forge-joniko/ldc-crm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: 🛂 change BO Auth for SAML #42

Browse source
This commit is contained in:
Alexis Gousseau 2025-07-25 11:23:07 +02:00
parent 688ac1a2e2
commit c828952e7b
No known key found for this signature in database
GPG key ID: 4A614CB3DBBA2406
12 changed files with 758 additions and 158 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.env.example
View file

@ -44,3 +44,9 @@ LDC_WEB_API_KEY=""
# - LIST SEPARATED WITH ',' (Optional)
LDC_WEB_CIDR_MANUAL_ALLOWED_LIST=""
# SAML
SAML2_DEFAULT_TENANT_UUID=
SAML2_SP_CERT_x509=
SAML2_SP_CERT_PRIVATEKEY=
SAML2_CONTACT_TECHNICAL_EMAIL=
SAML2_CONTACT_SUPPORT_EMAIL=

72
app/Console/Commands/UserCreate.php
View file

@ -8,6 +8,7 @@ use Carbon\Carbon;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Validator;
use Illuminate\Validation\ValidationException;
use Illuminate\Support\Str;
class UserCreate extends Command
{
@ -28,44 +29,37 @@ class UserCreate extends Command
/**
* The first name of the new user.
*
* @var string
* @var string|null
*/
protected $first_name;
/**
* The last name of the new user.
*
* @var string
* @var string|null
*/
protected $last_name;
/**
* The email of the new user.
*
* @var string
* @var string|null
*/
protected $email;
/**
* The password of the new user.
*
* @var string
*/
protected $password;
/**
* The role of the new user.
*
* @var string
* @var string|null
*/
protected $role;
/**
* Execute the console command.
*
* @return integer
* @return void
*/
public function handle(): int
public function handle(): void
{
$this->first_name = null;
$this->addFirstName();
@ -76,26 +70,20 @@ class UserCreate extends Command
$this->email = null;
$this->addEmail();
$this->password = null;
$this->addPassword();
$this->role = null;
$this->addRole();
$user = new User([
'first_name' => $this->first_name,
'last_name' => $this->last_name,
'email' => $this->email,
'password' => $this->password,
'role' => $this->role,
'published' => true,
'first_name' => $this->first_name,
'last_name' => $this->last_name,
'email' => $this->email,
'role' => $this->role,
'published' => true,
'published_at' => Carbon::now(),
]);
$user->saveOrFail();
$this->info('User created 👌');
return 0;
}
/**
@ -173,22 +161,6 @@ class UserCreate extends Command
}; //end while
}
/**
* Add a password to the user.
*
* @return void
*/
private function addPassword(): void
{
while (
($this->password = $this->secret(
(!\is_null($this->password) ? 'Failed to confirm, ' : '') . 'Type the wanted user password'
)) !== $this->secret('Confirm the password')
) {
continue;
}; //end while
}
/**
* Add a role to the user.
*
@ -198,20 +170,22 @@ class UserCreate extends Command
{
while (is_null($this->role)) {
try {
$tmp = $this->choice(
$tmp = $this->choice(
'Select his role',
[RoleEnum::conceptor->name, RoleEnum::admin->name, RoleEnum::visitor->name],
RoleEnum::visitor->name,
$maxAttempts = null,
$allowMultipleSelections = false
[
Str::ucFirst(RoleEnum::conceptor->label()),
Str::ucFirst(RoleEnum::admin->label()),
Str::ucFirst(RoleEnum::visitor->label())
],
Str::ucFirst(RoleEnum::visitor->label()),
);
if ($tmp === RoleEnum::conceptor->name) {
if ($tmp === Str::ucFirst(RoleEnum::conceptor->label())) {
$tmp = RoleEnum::conceptor;
}
if ($tmp === RoleEnum::admin->name) {
if ($tmp === Str::ucFirst(RoleEnum::admin->label())) {
$tmp = RoleEnum::admin;
}
if ($tmp === RoleEnum::visitor->name) {
if ($tmp === Str::ucFirst(RoleEnum::visitor->label())) {
$tmp = RoleEnum::visitor;
}
$validator = Validator::make(['role' => $tmp], [
@ -221,7 +195,7 @@ class UserCreate extends Command
$this->role = $tmp;
} catch (ValidationException $e) {
$this->error(sprintf(
'Please choose from the selection',
'Please choose from the selection %s',
\implode(',', collect($e->errors())->flatten()->all())
));
continue;

