 --- a/devel/simplesamlphp-authsource.html +++ b/devel/simplesamlphp-authsource.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-changelog-1.x.html b/devel/simplesamlphp-changelog-1.x.html index 01d601e..90188f0 100644 --- a/devel/simplesamlphp-changelog-1.x.html +++ b/devel/simplesamlphp-changelog-1.x.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-changelog.html b/devel/simplesamlphp-changelog.html index 46b9f87..7844850 100644 --- a/devel/simplesamlphp-changelog.html +++ b/devel/simplesamlphp-changelog.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-customauth.html b/devel/simplesamlphp-customauth.html index 2a47943..603ed8b 100644 --- a/devel/simplesamlphp-customauth.html +++ b/devel/simplesamlphp-customauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-database.html b/devel/simplesamlphp-database.html index 5ab3be3..78800c8 100644 --- a/devel/simplesamlphp-database.html +++ b/devel/simplesamlphp-database.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-ecp-idp.html b/devel/simplesamlphp-ecp-idp.html index fc6f96e..c7c4435 100644 --- a/devel/simplesamlphp-ecp-idp.html +++ b/devel/simplesamlphp-ecp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-errorhandling.html b/devel/simplesamlphp-errorhandling.html index b1a458c..f11b114 100644 --- a/devel/simplesamlphp-errorhandling.html +++ b/devel/simplesamlphp-errorhandling.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-googleapps.html b/devel/simplesamlphp-googleapps.html index bb77491..72ae2cf 100644 --- a/devel/simplesamlphp-googleapps.html +++ b/devel/simplesamlphp-googleapps.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-hok-idp.html b/devel/simplesamlphp-hok-idp.html index 1ef1ac4..1fc0186 100644 --- a/devel/simplesamlphp-hok-idp.html +++ b/devel/simplesamlphp-hok-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-hok-sp.html b/devel/simplesamlphp-hok-sp.html index b4ea337..64fab6d 100644 --- a/devel/simplesamlphp-hok-sp.html +++ b/devel/simplesamlphp-hok-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-idp-more.html b/devel/simplesamlphp-idp-more.html index d0b4d4c..f8bab0b 100644 --- a/devel/simplesamlphp-idp-more.html +++ b/devel/simplesamlphp-idp-more.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-idp.html b/devel/simplesamlphp-idp.html index 8ef721c..9b67afc 100644 --- a/devel/simplesamlphp-idp.html +++ b/devel/simplesamlphp-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-install-repo.html b/devel/simplesamlphp-install-repo.html index c0fa57b..1298234 100644 --- a/devel/simplesamlphp-install-repo.html +++ b/devel/simplesamlphp-install-repo.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-install.html b/devel/simplesamlphp-install.html index 1d2d018..77bbbc2 100644 --- a/devel/simplesamlphp-install.html +++ b/devel/simplesamlphp-install.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-maintenance.html b/devel/simplesamlphp-maintenance.html index dabaaf0..48d4e3b 100644 --- a/devel/simplesamlphp-maintenance.html +++ b/devel/simplesamlphp-maintenance.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-metadata-endpoints.html b/devel/simplesamlphp-metadata-endpoints.html index eaa5e1a..64ef497 100644 --- a/devel/simplesamlphp-metadata-endpoints.html +++ b/devel/simplesamlphp-metadata-endpoints.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-metadata-extensions-attributes.html b/devel/simplesamlphp-metadata-extensions-attributes.html index e5c0f22..74c3fa7 100644 --- a/devel/simplesamlphp-metadata-extensions-attributes.html +++ b/devel/simplesamlphp-metadata-extensions-attributes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-metadata-extensions-rpi.html b/devel/simplesamlphp-metadata-extensions-rpi.html index 9013064..63d1636 100644 --- a/devel/simplesamlphp-metadata-extensions-rpi.html +++ b/devel/simplesamlphp-metadata-extensions-rpi.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-metadata-extensions-ui.html b/devel/simplesamlphp-metadata-extensions-ui.html index 02481cc..7a2d16d 100644 --- a/devel/simplesamlphp-metadata-extensions-ui.html +++ b/devel/simplesamlphp-metadata-extensions-ui.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-metadata-pdostoragehandler.html b/devel/simplesamlphp-metadata-pdostoragehandler.html index 87182ed..21b73b1 100644 --- a/devel/simplesamlphp-metadata-pdostoragehandler.html +++ b/devel/simplesamlphp-metadata-pdostoragehandler.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-modules.html b/devel/simplesamlphp-modules.html index b694b61..ca10bf2 100644 --- a/devel/simplesamlphp-modules.html +++ b/devel/simplesamlphp-modules.