343 lines
13 KiB
PHP
343 lines
13 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use Slides\Saml2\Models\Tenant;
|
|
|
|
return [
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Tenant Model
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* This will allow you to override the tenant model with your own.
|
|
*/
|
|
'tenantModel' => Tenant::class,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Use built-in routes
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* If "useRoutes" set to true, the package defines five new routes:
|
|
*
|
|
* Method | URI | Name
|
|
* -------|---------------------------------|------------------
|
|
* POST | {routesPrefix}/{uuid}/acs | saml.acs
|
|
* GET | {routesPrefix}/{uuid}/login | saml.login
|
|
* GET | {routesPrefix}/{uuid}/logout | saml.logout
|
|
* GET | {routesPrefix}/{uuid}/metadata | saml.metadata
|
|
* GET | {routesPrefix}/{uuid}/sls | saml.sls
|
|
*/
|
|
'useRoutes' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Built-in routes prefix
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Here you may define the prefix for built-in routes.
|
|
*/
|
|
'routesPrefix' => '/saml2',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Middle groups to use for the SAML routes
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Note, Laravel 5.2 requires a group which includes StartSession
|
|
*/
|
|
'routesMiddleware' => ['saml'],
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Signature validation
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Set to true if you want to use parameters from $_SERVER to validate the signature.
|
|
*/
|
|
'retrieveParametersFromServer' => false,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Login redirection URL.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* The redirection URL after successful login.
|
|
*/
|
|
'loginRoute' => '/admin/login',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Logout redirection URL.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* The redirection URL after successful logout.
|
|
*/
|
|
'logoutRoute' => '/admin/login',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Login error redirection URL.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* The redirection URL after login failing.
|
|
*/
|
|
'errorRoute' => '/admin/login',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Strict mode.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* If 'strict' is True, then the PHP Toolkit will reject unsigned
|
|
* or unencrypted messages if it expects them signed or encrypted
|
|
* Also will reject the messages if not strictly follow the SAML
|
|
* standard: Destination, NameId, Conditions... are validated too.
|
|
*/
|
|
'strict' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Debug mode.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* When enabled, errors must be printed.
|
|
*/
|
|
'debug' => env('SAML2_DEBUG', env('APP_DEBUG', false)),
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Whether to use `X-Forwarded-*` headers to determine port/domain/protocol.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* If 'proxyVars' is True, then the Saml lib will trust proxy headers
|
|
* e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if
|
|
* your application is running behind a load balancer which terminates SSL.
|
|
*/
|
|
'proxyVars' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Service Provider configuration.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* General setting of the service provider.
|
|
*/
|
|
'sp' => [
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* NameID format.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Specifies constraints on the name identifier to be used to
|
|
* represent the requested subject.
|
|
*/
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* SP Certificates.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Usually x509cert and privateKey of the SP are provided by files placed at
|
|
* the certs folder. But we can also provide them with the following parameters.
|
|
*/
|
|
'x509cert' => env('SAML2_SP_CERT_x509', ''),
|
|
'privateKey' => env('SAML2_SP_CERT_PRIVATEKEY', ''),
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Identifier (URI) of the SP entity.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Leave blank to use the 'saml.metadata' route.
|
|
*/
|
|
'entityId' => env('SAML2_SP_ENTITYID', ''),
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* The Assertion Consumer Service (ACS) URL.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* URL Location where the <Response> from the IdP will be returned, using HTTP-POST binding.
|
|
* Leave blank to use the 'saml.acs' route.
|
|
*/
|
|
'assertionConsumerService' => [
|
|
'url' => '',
|
|
],
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* The Single Logout Service URL.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Specifies info about where and how the <Logout Response> message MUST be
|
|
* returned to the requester, in this case our SP.
|
|
*
|
|
* URL Location where the <Response> from the IdP will be returned, using HTTP-Redirect binding.
|
|
* Leave blank to use the 'saml.sls' route.
|
|
*/
|
|
'singleLogoutService' => [
|
|
'url' => '',
|
|
],
|
|
],
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* OneLogin security settings.
|
|
*--------------------------------------------------------------------------
|
|
*/
|
|
'security' => [
|
|
|
|
'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
|
|
'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* NameId encryption
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
|
|
* will be encrypted.
|
|
*/
|
|
'nameIdEncrypted' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* AuthnRequest signage
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates whether the <samlp:AuthnRequest> messages sent by
|
|
* this SP will be signed. The Metadata of the SP will offer this info
|
|
*/
|
|
'authnRequestsSigned' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Logout request signage
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates whether the <samlp:logoutRequest> messages sent by this SP
|
|
* will be signed.
|
|
*/
|
|
'logoutRequestSigned' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Logout response signage
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates whether the <samlp:logoutResponse> messages sent by this SP
|
|
* will be signed.
|
|
*/
|
|
'logoutResponseSigned' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Whether need to sign metadata.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* The possible values:
|
|
* - false
|
|
* - true (use certs)
|
|
* - array:
|
|
* ```
|
|
* [
|
|
* 'keyFileName' => 'metadata.key',
|
|
* 'certFileName' => 'metadata.crt'
|
|
* ]
|
|
* ```
|
|
*/
|
|
'signMetadata' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Requirement to sign messages.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
|
|
* <samlp:LogoutResponse> elements received by this SP to be signed.
|
|
*/
|
|
'wantMessagesSigned' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Requirement to sign assertion elements.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates a requirement for the <saml:Assertion> elements received by
|
|
* this SP to be signed.
|
|
*/
|
|
'wantAssertionsSigned' => true,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Requirement to encrypt NameID.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Indicates a requirement for the NameID received by this SP to be encrypted.
|
|
*/
|
|
'wantNameIdEncrypted' => false,
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Authentication context.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* Set to false and no AuthContext will be sent in the AuthNRequest,
|
|
*
|
|
* Set true or don't present this parameter and you will get an
|
|
* AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
|
|
*
|
|
* Set an array with the possible auth context values:
|
|
* ['urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509']
|
|
*/
|
|
'requestedAuthnContext' => true,
|
|
],
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Contact information.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* It is recommended to supply a technical and support contacts.
|
|
*/
|
|
'contactPerson' => [
|
|
'technical' => [
|
|
'givenName' => env('SAML2_CONTACT_TECHNICAL_NAME', env('APP_NAME', 'Technical')),
|
|
'emailAddress' => env('SAML2_CONTACT_TECHNICAL_EMAIL', 'no@reply.com'),
|
|
],
|
|
'support' => [
|
|
'givenName' => env('SAML2_CONTACT_SUPPORT_NAME', env('APP_NAME', 'Support')),
|
|
'emailAddress' => env('SAML2_CONTACT_SUPPORT_EMAIL', 'no@reply.com'),
|
|
],
|
|
],
|
|
|
|
/**
|
|
*--------------------------------------------------------------------------
|
|
* Organization information.
|
|
*--------------------------------------------------------------------------
|
|
*
|
|
* The info in en_US lang is recommended, add more if required.
|
|
*/
|
|
'organization' => [
|
|
'en-US' => [
|
|
'name' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
|
|
'displayname' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
|
|
'url' => env('SAML2_ORGANIZATION_URL', env('APP_URL', 'http://url')),
|
|
],
|
|
],
|
|
|
|
/**
|
|
* Default tenant UUID.
|
|
*/
|
|
'default_tenant_uuid' => env('SAML2_DEFAULT_TENANT_UUID', null),
|
|
|
|
/**
|
|
* Target domain.
|
|
*/
|
|
'domain' => env('SAML2_DOMAIN', ''),
|
|
];
|