6
app/Http/Kernel.php
View file

@ -39,7 +39,6 @@ class Kernel extends HttpKernel
\Illuminate\Routing\Middleware\SubstituteBindings::class,
\App\Http\Middleware\SecureHeaders::class
],
'api' => [
\Illuminate\Routing\Middleware\ThrottleRequests::class . ':api',
\App\Http\Middleware\JsonOnly::class,
@ -47,6 +46,11 @@ class Kernel extends HttpKernel
\App\Http\Middleware\ApiCheckTimeStamps::class,
\Illuminate\Routing\Middleware\SubstituteBindings::class
],
'saml' => [
\App\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
],
];
/**

6
app/Models/Service.php
View file

@ -79,6 +79,12 @@ class Service extends Model
*/
protected static function booted(): void
{
static::creating(function (self $model) {
if (config('app.env') !== 'production') {
$model->generateBearerToken();
$model->generateBearerPassword();
}
});
static::created(function () {
// * Flush Eloquent cache.
self::flushQueryCache();

86
app/Models/User.php
View file

@ -4,27 +4,24 @@ namespace App\Models;
use App\Enums\Users\RoleEnum;
use App\Traits\Models\ActivityLog;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Facades\Hash;
/**
* @property string $first_name Prénom.
* @property string $last_name Nom.
* @property string $email Email.
* @property string $password Mot de passe.
* @property \App\Enums\Users\RoleEnum $role Rôle.
* @property \Illuminate\Support\Carbon $published État de publication.
* @property \Illuminate\Support\Carbon $published_at Date de mise à jour de l'état de publication.
* @property-read \Illuminate\Support\Carbon $created_at Created date.
* @property-read \Illuminate\Support\Carbon $updated_at Updated date.
* @property string $first_name User firstname.
* @property string $last_name User lastname.
* @property string $email User email.
* @property string $remember_token User remember token.
* @property \App\Enums\Users\RoleEnum $role User role.
* @property boolean $published User published status.
* @property \Illuminate\Support\Carbon $published_at User publication status update date.
* @property \Illuminate\Support\Carbon $last_connection User last_connection.
* @property-read \Illuminate\Support\Carbon $created_at User created date.
* @property-read \Illuminate\Support\Carbon $updated_at User updated date.
*
* @method protected static function booted() Perform any actions required after the model boots.
* @method private static function setOrder($model) Set order after the last element of the list.
* @method private static function updatePassword($model) Update password.
*
* @property-read \App\Models\ActivityLog $activityLogs Activities logs One-to-many relationship.
* @property-read \App\Models\ActivityLog $activityLogs Activities logs HasMany relationship.
*/
class User extends Authenticatable
{
@ -41,7 +38,6 @@ class User extends Authenticatable
'first_name',
'last_name',
'email',
'password',
'role',
'published',
'published_at',
@ -53,7 +49,6 @@ class User extends Authenticatable
* @var array<int, string>
*/
protected $hidden = [
'password',
'remember_token',
];
@ -63,9 +58,10 @@ class User extends Authenticatable
* @var array<string, string>
*/
protected $casts = [
'role' => RoleEnum::class,
'email_verified_at' => 'datetime',
'published' => 'boolean',
'role' => RoleEnum::class,
'published' => 'boolean',
'published_at' => 'datetime',
'last_connection' => 'datetime',
];
/**
@ -76,54 +72,44 @@ class User extends Authenticatable
protected static function booted(): void
{
static::creating(function (self $model) {
static::updatePassword($model);
// * Prevent user elevation privileges
throw_if(
auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
AuthorizationException::class
);
self::checkElevationPrivileges($model);
});
static::updating(function (self $model) {
static::updatePassword($model);
if (optional(auth('backend')->user())->getKey() === $model->getKey()) {
\validator(
['published' => $model->published],
['published' => 'required|boolean|accepted'],
['published.accepted' => trans('Vous ne pouvez pas déactiver votre propre compte')],
)->validate();
}
// * Prevent user elevation privileges
throw_if(
auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
AuthorizationException::class
);
self::updatePublishedStatus($model);
self::checkElevationPrivileges($model);
});
}
// * METHODS
/**
* Update password.
* Check if the authenticable user can update the published status.
*
* @param self $model
* @param self $user
* @return void
*/
private static function updatePassword(self $model): void
private static function updatePublishedStatus(self $user): void
{
if (Hash::needsRehash($model->password)) {
$model->password = Hash::make($model->password);
if (optional(auth('backend')->user())->getKey() === $user->getKey()) {
\validator(
['published' => $user->published],
['published' => 'required|boolean|accepted'],
['published.accepted' => trans('Vous ne pouvez pas désactiver votre propre compte')],
)->validate();
}
}
// * RELATIONS
/**
* Activities logs One-to-many relationship.
* Prevent user elevation privileges.
*
* @return \Illuminate\Database\Eloquent\Relations\HasMany
* @param self $user
* @return void
*/
public function activityLogs(): \Illuminate\Database\Eloquent\Relations\HasMany
private static function checkElevationPrivileges(self $user): void
{
return $this->hasMany(ActivityLog::class);
throw_if(
auth('backend')->user() and auth('backend')->user()->role->value() > $user->role->value(),
AuthorizationException::class
);
}
}

