对于那些还在努力奋斗的人们Azure Active Directory SSO in Laravel。如果您愿意使用 SAML。
这是他们可以使用的存储库。
https://github.com/aacotroneo/laravel-saml2 https://github.com/aacotroneo/laravel-saml2
只要您在 Azure 门户上正确完成了 SSO 设置，它的使用就非常简单。
这是两步过程
步骤 1 - 在 Azure 门户上设置 SSO 项目
a) Go to Azure Active Directory进而Enterprise Application
b)添加新应用程序并选择Non-gallery Application
c) Click Set up single sign on然后点击SAML Box
d)编辑basic SAML configuration并添加以下内容
标识符（实体 ID） - https://my-laravel-website.com/saml2/aad/metadata https://my-laravel-website.com/saml2/aad/metadata
回复 URL（断言消费者服务 URL） -
https://my-laravel-website.com/saml2/aad/acs https://my-laravel-website.com/saml2/aad/acs
（这些网址来自哪里，我将在Step 2。现在只需保存它即可。）
e)下载Federation Metadata XML from SAML Signing Certificate部分，在您的系统上
f)接下来将用户分配到当前的 SAML SSO 项目。
注意-如果您的帐户中不存在用户。然后你需要创建一个并分配一些角色（这是必要的）.
这是设置步骤 1 的教程https://www.youtube.com/watch?v=xn_8Fm7S7y8 https://www.youtube.com/watch?v=xn_8Fm7S7y8
.
第 2 步 - 在项目中安装并配置 Laravel SAML 2 包
a) run composer require aacotroneo/laravel-saml2
b) run php artisan vendor:publish --provider="Aacotroneo\Saml2\Saml2ServiceProvider"
c)配置/saml2_settings.php
<?php
return $settings = array(
/**
* Array of IDP prefixes to be configured e.g. 'idpNames' => ['test1', 'test2', 'test3'],
* Separate routes will be automatically registered for each IDP specified with IDP name as prefix
* Separate config file saml2/<idpName>_idp_settings.php should be added & configured accordingly
*/
'idpNames' => ['aad'],
/**
* If 'useRoutes' is set to true, the package defines five new routes for reach entry in idpNames:
*
* Method | URI | Name
* -------|------------------------------------|------------------
* POST | {routesPrefix}/{idpName}/acs | saml_acs
* GET | {routesPrefix}/{idpName}/login | saml_login
* GET | {routesPrefix}/{idpName}/logout | saml_logout
* GET | {routesPrefix}/{idpName}/metadata | saml_metadata
* GET | {routesPrefix}/{idpName}/sls | saml_sls
*/
'useRoutes' => true,
/**
* Optional, leave empty if you want the defined routes to be top level, i.e. "/{idpName}/*"
*/
'routesPrefix' => 'saml2',
/**
* which middleware group to use for the saml routes
* Laravel 5.2 will need a group which includes StartSession
*/
'routesMiddleware' => ['saml'],
/**
* Indicates how the parameters will be
* retrieved from the sls request for signature validation
*/
'retrieveParametersFromServer' => false,
/**
* Where to redirect after logout
*/
'logoutRoute' => '/login',
/**
* Where to redirect after login if no other option was provided
*/
'loginRoute' => '/dashboard',
/**
* Where to redirect after login if no other option was provided
*/
'errorRoute' => '/login',
// If 'proxyVars' is True, then the Saml lib will trust proxy headers
// e.g X-Forwarded-Proto / HTTP_X_FORWARDED_PROTO. This is useful if
// your application is running behind a load balancer which terminates
// SSL.
'proxyVars' => true,
/**
* (Optional) Which class implements the route functions.
* If commented out, defaults to this lib's controller (Aacotroneo\Saml2\Http\Controllers\Saml2Controller).
* If you need to extend Saml2Controller (e.g. to override the `login()` function to pass
* a `$returnTo` argument), this value allows you to pass your own controller, and have
* it used in the routes definition.
