search

cdaecke / md_saml

TYPO3 SSO Login with SAML authentication
Other
2 stars 9 forks source link
adfs authentication saml sso typo3 typo3-cms-extension typo3-extension

readme

TYPO3 Extension md_saml

Single Sign-on extension for TYPO3. It enables you, to log into the TYPO3 backend or the website frontend by using an Identity Provider (IdP), for example an ADFS server (Active Directory Federation Services). It is fully configurable by TypoScript.

Screenshots

TYPO3 login:

TYPO3 login

Frontend login:

Frontend login

Requirements

Installation

Configuration

TypoScript

SAML

The Service Provider (SP) and Identity Provider (IdP) can be configured by adapting the settings in TypoScript.

Backend

Frontend

Note

All default settings, which are configured in plugin.tx_mdsaml.settings.saml can be overwritten for backend or frontend needs with properties in plugin.tx_mdsaml.settings.be_users.saml... (backend) and plugin.tx_mdsaml.settings.fe_users.saml... (frontend).

As underlying SAML toolkit the library of OneLogin is used (no account with OneLogin is needed!). See full documentation for details on the configuration.

Users

You are able to create new users, if they are not present at the time of login.

You are able to update existing users, if they are already present at the time of login.

Backend

Frontend

SSO

The returned value of the SSO provider can be anything. With the following configuration set the names of the returned values to the ones needed in TYPO3:

Backend

Frontend

ADFS

The following steps are an example on how to configure an ADFS server as IdP (Identity Provider).

Since I don't have the configuration in english, the following section is available in german only. I am sorry for that!

ACHTUNG:
Die Reihenfolge der Regeln ist wichtig! Die erste muss die Name Identifier Regel sein!

Als letztes muss noch im Reiter Bezeichner der Vertrauensstellung im Feld Bezeichner der vertrauenden Seite der Wert, der in plugin.tx_mdsaml.settings.mdsamlSpBaseUrl eingegeben werden.

TYPO3

General

Site Config

errorHandling:
    errorCode: 403
    errorHandler: PHP
    errorPhpClassFQCN: Mediadreams\MdSaml\Error\ForbiddenHandling

Change User Event

event to customize user data before insert/update on login

namespace XXX\XXX\EventListener;

use Mediadreams\MdSaml\Event\ChangeUserEvent;
use TYPO3\CMS\Core\Utility\GeneralUtility;

final class AddGroupChangeUserEventListener {

  protected int $adminGroupUid = 3;

  // SSO User Changes
  public function __invoke(ChangeUserEvent $event): void
  {
      // get current data
      $userData = $event->getUserData();
      $email = $userData['email'] ?? null;
      // some conditions, if true add group
      if (1) {
          $usergroups = GeneralUtility::intExplode(',', $userData['usergroup']);
          $usergroups[] = $this->adminGroupUid;
      // change some data
          $userData['usergroup'] = implode(',', $usergroups);
      // save new data
          $event->setUserData($userData);
      }
  }
}

You must register the event listener in Services.yaml

FAQ

Is is possible, to remove the default login with username and password?
Yes, just add following line in the `ext_localconf.php` of your the extension:
unset($GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['backend']['loginProviders'][1433416747]);
I get a `1648646492 RuntimeException, The site configuration could not be resolved.`
Make sure, that the domain of your website is configured in the site configuration (`sites/identifier/config.yaml`) for `base`.

Troubleshooting

If your login fails with the parameter ?commandLI=setCookie (typo3/index.php?commandLI=setCookie), please make sure, that you have set $GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'lax'.

Bugs and Known Issues

If you find a bug, it would be nice if you add an issue on Github.

THANKS

Thanks a lot to all who make this outstanding TYPO3 project possible!

Credits