46
app/Providers/EventServiceProvider.php
View file

@ -2,9 +2,15 @@
namespace App\Providers;
use App\Models\User;
use Illuminate\Auth\Events\Registered;
use Illuminate\Auth\Listeners\SendEmailVerificationNotification;
use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Session;
use Slides\Saml2\Events\SignedIn;
class EventServiceProvider extends ServiceProvider
{
@ -28,4 +34,44 @@ class EventServiceProvider extends ServiceProvider
{
return false;
}
/**
* Register any events for your application.
*
* @return void
*/
public function boot(): void
{
Event::listen('Slides\Saml2\Events\SignedIn', function (SignedIn $event) {
$messageId = $event->getAuth()->getLastMessageId();
if (Cache::get(config('cache.prefix') . "_saml_message_id_" . $messageId)) {
logger()->error(
'SAML MESSAGE ID HANDLER',
['error' => 'Message ID : ' . $messageId . " replayed !"]
);
abort(403);
} else {
// Cache for 8h.
Cache::put(config('cache.prefix') . "_saml_message_id_" . $messageId, $messageId, 28800);
}
$user = $event->getSaml2User();
$email = $user->getNameId();
$lUser = User::query()->where('email', $email)->first();
if (!$lUser) {
abort(403);
}
Auth::guard('backend')->login($lUser);
session(['sessionIndex' => $user->getSessionIndex()]);
$lUser->last_connection = now();
$lUser->saveQuietly();
});
Event::listen('Slides\Saml2\Events\SignedOut', function () {
Auth::guard('backend')->logout();
Session::save();
});
}
}

1
composer.json
View file

@ -25,6 +25,7 @@
"ext-curl": "*",
"ext-dom": "*",
"ext-json": "*",
"24slides/laravel-saml2": "^2.4",
"arondeparon/laravel-request-sanitizer": "^5.0",
"axlon/laravel-postal-code-validation": "^3.2",
"diglactic/laravel-breadcrumbs": "^9.0",