*/
'saml2_controller' => 'App\Http\Controllers\Auth\SAML2LoginController',
);
Note - Part d) of Step 1来自以下
d)创建一个新文件config/saml2/aad_idp_settings.php并复制内容config/saml2/test_idp_settings.php进去。改变$this_idp_env_id in aad_idp_settings.php to 'AAD'。所以最后的aad_idp_settings.php将如下所示。
<?php
// If you choose to use ENV vars to define these values, give this IdP its own env var names
// so you can define different values for each IdP, all starting with 'SAML2_'.$this_idp_env_id
$this_idp_env_id = 'AAD';
//This is variable is for simplesaml example only.
// For real IdP, you must set the url values in the 'idp' config to conform to the IdP's real urls.
$idp_host = env('SAML2_'.$this_idp_env_id.'_IDP_HOST', 'http://localhost:8000/simplesaml');
return $settings = array(
/*****
* One Login Settings
*/
// If 'strict' is True, then the PHP Toolkit will reject unsigned
// or unencrypted messages if it expects them signed or encrypted
// Also will reject the messages if not strictly follow the SAML
// standard: Destination, NameId, Conditions ... are validated too.
'strict' => true, //@todo: make this depend on laravel config
// Enable debug mode (to print errors)
'debug' => env('APP_DEBUG', false),
// Service Provider Data that we are deploying
'sp' => array(
// Specifies constraints on the name identifier to be used to
// represent the requested subject.
// Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
// Usually x509cert and privateKey of the SP are provided by files placed at
// the certs folder. But we can also provide them with the following parameters
'x509cert' => env('SAML2_'.$this_idp_env_id.'_SP_x509',''),
'privateKey' => env('SAML2_'.$this_idp_env_id.'_SP_PRIVATEKEY',''),
// Identifier (URI) of the SP entity.
// Leave blank to use the '{idpName}_metadata' route, e.g. 'test_metadata'.
'entityId' => env('SAML2_'.$this_idp_env_id.'_SP_ENTITYID',''),
// Specifies info about where and how the <AuthnResponse> message MUST be
// returned to the requester, in this case our SP.
'assertionConsumerService' => array(
// URL Location where the <Response> from the IdP will be returned,
// using HTTP-POST binding.
// Leave blank to use the '{idpName}_acs' route, e.g. 'test_acs'
'url' => '',
),
// Specifies info about where and how the <Logout Response> message MUST be
// returned to the requester, in this case our SP.
// Remove this part to not include any URL Location in the metadata.
'singleLogoutService' => array(
// URL Location where the <Response> from the IdP will be returned,
// using HTTP-Redirect binding.
// Leave blank to use the '{idpName}_sls' route, e.g. 'test_sls'
'url' => '',
),
),
// Identity Provider Data that we want connect with our SP
'idp' => array(
// Identifier of the IdP entity (must be a URI)
'entityId' => env('SAML2_'.$this_idp_env_id.'_IDP_ENTITYID', $idp_host . '/saml2/idp/metadata.php'),
// SSO endpoint info of the IdP. (Authentication Request protocol)
'singleSignOnService' => array(
// URL Target of the IdP where the SP will send the Authentication Request Message,
// using HTTP-Redirect binding.
'url' => env('SAML2_'.$this_idp_env_id.'_IDP_SSO_URL', $idp_host . '/saml2/idp/SSOService.php'),
),
// SLO endpoint info of the IdP.
'singleLogoutService' => array(
// URL Location of the IdP where the SP will send the SLO Request,
// using HTTP-Redirect binding.
'url' => env('SAML2_'.$this_idp_env_id.'_IDP_SL_URL', $idp_host . '/saml2/idp/SingleLogoutService.php'),
),
// Public x509 certificate of the IdP
'x509cert' => env('SAML2_'.$this_idp_env_id.'_IDP_x509', 'MIID/TCCAuWgAwIBAgIJAI4R3WyjjmB1MA0GCS'),
/*
* Instead of use the whole x509cert you can use a fingerprint
* (openssl x509 -noout -fingerprint -in "idp.crt" to generate it)
*/
// 'certFingerprint' => '',
),
/***
*
* OneLogin advanced settings
*
*
*/
// Security settings
'security' => array(
/** signatures and encryptions offered */
// Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
// will be encrypted.
