Below is forked readme from korotovsky, here will be explained what this extension provides:
With original SSO implementation there was a problem when we are authenticated on IDP and SP1, but not on SP2. So when we visit SP2 public route SSO authentication is not triggered and user sees the public page of SP2 as not logged in user. So SsoAuthenticationController is added which is hit by /sso/authenticate-user path from SP1 ajax call and this ajax call generates session on SP2. Offcourse on IDP, SP1, SP2... some CORS settings on http server should be added.
So this to be working on SP in routing.yml file should be added:
KrtvSingleSignOnServiceProviderBundle:
resource: "@KrtvSingleSignOnServiceProviderBundle/Resources/config/routing.yml"
prefix: /
and in base twig:
{% if app.request.query.get('ajax') %}
<script src="{{ idp_url }}/js/authenticate.js" type="text/javascript"></script>
{% endif %}
and parameters.yml should contain:
idp_url: 'http://YOUR_IDP_GOES_HERE.com'
For authenticate.js file look at IDP extension
SingleSignOnAuthenticationEntryPoint.php had an extra hashing which is commented out. HttpUtils from symfony core from version 3.2 don't allow redirect to other domain (IDP). So calls like:
return $this->httpUtils->createRedirectResponse($request, $redirectUri);
are changed with:
return new RedirectResponse($this->httpUtils->generateUri($request, $redirectUri), 302);
Regarding this redirect problem logout target from security.yml is changed from:
target: http://idp.example.com/sso/logout?service=consumer1
to:
target: http://isp.example.com/sso/logout-user/consumer1
And offcourse appropriate route exists in SsoAuthenticationController.
PHP session names on IDP and all SPs should be different and set in config.yml with ie:
framework
session:
name: SP1SESSID
I am by no means a security expert. I'm not bad at it either, but I cannot vouch for the security of this bundle. You can use this in production if you want, but please do so at your own risk. That said, if you'd like to contribute to make this bundle better/safer, you can always create an issue or send a pull request.
This bundle provides an easy way to integrate a single-sign-on in your website. It uses an existing ('main') firewall for the actual authentication, and redirects all configured SSO-routes to authenticate via a one-time-password.
Installation is a quick 5 steps process:
- Download SingleSignOnServiceProviderBundle using composer
- Enable the bundle
- Configure SingleSignOnServiceProviderBundle
- Enable the route to validate OTP
- Modify security settings
Tell composer to require the package:
composer require korotovsky/sso-sp-bundle
Composer will install the bundle to your project's vendor/korotovsky
directory.
<?php
// app/AppKernel.php
public function registerBundles()
{
$bundles = [
// ...
new Krtv\Bundle\SingleSignOnServiceProviderBundle\KrtvSingleSignOnServiceProviderBundle(),
];
}
?>
Add the following settings to your config.yml.
# app/config/config.yml
krtv_single_sign_on_service_provider:
host: idp.example.com
host_scheme: http
login_path: /sso/login/
# Configuration for OTP managers
otp_manager:
name: http
managers:
http:
provider: guzzle # Active provider for HTTP OTP manager
providers: # Available HTTP providers
service:
# the service must implement Krtv\SingleSignOn\Manager\Http\Provider\ProviderInterface
id: krtv_single_sign_on_service_provider.security.authentication.otp_manager.http.provider.guzzle
guzzle:
# in case you don't have a guzzle client, you must create one
client: acme_bundle.guzzle_service
# the route that was created in the IdP bundle
resource: http://idp.example.com/internal/v1/sso
otp_parameter: _otp
secret_parameter: secret
# app/config/routing.yml
otp:
# this needs to be the same as the check_path, specified later on in security.yml
path: /otp/validate/
# app/config/security.yml
security:
firewalls:
main:
pattern: ^/
sso:
require_previous_session: false
provider: main
check_path: /otp/validate/ # Same as in app/config/routing.yml
sso_scheme: http # Required
sso_host: idp.example.com # Required
sso_otp_scheme: http # Optional
sso_otp_host: consumer1.com # Optional
sso_failure_path: /login # Can also be as an absolute path to service provider
sso_path: /sso/login/ # SSO endpoint on IdP.
sso_service_extra: null # Default service extra parameters. Optional.
sso_service_extra_parameter: service_extra # Parameter name. Optional
sso_login_required: 1 # Optional
sso_login_required_parameter: login_required # Optional
sso_service: consumer1 # Consumer name
logout:
invalidate_session: true
path: /logout
target: http://idp.example.com/sso/logout?service=consumer1
This bundle registers several services into service container. This services will help you customize SSO flow in the you application:
- sso_service_provider.otp_manager – Manager for working with OTP-tokens. Checking and receiving.
- sso_service_provider.uri_signer -Service for signing URLs, if you need to redirect users to /sso/login yourself.