true, // TODO: make this depend on laravel config // Enable debug mode (to print errors). 'debug' => env('APP_DEBUG', false), // Service Provider Data that we are deploying. 'sp' => array( // Specifies constraints on the name identifier to be used to // represent the requested subject. // Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported. 'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', // Usually x509cert and privateKey of the SP are provided by files placed at // the certs folder. But we can also provide them with the following parameters. 'x509cert' => env('SAML2_' . $this_idp_env_id . '_SP_x509', ''), 'privateKey' => env('SAML2_' . $this_idp_env_id . '_SP_PRIVATEKEY', ''), // Identifier (URI) of the SP entity. // Leave blank to use the '{idpName}_metadata' route, e.g. 'test_metadata'. 'entityId' => env('SAML2_' . $this_idp_env_id . '_SP_ENTITYID', ''), // Specifies info about where and how the message MUST be // returned to the requester, in this case our SP. 'assertionConsumerService' => array( // URL Location where the from the IdP will be returned, // using HTTP-POST binding. // Leave blank to use the '{idpName}_acs' route, e.g. 'test_acs'. 'url' => '', ), // Specifies info about where and how the message MUST be // returned to the requester, in this case our SP. // Remove this part to not include any URL Location in the metadata. 'singleLogoutService' => array( // URL Location where the from the IdP will be returned, // using HTTP-Redirect binding. // Leave blank to use the '{idpName}_sls' route, e.g. 'test_sls'. 'url' => '', ), ), // Identity Provider Data that we want connect with our SP. 'idp' => array( // Identifier of the IdP entity (must be a URI). 'entityId' => env('SAML2_' . $this_idp_env_id . '_IDP_ENTITYID', $idp_host . '/saml2/idp/metadata.php'), // SSO endpoint info of the IdP. (Authentication Request protocol). 'singleSignOnService' => array( // URL Target of the IdP where the SP will send the Authentication Request Message, // using HTTP-Redirect binding. 'url' => env('SAML2_' . $this_idp_env_id . '_IDP_SSO_URL', $idp_host . '/saml2/idp/SSOService.php'), ), // SLO endpoint info of the IdP. 'singleLogoutService' => array( // URL Location of the IdP where the SP will send the SLO Request, // using HTTP-Redirect binding. 'url' => env('SAML2_' . $this_idp_env_id . '_IDP_SL_URL', $idp_host . '/saml2/idp/SingleLogoutService.php'), ), // Public x509 certificate of the IdP. // phpcs:ignore Generic.Files.LineLength.TooLong 'x509cert' => env('SAML2_' . $this_idp_env_id . '_IDP_x509', 'MIID/TCCAuWgAwIBAgIJAI4R3WyjjmB1MA0GCSqGSIb3DQEBCwUAMIGUMQswCQYDVQQGEwJBUjEVMBMGA1UECAwMQnVlbm9zIEFpcmVzMRUwEwYDVQQHDAxCdWVub3MgQWlyZXMxDDAKBgNVBAoMA1NJVTERMA8GA1UECwwIU2lzdGVtYXMxFDASBgNVBAMMC09yZy5TaXUuQ29tMSAwHgYJKoZIhvcNAQkBFhFhZG1pbmlAc2l1LmVkdS5hcjAeFw0xNDEyMDExNDM2MjVaFw0yNDExMzAxNDM2MjVaMIGUMQswCQYDVQQGEwJBUjEVMBMGA1UECAwMQnVlbm9zIEFpcmVzMRUwEwYDVQQHDAxCdWVub3MgQWlyZXMxDDAKBgNVBAoMA1NJVTERMA8GA1UECwwIU2lzdGVtYXMxFDASBgNVBAMMC09yZy5TaXUuQ29tMSAwHgYJKoZIhvcNAQkBFhFhZG1pbmlAc2l1LmVkdS5hcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbzW/EpEv+qqZzfT1Buwjg9nnNNVrxkCfuR9fQiQw2tSouS5X37W5h7RmchRt54wsm046PDKtbSz1NpZT2GkmHN37yALW2lY7MyVUC7itv9vDAUsFr0EfKIdCKgxCKjrzkZ5ImbNvjxf7eA77PPGJnQ/UwXY7W+cvLkirp0K5uWpDk+nac5W0JXOCFR1BpPUJRbz2jFIEHyChRt7nsJZH6ejzNqK9lABEC76htNy1Ll/D3tUoPaqo8VlKW3N3MZE0