2017 © Pedro Peláez
 

silverstripe-module saml

Adds SSO/SAML authentication support to SilverStripe

image

silverstripe/saml

Adds SSO/SAML authentication support to SilverStripe

  • Wednesday, January 10, 2018
  • by robbieaverill
  • Repository
  • 13 Watchers
  • 1 Stars
  • 35 Installations
  • PHP
  • 0 Dependents
  • 0 Suggesters
  • 7 Forks
  • 2 Open issues
  • 1 Versions
  • 75 % Grown

The README.md

SilverStripe SAML module

Build Status Scrutinizer Code Quality codecov, (*1)

Table of Contents

, (*2)

Introduction

This SilverStripe module provides single sign-on authentication integration with a SAML provider., (*3)

This component can also be used alongside the default SilverStripe authentication scheme., (*4)

Requirements

  • PHP 8+ with extensions: openssl, dom
  • SilverStripe 5+ (see 2 branch for SilverStripe 4)
  • Active Directory Federation Services 2.0 or greater (ADFS)
  • HTTPS endpoint on SilverStripe site
  • HTTPS endpoint on ADFS

This module has prevoiously been tested on the following configurations, but is now untested:, (*5)

  • Windows Server 2008 R2 with ADFS 2.0
  • Windows Server 2012 R2 with ADFS 3.0

Note: For LDAP only Active Directory integration, please see silverstripe-ldap., (*6)

Overview

(Image) Typical authentication and authorisation flow for this module, (*7)

Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties. The single most important requirement that SAML addresses is web browser single sign-on (SSO)., (*8)

With this module, SilverStripe site is able to act as a SAML Service Provider (SP) entity, and thus allows users to perform a single sign-on against a centralised user directory (an Identity Provider - IdP)., (*9)

The intended counterparty for this module is the Active Directory Federation Services (ADFS). ADFS is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries., (*10)

ADFS uses a claims-based access control authorization model to maintain application security and implement federated identity. We rely on this mechanism for authentication, and for automated synchronisation of some basic personal details into SilverStripe., (*11)

This module doesn't allow you to store additional user attributes. If this is desired, you can optionally install the silverstripe-ldap module and run alongside to synchronise custom user attributes from an Active Directory server., (*12)

Security

With appropriate configuration, this module provides a secure means of authentication and authorisation., (*13)

For secure communication over the internet during the SAML authentication process, users must communicate with SilverStripe and ADFS using HTTPS. Similarly, for AD authentication to be secure users must access the SilverStripe site using HTTPS., (*14)

SilverStripe trusts ADFS responses based on pre-shared X509 certificates. These certificates are exchanged between the Identity Provider (ADFS) and the Service Provider (SilverStripe site) during the initial configuration phase., (*15)

In-depth guides

For SilverStripe developers

For identity provider administrators

These guides will help you prepare your identity provider and configure it to work with the module correctly., (*16)

Changelog

Please see the GitHub releases for changes., (*17)

The Versions

10/01 2018

dev-master

9999999-dev

Adds SSO/SAML authentication support to SilverStripe

  Sources   Download

BSD-3-Clause

The Requires

 

The Development Requires

by Stig Lindqvist
by Sean Harvey

saml sso silverstripe active directory ad