After creating the acquia_config.php file, you must provide information about your service provider (SP) and identity provider (IdP) to SimpleSAMLphp in an authsources.php
file, which configures the service provider.
The values in the authsources.php
file control the following settings:
- Entity ID of your SP, which is a unique identifier for your SP. This value defaults to the URL of the service provider’s metadata. You may want to override this value with a more human-readable name.
- Entity ID of your IdP, which is a unique identifier for your IdP. This value must match the entity ID value in the metadata provided to you by your IdP.
- The NameIDFormat, which your IdP includes in its metadata.
- The location of a self-signed SSL certificate, if your IdP requires your service provider to have a self-signed SSL certificate.
If your application has separate IdPs for both non-production and production environments, you must set entityID
values based on environment. You can change the value of entityID
based on the hostname or any other criteria necessary.
To ensure that your authsources.php
can be available for general use, Acquia recommends storing the authsources.php
file in your Git repository.
Multisite and Site Factory applications
For multisite applications, including Site Factory, you can use the default-sp
array defined in authsources.php
as a common configuration. For an example, see Modifying authsources.php for multisite use. If you don’t specify a value for entityID
, Acquia will use the metadata URL, creating unique values for all environments and websites.
Creating and configuring authentication sources
To create and configure the authsources.php
file SimpleSAMLphp needs, complete the following steps:
- Download the
authsources.php
file, and then save the file in thesimplesamlphp/config
directory. - Review the customizations described in Modifying authsources.php for multisite use, and then apply any modifications that meet your application’s needs.
- Save the
authsources.php
file, and then commit the file to your Git repository.
Next, you must configure your identity provider.
Example authsources.php file
<?php
// This file is available at
// https://docs.acquia.com/resource/simplesaml/sources/
$config = array(
// This is a authentication source which handles admin authentication.
'admin' => array(
// The default is to use core:AdminPassword, but it can be replaced with
// any authentication source.
'core:AdminPassword',
),
'default-sp' => array(
'saml:SP',
// The entityID is the entityID of the SP that the IdP is expecting.
// This value must be exactly what the IdP is expecting. If the
// entityID is not set, it defaults to the URL of the SP's metadata.
// Don't declare an entityID for Site Factory.
'entityID' => 'SP EntityID',
// If the IdP requires the SP to hold a certificate, the location
// of the self-signed certificate.
// If you need to generate a SHA256 cert, see
// https://gist.github.com/guitarte/5745b94c6883eaddabfea68887ba6ee6
'certificate' => "../cert/saml.crt",
'privatekey' => "../cert/saml.pem",
'redirect.sign' => TRUE,
'redirect.validate' => TRUE,
// The entityID of the IdP.
// This is included in the metadata from the IdP.
'idp' => 'IdP EntityID',
// NameIDFormat is included in the metadata from the IdP
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
// If the IdP does not pass any attributes, but provides a NameID in
// the authentication response, we can filter and add the value as an
// attribute.
// See https://simplesamlphp.org/docs/stable/saml:nameidattribute
'authproc' => array(
20 => array(
'class' => 'saml:NameIDAttribute',
'format' => '%V',
),
),
// The RelayState parameter needs to be set if SSL is terminated
// upstream. If you see the SAML response come back with
// https://example.com:80/saml_login, you likely need to set this.
// See https://github.com/simplesamlphp/simplesamlphp/issues/420
'RelayState' => 'https://' . $_SERVER['HTTP_HOST'] . '/saml_login',
// If working with ADFS, Microsoft may soon only allow SHA256 certs.
// You must specify signature.algorithm as SHA256.
// Defaults to SHA1 (http://www.w3.org/2000/09/xmldsig#rsa-sha1)
// See https://docs.microsoft.com/en-us/security/trusted-root/program-requirements
// 'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
),
);
Modifying authsources.php for multisite use
When configuring SimpleSAMLphp for multisite use, add logic to your authsources.php
file to create different keys in the array for each website in the multisite. For example, the Dev environment may contain two websites: siteA.example.com
and siteB.example.com
. Your authsources.php
file should populate the $config
array with an array for each website, as indicated by subsite-a
and subsite-b
in the following example:
1<?php
2$config = array(
3 'subsite-a' => array(
4 'saml:SP',
5 'entityID' => 'Subsite-A-SP',
6 'certificate' => "../cert/saml-sitesite-a.crt",
7 'privatekey' => "../cert/saml-sitesite-a.pem",
8 'redirect.sign' => TRUE,
9 'redirect.validate' => TRUE,
10 'idp' => 'IdP EntityID',
11 'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
12 ),
13 'subsite-b' => array(
14 'saml:SP',
15 'entityID' => 'Subsite-B-SP',
16 'certificate' => "../cert/saml-site-b.crt",
17 'privatekey' => "../cert/saml-site-b.pem",
18 'redirect.sign' => TRUE,
19 'redirect.validate' => TRUE,
20 'idp' => 'IdP EntityID',
21 'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
22 ),
23);
Troubleshooting the authsources.php file
If your application displays the following error message:
Caused by: sspmod_saml_Error: Requester/InvalidNameIDPolicy
you must patch /simplesamlphp/modules/saml/lib/Message.php
to set the NameIDPolicy
to FALSE
, as indicated by the following example:
// NameIDFormat is included in the metadata from the IdP
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
// If the IdP does not pass any attributes,
// but provides a NameID in the authentication response
'NameIDPolicy' => false,
// We can filter and add the value as an attribute
// https://simplesamlphp.org/docs/stable/saml:nameidattribute