How to integrate PHP application and ADFS using SAML 2.0 - php

Recently I started a conversation about an integration of my company's application to the ADFS of our client.
Their team generated a XML (FederationMetadata.xml) and gave it to us, now they're asking for a XML that should be generated by us and imported into their ADFS.
I have no idea what this XML I need to generate is.
Searching on internet I haven't found anything in this way, which made me question if that is right (giving back a config xml, what configs??)
My application runs using PHP.
Is there a succinct documentation I can start with and is that concept of returning a XML (to be imported in ADFS) generated using FederationMetadata.xml right?
Thank you

Your best bet is to use an existing library for SAML. SimpleSAMLphp is a solid option, it's very mature and widely used. The documentation is good, and it's quite easy to integrate into an existing application.

Related

How can I handle SCORM integration in web application? Or how can I integrate Moodle player in my webpage

I want to implement SCORM upload functionality and SCORM package play functionality in my web app which is in php so please suggest any solution for it.
I don't think Moodle is modular enough to extract what you want out of it directly, but you could learn from how they managed to do it. It may even be worth upgrading it to your architecture anyway.
uploading a zip
expanding on your server
reading the imsmanifest.xml to make the appropriate Table of contents
assigning
launching the content*
*Moodle runs the SCORM 1.2 API literally named "API" which has all the communication methods for the content to communicate data back to the LMS. You'd have to reverse engineer that as well which means managing the student attempt or CMI object on your server too. Extensive bit of work, but possible.

Adding REST API to existing PHP website

I'm using some open source code to launch a game. The game is old, around 11yrs. It is a tick based web based game. It's written in php and using MySQL. Basically I want to port this game to ios, instead of using uiwebview I want to build native controls.
I know that it's bad practice to communicate directly with MySQL from an ios app. So what I want to do is add a RESTful API. I'm new to this and have scoured google for answers, does anyone have any pointers of where to start when adding an API to an existing site? It's quite a complex structure.
Thanks.
Paul.
My suggestion is using a framework that is guided towards building an API. I use Slim Framework for my API back end and it's pretty easy to use. If you create a separate URL for this API or include directly into the PHP project as a class it could work.
Some tutorials to get you started are
Say Hello World with Slim
RESTful services with jQuery, PHP and the Slim Framework
Writing a RESTful Web Service with Slim
Hope this helps,
Wes

CodeIgniter Authentication System that allows 3rd party auth?

My question is rather simple. Is there a system for CodeIgniter that allows both local and 3rd party login? (Such as FB/Twitter/Google etc.)
I've tried A3M but it's hard to use and requires tinkering before it will even work out of the box, as is the case with outdated software.
My current solution is flexi auth, however it doesn't offer 3rd party login at all, and after an email to the developer it doesn't look like he's planning on integrating it anytime soon.
So does anyone know of a good system that is up-to-date and provides both 3rd party and local login?
If there isn't one, what other PHP framework does have such a package?
Edit for Clarity: I'm looking for a system that does both these things. While I appreciate the answers and comments with systems that I can integrate myself, the end result of that will be shaky at best. There's gotta be someone who's done this before, all integrated into one package so it's designed to work together.
I was also looking for something like this just a month ago, but unsuccessfully. The only framework that has it all integrated in a simple way that I have seen is meteor, but it is not a PHP framework.
I had to do it myself by wrapping different PHP libraries in CI libraries. The source code is on github: CI Twitter and Who You Meet (a live web app), that has Twitter, LinkedIn and Facebook authentication and also a lot of local authentication logic with email verification and password recovery.
I know it can be considered a shameless promotion, but I hope it is useful. Although it is not exactly what you are looking for, it seems to be rather stable, so feel free to re-use it.
Maybe you will have time to extract all this logic in a standalone library (like I did for twitter) for other folks to use :)
If you want a CI OAuth2 implementation you can use this library which is both client and server:
https://github.com/alexbilbie/CodeIgniter-OAuth-2.0-Server
Otherwise for OpenID use this library:
https://github.com/EllisLab/CodeIgniter/wiki/OpenID

Single Sign On using SAML 2.0

We’ve been tasked to integrate Single Sign On using SAML 2.
There will be two websites (one of them is ours, the other is an external website outside of our control). We use PHP and we believe theirs using .NET.
I’ve looked into implementing this using SimpleSamlPHP, however this hasn’t been going really well. I’ve been using a Ubuntu VM to test SimpleSAMLPHP before I implement it fully but I’m unable to proceed any further from the installation – I’ve gone through the documentation however I can’t see where I’ve gone wrong – is using VM causing the issue?
Anyway, are there any other methods which I can implement to get this working, with the ability to communicate with PHP and .NET websites?
Also, one final note is I need our website to be the primary SP, with theirs being a secondary SP – is this possible and if so how?
Thanks.
Check out PingFederate from Ping Identity [Note: I work for Ping). There is native PHP application integration support as well as a web-services (JSON) based integration for your application (among others) for the Service Provider role. The same product can then easily handle the IDP duties as well to allow your users to SSO via SAML2 (or 1.0/1.1/WS-Federation (Passive)) to other Partners you may have. While I'm not 100% sure of all the use cases you may need to support, PF can more than handle your needs w/out any complicated deployment requirements.
Anyway - we can provide full trial software and help getting it up and running.
HTH -
Ian
My advice would be to use Shibboleth.
Hope it helps,
Luis

How to write a REST API?

