diff --git a/.env.example b/.env.example index b3744a1..d012610 100644 --- a/.env.example +++ b/.env.example @@ -44,3 +44,9 @@ LDC_WEB_API_KEY="" # - LIST SEPARATED WITH ',' (Optional) LDC_WEB_CIDR_MANUAL_ALLOWED_LIST="" +# SAML +SAML2_DEFAULT_TENANT_UUID= +SAML2_SP_CERT_x509= +SAML2_SP_CERT_PRIVATEKEY= +SAML2_CONTACT_TECHNICAL_EMAIL= +SAML2_CONTACT_SUPPORT_EMAIL= diff --git a/app/Console/Commands/UserCreate.php b/app/Console/Commands/UserCreate.php index 57b463f..533eb23 100644 --- a/app/Console/Commands/UserCreate.php +++ b/app/Console/Commands/UserCreate.php @@ -8,6 +8,7 @@ use Carbon\Carbon; use Illuminate\Console\Command; use Illuminate\Support\Facades\Validator; use Illuminate\Validation\ValidationException; +use Illuminate\Support\Str; class UserCreate extends Command { @@ -28,44 +29,37 @@ class UserCreate extends Command /** * The first name of the new user. * - * @var string + * @var string|null */ protected $first_name; /** * The last name of the new user. * - * @var string + * @var string|null */ protected $last_name; /** * The email of the new user. * - * @var string + * @var string|null */ protected $email; - /** - * The password of the new user. - * - * @var string - */ - protected $password; - /** * The role of the new user. * - * @var string + * @var string|null */ protected $role; /** * Execute the console command. * - * @return integer + * @return void */ - public function handle(): int + public function handle(): void { $this->first_name = null; $this->addFirstName(); @@ -76,26 +70,20 @@ class UserCreate extends Command $this->email = null; $this->addEmail(); - $this->password = null; - $this->addPassword(); - $this->role = null; $this->addRole(); $user = new User([ - 'first_name' => $this->first_name, - 'last_name' => $this->last_name, - 'email' => $this->email, - 'password' => $this->password, - 'role' => $this->role, - 'published' => true, + 'first_name' => $this->first_name, + 'last_name' => $this->last_name, + 'email' => $this->email, + 'role' => $this->role, + 'published' => true, 'published_at' => Carbon::now(), ]); $user->saveOrFail(); $this->info('User created 👌'); - - return 0; } /** @@ -173,22 +161,6 @@ class UserCreate extends Command }; //end while } - /** - * Add a password to the user. - * - * @return void - */ - private function addPassword(): void - { - while ( - ($this->password = $this->secret( - (!\is_null($this->password) ? 'Failed to confirm, ' : '') . 'Type the wanted user password' - )) !== $this->secret('Confirm the password') - ) { - continue; - }; //end while - } - /** * Add a role to the user. * @@ -198,20 +170,22 @@ class UserCreate extends Command { while (is_null($this->role)) { try { - $tmp = $this->choice( + $tmp = $this->choice( 'Select his role', - [RoleEnum::conceptor->name, RoleEnum::admin->name, RoleEnum::visitor->name], - RoleEnum::visitor->name, - $maxAttempts = null, - $allowMultipleSelections = false + [ + Str::ucFirst(RoleEnum::conceptor->label()), + Str::ucFirst(RoleEnum::admin->label()), + Str::ucFirst(RoleEnum::visitor->label()) + ], + Str::ucFirst(RoleEnum::visitor->label()), ); - if ($tmp === RoleEnum::conceptor->name) { + if ($tmp === Str::ucFirst(RoleEnum::conceptor->label())) { $tmp = RoleEnum::conceptor; } - if ($tmp === RoleEnum::admin->name) { + if ($tmp === Str::ucFirst(RoleEnum::admin->label())) { $tmp = RoleEnum::admin; } - if ($tmp === RoleEnum::visitor->name) { + if ($tmp === Str::ucFirst(RoleEnum::visitor->label())) { $tmp = RoleEnum::visitor; } $validator = Validator::make(['role' => $tmp], [ @@ -221,7 +195,7 @@ class UserCreate extends Command $this->role = $tmp; } catch (ValidationException $e) { $this->error(sprintf( - 'Please choose from the selection', + 'Please choose from the selection %s', \implode(',', collect($e->errors())->flatten()->all()) )); continue; diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index a432dae..f6abd77 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -39,7 +39,6 @@ class Kernel extends HttpKernel \Illuminate\Routing\Middleware\SubstituteBindings::class, \App\Http\Middleware\SecureHeaders::class ], - 'api' => [ \Illuminate\Routing\Middleware\ThrottleRequests::class . ':api', \App\Http\Middleware\JsonOnly::class, @@ -47,6 +46,11 @@ class Kernel extends HttpKernel \App\Http\Middleware\ApiCheckTimeStamps::class, \Illuminate\Routing\Middleware\SubstituteBindings::class ], + 'saml' => [ + \App\Http\Middleware\EncryptCookies::class, + \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, + \Illuminate\Session\Middleware\StartSession::class, + ], ]; /** diff --git a/app/Models/Service.php b/app/Models/Service.php index bff09db..b8b6cb0 100644 --- a/app/Models/Service.php +++ b/app/Models/Service.php @@ -79,6 +79,12 @@ class Service extends Model */ protected static function booted(): void { + static::creating(function (self $model) { + if (config('app.env') !