- Notifications
You must be signed in to change notification settings - Fork0
Symfony 3 bundle for shibboleth authentication
License
sygefor/ShibbolethBundle
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
This bundle adds a shibboleth authentication provider for your Symfony2 project.
- PHP 5.3.3 and up.
- [Symfony 3.0+][http://symfony.com]
ShibbolethBundle is composer-friendly.
"require":{ ..."sygefor/shibboleth-bundle":"dev-master"...},"repositories":[{"type":"vcs","url":"git@github.com:sygefor/ShibbolethBundle.git"}],
Now tell composer to download the bundle by running the command:
php composer.phar update kuleuven/shibboleth-bundle
Composer will install the bundle to your project's vendor/kuleuven directory..
Instantiate the bundle in your kernel:
// app/AppKernel.php<?php// ...publicfunctionregisterBundles() {$bundles =array(// ...newKULeuven\ShibbolethBundle\ShibbolethBundle(), ); }
Add following lines to the .htaccess file in your projects web folder
# web/.htaccessAuthType shibbolethShibRequireSessionOffShibUseHeadersOnrequire shibboleth
# app/config/security.ymlsecurity:firewalls:secured_area:pattern: ^/securedshibboleth: ~logout:path:/secured/logouttarget:/success_handler:security.logout.handler.shibboleth
Possible configuration parameters are:
# app/config/config.ymlshibboleth:handler_path: /Shibboleth.ssosecured_handler: truesession_initiator_path: /Loginusername_attribute: uiduse_headers: true
The above listed configuration values are the default values. To use the defaults, simply use the following line in your config:
# app/config/config.ymlshibboleth: ~
By default, the bundle exposes several Shibboleth attributes through the user token,ShibbolethUserToken. The token provides specific accessors for most of the attributes, as well as the generic accessorsgetAttribute,getArrayAttribute andhasAttributeValue. Each attribute is internally identified by an alias, which serves as argument to the aforementioned methods. The following table lists the Shibboleth attributes available (when provided) through the user token:
| Attribute | Alias |
|---|---|
| Shib-Person-uid | uid |
| Shib-Person-commonName | cn |
| Shib-Person-surname | sn |
| Shib-Person-givenName | givenName |
| Shib-Person-mail | |
| Shib-Person-ou | ou |
| Shib-Person-telephoneNumber | telephoneNumber |
| Shib-Person-facsimileTelephoneNumber | facsimileTelephoneNumber |
| Shib-Person-mobile | mobile |
| Shib-Person-postalAddress | postalAddress |
| Shib-EP-UnscopedAffiliation | affiliation |
| Shib-EP-Scopedaffiliation | scopedAffiliation |
| Shib-EP-OrgunitDN | orgUnitDN |
| Shib-EP-OrgDN | orgDN |
| Shib-logoutURL | logoutURL |
| Shib-Identity-Provider | identityProvider |
| Shib-Origin-Site | originSite |
| Shib-Authentication-Instant | authenticationInstant |
| Shib-KUL-employeeType | employeeType |
| Shib-KUL-studentType | studentType |
| Shib-KUL-primouNumber | primouNumber |
| Shib-KUL-ouNumber | ouNumber |
| Shib-KUL-dipl | dipl |
| Shib-KUL-opl | opl |
| Shib-KUL-campus | campus |
| Shib-logoutURL | logoutURL |
If for some reason you want to pass additional attributes (for example custom attributes) or overwrite existing, you can configure them this way:
# app/config/config.ymlshibboleth:# ...attribute_definitions:foo:# the attribute aliasheader: shib-acme-foo# the attribute namebar:header: shib-acme-barmultivalue: true# attribute contains multiple values (default is false, i.e. attribute is scalar)identityProvider:header:REDIRECT_Shib-Identity-Provider# Change the existing attributeserver:REDIRECT_Shib_Identity_Provider# Change the name of the variable with use_header option off
The key containing the configuration of each attribute will be its alias. That means the value(s) of theshib-acme-foo andshib-acme-bar attributes can be retrieved with:
$foo =$token->getAttribute('foo');$bars =$token->getArrayAttribute('bar');// returns an array containing the multiple values
This bundle doesn't include any User Provider, but you can implement your own.
If you store users in a database, they can be created on the fly when a users logs on for the first time on your application. Your UserProvider needs to implement theKULeuven\ShibbolethBundle\Security\ShibbolethUserProviderInterface interface.
This example uses Propel ORM to store users.
<?phpnamespaceYourProjectNamespace\Security;useYourProjectNamespace\Model\User;useYourProjectNamespace\Model\UserQuery;useKULeuven\ShibbolethBundle\Security\ShibbolethUserProviderInterface;useKULeuven\ShibbolethBundle\Security\ShibbolethUserToken;useSymfony\Component\Security\Core\Authentication\Token\TokenInterface;useSymfony\Component\Security\Core\User\UserProviderInterface;useSymfony\Component\Security\Core\User\UserInterface;useSymfony\Component\Security\Core\Exception\UsernameNotFoundException;useSymfony\Component\Security\Core\Exception\UnsupportedUserException;class UserProviderimplements ShibbolethUserProviderInterface{publicfunctionloadUserByUsername($username){$user = UserQuery::create()->findOneByUsername($username);if($user){return$user;}else{thrownewUsernameNotFoundException("User".$username." not found.");}}publicfunctioncreateUser(ShibbolethUserToken$token){// Create user object using shibboleth attributes stored in the token.//$user =newUser();$user->setUid($token->getUsername());$user->setSurname($token->getSurname());$user->setGivenName($token->getGivenName());$user->setMail($token->getMail());// If you like, you can also add default roles to the user based on shibboleth attributes. E.g.:if ($token->isStudent())$user->addRole('ROLE_STUDENT');elseif ($token->isStaff())$user->addRole('ROLE_STAFF');else$user->addRole('ROLE_GUEST');$user->save();return$user;}publicfunctionrefreshUser(UserInterface$user){if (!$userinstanceof User) {thrownewUnsupportedUserException(sprintf('Instances of "%s" are not supported.',get_class($user)));}return$this->loadUserByUsername($user->getUsername());}publicfunctionsupportsClass($class){return$class ==='YourProjectNamespace\Model\User';}}
About
Symfony 3 bundle for shibboleth authentication
Resources
License
Stars
Watchers
Forks
Packages0
Languages
- PHP99.5%
- HTML0.5%