397 lines
14 KiB
PHP
397 lines
14 KiB
PHP
<?php
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Tenant Model
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This will allow you to override the tenant model with your own.
|
|
|
|
|
*/
|
|
|
|
'tenantModel' => \Slides\Saml2\Models\Tenant::class,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Use built-in routes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| If "useRoutes" set to true, the package defines five new routes:
|
|
|
|
|
| Method | URI | Name
|
|
| -------|---------------------------------|------------------
|
|
| POST | {routesPrefix}/{uuid}/acs | saml.acs
|
|
| GET | {routesPrefix}/{uuid}/login | saml.login
|
|
| GET | {routesPrefix}/{uuid}/logout | saml.logout
|
|
| GET | {routesPrefix}/{uuid}/metadata | saml.metadata
|
|
| GET | {routesPrefix}/{uuid}/sls | saml.sls
|
|
|
|
|
*/
|
|
|
|
'useRoutes' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Built-in routes prefix
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Here you may define the prefix for built-in routes.
|
|
|
|
|
*/
|
|
|
|
'routesPrefix' => '/saml2',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Middle groups to use for the SAML routes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Note, Laravel 5.2 requires a group which includes StartSession
|
|
|
|
|
*/
|
|
|
|
'routesMiddleware' => ['saml'],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Signature validation
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Set to true if you want to use parameters from $_SERVER to validate the signature.
|
|
|
|
|
*/
|
|
|
|
'retrieveParametersFromServer' => false,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Login redirection URL.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The redirection URL after successful login.
|
|
|
|
|
*/
|
|
|
|
'loginRoute' => '/bo',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Logout redirection URL.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The redirection URL after successful logout.
|
|
|
|
|
*/
|
|
|
|
'logoutRoute' => '/bo',
|
|
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Login error redirection URL.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The redirection URL after login failing.
|
|
|
|
|
*/
|
|
|
|
'errorRoute' => '/bo/login-error',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Strict mode.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| If 'strict' is True, then the PHP Toolkit will reject unsigned
|
|
| or unencrypted messages if it expects them signed or encrypted
|
|
| Also will reject the messages if not strictly follow the SAML
|
|
| standard: Destination, NameId, Conditions... are validated too.
|
|
|
|
|
*/
|
|
|
|
'strict' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Debug mode.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| When enabled, errors must be printed.
|
|
|
|
|
*/
|
|
|
|
'debug' => env('SAML2_DEBUG', env('APP_DEBUG', false)),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Whether to use `X-Forwarded-*` headers to determine port/domain/protocol.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| If 'proxyVars' is True, then the Saml lib will trust proxy headers
|
|
| e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if
|
|
| your application is running behind a load balancer which terminates SSL.
|
|
|
|
|
*/
|
|
|
|
'proxyVars' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Service Provider configuration.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| General setting of the service provider.
|
|
|
|
|
*/
|
|
|
|
'sp' => [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| NameID format.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specifies constraints on the name identifier to be used to
|
|
| represent the requested subject.
|
|
|
|
|
*/
|
|
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| SP Certificates.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Usually x509cert and privateKey of the SP are provided by files placed at
|
|
| the certs folder. But we can also provide them with the following parameters.
|
|
|
|
|
*/
|
|
|
|
'x509cert' => env('SAML2_SP_CERT_x509', ''),
|
|
'privateKey' => env('SAML2_SP_CERT_PRIVATEKEY', ''),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Identifier (URI) of the SP entity.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Leave blank to use the 'saml.metadata' route.
|
|
|
|
|
*/
|
|
|
|
'entityId' => env('SAML2_SP_ENTITYID', ''),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| The Assertion Consumer Service (ACS) URL.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| URL Location where the <Response> from the IdP will be returned, using HTTP-POST binding.
|
|
| Leave blank to use the 'saml.acs' route.
|
|
|
|
|
*/
|
|
|
|
'assertionConsumerService' => [
|
|
'url' => '',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| The Single Logout Service URL.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Specifies info about where and how the <Logout Response> message MUST be
|
|
| returned to the requester, in this case our SP.