== 'production') { + $model->generateBearerToken(); + $model->generateBearerPassword(); + } + }); static::created(function () { // * Flush Eloquent cache. self::flushQueryCache(); diff --git a/app/Models/User.php b/app/Models/User.php index a14b40d..b0981f5 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -4,27 +4,24 @@ namespace App\Models; use App\Enums\Users\RoleEnum; use App\Traits\Models\ActivityLog; +use Illuminate\Auth\Access\AuthorizationException; use Illuminate\Database\Eloquent\Factories\HasFactory; use Illuminate\Foundation\Auth\User as Authenticatable; use Illuminate\Notifications\Notifiable; -use Illuminate\Support\Facades\Hash; /** - * @property string $first_name Prénom. - * @property string $last_name Nom. - * @property string $email Email. - * @property string $password Mot de passe. - * @property \App\Enums\Users\RoleEnum $role Rôle. - * @property \Illuminate\Support\Carbon $published État de publication. - * @property \Illuminate\Support\Carbon $published_at Date de mise à jour de l'état de publication. - * @property-read \Illuminate\Support\Carbon $created_at Created date. - * @property-read \Illuminate\Support\Carbon $updated_at Updated date. + * @property string $first_name User firstname. + * @property string $last_name User lastname. + * @property string $email User email. + * @property string $remember_token User remember token. + * @property \App\Enums\Users\RoleEnum $role User role. + * @property boolean $published User published status. + * @property \Illuminate\Support\Carbon $published_at User publication status update date. + * @property \Illuminate\Support\Carbon $last_connection User last_connection. + * @property-read \Illuminate\Support\Carbon $created_at User created date. + * @property-read \Illuminate\Support\Carbon $updated_at User updated date. * - * @method protected static function booted() Perform any actions required after the model boots. - * @method private static function setOrder($model) Set order after the last element of the list. - * @method private static function updatePassword($model) Update password. - * - * @property-read \App\Models\ActivityLog $activityLogs Activities logs One-to-many relationship. + * @property-read \App\Models\ActivityLog $activityLogs Activities logs HasMany relationship. */ class User extends Authenticatable { @@ -41,7 +38,6 @@ class User extends Authenticatable 'first_name', 'last_name', 'email', - 'password', 'role', 'published', 'published_at', @@ -53,7 +49,6 @@ class User extends Authenticatable * @var array */ protected $hidden = [ - 'password', 'remember_token', ]; @@ -63,9 +58,10 @@ class User extends Authenticatable * @var array */ protected $casts = [ - 'role' => RoleEnum::class, - 'email_verified_at' => 'datetime', - 'published' => 'boolean', + 'role' => RoleEnum::class, + 'published' => 'boolean', + 'published_at' => 'datetime', + 'last_connection' => 'datetime', ]; /** @@ -76,54 +72,44 @@ class User extends Authenticatable protected static function booted(): void { static::creating(function (self $model) { - static::updatePassword($model); - // * Prevent user elevation privileges - throw_if( - auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(), - AuthorizationException::class - ); + self::checkElevationPrivileges($model); }); static::updating(function (self $model) { - static::updatePassword($model); - if (optional(auth('backend')->user())->getKey() === $model->getKey()) { - \validator( - ['published' => $model->published], - ['published' => 'required|boolean|accepted'], - ['published.accepted' => trans('Vous ne pouvez pas déactiver votre propre compte')], - )->validate(); - } - // * Prevent user elevation privileges - throw_if( - auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(), - AuthorizationException::class - ); + self::updatePublishedStatus($model); + self::checkElevationPrivileges($model); }); } // * METHODS /** - * Update