189
composer.lock generated
View file

@ -4,8 +4,83 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"content-hash": "c88d1720f6f7d02f5197fd3eede6c5ca",
"content-hash": "3343f5ab073be3ad2e381f796d2dbb59",
"packages": [
{
"name": "24slides/laravel-saml2",
"version": "2.4.2",
"source": {
"type": "git",
"url": "https://github.com/24Slides/laravel-saml2.git",
"reference": "e7f4938586c65fbe1fdd91552c582cac745223b9"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/24Slides/laravel-saml2/zipball/e7f4938586c65fbe1fdd91552c582cac745223b9",
"reference": "e7f4938586c65fbe1fdd91552c582cac745223b9",
"shasum": ""
},
"require": {
"ext-openssl": "*",
"illuminate/console": "~5.5|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
"illuminate/database": "~5.5|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
"illuminate/support": "~5.4|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
"onelogin/php-saml": "^3.0|^4.0",
"php": ">=7.1",
"ramsey/uuid": "^3.8|^4.0"
},
"require-dev": {
"mockery/mockery": "^0.9.9",
"phpunit/phpunit": "^7.5|^9.0",
"squizlabs/php_codesniffer": "^2.3"
},
"type": "library",
"extra": {
"laravel": {
"aliases": {
"Saml2": "Slides\\Saml2\\Facades\\Auth"
},
"providers": [
"Slides\\Saml2\\ServiceProvider"
]
},
"branch-aliases": {
"dev-master": "2.0.8-dev"
}
},
"autoload": {
"files": [
"src/helpers.php"
],
"psr-4": {
"Slides\\Saml2\\": "src/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"authors": [
{
"name": "Artem Brezhnev",
"email": "brezzhnev@gmail.com"
}
],
"description": "SAML2 Service Provider integration to your Laravel 5.4+ application, based on OneLogin toolkit",
"homepage": "https://github.com/24slides/laravel-saml2",
"keywords": [
"SAML2",
"SSO",
"laravel",
"onelogin",
"saml"
],
"support": {
"issues": "https://github.com/24Slides/laravel-saml2/issues",
"source": "https://github.com/24Slides/laravel-saml2/tree/2.4.2"
},
"time": "2025-03-12T12:39:37+00:00"
},
{
"name": "arondeparon/laravel-request-sanitizer",
"version": "5.0.0",
@ -3707,6 +3782,70 @@
],
"time": "2024-09-09T07:06:30+00:00"
},
{
"name": "onelogin/php-saml",
"version": "4.3.0",
"source": {
"type": "git",
"url": "https://github.com/SAML-Toolkits/php-saml.git",
"reference": "bf5efce9f2df5d489d05e78c27003a0fc8bc50f0"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/SAML-Toolkits/php-saml/zipball/bf5efce9f2df5d489d05e78c27003a0fc8bc50f0",
"reference": "bf5efce9f2df5d489d05e78c27003a0fc8bc50f0",
"shasum": ""
},
"require": {
"php": ">=7.3",
"robrichards/xmlseclibs": "^3.1"
},
"require-dev": {