|
|
|
|
|
| URL Location where the <Response> from the IdP will be returned, using HTTP-Redirect binding.
|
|
| Leave blank to use the 'saml.sls' route.
|
|
|
|
|
*/
|
|
|
|
'singleLogoutService' => [
|
|
'url' => ''
|
|
],
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| OneLogin security settings.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
*/
|
|
|
|
'security' => [
|
|
|
|
'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
|
|
'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| NameId encryption
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
|
|
| will be encrypted.
|
|
|
|
|
*/
|
|
|
|
'nameIdEncrypted' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| AuthnRequest signage
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates whether the <samlp:AuthnRequest> messages sent by
|
|
| this SP will be signed. The Metadata of the SP will offer this info
|
|
|
|
|
*/
|
|
|
|
'authnRequestsSigned' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Logout request signage
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates whether the <samlp:logoutRequest> messages sent by this SP
|
|
| will be signed.
|
|
|
|
|
*/
|
|
|
|
'logoutRequestSigned' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Logout response signage
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates whether the <samlp:logoutResponse> messages sent by this SP
|
|
| will be signed.
|
|
|
|
|
*/
|
|
|
|
'logoutResponseSigned' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Whether need to sign metadata.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The possible values:
|
|
| - false
|
|
| - true (use certs)
|
|
| - array:
|
|
| ```
|
|
| [
|
|
| 'keyFileName' => 'metadata.key',
|
|
| 'certFileName' => 'metadata.crt'
|
|
| ]
|
|
| ```
|
|
|
|
|
*/
|
|
|
|
'signMetadata' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Requirement to sign messages.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
|
|
| <samlp:LogoutResponse> elements received by this SP to be signed.
|
|
|
|
|
*/
|
|
|
|
'wantMessagesSigned' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Requirement to sign assertion elements.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates a requirement for the <saml:Assertion> elements received by
|
|
| this SP to be signed.
|
|
|
|
|
*/
|
|
|
|
'wantAssertionsSigned' => true,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Requirement to encrypt NameID.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Indicates a requirement for the NameID received by this SP to be encrypted.
|
|
|
|
|
*/
|
|
|
|
'wantNameIdEncrypted' => false,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Authentication context.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Set to false and no AuthContext will be sent in the AuthNRequest,
|
|
|
|
|
| Set true or don't present this parameter and you will get an
|
|
| AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
|
|
|
|
|
| Set an array with the possible auth context values:
|
|
| ['urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509']
|
|
|
|
|
*/
|
|
|
|
'requestedAuthnContext' => true,
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Contact information.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| It is recommended to supply a technical and support contacts.
|
|
|
|
|
*/
|
|
|
|
'contactPerson' => [
|
|
'technical' => [
|
|
'givenName' => env('SAML2_CONTACT_TECHNICAL_NAME', env('APP_NAME', 'Technical')),
|
|
'emailAddress' => env('SAML2_CONTACT_TECHNICAL_EMAIL', 'no@reply.com')
|
|
],
|
|
'support' => [
|
|
'givenName' => env('SAML2_CONTACT_SUPPORT_NAME', env('APP_NAME', 'Support')),
|
|
'emailAddress' => env('SAML2_CONTACT_SUPPORT_EMAIL', 'no@reply.com')
|
|
],
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Organization information.
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The info in en_US lang is recommended, add more if required.
|
|
|
|
|
*/
|
|
|
|
'organization' => [
|
|
'en-US' => [
|
|
'name' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
|
|
'displayname' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')),
|
|
'url' => env('SAML2_ORGANIZATION_URL', env('APP_URL', 'http://url'))
|
|
],
|
|
],
|
|
|
|
/**
|
|
* Default tenant UUID
|
|
*/
|
|
|
|
'default_tenant_uuid' => env('SAML2_DEFAULT_TENANT_UUID', null)
|
|
|
|
];
|