SAML SSO WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

SAML SSO

SAML SSO plugin for Wordpress
Report Bug · Request Feature

Table of Contents

• Table of Contents
• About SAML SSO
  • Built With
• Getting Started
  • Prerequisites
  • Installation
  • Configuration
    • Required PHP-SAML Constants
    • Optional PHP-SAML Constants
    • Additional PHP-SAML settings.
    • Other constants
• Usage
• Roadmap
• Contributing
• License
• Acknowledgements

About SAML SSO

SAML SSO login plugin for wordpress. This plugin will add 3 endpoints required for SAML SSO to operate.

/saml/acs
/saml/logout
/saml/metadata

NOTE: Currently only invokable programatically se usage for instructions.

Built With

• Onelogin PHP SAML

Getting Started

To get a local copy up and running follow these steps.

Prerequisites

• Composer
  Install instructions

Installation

1. Clone the repo

   git clone https://github.com/helsingborg-stad/saml-sso.git

2. Install Composer packages

   composer install

Configuration

Configuration is done with constants in wp-config.php
PHP-SAML constants is in direct relation to settings the PHP-SAML require.
Check documentation in PHP SAML for more information about these settings.

Example configuration:

// NOTE Never place certificates below the root web folder!
$idpCertificateFile = '/etc/certs/idp-cert.cer';
$spCertificateFile = '/etc/certs/sp-cert.cer';
$spCertificateKeyFile = '/etc/certs/sp-cert.key';

define('SAML_SP_ENITITY_ID', 'https://www.example.com/saml/metadata');
define('SAML_SP_ACS_URL', 'https://www.example.com/saml/acs');
define('SAML_IDP_ENTITY_ID', 'https://www.example.com/adfs/services/trust');
define('SAML_IDP_SSO_URL', 'https://www.example.com/adfs/ls/');
define('SAML_IDP_SLS_URL', 'https://www.example.com/adfs/ls/');

if (file_exists($idpCertificateFile)) {
    define('SAML_IDP_CERTIFICATE', file_get_contents($idpCertificateFile));
}

if (file_exists($spCertificateFile)) {
    define('SAML_SP_CERTIFICATE', file_get_contents($spCertificateFile));
}

if (file_exists($spCertificateKeyFile)) {
    define('SAML_SP_CERTIFICATE_KEY', file_get_contents($spCertificateKeyFile));
}

Required PHP-SAML Constants

The below constants is required to be set in your wp-config.php file.

SAML_SP_ENITITY_ID
SAML_SP_ACS_URL
SAML_SP_CERTIFICATE
SAML_SP_CERTIFICATE_KEY
SAML_IDP_ENTITY_ID
SAML_IDP_SSO_URL
SAML_IDP_SLS_URL

Optional PHP-SAML Constants

Optional constants and their default value to be set in your wp-config.php file.

SAML_STRICT => true
SAML_DEBUG => false
SAML_SP_ACS_BINDING => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
SAML_SP_NAME_ID_FORMAT => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
SAML_IDP_SSO_BINDING => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
SAML_IDP_SLS_BINDING => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
SAML_IDP_CERTIFICATE => null,
SAML_SECURITY_REQUESTED_AUTHN_CONTEXT => false,
SAML_SECURITY_SIGNATURE_ALGORITHM' => 'http://www.w3.org/2001/04/xmlenc#sha256',
SAML_SECURITY_DIGEST_ALGORITHM' => 'http://www.w3.org/2001/04/xmlenc#sha256',
SAML_SECURITY_LOWERCASE_URL_ENCODING => true,

Additional PHP-SAML settings.

Additional PHP-SAML settings can be added with the saml-sso-settings filter.

Other constants

Two constants is present for mapping configuration.
Overwrite this with constants SAML_ATTRIBUTES_MAPPING and SAML_AD_GROUP_ROLE_MAPPING in wp-config-php.

Default values:

SAML_ATTRIBUTES_MAPPING = [
    'username' => 'http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname',
    'first-name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
    'last-name' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
    'email' => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
    'ad-groups' => 'http://schemas.xmlsoap.org/claims/Group',
];

SAML_MAP_TO_AD_GROUP = true;

SAML_AD_GROUP_ROLE_MAPPING = [
    'Domain Users' => 'subscriber',
    'Domain Admins' => 'administrator'
];

Usage

When configured and plugin is activated, the code below can be used to trigger a SAML SSO login.

if (class_exists('\SAMLSSO\Client')) {
    $client = new \SAMLSSO\Client();
    // Supply where to redirect after login.
    $client->authenticate('https://www.example.com/redirect');
}

Roadmap

See the open issues for a list of proposed features (and known issues).

Contributing

Contributions are what make the open source community such an amazing place to be learn, inspire, and create. Any contributions you make are greatly appreciated.

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

License

Distributed under the MIT License.

Acknowledgements

• othneildrew Best README Template