password. + * Check if the authenticable user can update the published status. * - * @param self $model + * @param self $user * @return void */ - private static function updatePassword(self $model): void + private static function updatePublishedStatus(self $user): void { - if (Hash::needsRehash($model->password)) { - $model->password = Hash::make($model->password); + if (optional(auth('backend')->user())->getKey() === $user->getKey()) { + \validator( + ['published' => $user->published], + ['published' => 'required|boolean|accepted'], + ['published.accepted' => trans('Vous ne pouvez pas désactiver votre propre compte')], + )->validate(); } } - // * RELATIONS - /** - * Activities logs One-to-many relationship. + * Prevent user elevation privileges. * - * @return \Illuminate\Database\Eloquent\Relations\HasMany + * @param self $user + * @return void */ - public function activityLogs(): \Illuminate\Database\Eloquent\Relations\HasMany + private static function checkElevationPrivileges(self $user): void { - return $this->hasMany(ActivityLog::class); + throw_if( + auth('backend')->user() and auth('backend')->user()->role->value() > $user->role->value(), + AuthorizationException::class + ); } } diff --git a/app/Providers/EventServiceProvider.php b/app/Providers/EventServiceProvider.php index 6e0c396..66ab757 100644 --- a/app/Providers/EventServiceProvider.php +++ b/app/Providers/EventServiceProvider.php @@ -2,9 +2,15 @@ namespace App\Providers; +use App\Models\User; use Illuminate\Auth\Events\Registered; use Illuminate\Auth\Listeners\SendEmailVerificationNotification; use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider; +use Illuminate\Support\Facades\Auth; +use Illuminate\Support\Facades\Cache; +use Illuminate\Support\Facades\Event; +use Illuminate\Support\Facades\Session; +use Slides\Saml2\Events\SignedIn; class EventServiceProvider extends ServiceProvider { @@ -28,4 +34,44 @@ class EventServiceProvider extends ServiceProvider { return false; } + + /** + * Register any events for your application. + * + * @return void + */ + public function boot(): void + { + Event::listen('Slides\Saml2\Events\SignedIn', function (SignedIn $event) { + $messageId = $event->getAuth()->getLastMessageId(); + + if (Cache::get(config('cache.prefix') . "_saml_message_id_" . $messageId)) { + logger()->error( + 'SAML MESSAGE ID HANDLER', + ['error' => 'Message ID : ' . $messageId . " replayed !"] + ); + abort(403); + } else { + // Cache for 8h. + Cache::put(config('cache.prefix') . "_saml_message_id_" . $messageId, $messageId, 28800); + } + + $user = $event->getSaml2User(); + $email = $user->getNameId(); + $lUser = User::query()->where('email', $email)->first(); + + if (!$lUser) { + abort(403); + } + Auth::guard('backend')->login($lUser); + session(['sessionIndex' => $user->getSessionIndex()]); + $lUser->last_connection = now(); + $lUser->saveQuietly(); + }); + + Event::listen('Slides\Saml2\Events\SignedOut', function () { + Auth::guard('backend')->logout(); + Session::save(); + }); + } } diff --git a/composer.json b/composer.json index fa60577..082963a 100644 --- a/composer.json +++ b/composer.json @@ -25,6 +25,7 @@ "ext-curl": "*", "ext-dom": "*", "ext-json": "*", + "24slides/laravel-saml2": "^2.4", "arondeparon/laravel-request-sanitizer": "^5.0", "axlon/laravel-postal-code-validation": "^3.2", "diglactic/laravel-breadcrumbs": "^9.0", diff --git a/composer.lock b/composer.lock index 2517076..b412990 100644 --- a/composer.lock +++ b/composer.lock @@ -4,8 +4,83 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "c88d1720f6f7d02f5197fd3eede6c5ca", + "content-hash": "3343f5ab073be3ad2e381f796d2dbb59", "packages": [ + { + "name": "24slides/laravel-saml2", + "version": "2.4.2", + "source": { + "type": "git", + "url": "https://github.com/24Slides/laravel-saml2.git", + "reference": "e7f4938586c65fbe1fdd91552c582cac745223b9" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/24Slides/laravel-saml2/zipball/e7f4938586c65fbe1fdd91552c582cac745223b9", + "reference": "e7f4938586c65fbe1fdd91552c582cac745223b9", + "shasum": "" + }, + "require": { + "ext-openssl": "*", + "illuminate/console": "~5.5|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0", + "illuminate/database": "~5.5|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0", + "illuminate/support": "~5.4|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0|^12.0", + "onelogin/php-saml": "^3.0|^4.0", + "php": ">=7.1", + "ramsey/uuid": "^3.8|^4.0" + }, + "require-dev": { + "mockery/mockery": "^0.9.9", + "phpunit/phpunit": "^7.5|^9.0", + "squizlabs/php_codesniffer": "^2.3" + }, + "type": "library", + "extra": { + "laravel": { + "aliases": { + "Saml2": "Slides\\Saml2\\Facades\\Auth" + }, + "providers": [ + "Slides\\Saml2\\ServiceProvider" + ] + }, + "branch-aliases": { + "dev-master": "2.0.8-dev" + } + }, + "autoload": { + "files": [ + "src/helpers.php" + ], + "psr-4": { + "Slides\\Saml2\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Artem Brezhnev", + "email": "brezzhnev@gmail.com" + } + ], + "description": "SAML2 Service Provider integration to your Laravel 5.4+ application, based on OneLogin toolkit", + "homepage": "https://github.com/24slides/laravel-saml2", + "keywords": [ + "SAML2", + "SSO", + "laravel", + "onelogin", + "saml" + ], + "support": { + "issues": "https://github.com/24Slides/laravel-saml2/issues", + "source": "https://github.com/24Slides/laravel-saml2/tree/2.4.2" + }, + "time": "2025-03-12T12:39:37+00:00" + }, { "name": "arondeparon/laravel-request-sanitizer", "version": "5.0.0", @@ -3707,6 +3782,70 @@ ], "time": "2024-09-09T07:06:30+00:00" }, + { + "name": "onelogin/php-saml", + "version": "4.3.0", + "source": { + "type": "git", + "url": "https://github.com/SAML-Toolkits/php-saml.git", + "reference": "bf5efce9f2df5d489d05e78c27003a0fc8bc50f0" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/SAML-Toolkits/php-saml/zipball/bf5efce9f2df5d489d05e78c27003a0fc8bc50f0", + "reference": "bf5efce9f2df5d489d05e78c27003a0fc8bc50f0", + "shasum": "" + }, + "require": { + "php": ">=7.3", + "robrichards/xmlseclibs": "^3.1" + }, + "require-dev": { + "pdepend/pdepend": "^2.8.0", + "php-coveralls/php-coveralls": "^2.0", + "phploc/phploc": "^4.0 || ^5.0 || ^6.0 || ^7.0", + "phpunit/phpunit": "^9.5", + "sebastian/phpcpd": "^4.0 || ^5.0 || ^6.0 ", + "squizlabs/php_codesniffer": "^3.5.8" + }, + "suggest": { + "ext-curl": "Install curl lib to be able to use the IdPMetadataParser for parsing remote XMLs", + "ext-dom": "Install xml lib", + "ext-openssl": "Install openssl lib in order to handle with x509 certs (require to support sign and encryption)", + "ext-zlib": "Install zlib" + }, + "type": "library", + "autoload": { + "psr-4": { + "OneLogin\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "description": "PHP SAML Toolkit", + "homepage": "https://github.com/SAML-Toolkits/php-saml", + "keywords": [ + "Federation", + "SAML2", + "SSO", + "identity", + "saml" + ], + "support": { + "email": "sixto.martin.garcia@gmail.com", + "issues": "https://github.com/onelogin/SAML-Toolkits/issues", + "source": "https://github.com/onelogin/SAML-Toolkits/" + }, + "funding": [ + { + "url": "https://github.com/SAML-Toolkits", + "type": "github" + } + ], + "time": "2025-05-25T14:28:00+00:00" + }, { "name": "phpoption/phpoption", "version": "1.9.3", @@ -4794,6 +4933,48 @@ ], "time": "2024-11-30T17:53:54+00:00" }, + { + "name": "robrichards/xmlseclibs", + "version": "3.1.3", + "source": { + "type": "git", + "url": "https://github.com/robrichards/xmlseclibs.git", + "reference": "2bdfd742624d739dfadbd415f00181b4a77aaf07" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/robrichards/xmlseclibs/zipball/2bdfd742624d739dfadbd415f00181b4a77aaf07", + "reference": "2bdfd742624d739dfadbd415f00181b4a77aaf07", + "shasum": "" + }, + "require": { + "ext-openssl": "*", + "php": ">= 5.4" + }, + "type": "library", + "autoload": { + "psr-4": { + "RobRichards\\XMLSecLibs\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "BSD-3-Clause" + ], + "description": "A PHP library for XML Security", + "homepage": "https://github.com/robrichards/xmlseclibs", + "keywords": [ + "security", + "signature", + "xml", + "xmldsig" + ], + "support": { + "issues": "https://github.com/robrichards/xmlseclibs/issues", + "source": "https://github.com/robrichards/xmlseclibs/tree/3.1.3" + }, + "time": "2024-11-20T21:13:56+00:00" + }, { "name": "sentry/sentry", "version": "4.10.0", @@ -11445,7 +11626,7 @@ ], "aliases": [], "minimum-stability": "stable", - "stability-flags": [], + "stability-flags": {}, "prefer-stable": true, "prefer-lowest": false, "platform": { @@ -11454,6 +11635,6 @@ "ext-dom": "*", "ext-json": "*" }, - "platform-dev": [], - "plugin-api-version": "2.3.0" + "platform-dev": {}, + "plugin-api-version": "2.6.0" } diff --git a/config/saml2.php b/config/saml2.php new file mode 100644 index 0000000..6dfdd40 --- /dev/null +++ b/config/saml2.php @@ -0,0 +1,397 @@ + \Slides\Saml2\Models\Tenant::class, + + /* + |-------------------------------------------------------------------------- + | Use built-in routes + |-------------------------------------------------------------------------- + | + | If "useRoutes" set to true, the package defines five new routes: + | + | Method | URI | Name + | -------|---------------------------------|------------------ + | POST | {routesPrefix}/{uuid}/acs | saml.acs + | GET | {routesPrefix}/{uuid}/login | saml.login + | GET | {routesPrefix}/{uuid}/logout | saml.logout + | GET | {routesPrefix}/{uuid}/metadata | saml.metadata + | GET | {routesPrefix}/{uuid}/sls | saml.sls + | + */ + + 'useRoutes' => true, + + /* + |-------------------------------------------------------------------------- + | Built-in routes prefix + |-------------------------------------------------------------------------- + | + | Here you may define the prefix for built-in routes. + | + */ + + 'routesPrefix' => '/saml2', + + /* + |-------------------------------------------------------------------------- + | Middle groups to use for the SAML routes + |-------------------------------------------------------------------------- + | + | Note, Laravel 5.2 requires a group which includes StartSession + | + */ + + 'routesMiddleware' => ['saml'], + + /* + |-------------------------------------------------------------------------- + | Signature validation + |-------------------------------------------------------------------------- + | + | Set to true if you want to use parameters from $_SERVER to validate the signature. + | + */ + + 'retrieveParametersFromServer' => false, + + /* + |-------------------------------------------------------------------------- + | Login redirection URL. + |-------------------------------------------------------------------------- + | + | The redirection URL after successful login. + | + */ + + 'loginRoute' => '/bo', + + /* + |-------------------------------------------------------------------------- + | Logout redirection URL. + |-------------------------------------------------------------------------- + | + | The redirection URL after successful logout. + | + */ + + 'logoutRoute' => '/bo', + + + /* + |-------------------------------------------------------------------------- + | Login error redirection URL. + |-------------------------------------------------------------------------- + | + | The redirection URL after login failing. + | + */ + + 'errorRoute' => '/bo/login-error', + + /* + |-------------------------------------------------------------------------- + | Strict mode. + |-------------------------------------------------------------------------- + | + | If 'strict' is True, then the PHP Toolkit will reject unsigned + | or unencrypted messages if it expects them signed or encrypted + | Also will reject the messages if not strictly follow the SAML + | standard: Destination, NameId, Conditions... are validated too. + | + */ + + 'strict' => true, + + /* + |-------------------------------------------------------------------------- + | Debug mode. + |-------------------------------------------------------------------------- + | + | When enabled, errors must be printed. + | + */ + + 'debug' => env('SAML2_DEBUG', env('APP_DEBUG', false)), + + /* + |-------------------------------------------------------------------------- + | Whether to use `X-Forwarded-*` headers to determine port/domain/protocol. + |-------------------------------------------------------------------------- + | + | If 'proxyVars' is True, then the Saml lib will trust proxy headers + | e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if + | your application is running behind a load balancer which terminates SSL. + | + */ + + 'proxyVars' => true, + + /* + |-------------------------------------------------------------------------- + | Service Provider configuration. + |-------------------------------------------------------------------------- + | + | General setting of the service provider. + | + */ + + 'sp' => [ + + /* + |-------------------------------------------------------------------------- + | NameID format. + |-------------------------------------------------------------------------- + | + | Specifies constraints on the name