"pdepend/pdepend": "^2.8.0",
"php-coveralls/php-coveralls": "^2.0",
"phploc/phploc": "^4.0 || ^5.0 || ^6.0 || ^7.0",
"phpunit/phpunit": "^9.5",
"sebastian/phpcpd": "^4.0 || ^5.0 || ^6.0 ",
"squizlabs/php_codesniffer": "^3.5.8"
},
"suggest": {
"ext-curl": "Install curl lib to be able to use the IdPMetadataParser for parsing remote XMLs",
"ext-dom": "Install xml lib",
"ext-openssl": "Install openssl lib in order to handle with x509 certs (require to support sign and encryption)",
"ext-zlib": "Install zlib"
},
"type": "library",
"autoload": {
"psr-4": {
"OneLogin\\": "src/"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
],
"description": "PHP SAML Toolkit",
"homepage": "https://github.com/SAML-Toolkits/php-saml",
"keywords": [
"Federation",
"SAML2",
"SSO",
"identity",
"saml"
],
"support": {
"email": "sixto.martin.garcia@gmail.com",
"issues": "https://github.com/onelogin/SAML-Toolkits/issues",
"source": "https://github.com/onelogin/SAML-Toolkits/"
},
"funding": [
{
"url": "https://github.com/SAML-Toolkits",
"type": "github"
}
],
"time": "2025-05-25T14:28:00+00:00"
},
{
"name": "phpoption/phpoption",
"version": "1.9.3",
@ -4794,6 +4933,48 @@
],
"time": "2024-11-30T17:53:54+00:00"
},
{
"name": "robrichards/xmlseclibs",
"version": "3.1.3",
"source": {
"type": "git",
"url": "https://github.com/robrichards/xmlseclibs.git",
"reference": "2bdfd742624d739dfadbd415f00181b4a77aaf07"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/robrichards/xmlseclibs/zipball/2bdfd742624d739dfadbd415f00181b4a77aaf07",
"reference": "2bdfd742624d739dfadbd415f00181b4a77aaf07",
"shasum": ""
},
"require": {
"ext-openssl": "*",
"php": ">= 5.4"
},
"type": "library",
"autoload": {
"psr-4": {
"RobRichards\\XMLSecLibs\\": "src"
}
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"BSD-3-Clause"
],
"description": "A PHP library for XML Security",
"homepage": "https://github.com/robrichards/xmlseclibs",
"keywords": [
"security",
"signature",
"xml",
"xmldsig"
],
"support": {
"issues": "https://github.com/robrichards/xmlseclibs/issues",
"source": "https://github.com/robrichards/xmlseclibs/tree/3.1.3"
},
"time": "2024-11-20T21:13:56+00:00"
},
{
"name": "sentry/sentry",
"version": "4.10.0",
@ -11445,7 +11626,7 @@
],
"aliases": [],
"minimum-stability": "stable",
"stability-flags": [],
"stability-flags": {},
"prefer-stable": true,
"prefer-lowest": false,
"platform": {
@ -11454,6 +11635,6 @@
"ext-dom": "*",
"ext-json": "*"
},
"platform-dev": [],
"plugin-api-version": "2.3.0"
"platform-dev": {},
"plugin-api-version": "2.6.0"
}

