search

simplesamlphp / simplesamlphp

SimpleSAMLphp is an application written in native PHP that deals with authentication.
https://simplesamlphp.org
GNU Lesser General Public License v2.1
1.07k stars 677 forks source link

Configurable SP metadata? #954

Open MrDys opened 5 years ago

MrDys commented 5 years ago

I have a rather complex setup using simpleSAMLphp to run a number of service providers. For regionalization reasons (thanks, GDPR), they all respond to the same entityID. My primary SP also includes the regional ACS endpoints so that folks at the various regions can be passed along appropriately.

I would like the ability to be able to configure certain parts of the SP metadata output (ACS endpoints, Single Logout Service location, etc.) from config.php. Right now I am making these changes via patches to simplesamlphp/modules/saml/www/sp/metadata.php, but that is fragile and doesn't let me configure on a per-SP basis.

If I were to submit a PR that allowed for config.php customizability of these endpoints, would that be something the project would be interested in? Or, is there another way to accomplish what I need to do with the existing code?

thijskh commented 5 years ago

I'm a bit hesitant about this. There are infinitely many things one can configure in metadata. The generated metadata provides sane defaults, which directly relate to things that SSP actually knows/handles.

There's no requirement to use the generated metadata as-is. For advanced use cases it can be better to augment the generated metadata (eg with xslt) or to generate it separately from SSP. I'm worried about maintainability if we'd build ifs and config options for all kinds of possible things which are in essence not related to SSP itself.

tvdijen commented 5 years ago

Would it be an idea to have a template for generated metadata that can be altered when needed? Something along the lines how OpenConext-manage.. If we'd put this in the saml-module, you could overwrite the template in a custom module We could actually use Twig-templates for this

MrDys commented 5 years ago

I'm in favor of any solution that allows for easy customization of SP metadata. The PR I coded up (#988) manages to do this without impacting any of the defaults, in only a few lines of code.

I don't have an idea of what it would take to integrate OpenConext-manage with the saml module.

rajeshdnws commented 5 years ago

I have used this code in magento 2 once I have updated magento 2.3 to magento 2.3.1 getting error ERROR: The configuration (config/config.php) is invalid: Missing configuration file