identifier to be used to + | represent the requested subject. + | + */ + + 'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', + + /* + |-------------------------------------------------------------------------- + | SP Certificates. + |-------------------------------------------------------------------------- + | + | Usually x509cert and privateKey of the SP are provided by files placed at + | the certs folder. But we can also provide them with the following parameters. + | + */ + + 'x509cert' => env('SAML2_SP_CERT_x509', ''), + 'privateKey' => env('SAML2_SP_CERT_PRIVATEKEY', ''), + + /* + |-------------------------------------------------------------------------- + | Identifier (URI) of the SP entity. + |-------------------------------------------------------------------------- + | + | Leave blank to use the 'saml.metadata' route. + | + */ + + 'entityId' => env('SAML2_SP_ENTITYID', ''), + + /* + |-------------------------------------------------------------------------- + | The Assertion Consumer Service (ACS) URL. + |-------------------------------------------------------------------------- + | + | URL Location where the from the IdP will be returned, using HTTP-POST binding. + | Leave blank to use the 'saml.acs' route. + | + */ + + 'assertionConsumerService' => [ + 'url' => '', + ], + + /* + |-------------------------------------------------------------------------- + | The Single Logout Service URL. + |-------------------------------------------------------------------------- + | + | Specifies info about where and how the message MUST be + | returned to the requester, in this case our SP. + | + | URL Location where the from the IdP will be returned, using HTTP-Redirect binding. + | Leave blank to use the 'saml.sls' route. + | + */ + + 'singleLogoutService' => [ + 'url' => '' + ], + ], + + /* + |-------------------------------------------------------------------------- + | OneLogin security settings. + |-------------------------------------------------------------------------- + | + | + | + */ + + 'security' => [ + + 'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', + 'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256', + + /* + |-------------------------------------------------------------------------- + | NameId encryption + |-------------------------------------------------------------------------- + | + | Indicates that the nameID of the sent by this SP + | will be encrypted. + | + */ + + 'nameIdEncrypted' => true, + + /* + |-------------------------------------------------------------------------- + | AuthnRequest signage + |-------------------------------------------------------------------------- + | + | Indicates whether the messages sent by + | this SP will be signed. The Metadata of the SP will offer this info + | + */ + + 'authnRequestsSigned' => true, + + /* + |-------------------------------------------------------------------------- + | Logout request signage + |-------------------------------------------------------------------------- + | + | Indicates whether the messages sent by this SP + | will be signed. + | + */ + + 'logoutRequestSigned' => true, + + /* + |-------------------------------------------------------------------------- + | Logout response signage + |-------------------------------------------------------------------------- + | + | Indicates whether the messages sent by this SP + | will be signed. + | + */ + + 'logoutResponseSigned' => true, + + /* + |-------------------------------------------------------------------------- + | Whether need to sign metadata. + |-------------------------------------------------------------------------- + | + | The possible values: + | - false + | - true (use certs) + | - array: + | ``` + | [ + | 'keyFileName' => 'metadata.key', + | 'certFileName' => 'metadata.crt' + | ] + | ``` + | + */ + + 'signMetadata' => true, + + /* + |-------------------------------------------------------------------------- + | Requirement to sign messages. + |-------------------------------------------------------------------------- + | + | Indicates a requirement for the , and + | elements received by this SP to be signed. + | + */ + + 'wantMessagesSigned' => true, + + /* + |-------------------------------------------------------------------------- + | Requirement to sign assertion elements. + |-------------------------------------------------------------------------- + | + | Indicates