Skip to content

Commit c01485a

Browse files
caleelicaleeli
authored
Merge pull request #5717 from ProcessMaker/feature/FOUR-12244
FOUR-12244 implement IDP for processmaker
2 parents c9c223e + bc782a7 commit c01485a

File tree

10 files changed

+255
-6
lines changed

10 files changed

+255
-6
lines changed

‎.env.example

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,4 @@ BROWSER_CACHE=true
4040
VUE_APP_WEBSOCKET_PROVIDER=socket.io
4141
VUE_APP_WEBSOCKET_PROVIDER_URL=ws:127.0.0.1:1234
4242
VUE_APP_COLLABORATIVE_ENABLED=true
43+
SAML_SP_DESTINATION="https://keycloak.processmaker.net/realms/realmname/broker/saml/endpoint"

‎composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
"require": {
1313
"php": "^8.2",
1414
"babenkoivan/elastic-scout-driver": "^3.0",
15+
"codegreencreative/laravel-samlidp": "^5.2",
1516
"composer/semver": "^3.3",
1617
"darkaonline/l5-swagger": "^8.3",
1718
"doctrine/dbal": "^3.5",

‎composer.lock

Lines changed: 165 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/filesystems.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@
109109
'visibility' => 'public',
110110
],
111111

112+
'samlidp' => [
113+
'driver' => 'local',
114+
'root' => storage_path() . '/samlidp',
115+
],
116+
112117
],
113118

114119
/*

‎config/samlidp.php

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?php
2+
3+
return [
4+
/*
5+
|--------------------------------------------------------------------------
6+
| SAML idP configuration file
7+
|--------------------------------------------------------------------------
8+
|
9+
| Use this file to configure the service providers you want to use.
10+
|
11+
*/
12+
// Outputs data to your laravel.log file for debugging
13+
'debug' => false,
14+
// Define the email address field name in the users table
15+
'email_field' => 'email',
16+
// Define the name field in the users table
17+
'name_field' => 'name',
18+
// The URI to your login page
19+
'login_uri' => 'login',
20+
// Log out of the IdP after SLO
21+
'logout_after_slo' => env('LOGOUT_AFTER_SLO', false),
22+
// The URI to the saml metadata file, this describes your idP
23+
'issuer_uri' => 'saml/metadata',
24+
// The certificate
25+
'cert' => env('SAMLIDP_CERT'),
26+
// Name of the certificate PEM file, ignored if cert is used
27+
'certname' => 'cert.pem',
28+
// The certificate key
29+
'key' => env('SAMLIDP_KEY'),
30+
// Name of the certificate key PEM file, ignored if key is used
31+
'keyname' => 'key.pem',
32+
// Encrypt requests and responses
33+
'encrypt_assertion' => true,
34+
// Make sure messages are signed
35+
'messages_signed' => true,
36+
// Defind what digital algorithm you want to use
37+
'digest_algorithm' => \RobRichards\XMLSecLibs\XMLSecurityDSig::SHA1,
38+
// list of all service providers
39+
'sp' => [
40+
// Base64 encoded ACS URL
41+
base64_encode(env('SAML_SP_DESTINATION', '')) => [
42+
'destination' => env('SAML_SP_DESTINATION', ''),
43+
'logout' => '',
44+
// SP certificate
45+
'certificate' => '',
46+
// Turn off auto appending of the idp query param
47+
'query_params' => false,
48+
// Turn off the encryption of the assertion per SP
49+
'encrypt_assertion' => false,
50+
],
51+
],
52+
53+
// If you need to redirect after SLO depending on SLO initiator
54+
// key is beginning of HTTP_REFERER value from SERVER, value is redirect path
55+
'sp_slo_redirects' => [
56+
// 'https://example.com' => 'https://example.com',
57+
],
58+
59+
// All of the Laravel SAML IdP event / listener mappings.
60+
'events' => [
61+
'CodeGreenCreative\SamlIdp\Events\Assertion' => [],
62+
'Illuminate\Auth\Events\Logout' => ['CodeGreenCreative\SamlIdp\Listeners\SamlLogout'],
63+
'Illuminate\Auth\Events\Authenticated' => ['CodeGreenCreative\SamlIdp\Listeners\SamlAuthenticated'],
64+
'Illuminate\Auth\Events\Login' => ['CodeGreenCreative\SamlIdp\Listeners\SamlLogin'],
65+
],
66+
67+
// List of guards saml idp will catch Authenticated, Login and Logout events
68+
'guards' => ['web'],
69+
];

‎resources/views/auth/newLogin.blade.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<head>
44
<meta charset="utf-8">
55
<meta http-equiv="X-UA-Compatible" content="IE=edge">
6-
<meta http-equiv="Content-Security-Policy" content="script-src * 'unsafe-inline' 'unsafe-eval'; object-src 'none';">
6+
<meta http-equiv="Content-Security-Policy" content="script-src * 'unsafe-inline' 'unsafe-eval'; object-src 'none';">
77
<meta name="viewport" content="width=device-width, initial-scale=1">
88
<meta name="csrf-token" content="{{ csrf_token() }}">
99
<meta name="i18n-mdate" content='{!! json_encode(ProcessMaker\i18nHelper::mdates()) !!}'>
@@ -44,6 +44,9 @@
4444
@if (session()->has('login-error'))
4545
<div class="alert alert-danger">{{ session()->get('login-error')}}</div>
4646
@endif
47+
48+
@samlidp
49+
4750
<div class="form-group">
4851
<label for="username">{{ __('Username') }}</label>
4952
<div class="password-container">
@@ -110,7 +113,7 @@
110113
if (isMobileDevice) {
111114
document.cookie = "isMobile=true"
112115
}
113-
116+
114117
const togglePassword = document.querySelector('#togglePassword');
115118
const password = document.querySelector('#password');
116119

‎storage/samlidp/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*
2+
!.gitignore

‎tests/Feature/AuthTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ public function testAuthLoginAndLogout()
2121
$user = User::factory()->create();
2222
Auth::login($user);
2323
$this->assertEquals($user->id, Auth::id());
24-
Auth::logout();
24+
Auth::logoutCurrentDevice();
2525
$this->assertNull(Auth::user());
2626
}
2727

‎tests/Feature/RedirectTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public function test401RedirectsToLogin()
2727
$response = $this->get('/requests');
2828
$response->assertStatus(200);
2929
$response->assertViewIs('requests.index');
30-
Auth::logout();
30+
Auth::logoutCurrentDevice();
3131
$response = $this->get('/requests');
3232
//302 because we want to make sure they are being redirected
3333
$response->assertStatus(302);

‎tests/Feature/SecurityLoggerTest.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,11 @@ public function testLogSecurityEvents()
4343
$this->assertDatabaseHas('security_logs', ['event' => 'login', 'user_id' => $user->id]);
4444

4545
// Attempt to logout
46-
Auth::logout();
46+
if (in_array(Auth::getDefaultDriver(), config('samlidp.guards'))) {
47+
return redirect('saml/logout');
48+
} else {
49+
Auth::logout();
50+
}
4751
$this->assertDatabaseHas('security_logs', ['event' => 'logout', 'user_id' => $user->id]);
4852

4953
// Disable security logging

0 commit comments

Comments
 (0)