Tenant::class, /** *-------------------------------------------------------------------------- * Use built-in routes *-------------------------------------------------------------------------- * * If "useRoutes" set to true, the package defines five new routes: * * Method | URI | Name * -------|---------------------------------|------------------ * POST | {routesPrefix}/{uuid}/acs | saml.acs * GET | {routesPrefix}/{uuid}/login | saml.login * GET | {routesPrefix}/{uuid}/logout | saml.logout * GET | {routesPrefix}/{uuid}/metadata | saml.metadata * GET | {routesPrefix}/{uuid}/sls | saml.sls */ 'useRoutes' => true, /** *-------------------------------------------------------------------------- * Built-in routes prefix *-------------------------------------------------------------------------- * * Here you may define the prefix for built-in routes. */ 'routesPrefix' => '/saml2', /** *-------------------------------------------------------------------------- * Middle groups to use for the SAML routes *-------------------------------------------------------------------------- * * Note, Laravel 5.2 requires a group which includes StartSession */ 'routesMiddleware' => ['saml'], /** *-------------------------------------------------------------------------- * Signature validation *-------------------------------------------------------------------------- * * Set to true if you want to use parameters from $_SERVER to validate the signature. */ 'retrieveParametersFromServer' => false, /** *-------------------------------------------------------------------------- * Login redirection URL. *-------------------------------------------------------------------------- * * The redirection URL after successful login. */ 'loginRoute' => '/admin/login', /** *-------------------------------------------------------------------------- * Logout redirection URL. *-------------------------------------------------------------------------- * * The redirection URL after successful logout. */ 'logoutRoute' => '/admin/login', /** *-------------------------------------------------------------------------- * Login error redirection URL. *-------------------------------------------------------------------------- * * The redirection URL after login failing. */ 'errorRoute' => '/admin/login', /** *-------------------------------------------------------------------------- * Strict mode. *-------------------------------------------------------------------------- * * If 'strict' is True, then the PHP Toolkit will reject unsigned * or unencrypted messages if it expects them signed or encrypted * Also will reject the messages if not strictly follow the SAML * standard: Destination, NameId, Conditions... are validated too. */ 'strict' => true, /** *-------------------------------------------------------------------------- * Debug mode. *-------------------------------------------------------------------------- * * When enabled, errors must be printed. */ 'debug' => env('SAML2_DEBUG', env('APP_DEBUG', false)), /** *-------------------------------------------------------------------------- * Whether to use `X-Forwarded-*` headers to determine port/domain/protocol. *-------------------------------------------------------------------------- * * If 'proxyVars' is True, then the Saml lib will trust proxy headers * e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if * your application is running behind a load balancer which terminates SSL. */ 'proxyVars' => true, /** *-------------------------------------------------------------------------- * Service Provider configuration. *-------------------------------------------------------------------------- * * General setting of the service provider. */ 'sp' => [ /** *-------------------------------------------------------------------------- * NameID format. *-------------------------------------------------------------------------- * * Specifies constraints on the name identifier to be used to * represent the requested subject. */ 'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', /** *-------------------------------------------------------------------------- * SP Certificates. *-------------------------------------------------------------------------- * * Usually x509cert and privateKey of the SP are provided by files placed at * the certs folder. But we can also provide them with the following parameters. */ 'x509cert' => env('SAML2_SP_CERT_x509', ''), 'privateKey' => env('SAML2_SP_CERT_PRIVATEKEY', ''), /** *-------------------------------------------------------------------------- * Identifier (URI) of the SP entity. *-------------------------------------------------------------------------- * * Leave blank to use the 'saml.metadata' route. */ 'entityId' => env('SAML2_SP_ENTITYID', ''), /** *-------------------------------------------------------------------------- * The Assertion Consumer Service (ACS) URL. *-------------------------------------------------------------------------- * * URL Location where the from the IdP will be returned, using HTTP-POST binding. * Leave blank to use the 'saml.acs' route. */ 