Sunet Authentication for Drupal using SimpleSAMLphp

Document  by K. Sharp

Setting SSL certificate and https connection

Make sure the web server has a valid SSL certificate. See https://uit.stanford.edu/service/ssl for more information. If you are setting this on on your development machine make sure that it is registered to Stanford.

Setting  SimpleSAMLphp library

• Download SimpleSAMLphp from https://simplesamlphp.org/download
• Unzip into a directory and tell server where library is located
• For configuration on Pantheon follow these instructions to add library in directory /private/simplesamlphp/www  and set symlink https://pantheon.io/docs/shibboleth-sso/
• For configuration on your local computer
  • unzip into a directory outside your web server docroot.
  • In web server configuration (httpd-ssl.conf, for example, in apache), add the following to the VirtualHost definition for your server:

SetEnv SIMPLESAMLPHP_CONFIG_DIR /Users/irinaz/Sites/siepr/simplesamlphp/config
Alias /simplesaml /Users/irinaz/Sites/siepr/simplesamlphp/www
<Directory /Users/irinaz/Sites/siepr/simplesamlphp/www>
   <IfModule !mod_authz_core.c>
       Order allow,deny
       Allow from all
   </IfModule>
</Directory>

• For configuration on Pantheon follow these instructions to add universal absolute path to the installation in  settings.php  https://pantheon.io/docs/shibboleth-sso/#drupal-configuration
• cd into SimpleSAMLphp cert directory (on your local computer) and create a self-signed certificate: openssl req -newkey rsa:2048 -new -x509 -days 3652 -nodes -out saml.crt -keyout saml.pem
• cd into SimpleSAMLphp metadata directory and edit saml20-idp-remote.php

and add the following to the bottom of the file:

$metadata['https://idp.stanford.edu/'] = array(
 'name' => array(
   'en' => 'Stanford University WebLogin',
 ),
 'description'         => 'Stanford University WebAuth',
 'SingleSignOnService' => 'https://login.stanford.edu/idp/profile/SAML2/Redirect/SSO',
  'certFingerprint'     => '2b:41:a2:66:6a:4e:3F:40:c6:30:55:6a:1f:ec:c3:e3:0b:ce:ee:8f'
);

New config shoud be using certData instead of certFingerprint.

• cd into SimpleSAMLphp/config directory and edit authsources.php

In the "default-sp" section, change

"idp" => null,  
to: "idp" => "https://idp.stanford.edu/',

and add the following:
   'privatekey' => 'saml.pem',
   'certificate' => 'saml.crt',
   'authproc' => array(
     20 => 'saml:NameIDAttribute',
   ),

• Stay in the config directory and edit config.php

7a. Make sure the following config options are set:

   'baseurlpath' => 'https://<YOUR WEB SERVER HOSTNAME>.stanford.edu/simplesaml/',
   'certdir' => "/<YOUR SIMPLESAMLPHP LOCATION>/simplesamlphp/cert/',
   'metadatadir' => '/<YOUR SIMPLESAMLPHP LOCATION>/simplesamlphp/metadata/',
   'attributenamemapdir' => '/<YOUR SIMPLESAMLPHP LOCATION>/simplesamlphp/attributemap/',
   'loggingdir' => '/<YOUR SIMPLESAMLPHP LOCATION>/simplesamlphp/log/',
   'datadir' => '/<YOUR SIMPLESAMLPHP LOCATION>/simplesamlphp/data/',

7b. Change auth.adminpassword to something better than "123"

7c. Change secretsalt to something other than default by following instructions in config.php

7d. Change technicalcontact_name and technicalcontact_email to your name and email address

7e. Change timezone to 'America/Los_Angeles"

7f. Change "enable.saml20-idp" to true

7g. Replace the "authproc.sp" section with the following:

   'authproc.sp' => array(
       10 => array(
           'class' => 'core:AttributeMap', 'removeurnprefix',
           'oid2name',
       ),
       20 => array(
           'class' => 'authorize:Authorize',
           // use Regular Expression to define which workgroup members can login
           // this example lets in anyone from earthsci:web-authors or earthsci:web-developers, make sure that you use correct workgroup here
           'eduPersonEntitlement' => array(
               '/earthsci:(web-authors|web-developers)/',
           )
       ),
       // Adopts language from attribute to use in UI
       90 => 'core:LanguageAdaptor',

   ),

7h. It is recommended that you do not use "store.type" => "phpsession".
If PHP on your server includes memcache, change "store.type" => "memcache" and (other memcache configuration TBD).

