kenchan0130/simplesamlphp

By kenchan0130

•Updated over 2 years ago

Dockerized plug and play SAML 2.0 Identity Provider (IdP) for development and testing.

Image

1M+

Overview Tags

kenchan0130/simplesamlphp repository overview

⁠Docker Test SAML 2.0 Identity Provider (IdP)

Docker container with a plug and play SAML 2.0 Identity Provider (IdP) for development and testing.

Built with SimpleSAMLphp⁠. Based on official PHP8 Apache image⁠.

SimpleSAMLphp is logging to stdout on debug log level. Apache is logging error and access log to stdout.

You must not use at your production. This is for test.

⁠Usage

⁠Using docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -d kenchan0130/simplesamlphp

⁠Using docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp

There are two static users configured in the IdP with the following data:

Username	Password
user1	password
user2	password

And there is one admin:

Username	Password
admin	secret

⁠Environment Variables

Name	Required/Optional	Description
`SIMPLESAMLPHP_SP_ENTITY_ID`	Required	The entity ID of your SP.
`SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE`	Requried	The assertion consumer service of your SP.
`SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE`	Optional	The single logout url of your SP.
`SIMPLESAMLPHP_IDP_ADMIN_PASSWORD`	Optional	The password of admin of this IdP. Default is `secret`.
`SIMPLESAMLPHP_IDP_SECRET_SALT`	Optional	This is a secret salt used by this IdP when it needs to generate a secure hash of a value. Default is `defaultsecretsalt`.
`SIMPLESAMLPHP_IDP_SESSION_DURATION_SECONDS`	Optional	This value is the duration of the session of this IdP in seconds.
`SIMPLESAMLPHP_IDP_BASE_URL`	Optional	This value allows you to override the base URL. Valuable for setting an `https://` base url behind a reverse proxy. If you set this variable, please end it with a trailing `/` example: `https://my.proxy.com/` Default is `` (empty string).

⁠Advanced Usage

⁠Customize IdP Users

If you want to customize IdP users, you can define your own users by mounting a configuration file.

<?php
// These attributes mimic those of Azure AD.
$test_user_base = array(
    'http://schemas.microsoft.com/identity/claims/tenantid' => 'ab4f07dc-b661-48a3-a173-d0103d6981b2',
    'http://schemas.microsoft.com/identity/claims/objectidentifier' => '',
    'http://schemas.microsoft.com/identity/claims/displayname' => '',
    'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' => array(),
    'http://schemas.microsoft.com/identity/claims/identityprovider' => 'https://sts.windows.net/da2a1472-abd3-47c9-95a4-4a0068312122/',
    'http://schemas.microsoft.com/claims/authnmethodsreferences' => array('http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password', 'http://schemas.microsoft.com/claims/multipleauthn'),
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => ''
);

$config = array(
    'admin' => array(
        'core:AdminPassword',
    ),
    'example-userpass' => array(
        'exampleauth:UserPass',
        'user1:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2d75402-e1ae-40fe-8cc9-98ca1ab9cd5e',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User1 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User1',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
        'user2:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2a94916-2fcb-4b68-9eb1-5436309006a3',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User2 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User2',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
    ),
);

If you save this source as authsources.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -v $PWD/authsources.php:/var/www/simplesamlphp/config/authsources.php \
  -d kenchan0130/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp
    volumes:
      - authsources.php:/var/www/simplesamlphp/config/authsources.php

For detailed attributes, see SimpleSAMLphp Identity Provider QuickStart#Authentication module⁠.

⁠Customize SP remote metadata reference

If you want to customize SP remote metadata reference, you can define your own users by mounting a configuration file.

<?php
/* The index of the array is the entity ID of this SP. */
$metadata['entity-id-1'] = array(
    'AssertionConsumerService' => 'http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp',
    ForceAuthn => true
);
$metadata['entity-id-2'] = array(
    'AssertionConsumerService' => 'http://localhost/saml/acs',
    'SingleLogoutService' => 'http://localhost/saml/logout'
);

If you save this source as saml20-sp-remote.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -v saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php \
  -d kenchan0130/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    volumes:
      - saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php

For detailed attributes, see SP remote metadata reference#SAML 2.0 options⁠.

⁠Inspired By

https://github.com/kristophjunge/docker-test-saml-idp⁠

⁠License

MIT

Tag summary

Recent tags

Content type

Image

Digest

sha256:3c6ed4b8c…

Size

212.1 MB

Last updated

over 2 years ago

docker pull kenchan0130/simplesamlphp