我正在为其中一个 php 网络应用程序实现基于 SAML 的 SSO。我正在使用谷歌作为 IDP。我用过 Laravel 5 - Saml2插件并按照其文档中给出的步骤进行配置。我还使用给定的步骤在谷歌管理控制台中将此应用添加为 SAML 应用 here并在 saml2_settings.php 中配置了 entityId 和 acs url。但是我无法配置 x509cert 证书。当我点击登录 url 时,用户被重定向到 google 进行身份验证,但是当我输入凭据时,它不会返回到应用程序并给出以下错误:
- That’s an error.
Error: app_not_configured_for_user
Service is not configured for this user.
以下是我的 saml2_settings 文件:
'sp' => array(
// Specifies constraints on the name identifier to be used to
// represent the requested subject.
// Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
// Usually x509cert and privateKey of the SP are provided by files placed at
// the certs folder. But we can also provide them with the following parameters
'x509cert' => 'I ADDED x509certs here which I downloaded from google',
'privateKey' => '',
//LARAVEL - You don't need to change anything else on the sp
// Identifier of the SP entity (must be a URI)
'entityId' => 'snipeit', //LARAVEL: This would be set to saml_metadata route
// Specifies info about where and how the <AuthnResponse> message MUST be
// returned to the requester, in this case our SP.
'assertionConsumerService' => array(
// URL Location where the <Response> from the IdP will be returned
'url' => 'http://dev.sb.com/snipeit/public/account/profile', //LARAVEL: This would be set to saml_acs route
//SAML protocol binding to be used when returning the <Response>
//message. Onelogin Toolkit supports for this endpoint the
//HTTP-Redirect binding only
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
),
// Specifies info about where and how the <Logout Response> message MUST be
// returned to the requester, in this case our SP.
'singleLogoutService' => array(
// URL Location where the <Response> from the IdP will be returned
'url' => '', //LARAVEL: This would be set to saml_sls route
// SAML protocol binding to be used when returning the <Response>
// message. Onelogin Toolkit supports for this endpoint the
// HTTP-Redirect binding only
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
),
),
// Identity Provider Data that we want connect with our SP
'idp' => array(
// Identifier of the IdP entity (must be a URI)
'entityId' => '',
// SSO endpoint info of the IdP. (Authentication Request protocol)
'singleSignOnService' => array(
// URL Target of the IdP where the SP will send the Authentication Request Message
'url' => $idp_host,
// SAML protocol binding to be used when returning the <Response>
// message. Onelogin Toolkit supports for this endpoint the
// HTTP-POST binding only
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
),
// SLO endpoint info of the IdP.
'singleLogoutService' => array(
// URL Location of the IdP where the SP will send the SLO Request
'url' => $idp_host . '/saml2/idp/SingleLogoutService.php',
// SAML protocol binding to be used when returning the <Response>
// message. Onelogin Toolkit supports for this endpoint the
// HTTP-Redirect binding only
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
),
// Public x509 certificate of the IdP
'x509cert' => 'SAME CERTIFICATES I ADDED HERE AS WELL', /*
* Instead of use the whole x509cert you can use a fingerprint
* (openssl x509 -noout -fingerprint -in "idp.crt" to generate it)
*/
// 'certFingerprint' => '',
),
谁能帮帮我。
最佳答案
'sp' => array(
'x509cert' => 'I ADDED x509certs here which I downloaded from google', 'privateKey' => '',
您将 Google 用作 IdP,那么为什么要在 sp 部分使用 google public cert?
如果您打算对 SP 发送的 SAML 消息进行签名,那么您需要将自己的证书/私钥放在那里。您可以使用此工具生成自签名证书:https://www.samltool.com/self_signed_certs.php
如果您对某些设置字段有疑问,请查看 Lavarel SAML 插件的文档,同时查看 documentation of php-saml ,插件使用的 SAML 工具包。
为了调试正在发生的事情,我还建议您使用浏览器扩展来记录您的 SAML 消息,例如使用 SAML Tracer 并查看将通知您可能的错误的响应状态。
关于php - 使用 Laravel 基于 SAML 的单点登录,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/36013522/