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-nostate.html b/devel/simplesamlphp-nostate.html index 7e893ef..0669ba7 100644 --- a/devel/simplesamlphp-nostate.html +++ b/devel/simplesamlphp-nostate.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-reference-idp-hosted.html b/devel/simplesamlphp-reference-idp-hosted.html index ec9bf26..a3e1d0f 100644 --- a/devel/simplesamlphp-reference-idp-hosted.html +++ b/devel/simplesamlphp-reference-idp-hosted.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-reference-idp-remote.html b/devel/simplesamlphp-reference-idp-remote.html index ab04f9b..0d7574d 100644 --- a/devel/simplesamlphp-reference-idp-remote.html +++ b/devel/simplesamlphp-reference-idp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-reference-sp-remote.html b/devel/simplesamlphp-reference-sp-remote.html index 3124a01..ef718a4 100644 --- a/devel/simplesamlphp-reference-sp-remote.html +++ b/devel/simplesamlphp-reference-sp-remote.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-scoping.html b/devel/simplesamlphp-scoping.html index 55c4d39..fdc4a96 100644 --- a/devel/simplesamlphp-scoping.html +++ b/devel/simplesamlphp-scoping.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-sp-api.html b/devel/simplesamlphp-sp-api.html index 38cf81d..b507554 100644 --- a/devel/simplesamlphp-sp-api.html +++ b/devel/simplesamlphp-sp-api.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-sp.html b/devel/simplesamlphp-sp.html index f04e830..d00c67b 100644 --- a/devel/simplesamlphp-sp.html +++ b/devel/simplesamlphp-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-theming.html b/devel/simplesamlphp-theming.html index 34f8e5f..1a7549b 100644 --- a/devel/simplesamlphp-theming.html +++ b/devel/simplesamlphp-theming.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-translation.html b/devel/simplesamlphp-translation.html index 197cb78..ba1c793 100644 --- a/devel/simplesamlphp-translation.html +++ b/devel/simplesamlphp-translation.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.10.html b/devel/simplesamlphp-upgrade-notes-1.10.html index 316d934..f4a3217 100644 --- a/devel/simplesamlphp-upgrade-notes-1.10.html +++ b/devel/simplesamlphp-upgrade-notes-1.10.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.11.html b/devel/simplesamlphp-upgrade-notes-1.11.html index 9ec0fbc..5b3b8b7 100644 --- a/devel/simplesamlphp-upgrade-notes-1.11.html +++ b/devel/simplesamlphp-upgrade-notes-1.11.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.12.html b/devel/simplesamlphp-upgrade-notes-1.12.html index f7f417e..4c7dddc 100644 --- a/devel/simplesamlphp-upgrade-notes-1.12.html +++ b/devel/simplesamlphp-upgrade-notes-1.12.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.13.html b/devel/simplesamlphp-upgrade-notes-1.13.html index 2df27b7..3c71d51 100644 --- a/devel/simplesamlphp-upgrade-notes-1.13.html +++ b/devel/simplesamlphp-upgrade-notes-1.13.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.14.html b/devel/simplesamlphp-upgrade-notes-1.14.html index 87e27d6..88f7334 100644 --- a/devel/simplesamlphp-upgrade-notes-1.14.html +++ b/devel/simplesamlphp-upgrade-notes-1.14.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.15.html b/devel/simplesamlphp-upgrade-notes-1.15.html index 75ef91f..ba6a1e3 100644 --- a/devel/simplesamlphp-upgrade-notes-1.15.html +++ b/devel/simplesamlphp-upgrade-notes-1.15.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.16.html b/devel/simplesamlphp-upgrade-notes-1.16.html index 83409fe..1070e03 100644 --- a/devel/simplesamlphp-upgrade-notes-1.16.html +++ b/devel/simplesamlphp-upgrade-notes-1.16.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.17.html b/devel/simplesamlphp-upgrade-notes-1.17.html index a78c8dc..99a1803 100644 --- a/devel/simplesamlphp-upgrade-notes-1.17.html +++ b/devel/simplesamlphp-upgrade-notes-1.17.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.18.html b/devel/simplesamlphp-upgrade-notes-1.18.html index b5cb729..616046f 100644 --- a/devel/simplesamlphp-upgrade-notes-1.18.html +++ b/devel/simplesamlphp-upgrade-notes-1.18.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.19.html b/devel/simplesamlphp-upgrade-notes-1.19.html index e1765b3..e319476 100644 --- a/devel/simplesamlphp-upgrade-notes-1.19.html +++ b/devel/simplesamlphp-upgrade-notes-1.19.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.5.html b/devel/simplesamlphp-upgrade-notes-1.5.html index 2b1b58d..bfae196 100644 --- a/devel/simplesamlphp-upgrade-notes-1.5.html +++ b/devel/simplesamlphp-upgrade-notes-1.5.