I'm writing an iPhone app as a hobby project and it will need a web service to provide it with data. It's not very different from what I do at work, but at work I only write views and controllers. Someone else is responsible for writing the model and usually the clients provide the web service.
I have done some web programming before, back when everyone were using MySQL and PHP, so my skills are a bit outdated, but I'm confident that I would be able to pull it of using the techniques I already know. However, I don't want to waste my time using obsolete tools. I've figured out that the state of the art would be to write a REST API. I was thinking that there should be some pretty good frameworks out there that pretty much just gives you a REST API with CRUD functionality as soon as you've defined a model.
I guess my question is: What would be the fastest way to get a REST API up and running? I really just want to focus on writing the iPhone app and not spend too much time on this API. It would be great if I could get web administration and revision history too. I should also add that the API isn't supposed to be public, so support for authentication would be great as well.
Just to be clear. I wouldn't mind a PHP framework. In fact it could possibly be better since I know that my current hosting supports it.
EDIT:
The links below which apparently were good for 3 years are no longer working so I went and found a couple of new tutorials that I think are going to stick around for a while. These are on the Ray Wenderlich site, a very well respected ios dev tutorial site. The first article actually references the broken links below but it is complete within itself:
How To Write A Simple PHP/MySQL Web Service for an iOS App
and the second one has a little twist to it. It used parse.com on the backend and AFNetworking. Both of which are quite excellent.
How To Synchronize Core Data with a Web Service – Part 1
I have fixed the broken links below by finding the articles in the way back machine. People seem to like the links so I will keep them. The links above should provide more food for thought.
I am doing exactly the same thing with my iphone app. I found this article on building a RESTful API in PHP:
https://web.archive.org/web/20130910164802/http://www.gen-x-design.com/archives/create-a-rest-api-with-php/
and there is also a followup article here:
https://web.archive.org/web/20130323001500/http://www.gen-x-design.com/archives/making-restful-requests-in-php/
with a link to source code at the bottom of the article.
I have programmed a REST API in ZEND Framework using the Zend_Rest_Controller, on the iPhone I used ASIHTTPRequest. My experience with both where good. At the beginning I had some trouble setting up ZEND and connecting it to mySQL, but once I figured out how to do it I was able to write the API very quickly. I can share more information with you if you have any further questions.
EDIT: There seems to be no official documentation on Zend_Rest_Controller. This link describes how to use it to create your API. You simply have to disable rendering in the init() of your subclass and implement the methods for each REST call.
Just to let you know:
I ended up using Ruby on Rails.
EDIT: Since this answer has been downvoted for not providing the reason behind choosing Ruby on Rails and also no instructions on how to write a REST API with it, I thought I would give you my motivation and some simple instructions.
I started reading a book about Ruby on Rails and realized that all I needed to do was to use scaffolding and I got a JSON REST API for free.
Here's a good guide to get you started: http://guides.rubyonrails.org/getting_started.html
When you have your Ruby on Rails environment up and running, creating your REST API isn't harder than running:
$ rails generate scaffold Post name:string title:string content:text
(Example from the above link.) I also found that Rails is very easy and free to deploy to heroku, which meant that I didn't have to pay for hosting for my very basic, low traffic, REST API. There are many other reasons why I am very happy to work with Ruby on Rails, but that's beyond the context of this question.
I followed a quite simple tutorial for creating RESTful APIs with PHP:
Corey Maynard - Creating a RESTful API with PHP
The main concept includes:
one abstract class that handles the parsing of the URI and returning the response, and
one concrete class that consists of just the endpoints for the API.
What about Python?
I'd use Python, Django and Piston.
I'd generate Django models from your
existent DB using inspectdb.
Add the Django admin to your models.
Add Django Piston to your app.
Profit.
With no experience with Python or Django probably it'll take you a day to develop this solution and all code is unit tested and proved to work.
If you want to use PHP I recommend using the CodeIgniter framework with Phil Sturgeon's REST server:
http://net.tutsplus.com/tutorials/php/working-with-restful-services-in-codeigniter-2
https://github.com/philsturgeon/codeigniter-restserver
Checkout the following PHP class that follows MVC.
http://www.phpclasses.org/package/5080-PHP-Implement-REST-Web-services-servers.html
Hope this helps.
If you already know PHP, there's nothing wrong with a PHP/MySQL backend. You can send all responses in iPhone-compatible plist xml format, and instantly turn the response into a NSDictionary/NSArray/NSNumber data structure with this short snippet of code:
NSString *response = [request responseString];
NSData* plistData = [response dataUsingEncoding:NSUTF8StringEncoding];
NSPropertyListFormat format;
NSString *errorStr;
NSDictionary* plist = [NSPropertyListSerialization propertyListFromData:plistData
mutabilityOption:NSPropertyListImmutable
format:&format
errorDescription:&errorStr];
I also use the ASIHTTP package for forming URLs, sending asynchronous requets, and receiving the responses, I highly recommend it:
http://allseeing-i.com/ASIHTTPRequest/
You should use whatever languages you are comfortable with for the web service. Any language that can formulate REST responses to requests is fine.
That said, if you want to get something running quickly, I suggest using Python on Google App Engine. It's free and you can use Java instead of Python if you so desire. App Engine supports authentication using OpenID and/or Google Accounts (not sure if they're mutually exclusive) so that should make things easier to code.
As far as making the requests on the iOS device, I suggest using ASIHTTPRequest.
Another option is restSQL, an ultra-lightweight persistence framework. See http://restsql.org. It supports MySQL and PostgreSQL and runs in a standard Java EE container, e.g. Apache Tomcat.
restSQL is a very unconventional data access layer. restSQL is not an object-oriented view of the database. It presents flat or hierarchical "views" of relational database tables. These views are query-able and updatable through a simple REST-based HTTP or Java API. The HTTP interface is based on REST principles, which use HTTP’s built-in features, rather than abstracting away from them.
You want a 'REST API with CRUD functionality' and that's exactly restSQL's sweet spot. You could do this with no code. Simply define your SQL Resources via XML files and start doing HTTP calls against them with full CRUD capability.

Categories