'nameIdEncrypted' => false,
// Indicates whether the <samlp:AuthnRequest> messages sent by this SP
// will be signed. [The Metadata of the SP will offer this info]
'authnRequestsSigned' => false,
// Indicates whether the <samlp:logoutRequest> messages sent by this SP
// will be signed.
'logoutRequestSigned' => false,
// Indicates whether the <samlp:logoutResponse> messages sent by this SP
// will be signed.
'logoutResponseSigned' => false,
/* Sign the Metadata
False || True (use sp certs) || array (
keyFileName => 'metadata.key',
certFileName => 'metadata.crt'
)
*/
'signMetadata' => false,
/** signatures and encryptions required **/
// Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
// <samlp:LogoutResponse> elements received by this SP to be signed.
'wantMessagesSigned' => false,
// Indicates a requirement for the <saml:Assertion> elements received by
// this SP to be signed. [The Metadata of the SP will offer this info]
'wantAssertionsSigned' => false,
// Indicates a requirement for the NameID received by
// this SP to be encrypted.
'wantNameIdEncrypted' => false,
// Authentication context.
// Set to false and no AuthContext will be sent in the AuthNRequest,
// Set true or don't present thi parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
// Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
'requestedAuthnContext' => true,
),
// Contact information template, it is recommended to suply a technical and support contacts
'contactPerson' => array(
'technical' => array(
'givenName' => 'name',
'emailAddress' => '[email protected] /cdn-cgi/l/email-protection'
),
'support' => array(
'givenName' => 'Support',
'emailAddress' => '[email protected] /cdn-cgi/l/email-protection'
),
),
// Organization information template, the info in en_US lang is recomended, add more if required
'organization' => array(
'en-US' => array(
'name' => 'Name',
'displayname' => 'Display Name',
'url' => 'http://url'
),
),
/* Interoperable SAML 2.0 Web Browser SSO Profile [saml2int] http://saml2int.org/profile/current
'authnRequestsSigned' => false, // SP SHOULD NOT sign the <samlp:AuthnRequest>,
// MUST NOT assume that the IdP validates the sign
'wantAssertionsSigned' => true,
'wantAssertionsEncrypted' => true, // MUST be enabled if SSL/HTTPs is disabled
'wantNameIdEncrypted' => false,
*/
);
e)现在我们需要放置以下 ENV 变量
SAML2_AAD_IDP_ENTITYID=
SAML2_AAD_IDP_SSO_URL=
SAML2_AAD_IDP_SL_URL=
SAML2_AAD_IDP_x509=
前 3 个环境变量的值将来自此处。
最后一个环境变量将来自以下内容
f) run php artisan make:provider SAML2ServiceProvider。这将创建一个文件app/Providers/SAML2ServiceProvider.php.
In the boot方法粘贴以下代码片段
Event::listen('Aacotroneo\Saml2\Events\Saml2LoginEvent', function (Saml2LoginEvent $event) {
$messageId = $event->getSaml2Auth()->getLastMessageId();
// Add your own code preventing reuse of a $messageId to stop replay attacks
$user = $event->getSaml2User();
$userData = [
'id' => $user->getUserId(),
'attributes' => $user->getAttributes(),
'assertion' => $user->getRawSamlAssertion()
];
$inputs = [
'sso_user_id' => $user->getUserId(),
'username' => self::getValue($user->getAttribute('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')),
'email' => self::getValue($user->getAttribute('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name')),
'first_name' => self::getValue($user->getAttribute('http://schemas.microsoft.com/identity/claims/displayname')),
'last_name' => self::getValue($user->getAttribute('http://schemas.microsoft.com/identity/claims/displayname')),
'password' => Hash::make('anything'),
];
$user = User::where('sso_user_id', $inputs['sso_user_id'])->where('email', $inputs['email'])->first();
if(!$user){
$res = PortalUser::store($inputs);
if($res['status'] == 'success'){
$user = $res['data'];
Auth::guard('web')->login($user);
}else{
Log::info('SAML USER Error '.$res['messages']);
}
}else{
Auth::guard('web')->login($user);
}
});
最后在中注册该提供商提供者的数组config/app.php.
。
测试 SAML AAD SSO
Go to https://[your-site-url]/saml2/aad/login
