search

flipboxfactory / saml-sp

SAML Service Provider (SP) Plugin for Craft CMS
https://saml-sp.flipboxfactory.com/
Other
19 stars 5 forks source link

Does this plugin work with ADFS #30

Closed BenParizek closed 5 years ago

BenParizek commented 5 years ago

Hi Folks, I'm definitely out of my comfort zone on this topic and trying to understand if this plugin may be a good fit for a project we have, or if it might be able to be extended or customized to this use case. It's quite possible I will misuse or misunderstand a term I am using in the following questions, so please just ask for clarification if I'm not making any sense.

We have a client who is moving to ADFS. Would this plugin be able to help us connect to ADFS? They also mentioned that some integrations they have connect to Azure/Active Directory Direct Connect, but that sounded like it may be a bit more involved as an option.

Once connected, are there any special attributes that have to be passed? Can we get back info on ACLs and other content?

dsmrt commented 5 years ago

Hi @BenParizek!

SAML SSO can be confusing so I totally respect your questions!

Although I have noticed that ADFS is pickier than other providers I've worked with, it should work fine with the plugin. Custom/special attributes and events are supported but there are some changes in the works for the plugin's 2.0 version: https://github.com/flipboxfactory/saml-sp/tree/feature/2.0

Those changes in 2.0 will change the way you extend and hook into the plugin. Feel free to check that branch out. It's pretty stable at this point, I just need to release it and make sure upgrades will work ok.

ACLs aren't supported but you can use groups to help translate permissions. For example, when a users attributes are passed along to Craft, the plugin can automatically set the user to that matching group (in Craft) and even create that group if it doesn't exist. From there, you manage the permission separately.

BenParizek commented 5 years ago

Thanks @dsmrt

This will help me keep moving for now. I'll follow up if I have more questions as we get deeper.

dmatthams commented 5 years ago

@BenParizek I'm doing this as we speak (also new territory for me) and have successfully set up with my own Azure account and it works like magic. Now going through the process to get it working with the client's account before working out a way to pass user groups etc, so hopefully in a week or so I will be useful to you so feel free to ping me.

dsmrt commented 5 years ago

@dmatthams, Let's me know if you have questions with user groups, etc!

BenParizek commented 5 years ago

@dmatthams Pinging you here to follow up on your success so far. If you want to ping me at @BenParizek on Craft Discord or via email (ben@barrelstrengthdesign.com) happy to carry on the conversation there. If you're making progress, I'd be happy to consider contracting you (for whatever appropriate) to help kick start our implementation too.

dmatthams commented 5 years ago

Hi Ben, I've modified the instructions I sent to my client and pasted below so it may be useful to you and others. You can set up an enterprise Azure account for free so you can test all these steps also. Note that I didn't have the need to transfer any user group info, so you may need to look into that.

Create your service provider as per the docs and copy the generated metadata into an XML file then;

For Client

  1. In the dashboard goto Azure Active Directory > Enterprise Applications > + New Application > Non-gallery app
  2. Give the app a name and click Add
  3. Once the app has been created, add yourself as user for testing in Users and Groups (also get client to add you here – they should be able to add any Microsoft account)
  4. goto Single sign-on > SAML
  5. Click Upload metadata file and upload the provided metadata XML.
  6. Once the metadata has loaded, and click Save. (No need to add login/logout urls)
  7. When prompted, don't choose to validate
  8. Edit user Attributes & Claims (Stage 2)
    1. Edit Unique User Identifier (Name ID) and change Source attribute to user.mail
  9. In stage 3 of the Azure SAML dashboard you will see a 'Federation Metadata XML' download. Download this and send to XXX

You

  1. Create the Identity provider as per docs
  2. Paste in the meta data provided by client
  3. For Mapping, under the Configure tab use these urls as attribute names:
    1. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress → email
    2. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → first name
    3. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → surname

That should get you running, but shoot me an e-mail if I can help further -> dave@madebyloom.co.uk