KNF:OneLogin configureren als Service Provider/en: verschil tussen versies

Uit Kennisnet Developers Documentatie
Ga naar: navigatie, zoeken
(Step 2: Generating a certificate)
Regel 15: Regel 15:
   
 
==Step 2: Generating a certificate==
 
==Step 2: Generating a certificate==
De berichten die met de Entree Federatie applicatie worden uitgewisseld tijdens een authenticatie worden ondertekend door middel van XML-signing. For this purpose a certificate has to be generated.
+
The messages that are exchanged between the OneLogin application and Entree Federation during an authentication need to be signed. For this purpose a certificate has to be generated.
 
# In the main directory (''php-saml-master'') you will find the sub directory ''certs''.
 
# In the main directory (''php-saml-master'') you will find the sub directory ''certs''.
 
# Go to the ''certs'' directory.
 
# Go to the ''certs'' directory.

Versie van 17 aug 2018 om 08:21

KNF-symbol.png Entree Federation: Implement OneLogin PHP as Service Provider

Nl.gif Nederlands En.gif English


This manual provides a guide on how to implement OneLogin as a Service Provider.

Step 1: Installation

  1. Download the PHP toolkit at https://github.com/onelogin/php-saml.
  2. Unpack the zip and copy the directory php-saml-master to the right location on your webserver.
  3. Rename the demo1 directory to the preferred projectname (for example entreefederation).
  4. Delete the file settings_example.php from the project directory.
  5. Copy the file settings_example.php from the main directory to the project directory.
  6. Rename this file to settings.php.
  7. Rename the file advanced_settings_example.php in the main directory to advanced_settings.php.

Step 2: Generating a certificate

The messages that are exchanged between the OneLogin application and Entree Federation during an authentication need to be signed. For this purpose a certificate has to be generated.

  1. In the main directory (php-saml-master) you will find the sub directory certs.
  2. Go to the certs directory.
  3. Execute the following command in order to generate the certificate:
    openssl req -newkey rsa:2048 -new -x509 -days 3652 -nodes -out sp.crt -keyout sp.key
    
  4. Follow the instructions and provide the correct information.

Step 3: Edit settings.php

Voor het realiseren van een koppeling met Entree Federatie zijn een aantal aanpassingen in het bestand settings.php in de project directory nodig.
NOTE! The following configuration exists of additions or changes. The php tags are not included.
The changes are described in the comment in the example code.

$settings = array (
    'strict' => false,
    'debug' => false,
    // Provide the base URL of your application (for example: https://example.com)
    'baseurl' => '',
    // Information about the Service Provider application
    'sp' => array (
        // The entityID is the unique idenitfier of the application (for example: https://example.com/projectname)
        'entityId' => '',
        // Information about the endpoint Entree Federatie will use to send its responses to
        'assertionConsumerService' => array (
            // The URL of the endpoint (for example: https://example.com/index.php?acs)
            'url' => '',
             // SAML protocol binding that will be used for sending the responses
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ),
        // Format of the identifier van het onderwerp van authenticatie
        // Entree Federation requires this to be 'unspecified'
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
        // Information about the certificate generated in step 2
        'x509cert' => '...'
        'privateKey' => '...'
    ),
    // Information about the Entree Federation application
    // This information can be found in the metadata of Entree Federation
    // Metadata staging environment: https://hub-s.entree.kennisnet.nl/openaselect/profiles/saml2/
    // Metadata production environment: https://hub.entree.kennisnet.nl/openaselect/profiles/saml2/
    'idp' => array (
        // The unique identifier of Entree Federation
        'entityId' => '',
        // Endpoint van Entree Federatie waar de authenticatie requests naar toegestuurd worden
        'singleSignOnService' => array (
            // De URL van het endpoint
            'url' => '',
            // SAML protocol binding dat gebruikt wordt om de requests naar Entree Federatie te versturen
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ),
        // The public key in the metadata of Entree Federation
        'x509cert' => '...'
    ),
);

Step 4: Edit advanced_settings.php

Necessary changes in advanced_settings.php in the main directory.
ATTENTION! De volgende configuratie aanpassingen zijn toevoegingen of wijzigingen. The php tags are not included.
De aanpassingen staan beschreven in commentaar in de onderstaande voorbeeld code.

    // Alle verzonden en ontvangen berichten moeten gesigned zijn
    'authnRequestsSigned' => true,

    // Contact information
    'contactPerson' => array (
        'technical' => array (
            'givenName' => '',
            'emailAddress' => ''
        ),
        'support' => array (
            'givenName' => '',
            'emailAddress' => ''
        ),
    ),
    // Organisational information
    'organization' => array (
        'nl-nl' => array(
            'name' => '',
            'displayname' => '',
            'url' => ''
        ),
    ),