a requirement for the elements received by + | this SP to be signed. + | + */ + + 'wantAssertionsSigned' => true, + + /* + |-------------------------------------------------------------------------- + | Requirement to encrypt NameID. + |-------------------------------------------------------------------------- + | + | Indicates a requirement for the NameID received by this SP to be encrypted. + | + */ + + 'wantNameIdEncrypted' => false, + + /* + |-------------------------------------------------------------------------- + | Authentication context. + |-------------------------------------------------------------------------- + | + | Set to false and no AuthContext will be sent in the AuthNRequest, + | + | Set true or don't present this parameter and you will get an + | AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' + | + | Set an array with the possible auth context values: + | ['urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'] + | + */ + + 'requestedAuthnContext' => true, + ], + + /* + |-------------------------------------------------------------------------- + | Contact information. + |-------------------------------------------------------------------------- + | + | It is recommended to supply a technical and support contacts. + | + */ + + 'contactPerson' => [ + 'technical' => [ + 'givenName' => env('SAML2_CONTACT_TECHNICAL_NAME', env('APP_NAME', 'Technical')), + 'emailAddress' => env('SAML2_CONTACT_TECHNICAL_EMAIL', 'no@reply.com') + ], + 'support' => [ + 'givenName' => env('SAML2_CONTACT_SUPPORT_NAME', env('APP_NAME', 'Support')), + 'emailAddress' => env('SAML2_CONTACT_SUPPORT_EMAIL', 'no@reply.com') + ], + ], + + /* + |-------------------------------------------------------------------------- + | Organization information. + |-------------------------------------------------------------------------- + | + | The info in en_US lang is recommended, add more if required. + | + */ + + 'organization' => [ + 'en-US' => [ + 'name' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')), + 'displayname' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')), + 'url' => env('SAML2_ORGANIZATION_URL', env('APP_URL', 'http://url')) + ], + ], + + /** + * Default tenant UUID + */ + + 'default_tenant_uuid' => env('SAML2_DEFAULT_TENANT_UUID', null) + +]; diff --git a/database/migrations/2025_07_25_112127_alter_users_for_saml.php b/database/migrations/2025_07_25_112127_alter_users_for_saml.php new file mode 100644 index 0000000..b3daaa9 --- /dev/null +++ b/database/migrations/2025_07_25_112127_alter_users_for_saml.php @@ -0,0 +1,36 @@ +dropColumn('email_verified_at'); + $table->dropColumn('password'); + $table->date('last_connection')->nullable()->after('published_at'); + }); + } + + /** + * Reverse the migrations. + * + * @return void + */ + public function down(): void + { + Schema::table('users', function (Blueprint $table) { + $table->timestamp('email_verified_at')->nullable()->after('email'); + $table->string('password')->after('email_verified_at'); + $table->dropColumn('last_connection'); + }); + } +}; diff --git a/manifest.yaml b/manifest.yaml index 5582f98..da158f1 100644 --- a/manifest.yaml +++ b/manifest.yaml @@ -25,7 +25,11 @@ data: MAIL_FROM_NAME: "${APP_APP_NAME}" SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}" LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}" - + SAML2_DEFAULT_TENANT_UUID: "${APP_SAML2_DEFAULT_TENANT_UUID}" + SAML2_SP_CERT_x509: "${APP_SAML2_SP_CERT_x509}" + SAML2_SP_CERT_PRIVATEKEY: "${APP_SAML2_SP_CERT_PRIVATEKEY}" + SAML2_CONTACT_TECHNICAL_EMAIL: "${APP_SAML2_CONTACT_TECHNICAL_EMAIL}" + SAML2_CONTACT_SUPPORT_EMAIL: "${APP_SAML2_CONTACT_SUPPORT_EMAIL}" --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/resources/views/bo/auth/login.blade.php b/resources/views/bo/auth/login.blade.php index 1731442..b1c12de 100644 --- a/resources/views/bo/auth/login.blade.php +++ b/resources/views/bo/auth/login.blade.php @@ -3,65 +3,24 @@ @section('description', __('Formulaire d\'authentification au back-office.')) @section('content') -
-
-
-
-
{{ __('Connexion') }}
-
-
- @csrf -
- -
- - @error('email') - - {{ $message }} - - @enderror -
-
-
- -
- - @error('password') - - {{ $message }} - - @enderror -
-
-
-
-
- - -
-
-
-
-
- - @if (Route::has('bo.password.request')) - - {{ __('Mot de passe oublié ?') }} - @endif
-
+
- @endsection