Story is that I need to make my website act as Identity Provider (read: IDP). Website itself is on Zend platform. Idea is making a IDP controller by which Service Providers (read: SP) contacts IDP. As it must be part of the website, I would need to include some extension, which could be easily used for responding SAML requests from SP.
I have found list of PHP extensions from:
https://wiki.surfnetlabs.nl/display/OSP/RFC+-+OpenSAMLphp,+a+new+PHP+library+for+SAML+2.0+support
All of these extensions have little documentation or are too complex. For example I haven't found a way to use SimpleSamlPHP in my application and also extracting useful code out of it looks very time consuming (which I really don't have anymore). Also I find all of them hard to implement into website.
I have been googling and checking github for days now, trying to find easy way to use some library (right now I'm trying to implement Lasso, which seems reasonable, but unfortunately lacks good examples / information how to use it as IDP).
Any kind of criticism, ideas, help or tutorial/code examples would be useful.
I wrote a guide about how deploy on an open source software (Tiki-wiki) an IdP using simplesamlphp, and how to connect the IdP to google or salesforce. Take a look:
https://github.com/pitbulk/tiki-saml/blob/master/doc/tiki_wiki_as_idp.rst
SimpleSAMLphp seems intimidating at first but it can handle all the SAML responses for you.
Have you looked at creating custom authentication module - http://simplesamlphp.org/docs/stable/simplesamlphp-customauth
You can tie this module to your existing login mechanism pretty easily.
Check out PingFederate and the PHP Integration Kit from Ping Identity. Alternatively there is the Agentless Integration Kit (instead of PHP) which allows you to integrate using a RESTful API call to the PingFed server instead of embedding any PHP libraries.
HTH,
Ian
Related
That's my need: my company run a web-application coded with classic asp. Now one of our customer want that application to use SSO with their own IdP using SAML 2.0. So I have to interface with that service to verify users credential and then granting access.
I search the web to know about SAML protocol and, as far as I understood, my web-app have to act as a Service Provider, but the SAML protocols and specs are quite complex.
So, that's the question: do you know any "middleware", Classic ASP or PHP based, that can help me dealing with this kind of authentication?
Thanks.
EDIT: googling around, I came across this one
https://onelogin.zendesk.com/entries/268420-saml-toolkit-for-php
Anyone knows it?
SimpleSAMLPHP is a solid library, however, I would guess that it's far more than what you are looking for... It's an implementation with both SP and IdP code, and, while it has the name "simple" in it, is far more complex than what you need.
I would suggest you try looking at Kentor's open source stuff:
http://coding.abel.nu/2013/09/an-open-source-asp-net-saml2-service-provider/ It's pretty recent, and I've seen others use it successfully.
Yes, your application has to act as a Service Provider.
Try SimpleSAMLphp Service Provider. I haven't used it personally for integration with an existing application, but seems it should work for you.
Please refer: http://simplesamlphp.org/docs/1.5/simplesamlphp-sp#section_6
Try OpenAm's Fedlet library for .Net applications :
http://docs.forgerock.org/en/openam/10.1.0/dev-guide/index/chap-fedlet-dotnet.html
Is there any way that I can integrate the UserCake user management system with MediaWiki? I want to link the accounts in each system so users can log into both with the same username and password.
There is no existing system to do this. You can create an extension for MediaWiki to do this without too much trouble. Basing it off an existing extension is probably a good starting point. By looking at AuthJoomla, AuthBugzilla and AuthSymfony you should get a good idea of how MediaWiki's authentication extension API operates. It's really just a matter of creating the class, getting it to call the relevant UC functions and then loading it as an extension into MW.
Having said that, UserCake seems unmaintained. It may be worth taking this opportunity to migrate your users to another authentication system. If you are using credentials between several applications you might want to look at something like LDAP.
I know that this is a really old question, but UserSpice is the fully PDO/OOP spiritual successor to UserCake and would probably be better equipped to handle this. It would take some modification, but it could be done.
May I recommend that you use other ways to secure you applications. Take a look at Windows Azure ACS that gives you security federation to Facebook, Google, Yahoo and more.