'assertionConsumerService' => [ 'url' => '', ], /** *-------------------------------------------------------------------------- * The Single Logout Service URL. *-------------------------------------------------------------------------- * * Specifies info about where and how the message MUST be * returned to the requester, in this case our SP. * * URL Location where the from the IdP will be returned, using HTTP-Redirect binding. * Leave blank to use the 'saml.sls' route. */ 'singleLogoutService' => [ 'url' => '', ], ], /** *-------------------------------------------------------------------------- * OneLogin security settings. *-------------------------------------------------------------------------- */ 'security' => [ 'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', 'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256', /** *-------------------------------------------------------------------------- * NameId encryption *-------------------------------------------------------------------------- * * Indicates that the nameID of the sent by this SP * will be encrypted. */ 'nameIdEncrypted' => true, /** *-------------------------------------------------------------------------- * AuthnRequest signage *-------------------------------------------------------------------------- * * Indicates whether the messages sent by * this SP will be signed. The Metadata of the SP will offer this info */ 'authnRequestsSigned' => true, /** *-------------------------------------------------------------------------- * Logout request signage *-------------------------------------------------------------------------- * * Indicates whether the messages sent by this SP * will be signed. */ 'logoutRequestSigned' => true, /** *-------------------------------------------------------------------------- * Logout response signage *-------------------------------------------------------------------------- * * Indicates whether the messages sent by this SP * will be signed. */ 'logoutResponseSigned' => true, /** *-------------------------------------------------------------------------- * Whether need to sign metadata. *-------------------------------------------------------------------------- * * The possible values: * - false * - true (use certs) * - array: * ``` * [ * 'keyFileName' => 'metadata.key', * 'certFileName' => 'metadata.crt' * ] * ``` */ 'signMetadata' => true, /** *-------------------------------------------------------------------------- * Requirement to sign messages. *-------------------------------------------------------------------------- * * Indicates a requirement for the , and * elements received by this SP to be signed. */ 'wantMessagesSigned' => true, /** *-------------------------------------------------------------------------- * Requirement to sign assertion elements. *-------------------------------------------------------------------------- * * Indicates a requirement for the elements received by * this SP to be signed. */ 'wantAssertionsSigned' => true, /** *-------------------------------------------------------------------------- * Requirement to encrypt NameID. *-------------------------------------------------------------------------- * * Indicates a requirement for the NameID received by this SP to be encrypted. */ 'wantNameIdEncrypted' => false, /** *-------------------------------------------------------------------------- * Authentication context. *-------------------------------------------------------------------------- * * Set to false and no AuthContext will be sent in the AuthNRequest, * * Set true or don't present this parameter and you will get an * AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' * * Set an array with the possible auth context values: * ['urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'] */ 'requestedAuthnContext' => true, ], /** *-------------------------------------------------------------------------- * Contact information. *-------------------------------------------------------------------------- * * It is recommended to supply a technical and support contacts. */ 'contactPerson' => [ 'technical' => [ 'givenName' => env('SAML2_CONTACT_TECHNICAL_NAME', env('APP_NAME', 'Technical')), 'emailAddress' => env('SAML2_CONTACT_TECHNICAL_EMAIL', 'no@reply.com'), ], 'support' => [ 'givenName' => env('SAML2_CONTACT_SUPPORT_NAME', env('APP_NAME', 'Support')), 'emailAddress' => env('SAML2_CONTACT_SUPPORT_EMAIL', 'no@reply.com'), ], ], /** *-------------------------------------------------------------------------- * Organization information. *-------------------------------------------------------------------------- * * The info in en_US lang is recommended, add more if required. */ 'organization' => [ 'en-US' => [ 'name' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')), 'displayname' => env('SAML2_ORGANIZATION_NAME', env('APP_NAME', 'Name')), 'url' => env('SAML2_ORGANIZATION_URL', env('APP_URL', 'http://url')), ], ], /** * Default tenant UUID. */ 'default_tenant_uuid' => env('SAML2_DEFAULT_TENANT_UUID', null), /** * Target domain. */ 'domain' => env('SAML2_DOMAIN', ''), ];