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.6.html b/devel/simplesamlphp-upgrade-notes-1.6.html index 94674a8..6a55315 100644 --- a/devel/simplesamlphp-upgrade-notes-1.6.html +++ b/devel/simplesamlphp-upgrade-notes-1.6.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.7.html b/devel/simplesamlphp-upgrade-notes-1.7.html index 0b60a61..5ed2be8 100644 --- a/devel/simplesamlphp-upgrade-notes-1.7.html +++ b/devel/simplesamlphp-upgrade-notes-1.7.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.8.html b/devel/simplesamlphp-upgrade-notes-1.8.html index 6188e26..a29f51e 100644 --- a/devel/simplesamlphp-upgrade-notes-1.8.html +++ b/devel/simplesamlphp-upgrade-notes-1.8.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-1.9.html b/devel/simplesamlphp-upgrade-notes-1.9.html index 6301080..0982f7e 100644 --- a/devel/simplesamlphp-upgrade-notes-1.9.html +++ b/devel/simplesamlphp-upgrade-notes-1.9.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes-2.0.html b/devel/simplesamlphp-upgrade-notes-2.0.html index e0fc628..6c2c396 100644 --- a/devel/simplesamlphp-upgrade-notes-2.0.html +++ b/devel/simplesamlphp-upgrade-notes-2.0.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/devel/simplesamlphp-upgrade-notes.html b/devel/simplesamlphp-upgrade-notes.html index 6517a36..89bde5b 100644 --- a/devel/simplesamlphp-upgrade-notes.html +++ b/devel/simplesamlphp-upgrade-notes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributeadd.html b/stable/core/authproc_attributeadd.html index 5a9205f..f2e5a90 100644 --- a/stable/core/authproc_attributeadd.html +++ b/stable/core/authproc_attributeadd.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributealter.html b/stable/core/authproc_attributealter.html index 83ffa26..ce3eeb4 100644 --- a/stable/core/authproc_attributealter.html +++ b/stable/core/authproc_attributealter.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributecopy.html b/stable/core/authproc_attributecopy.html index fc74935..a3a4eda 100644 --- a/stable/core/authproc_attributecopy.html +++ b/stable/core/authproc_attributecopy.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributelimit.html b/stable/core/authproc_attributelimit.html index 4475a34..2661c10 100644 --- a/stable/core/authproc_attributelimit.html +++ b/stable/core/authproc_attributelimit.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributemap.html b/stable/core/authproc_attributemap.html index 0b3a7ed..6eb3d59 100644 --- a/stable/core/authproc_attributemap.html +++ b/stable/core/authproc_attributemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_attributevaluemap.html b/stable/core/authproc_attributevaluemap.html index 9c5497a..827e516 100644 --- a/stable/core/authproc_attributevaluemap.html +++ b/stable/core/authproc_attributevaluemap.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_cardinality.html b/stable/core/authproc_cardinality.html index aba5443..1f8e9da 100644 --- a/stable/core/authproc_cardinality.html +++ b/stable/core/authproc_cardinality.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_cardinalitysingle.html b/stable/core/authproc_cardinalitysingle.html index 7756aff..f326684 100644 --- a/stable/core/authproc_cardinalitysingle.html +++ b/stable/core/authproc_cardinalitysingle.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_generategroups.html b/stable/core/authproc_generategroups.html index 88c28aa..1f5b678 100644 --- a/stable/core/authproc_generategroups.html +++ b/stable/core/authproc_generategroups.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_languageadaptor.html b/stable/core/authproc_languageadaptor.html index 259cd27..7213b31 100644 --- a/stable/core/authproc_languageadaptor.html +++ b/stable/core/authproc_languageadaptor.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_php.html b/stable/core/authproc_php.html index 6cce4de..ee267c4 100644 --- a/stable/core/authproc_php.html +++ b/stable/core/authproc_php.