This allows you to focus on your application and not security protocols.
Azure ACS supports many different of protocols and works great with PHP as well as .Net based applications.
I did a quick search and found the http://www.mediawiki.org/wiki/Extension:OpenID that can use Azure ACS. (Access Control Services)
There are other alternatives to ACS such as Ping Identity and OpenSSO; But ACS is a cheap alternative to Ping.
Q: How would you create a SSO? What would you do about authentication (separate app or same as sso) and user store?
Background info:
We have 40+ php apps, java apps and
Ruby apps.
Currently, we have a custom
SSO+authentication solution. It's an
app written in php that is now used as
SSO, while supporting
email/username/phone-number + password
as authentication. It works, but was
built for a few apps only, not
originally meant to be the SSO -
solution. It doesn't have a usable view, every app create their own login/register forms and use the API. They share context and we'd like a more universal design.
Now we know want to support Oauth and
openid solutions, as facebook connect,
google and more, (or do we really?), in addition to
existing authentications. We can
expand existing php-solution, but we
are considering alternatives.
If you were to do all this in Ruby, what would you do?
Some additional info:
All users exist in SSO, today.
The company does aquire other companies/systems at times, having their own users. Would you migrate or create some kind of mapper?
Customers in a Microsoft CRM, but I consider this unrelated. Or do I?
I've shallowly looked at RubyCAS and ClassyCAS, and don't know if they are suitable. Is CAS the way to go?
Would you keep going with php? What would you use?
As you see, I have a lot of questions. What would you suggest?
I a previous job we used Jasig CAS for SSO (several apps in Java and Python). After getting over some quirks in the configuration and my dislike of all things Java, it actually worked pretty well. At the time I found the wiki to be a valuable resource, but things might have changed in the last year.
Authentication was handled via a separate app (custom) using an OpenLDAP directory that was preinitialized with a script that got user info out of an AD server.
Regarding the actual server you might actually want to use the Jasig one, IIRC it's the reference implementation and is easy to customize via a Maven overlay.
Ruby-cas FTW.
We're planning a new project which will feature an API available to customers to interact with our app from their own web sites and systems. However never having built anything close to an full-fledged API in the past, I am not aware of any standards or recommendations that are available and could be used to make the API more easily adapted by our customers.
We will build the API using PHP and some parts of the API will need authentication while others don't. As of today, I have read a little about Oauth, SOAP & REST, but I have no idea on what is good practiec.
What technology/standard is recommended to base an API for 2011+ upon?
There are a number of options, but I would suggest that you may find publishing a SOAP API from PHP quite tricky to maintain.
The reason for this is that there is no inherent WSDL generation within PHP, so you'll either have to roll your own (and modify it each time), or experiment with one of the 3rd party tools - none of which I have found particularly satisfactory in the past.
I would suggest that a more straightfoward method for implementing an API in PHP would be to go down the RESTful route.
I would check out the choices made by successful APIs that are available through sites like Mashery or Programmable Web. By focusing on the successful API patterns before choosing a technology you will have a better chance that the API will work and be successful.
I am looking at ways to tie together a number of Windows-based web services together under single-sign-on. Microsoft's Windows Identity Framework and ADFS 2.0 are the perfect tools for the job, except that not all of our web services are written in .NET. One is classic ASP and another PHP. Are there existing libraries that will work for those platforms, or will I need to build them from scratch?
There are two ways to do this that I can think of off the top of my head:
Find a product that will sit in your Web server that intercepts calls, bounces unauthenticated users to an IdP, parses the responses, and puts the data in the header of the requests that it then passes on to your ASP/PHP app. There are many types of products that do this, e.g., Shibboleth SP, Ping Identity, and OpenSSO. I think Centrify DirectControl and Quest Single Sign-on might also provide this sort of capability.
Build a comparable component yourself that can do this sort of thing and leverage frameworks to help with the parsing of SAML and/or WS-Federation messages. If you take this route, check out SimpleSAMLphp and OIOSAML.NET.
HTH!
Using IIS 7.0 pipeline you can write a http module that will handle authentication for all sites hosted on the iis. (including classic asp and php).
See: MSDN article