3breadt/simplesamlphp

By 3breadt

•Updated almost 2 years ago

Image for using simplesamlphp as an IdP in test environments.

Image

Security

Integration & delivery

Developer tools

2.1K

Overview Tags

3breadt/simplesamlphp repository overview

⁠Docker Test SAML 2.0 Identity Provider (IdP)

Docker container with a plug and play SAML 2.0 Identity Provider (IdP) for development and testing.

Built with SimpleSAMLphp⁠. Based on official PHP8 Apache image⁠.

SimpleSAMLphp is logging to stdout on debug log level. Apache is logging error and access log to stdout.

THIS IMAGE IS NOT SUITABLE FOR USE IN PRODUCTION ENVIRONMENTS, USE ONLY FOR TESTING.

⁠Changelog

⁠Version 1.0.0

Added HTTPS support
Added configurable cookie lifetime
Based on kenchan0130/simplesamlphp:v1.19.9

⁠Usage

⁠Using docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -d 3breadt/simplesamlphp

⁠Using docker-compose

version: "3"
services:
  idp:
    image: 3breadt/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp

There are two static users configured in the IdP with the following data:

Username	Password
user1	password
user2	password

And there is one admin:

Username	Password
admin	secret

⁠Environment Variables

Name	Required/Optional	Description
`SIMPLESAMLPHP_SP_ENTITY_ID`	Required	The entity ID of your SP.
`SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE`	Requried	The assertion consumer service of your SP.
`SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE`	Optional	The single logout url of your SP.
`SIMPLESAMLPHP_IDP_ADMIN_PASSWORD`	Optional	The password of admin of this IdP. Default is `secret`.
`SIMPLESAMLPHP_IDP_SECRET_SALT`	Optional	This is a secret salt used by this IdP when it needs to generate a secure hash of a value. Default is `defaultsecretsalt`.
`SIMPLESAMLPHP_IDP_SESSION_DURATION_SECONDS`	Optional	This value is the duration of the session of this IdP in seconds. Defaults to 8 hours.
`SIMPLESAMLPHP_IDP_COOKIE_LIFETIME_SECONDS`	Optional	This value is the lifetime of the session cookie in seconds. Defaults to 0, meaning the cookie expires when the browser is closed.
`SIMPLESAMLPHP_IDP_BASE_URL`	Optional	This value allows you to override the base URL. Valuable for setting an `https://` base url behind a reverse proxy. If you set this variable, please end it with a trailing `/` example: `https://my.proxy.com/` Default is `` (empty string).

⁠Advanced Usage

⁠Customize IdP Users

If you want to customize IdP users, you can define your own users by mounting a configuration file.

<?php
// These attributes mimic those of Azure AD.
$test_user_base = array(
    'http://schemas.microsoft.com/identity/claims/tenantid' => 'ab4f07dc-b661-48a3-a173-d0103d6981b2',
    'http://schemas.microsoft.com/identity/claims/objectidentifier' => '',
    'http://schemas.microsoft.com/identity/claims/displayname' => '',
    'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' => array(),
    'http://schemas.microsoft.com/identity/claims/identityprovider' => 'https://sts.windows.net/da2a1472-abd3-47c9-95a4-4a0068312122/',
    'http://schemas.microsoft.com/claims/authnmethodsreferences' => array('http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password', 'http://schemas.microsoft.com/claims/multipleauthn'),
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => ''
);

$config = array(
    'admin' => array(
        'core:AdminPassword',
    ),
    'example-userpass' => array(
        'exampleauth:UserPass',
        'user1:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2d75402-e1ae-40fe-8cc9-98ca1ab9cd5e',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User1 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User1',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
        'user2:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2a94916-2fcb-4b68-9eb1-5436309006a3',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User2 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User2',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
    ),
);

If you save this source as authsources.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -v $PWD/authsources.php:/var/www/simplesamlphp/config/authsources.php \
  -d 3breadt/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: 3breadt/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp
    volumes:
      - authsources.php:/var/www/simplesamlphp/config/authsources.php

For detailed attributes, see SimpleSAMLphp Identity Provider QuickStart#Authentication module⁠.

⁠Customize SP remote metadata reference

If you want to customize SP remote metadata reference, you can define your own users by mounting a configuration file.

<?php
/* The index of the array is the entity ID of this SP. */
$metadata['entity-id-1'] = array(
    'AssertionConsumerService' => 'http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp',
    ForceAuthn => true
);
$metadata['entity-id-2'] = array(
    'AssertionConsumerService' => 'http://localhost/saml/acs',
    'SingleLogoutService' => 'http://localhost/saml/logout'
);

If you save this source as saml20-sp-remote.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -v saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php \
  -d 3breadt/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: 3breadt/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    volumes:
      - saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php

For detailed attributes, see SP remote metadata reference#SAML 2.0 options⁠.

⁠Based On

⁠License

MIT

Tag summary

Recent tags

Content type

Image

Digest

sha256:de67cea30…

Size

212.1 MB

Last updated

almost 2 years ago

docker pull 3breadt/simplesamlphp