Using SimpleSAMLphp with Drupal 10

ln -s ../vendor/simplesamlphp/simplesamlphp/public docroot/simplesaml

cat << EOF >> simplesamlphp_files/config/config.php

#Include Acquia specific functions and settings
include_once("acquia_config.php");

EOF

if (file_exists('/var/www/site-php')) {
   require_once("/var/www/html/" . $_ENV['AH_SITE_NAME'] . "/simplesamlphp_files/config/acquia_config.php");
}

# Allow access to simplesaml paths
RewriteCond %{REQUEST_URI} !^/simplesaml

<?php

/**
 * @file
 * SimpleSAMLPhp Acquia Configuration.
 *
 * Example Acquia settings for SimpleSAMLphp. Version 20241106.1
 * You MUST edit this file!
 * Edit all sections with "EDIT THIS".
 * See full instructions at https://dev.acquia.com/blog/using-simplesamlphp-drupal-10
 */

use SimpleSAML\Logger;

if (!isset($config)) {
  $config = [];
}


/**
 * Perform any global overrides.
 * EDIT THIS SECTION.
 */

$config['technicalcontact_name'] = "Your Name";
$config['technicalcontact_email'] = "[email protected]";

$config['secretsalt'] = "EDITME";
$config['auth.adminpassword'] = "EDITME";

$config['certdir'] = "/var/www/html/{$_ENV['AH_SITE_GROUP']}.{$_ENV['AH_SITE_ENVIRONMENT']}/simplesamlphp_files/cert/";
$config['metadatadir'] = "/var/www/html/{$_ENV['AH_SITE_GROUP']}.{$_ENV['AH_SITE_ENVIRONMENT']}/simplesamlphp_files/metadata";

/**
 * Edits should not be needed below this line.
 */

/*
* Perform any Acquia Cloud overrides.
*/
if (isset($_ENV['AH_SITE_ENVIRONMENT'])) {
  // do Acquia specific translations here
  // Prevent Varnish from interfering with SimpleSAMLphp.
  // SSL terminated at the ELB / balancer so we correctly set the SERVER_PORT
  // and HTTPS for SimpleSAMLphp baseurl configuration.
  $protocol = 'http://';
  $port = '80';
  if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
     $_SERVER['SERVER_PORT'] = 443;
     $_SERVER['HTTPS'] = 'true';
     $protocol = 'https://';
     $port = $_SERVER['SERVER_PORT'];
  }
  $config['baseurlpath'] = $protocol . $_SERVER['HTTP_HOST'] . ':' . $port . '/simplesaml/';
  $config['trusted.url.domains'] = [$_SERVER['HTTP_HOST']];

  // Setup basic file based logging.
  $config['logging.handler'] = 'file';
  $config['loggingdir'] = dirname(getenv('ACQUIA_HOSTING_DRUPAL_LOG'));
  $config['logging.logfile'] = 'simplesamlphp-' . date('Ymd') . '.log';

  // Retrieve database credentials from creds.json
  $creds_json = file_get_contents('/var/www/site-php/' . $_ENV['AH_SITE_GROUP'] . '.' . $_ENV['AH_SITE_ENVIRONMENT'] . '/creds.json');
  $creds = json_decode($creds_json, true);

  $database = $creds['databases'][$_ENV['AH_SITE_GROUP']];
  // For ODE environments, the host comes from the single item in db_url_ha
  if (substr($_ENV['AH_SITE_ENVIRONMENT'], 0, 3) === 'ode') {
    $database['host'] = key($database['db_url_ha']);
  }
  // For Cloud Classic environments, the current active database host is determined by a DNS lookup
  if (isset($database['db_cluster_id'])) {
    require_once "/usr/share/php/Net/DNS2_wrapper.php";
    try {
      $resolver = new Net_DNS2_Resolver([
         'nameservers' => [
         '127.0.0.1',
         'dns-master',
         ],
      ]);
      $response = $resolver->query("cluster-{$database['db_cluster_id']}.mysql", 'CNAME');
      $database['host'] = $response->answer[0]->cname;
    }
    catch (Net_DNS2_Exception $e) {
      Logger::warning('DNS entry for Acquia database not found');
    }
  }
  $config['store.type'] = 'sql';
  $config['store.sql.dsn'] = sprintf('mysql:host=%s;port=%s;dbname=%s', $database['host'], $database['port'], $database['name']);
  $config['store.sql.username'] = $database['user'];
  $config['store.sql.password'] = $database['pass'];
  $config['store.sql.prefix'] = 'simplesaml';
}

<?php

// This file is available at
// https://docs.acquia.com/resource/simplesaml/sources/

$config = array(
  // This is a authentication source which handles admin authentication.
  'admin' => array(
    // The default is to use core:AdminPassword, but it can be replaced with
    // any authentication source.

    'core:AdminPassword',
  ),
  'default-sp' => array(
    'saml:SP',
    // The entityID is the entityID of the SP that the IdP is expecting.
    // This value must be exactly what the IdP is expecting. If the
    // entityID is not set, it defaults to the URL of the SP's metadata.
    // Don't declare an entityID for Site Factory.
    'entityID' => 'https://' . $_SERVER['HTTP_HOST'] . '/simplesaml' . '/',

    // If the IdP requires the SP to hold a certificate, the location
    // of the self-signed certificate.
    // If you need to generate a SHA256 cert, see
    // https://gist.github.com/guitarte/5745b94c6883eaddabfea68887ba6ee6
    'certificate' => "../cert/saml.crt",
    'privatekey' => "../cert/saml.pem",
    'redirect.sign' => TRUE,
    'redirect.validate' => TRUE,

    // The entityID of the IdP.
    // This is included in the metadata from the IdP.
    'idp' => 'idp entityID goes here',

    // NameIDFormat is included in the metadata from the IdP
    'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',

    // If the IdP does not pass any attributes, but provides a NameID in
    // the authentication response, we can filter and add the value as an
    // attribute.
    // See https://simplesamlphp.org/docs/stable/saml:nameidattribute
    'authproc' => array(
      20 => array(
        'class' => 'saml:NameIDAttribute',
        'format' => '%V',
      ),
    ),
    // The RelayState parameter needs to be set if SSL is terminated
    // upstream. If you see the SAML response come back with
    // https://example.com:80/saml_login, you likely need to set this.
    // See https://github.com/simplesamlphp/simplesamlphp/issues/420
    'RelayState' => 'https://' . $_SERVER['HTTP_HOST'] . '/saml_login',

    // If working with ADFS, Microsoft may soon only allow SHA256 certs.
    // You must specify signature.algorithm as SHA256.
    // Defaults to SHA1 (http://www.w3.org/2000/09/xmldsig#rsa-sha1)
    // See https://docs.microsoft.com/en-us/security/trusted-root/program-requirements

    // 'signature.algorithm'  => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
  ),
);