397
config/saml2.php Normal file
View file

@ -0,0 +1,397 @@
<?php
return [
/*
|--------------------------------------------------------------------------
| Tenant Model
|--------------------------------------------------------------------------
|
| This will allow you to override the tenant model with your own.
|
*/
'tenantModel' => \Slides\Saml2\Models\Tenant::class,
/*
|--------------------------------------------------------------------------
| Use built-in routes
|--------------------------------------------------------------------------
|
| If "useRoutes" set to true, the package defines five new routes:
|
| Method | URI | Name
| -------|---------------------------------|------------------
| POST | {routesPrefix}/{uuid}/acs | saml.acs
| GET | {routesPrefix}/{uuid}/login | saml.login
| GET | {routesPrefix}/{uuid}/logout | saml.logout
| GET | {routesPrefix}/{uuid}/metadata | saml.metadata
| GET | {routesPrefix}/{uuid}/sls | saml.sls
|
*/
'useRoutes' => true,
/*
|--------------------------------------------------------------------------
| Built-in routes prefix
|--------------------------------------------------------------------------
|
| Here you may define the prefix for built-in routes.
|
*/
'routesPrefix' => '/saml2',
/*
|--------------------------------------------------------------------------
| Middle groups to use for the SAML routes
|--------------------------------------------------------------------------
|
| Note, Laravel 5.2 requires a group which includes StartSession
|
*/
'routesMiddleware' => ['saml'],
/*
|--------------------------------------------------------------------------
| Signature validation
|--------------------------------------------------------------------------
|
| Set to true if you want to use parameters from $_SERVER to validate the signature.
|
*/
'retrieveParametersFromServer' => false,
/*
|--------------------------------------------------------------------------
| Login redirection URL.
|--------------------------------------------------------------------------
|
| The redirection URL after successful login.
|
*/
'loginRoute' => '/bo',
/*
|--------------------------------------------------------------------------
| Logout redirection URL.
|--------------------------------------------------------------------------
|
| The redirection URL after successful logout.
|
*/
'logoutRoute' => '/bo',
/*
|--------------------------------------------------------------------------
| Login error redirection URL.
|--------------------------------------------------------------------------
|
| The redirection URL after login failing.
|
*/
'errorRoute' => '/bo/login-error',
/*
|--------------------------------------------------------------------------
| Strict mode.
|--------------------------------------------------------------------------
|
| If 'strict' is True, then the PHP Toolkit will reject unsigned
| or unencrypted messages if it expects them signed or encrypted
| Also will reject the messages if not strictly follow the SAML
| standard: Destination, NameId, Conditions... are validated too.
|
*/
'strict' => true,
/*
|--------------------------------------------------------------------------
| Debug mode.
|--------------------------------------------------------------------------
|
| When enabled, errors must be printed.
|
*/
'debug' => env('SAML2_DEBUG', env('APP_DEBUG', false)),
/*
|--------------------------------------------------------------------------
| Whether to use `X-Forwarded-*` headers to determine port/domain/protocol.
|--------------------------------------------------------------------------
|
| If 'proxyVars' is True, then the Saml lib will trust proxy headers
| e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if
| your application is running behind a load balancer which terminates SSL.
|
*/
'proxyVars' => true,
/*
|--------------------------------------------------------------------------
| Service Provider configuration.
|--------------------------------------------------------------------------
|
| General setting of the service provider.
|
*/
'sp' => [
/*
|--------------------------------------------------------------------------
| NameID format.
|--------------------------------------------------------------------------
|
| Specifies constraints on the name identifier to be used to
| represent the requested subject.
|
*/
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
/*
|--------------------------------------------------------------------------
| SP Certificates.
|--------------------------------------------------------------------------
|
| Usually x509cert and privateKey of the SP are provided by files placed at
| the certs folder. But we can also provide them with the following parameters.
|
*/
'x509cert' => env('SAML2_SP_CERT_x509', ''),
'privateKey' => env('SAML2_SP_CERT_PRIVATEKEY', ''),
/*
|--------------------------------------------------------------------------
| Identifier (URI) of the SP entity.
|--------------------------------------------------------------------------
|
| Leave blank to use the 'saml.metadata' route.
|
*/
'entityId' => env('SAML2_SP_ENTITYID', ''),
/*
|--------------------------------------------------------------------------
| The Assertion Consumer Service (ACS) URL.
|--------------------------------------------------------------------------