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_scopeattribute.html b/stable/core/authproc_scopeattribute.html index d4f66bf..ff69bf4 100644 --- a/stable/core/authproc_scopeattribute.html +++ b/stable/core/authproc_scopeattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_scopefromattribute.html b/stable/core/authproc_scopefromattribute.html index e1ca367..ce43a44 100644 --- a/stable/core/authproc_scopefromattribute.html +++ b/stable/core/authproc_scopefromattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_statisticswithattribute.html b/stable/core/authproc_statisticswithattribute.html index d6ee544..efd07ff 100644 --- a/stable/core/authproc_statisticswithattribute.html +++ b/stable/core/authproc_statisticswithattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_targetedid.html b/stable/core/authproc_targetedid.html index d02cefd..1de413d 100644 --- a/stable/core/authproc_targetedid.html +++ b/stable/core/authproc_targetedid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authproc_warnshortssointerval.html b/stable/core/authproc_warnshortssointerval.html index 1c36cd4..e037144 100644 --- a/stable/core/authproc_warnshortssointerval.html +++ b/stable/core/authproc_warnshortssointerval.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/core/authsource_selector.html b/stable/core/authsource_selector.html index f80d196..9acfea8 100644 --- a/stable/core/authsource_selector.html +++ b/stable/core/authsource_selector.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/cron/cron.html b/stable/cron/cron.html index 212d9a0..d8e514f 100644 --- a/stable/cron/cron.html +++ b/stable/cron/cron.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/index.html b/stable/index.html index d0fdecf..6eaebe4 100644 --- a/stable/index.html +++ b/stable/index.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/multiauth/multiauth.html b/stable/multiauth/multiauth.html index d23cb9b..00220da 100644 --- a/stable/multiauth/multiauth.html +++ b/stable/multiauth/multiauth.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/authproc_authncontextclassref.html b/stable/saml/authproc_authncontextclassref.html index cb9789c..9e9bcd8 100644 --- a/stable/saml/authproc_authncontextclassref.html +++ b/stable/saml/authproc_authncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/authproc_expectedauthncontextclassref.html b/stable/saml/authproc_expectedauthncontextclassref.html index 0e9e53a..6a7f643 100644 --- a/stable/saml/authproc_expectedauthncontextclassref.html +++ b/stable/saml/authproc_expectedauthncontextclassref.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/authproc_pairwiseid.html b/stable/saml/authproc_pairwiseid.html index 5de060f..a917e2f 100644 --- a/stable/saml/authproc_pairwiseid.html +++ b/stable/saml/authproc_pairwiseid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/authproc_subjectid.html b/stable/saml/authproc_subjectid.html index 21dd6cb..336baba 100644 --- a/stable/saml/authproc_subjectid.html +++ b/stable/saml/authproc_subjectid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/filterscopes.html b/stable/saml/filterscopes.html index fdbfcc0..dcf375b 100644 --- a/stable/saml/filterscopes.html +++ b/stable/saml/filterscopes.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/keyrollover.html b/stable/saml/keyrollover.html index c6f2983..0241bfe 100644 --- a/stable/saml/keyrollover.html +++ b/stable/saml/keyrollover.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/nameid.html b/stable/saml/nameid.html index 7fec72c..b41688c 100644 --- a/stable/saml/nameid.html +++ b/stable/saml/nameid.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/nameidattribute.html b/stable/saml/nameidattribute.html index 4ed10f3..0a764b3 100644 --- a/stable/saml/nameidattribute.html +++ b/stable/saml/nameidattribute.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/saml/sp.html b/stable/saml/sp.html index 37bfb34..e1305f3 100644 --- a/stable/saml/sp.html +++ b/stable/saml/sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/simplesamlphp-advancedfeatures.html b/stable/simplesamlphp-advancedfeatures.html index 7ea8e02..14313b0 100644 --- a/stable/simplesamlphp-advancedfeatures.html +++ b/stable/simplesamlphp-advancedfeatures.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/simplesamlphp-artifact-idp.html b/stable/simplesamlphp-artifact-idp.html index 9fd88fe..badca85 100644 --- a/stable/simplesamlphp-artifact-idp.html +++ b/stable/simplesamlphp-artifact-idp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/simplesamlphp-artifact-sp.html b/stable/simplesamlphp-artifact-sp.html index b9b1e6f..65abf19 100644 --- a/stable/simplesamlphp-artifact-sp.html +++ b/stable/simplesamlphp-artifact-sp.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
diff --git a/stable/simplesamlphp-authproc.html b/stable/simplesamlphp-authproc.html index b1b02f1..c0e7ffc 100644 --- a/stable/simplesamlphp-authproc.html +++ b/stable/simplesamlphp-authproc.html @@ -50,9 +50,14 @@ » Documentation

