KNF:OneLogin configureren als Service Provider/en

Entree Federation: Implement OneLogin PHP as a Service Provider

Nederlands

English

This manual provides a guide on how to implement the OneLogin PHP library as a Service Provider.

Step 1: Installation

1. Download the PHP toolkit at https://github.com/onelogin/php-saml.
2. Unpack the zip and copy the directory php-saml-master to the right location on your webserver.
3. Rename the demo1 directory to the preferred projectname (for example entreefederation).
4. Delete the file settings_example.php from the project directory.
5. Copy the file settings_example.php from the main directory to the project directory.
6. Rename this file to settings.php.
7. Rename the file advanced_settings_example.php in the main directory to advanced_settings.php.

Step 2: Generating a certificate

The messages that are exchanged between the OneLogin application and Entree Federation during an authentication need to be signed. For this purpose a certificate has to be generated.

1. In the main directory (php-saml-master) you will find the sub directory certs.
2. Go to the certs directory.
3. Execute the following command in order to generate the certificate:

   openssl req -newkey rsa:2048 -new -x509 -days 3652 -nodes -out sp.crt -keyout sp.key
   

4. Follow the instructions and provide the correct information.

Step 3: Edit settings.php

The settings.php in the project directory needs to be edited in order to realise the connection with Entree Federation.
NOTE! The following example code exists of additions or changes. The php tags are not included.
The changes are described in the comments.

$settings = array (
    'strict' => false,
    'debug' => false,
    // Provide the base URL of your application (for example: https://example.com)
    'baseurl' => '',
    // Information about the Service Provider application
    'sp' => array (
        // The entityID is the unique idenitfier of the application (for example: https://example.com/projectname)
        'entityId' => '',
        // Information about the endpoint Entree Federatie will use to send its responses to
        'assertionConsumerService' => array (
            // The URL of the endpoint (for example: https://example.com/index.php?acs)
            'url' => '',
             // SAML protocol binding that will be used for sending the responses
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ),
        // Format of the identifier van het onderwerp van authenticatie
        // Entree Federation requires this to be 'unspecified'
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
        // Information about the certificate generated in step 2
        'x509cert' => '...'
        'privateKey' => '...'
    ),
    // Information about the Entree Federation application
    // This information can be found in the metadata of Entree Federation
    // Metadata staging environment: https://hub-s.entree.kennisnet.nl/openaselect/profiles/saml/
    // Metadata production environment: https://hub.entree.kennisnet.nl/openaselect/profiles/saml/
    'idp' => array (
        // The unique identifier of Entree Federation
        'entityId' => 'https://engine.entree.kennisnet.nl/authentication/idp/metadata',
        //'entityId' => 'https://engine.entree-s.kennisnet.nl/authentication/idp/metadata',
        // Information about the endpoint of the Entree Federation to which the authentication requests will be sent
        'singleSignOnService' => array (
            // The URL of the endpoint
            'url' => 'https://engine.entree.kennisnet.nl/authentication/idp/single-sign-on',
            //'url' => 'https://engine.entree-s.kennisnet.nl/authentication/idp/single-sign-on',
            // SAML protocol binding that will be used for sending the requests
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ),
        // The public key in the metadata of Entree Federation, can be found in the metadata in the section IDPSSODescriptor.
        'x509cert' => '...'
    ),
);

Step 4: Edit advanced_settings.php

Necessary changes in advanced_settings.php in the main directory.
NOTE! The following example code exists of additions or changes. The php tags are not included.
The changes are described in the comments.

    // Every sent and received message needs to be signed
    'authnRequestsSigned' => true,

    // Contact information
    'contactPerson' => array (
        'technical' => array (
            'givenName' => '',
            'emailAddress' => ''
        ),
        'support' => array (
            'givenName' => '',
            'emailAddress' => ''
        ),
    ),
    // Organisational information
    'organization' => array (
        'nl-nl' => array(
            'name' => '',
            'displayname' => '',
            'url' => ''
        ),
    ),