|
| URL Location where the <Response> from the IdP will be returned, using HTTP-POST binding.
| Leave blank to use the 'saml.acs' route.
|
*/
'assertionConsumerService' => [
'url' => '',
],
/*
|--------------------------------------------------------------------------
| The Single Logout Service URL.
|--------------------------------------------------------------------------
|
| Specifies info about where and how the <Logout Response> message MUST be
| returned to the requester, in this case our SP.
|
| URL Location where the <Response> from the IdP will be returned, using HTTP-Redirect binding.
| Leave blank to use the 'saml.sls' route.
|
*/
'singleLogoutService' => [
'url' => ''
],
],
/*
|--------------------------------------------------------------------------
| OneLogin security settings.
|--------------------------------------------------------------------------
|
|
|
*/
'security' => [
'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
/*
|--------------------------------------------------------------------------
| NameId encryption
|--------------------------------------------------------------------------
|
| Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
| will be encrypted.
|
*/
'nameIdEncrypted' => true,
/*
|--------------------------------------------------------------------------
| AuthnRequest signage
|--------------------------------------------------------------------------
|
| Indicates whether the <samlp:AuthnRequest> messages sent by
| this SP will be signed. The Metadata of the SP will offer this info
|
*/
'authnRequestsSigned' => true,
/*
|--------------------------------------------------------------------------
| Logout request signage
|--------------------------------------------------------------------------
|
| Indicates whether the <samlp:logoutRequest> messages sent by this SP
| will be signed.
|
*/
'logoutRequestSigned' => true,
/*
|--------------------------------------------------------------------------
| Logout response signage
|--------------------------------------------------------------------------
|
| Indicates whether the <samlp:logoutResponse> messages sent by this SP
| will be signed.
|
*/
'logoutResponseSigned' => true,
/*
|--------------------------------------------------------------------------
| Whether need to sign metadata.
|--------------------------------------------------------------------------
|
| The possible values:
| - false
| - true (use certs)
| - array:
| ```
| [
| 'keyFileName' => 'metadata.key',
| 'certFileName' => 'metadata.crt'
| ]
| ```
|
*/
'signMetadata' => true,
/*
|--------------------------------------------------------------------------
| Requirement to sign messages.
|--------------------------------------------------------------------------
|
| Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
| <samlp:LogoutResponse> elements received by this SP to be signed.
|
*/
'wantMessagesSigned' => true,
/*
|--------------------------------------------------------------------------
| Requirement to sign assertion elements.
|--------------------------------------------------------------------------
|
| Indicates a requirement for the <saml:Assertion> elements received by
| this SP to be signed.
|
*/
'wantAssertionsSigned' => true,
/*
|--------------------------------------------------------------------------
| Requirement to encrypt NameID.
|--------------------------------------------------------------------------
|
| Indicates a requirement for the NameID received by this SP to be encrypted.
|
*/
'wantNameIdEncrypted' => false,
/*
|--------------------------------------------------------------------------
| Authentication context.
|--------------------------------------------------------------------------
|
| Set to false and no AuthContext will be sent in the AuthNRequest,
|
| Set true or don't present this parameter and you will get an
| AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
|
| Set an array with the possible auth context values:
| ['urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509']
|
*/
'requestedAuthnContext' => true,
],
/*
|--------------------------------------------------------------------------
| Contact information.
|--------------------------------------------------------------------------
|
| It is recommended to supply a technical and support contacts.
|
*/
'contactPerson' => [
'technical' => [
'givenName' => env('SAML2_CONTACT_TECHNICAL_NAME', env('APP_NAME', 'Technical')),
'emailAddress' => env('SAML2_CONTACT_TECHNICAL_EMAIL', 'no@reply.com')
],
'support' => [
'givenName' => env('SAML2_CONTACT_SUPPORT_NAME', env('APP_NAME', 'Support')),
'emailAddress' => env('SAML2_CONTACT_SUPPORT_EMAIL', 'no@reply.com')
],
],
/*
|--------------------------------------------------------------------------
| Organization information.
|--------------------------------------------------------------------------
|
| The info in en_US lang is recommended, add more if required.
|
*/
'organization' => [
'en-US' => [
'name' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
'displayname' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
'url' => env('SAML2_ORGANIZATION_URL', env('APP_URL', 'http://url'))
],
],
/**
* Default tenant UUID
*/
'default_tenant_uuid' => env('SAML2_DEFAULT_TENANT_UUID', null)
];