+
+ + 2.1 (stable) + +
- 2.0 (stable) + 2.0
@@ -105,6 +110,11 @@ +
  • + + Preconditional filters + +
  • Auth Proc Filters included in the SimpleSAMLphp distribution @@ -421,6 +431,42 @@

    .

    +

    + Preconditional filters +

    +

    + Any filter can be configured with a precondition that will determine whether or not a filter should run. +The condition is represented as a string that will be evaluated, similar to the + + core:PHP + + filter. It also has +the + + $attributes + + and + + $state + + variable available for use. +The code must return either + + true + + to run the filter, or + + false + + to skip it. +

    +
    + 
    'authproc' => [
+    40 => 'core:TargetedID',
+    '%precondition' => 'return $attributes["displayName"] === "John Doe";',
+],
+
    +

    Auth Proc Filters included in the SimpleSAMLphp distribution

    diff --git a/stable/simplesamlphp-authsource.html b/stable/simplesamlphp-authsource.html index 320c91a..e6fd56f 100644 --- a/stable/simplesamlphp-authsource.html +++ b/stable/simplesamlphp-authsource.html @@ -50,9 +50,14 @@ » Documentation

    +
    + + 2.1 (stable) + +
    - 2.0 (stable) + 2.0
    diff --git a/stable/simplesamlphp-changelog-1.x.html b/stable/simplesamlphp-changelog-1.x.html index c54d8f7..9278985 100644 --- a/stable/simplesamlphp-changelog-1.x.html +++ b/stable/simplesamlphp-changelog-1.x.html @@ -50,9 +50,14 @@ » Documentation

    +
    + + 2.1 (stable) + +
    - 2.0 (stable) + 2.0
    diff --git a/stable/simplesamlphp-changelog.html b/stable/simplesamlphp-changelog.html index 8b719f8..be2ac57 100644 --- a/stable/simplesamlphp-changelog.html +++ b/stable/simplesamlphp-changelog.html @@ -50,9 +50,14 @@ » Documentation

    +
    + + 2.1 (stable) + +
    - 2.0 (stable) + 2.0
    @@ -89,9 +94,16 @@