DB9O7g65DmZIIlFqkaMH3ALd8adodJtOvqfDU/A6SxuwMfwDYPjoucykGDu1etRZ7dF2gd+W+1Pn7yizPT1q8CAwEAAaNQME4wHQYDVR0OBBYEFPsn8tUHN8XXf23ig5Qro3beP8BuMB8GA1UdIwQYMBaAFPsn8tUHN8XXf23ig5Qro3beP8BuMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAGu60odWFiK+DkQekozGnlpNBQz5lQ/bwmOWdktnQj6HYXu43e7sh9oZWArLYHEOyMUekKQAxOK51vbTHzzw66BZU91/nqvaOBfkJyZKGfluHbD0/hfOl/D5kONqI9kyTu4wkLQcYGyuIi75CJs15uA03FSuULQdY/Liv+czS/XYDyvtSLnu43VuAQWN321PQNhuGueIaLJANb2C5qq5ilTBUw6PxY9Z+vtMjAjTJGKEkE/tQs7CvzLPKXX3KTD9lIILmX5yUC3dLgjVKi1KGDqNApYGOMtjr5eoxPQrqDBmyx3flcy0dQTdLXud3UjWVW3N0PYgJtw5yBsS74QTGD4='), /* * Instead of use the whole x509cert you can use a fingerprint * (openssl x509 -noout -fingerprint -in "idp.crt" to generate it) */ // 'certFingerprint' => '', ), /*** * * OneLogin advanced settings * * */ // Security settings. 'security' => array( 'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', 'digestAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#sha1', /** signatures and encryptions offered */ // Indicates that the nameID of the sent by this SP // will be encrypted. 'nameIdEncrypted' => false, // Indicates whether the messages sent by this SP // will be signed. [The Metadata of the SP will offer this info]. 'authnRequestsSigned' => true, // Indicates whether the messages sent by this SP // will be signed. 'logoutRequestSigned' => true, // Indicates whether the messages sent by this SP // will be signed. 'logoutResponseSigned' => true, /** * Sign the Metadata * False || True (use sp certs) || array ( * keyFileName => 'metadata.key', * certFileName => 'metadata.crt' * ) */ 'signMetadata' => true, /** signatures and encryptions required */ // Indicates a requirement for the , and // elements received by this SP to be signed. 'wantMessagesSigned' => true, // Indicates a requirement for the elements received by // this SP to be signed. [The Metadata of the SP will offer this info]. 'wantAssertionsSigned' => true, // Indicates a requirement for the NameID received by // this SP to be encrypted. 'wantNameIdEncrypted' => false, /** * Authentication context. * Set to false and no AuthContext will be sent in the AuthNRequest, * Set true or don't present thi parameter and you will get an * AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' * Set an array with the possible auth context values: array * ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'), */ 'requestedAuthnContext' => false, ), // Contact information template, it is recommended to suply a technical and support contacts. 'contactPerson' => array( 'technical' => array( 'givenName' => 'Vincent BRIDIER', 'emailAddress' => 'vincent.bridier@ldc.fr' ), 'support' => array( 'givenName' => 'Informatique Internet', 'emailAddress' => 'informatique.internet@ldc.fr' ), ), // Organization information template, the info in en_US lang is recomended, add more if required. 'organization' => array( 'fr-FR' => array( 'name' => 'LDC', 'displayname' => 'LDC Services', 'url' => 'https://www.ldc.fr' ), ), /* Interoperable SAML 2.0 Web Browser SSO Profile [saml2int] http://saml2int.org/profile/current 'authnRequestsSigned' => false, // SP SHOULD NOT sign the , // MUST NOT assume that the IdP validates the sign 'wantAssertionsSigned' => true, 'wantAssertionsEncrypted' => true, // MUST be enabled if SSL/HTTPs is disabled 'wantNameIdEncrypted' => false, */ ); return $settings;