36
database/migrations/2025_07_25_112127_alter_users_for_saml.php Normal file
View file

@ -0,0 +1,36 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*
* @return void
*/
public function up(): void
{
Schema::table('users', function (Blueprint $table) {
$table->dropColumn('email_verified_at');
$table->dropColumn('password');
$table->date('last_connection')->nullable()->after('published_at');
});
}
/**
* Reverse the migrations.
*
* @return void
*/
public function down(): void
{
Schema::table('users', function (Blueprint $table) {
$table->timestamp('email_verified_at')->nullable()->after('email');
$table->string('password')->after('email_verified_at');
$table->dropColumn('last_connection');
});
}
};

6
manifest.yaml
View file

@ -25,7 +25,11 @@ data:
MAIL_FROM_NAME: "${APP_APP_NAME}"
SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}"
SAML2_DEFAULT_TENANT_UUID: "${APP_SAML2_DEFAULT_TENANT_UUID}"
SAML2_SP_CERT_x509: "${APP_SAML2_SP_CERT_x509}"
SAML2_SP_CERT_PRIVATEKEY: "${APP_SAML2_SP_CERT_PRIVATEKEY}"
SAML2_CONTACT_TECHNICAL_EMAIL: "${APP_SAML2_CONTACT_TECHNICAL_EMAIL}"
SAML2_CONTACT_SUPPORT_EMAIL: "${APP_SAML2_CONTACT_SUPPORT_EMAIL}"
---
apiVersion: v1
kind: PersistentVolumeClaim

65
resources/views/bo/auth/login.blade.php
View file

@ -3,65 +3,24 @@
@section('description', __('Formulaire d\'authentification au back-office.'))
@section('content')
<div class="container">
<div class="row justify-content-center">
<div class="col-md-8 p-0">
<div class="card">
<div class="card-header">{{ __('Connexion') }}</div>
<div class="card-body">
<form method="POST" action="{{ route('bo.login') }}">
@csrf
<div class="row mb-3">
<label for="email" class="col-md-4 col-form-label text-md-end">{{ __('Adresse Email') }}</label>
<div class="col-md-6">
<input id="email" type="email" class="form-control @error('email') is-invalid @enderror" name="email"
value="{{ old('email') }}" autocomplete="email" autofocus required>
@error('email')
<span class="invalid-feedback" role="alert">
<strong>{{ $message }}</strong>
</span>
@enderror
</div>
</div>
<div class="row mb-3">
<label for="password" class="col-md-4 col-form-label text-md-end">{{ __('Mot de passe') }}</label>
<div class="col-md-6">
<input id="password" type="password" class="form-control @error('password') is-invalid @enderror"
name="password" autocomplete="current-password" required>
@error('password')
<span class="invalid-feedback" role="alert">
<strong>{{ $message }}</strong>
</span>
@enderror
</div>
</div>
<div class="row mb-3">
<div class="col-md-6 offset-md-4">
<div class="form-check">
<input class="form-check-input" type="checkbox" name="remember" id="remember" {{ old('remember') ? 'checked' : '' }}>
<label class="form-check-label user-select-none" for="remember">
{{ __('Se souvenir de moi') }}
</label>
</div>
</div>
</div>
<div class="row mb-0">
<div class="col-md-8 offset-md-4">
<button type="submit" class="btn btn-primary">
<span>{{ __('Connexion') }}</span>
<div class="container">
<div class="row justify-content-center">
<div class="col-md-8 p-0">
<div class="card">
<div class="card-header fw-bold">{{ __('Connexion') }}</div>
<div class="card-body">
<div class="row">
<div class="col text-center">
<a class="btn btn-primary"
href="{{ route('saml.login', ['uuid' => config('saml2.default_tenant_uuid')]) }}">
<span>{{ __('Connexion avec UWIL Support') }}</span>
<i class="fa-solid fa-arrow-right-from-bracket"></i>
</button>
@if (Route::has('bo.password.request'))
<a class="btn btn-link" href="{{ route('bo.password.request') }}">
{{ __('Mot de passe oublié ?') }}
</a>
@endif
</div>
</div>
</form>
</div>
</div>
</div>
</div>
</div>
</div>
@endsection