SSO auth option (SAML)

[robbykrlos]

This is a feature request.

We are starting implementing a new login option using simpleSAMLphp for SSO (Single Sign On). We were wondering if you consider this in the future, or you have already support for such login option.

If you are interested, I can change my implementation so it goes in the same direction with your vision, so later we will PR for everyone.

Just an idea...

[mauthi]

+1

[robbykrlos]

OK, so if this is not needed here's how I did / will do (still in progress) this:

• used https://github.com/aacotroneo/laravel-saml2 (which is using https://github.com/onelogin/php-saml)

• followed the instructions, published vendor, configured settings

• {routesPrefix}/{idpName}/login calls the {IdPName}Saml2Controller configured as custom controller in config/saml2_settings.php 'saml2_controller' => 'App\Http\Controllers\Auth{IdPName}Saml2Controller', which calls $saml2Auth->login(); that redirects to WAC based on parameters: .env configuration used:

  SAML2_XXX_SP_ENTITYID=xxx-dev
  SAML2_XXX_IDP_HOST=https://myidp.com
  SAML2_XXX_IDP_ENTITYID=myidp.com
  SAML2_XXX_IDP_SSO_URL=https://myidp.com/SingleSignOnService
  SAML2_XXX_IDP_x509=myidp.com.crt

• changed @enso-ui/auth/src/bulma/pages/auth/components/AuthForm.vue in order to inject new "SSO Login" button that redirects to {routesPrefix}/{idpName}/login ( local endpoint generated by aacotroneo/laravel-saml2 )

• changed @enso-ui/auth/src/bulma/routes/auth.js and added a new route that will handle my IdP response:

• name: 'loginsso',

• path: '/loginsso/:token',

• component: Login,

• meta: {

• guestGuard: true,

• title: 'LoginSSO',

• },

  
  This will be the endpoint that will handle responses from IdP. This route has the same Login component the normal login has.

• changed @enso-ui/ui/src/modules/store.js in order to allow ui to load loginsso route.

• if (!['login', 'password.email', 'password.reset'].includes(state.route.name)) {

• if (!['login', 'loginsso', 'password.email', 'password.reset'].includes(state.route.name)) {

• implemented the Event listener for "Saml2LoginEvent" so that the returned IdP data is handled. Inside this listener, a unique encryption key is generated once every login, and stored inside DB table for the user trying to login (the user coming as $user->id from IdP). With this token user information in serialized, encrypted and base64encoded (and some additional measures in order to keep things complicated and unable to brute-force, or reuse tokens). At the end of the listener, a redirect is made to /loginsso/user_id:encrypted_data

app/Providers/EventServiceProvider.php:

protected $listen = [
        'Aacotroneo\Saml2\Events\Saml2LoginEvent' => [
            'App\Listeners\Saml2LoginListener',
        ],
    ];

• app/Http/Controllers/Auth/OverrideEnsoLoginController.php - class OverrideEnsoLoginController extends EnsoLoginController is used to handle loggableUser where in case sso token is set, the u/p check will be skipped, token is checked, decrypted with DB token for current user(which is destroy after use), unseriallized, and verified and if user details matches with local user and it's authorized to login, normal user login flow is continued. If not, throw ValidationExceptions.

(the only part altered is the yellow part, where "wac" is my {IdPName})

---

Code flow:

1. User loads the login page.
2. User presses the SSO Login
3. A redirect is made to {routesPrefix}/{idpName}/login - which redirects to IdP and login is requested there.
4. After user sucessfuly logs in at IdP, it is redirected back to {routesPrefix}/{idpName}/acs which raises an event Aacotroneo\Saml2\Events\Saml2LoginEvent.
5. Inside the Event listener, we read data from IdP, validate it, and if valid, redirect to loginsso/encrpted_data
6. Enso login page is loaded again, but since the loginsso route loads the same Login component, we can disable validation of username/password, set a flag that this is sso login, and forward the data to the login controller.
7. Force submit.
8. Login component will call the api/login endpoint that will use LoginController to handle the request.
9. Override local LoginController will handle sso case based on found token.
10. Normal login will be granted.