Otherwise, change
"store.type" => "sql",
and set store.sql.dsn, store.sql.username, and store.sql.password to access your Drupal database.
 

Test SimpleSamlphp Library and get metadata

• Go to your website at https://<YOUR WEB SERVER HOSTNAME>.stanford.edu/simplesaml/ and click Configuration tab.
• Go to configuration tab and run the "sanity check" to see if you are still sane.
• Go to federation tab and click "SAML 2.0 SP Metadata" for "default-sp"
• Copy the metadata to your clipboard

Register your SP (service provider) with Stanford

• Go to https://spdb.stanford.edu  and click "Add New Service Provider"
• Paste metadata into Metadata field and enter a Contact (Group) Email. You need to be admin of respective workgroup, or you need to submit ServiceNow ticket so 
• Submit metadata
•  When you get word back that your SP has been registered, go back to https://<YOUR WEB SERVER HOSTNAME>.stanford.edu/simplesaml/ and click the authentication tab.
• Click default-sp. You should be taken to WebLogin and back to a page that shows your account information.

Configure Drupal SimpleSamlPHP or StanfordSimpleSaml modules

11. For Drupal 7.x, install module simplesamlphp_auth.  For integration with SPDB use stanford_ssp module

   For Drupal 8.x, install modules simplesamlphp_auth and externalauth.  

12. Configure simplesamlphp_auth

Drupal 7.x

• Check activate
• Enter the location of simplesamlphp directory.   If you are working on Pantheon, this will be defined in settings.php file.
• Leave default-sp as authentication source
• Check force https for login links
• Use "displayName" as attribute for user"s name
• use "urn:mace:dir:attribute-def:uid" as attribute for unique identifier for user (SUNet ID)
• use "mail" for user mail address
• set automatic role population like: "web_author:eduPersonEntitlement,=,earthsci:web-authors|web_developer:eduPersonEntitlement,=,earths:web-developer"
• check "reevaluate roles every time user logs in"
• check "Register users" under User Provisioning
• uncheck "Allow SAML users to set Drupal passwords"
• check "Allow authentication with local Drupal accounts" and restrict to administrator role and/or user 1
• option URL for after logging out

Drupal 8.x
 

• Check activate

• Leave default-sp as authentication source

• Change login text to "Stanford WebLogin"

• Check "Register Users (auto provisioning)"
  uncheck "Allow SAML users to set Drupal passwords" under Local Authentication
  check "Allow authentication with local Drupal accounts" and restrict to administrator role and/or user 1
  option URL for after logging out

• Under "User Info and Syncing":
  Use "displayName" as attribute for user"s name
  use "urn:mace:dir:attribute-def:uid" as attribute for unique identifier for user (SUNet ID)
  use "mail" for user mail address
  check "synchronize user name on every login"
  check "synchronize user email on every login"
  set automatic role population like: "web_author:eduPersonEntitlement,=,earthsci:web-authors|web_developer:eduPersonEntitlement,=,earths:web-developer"
  check "reevaluate roles every time user logs in"

• uncheck "Automatically enable SAML authentication for existing users"

Entitlements  

Additional feature - mapping roles to groups

In Stanford SSP module - uncheck button 

User Info and Syncing Tab for SimpleSAMLPHP Auth Settings:
Automatic role population field:
subsite_editor:eduPersonEntitlement,=,earthsci:webdev|staff:suAffiliation,=,stanford:staff|faculty:suAffiliation,=,stanford:faculty|postdoc:suAffiliation,=,stanford:student:postdoc|student:suAffiliation,=,stanford:student

Configuration on Pantheon hosting

The following files are used in cofiguraiton

• settings.php - defines path to simplesaml library ( $settings['simplesamlphp_dir'] = $_SERVER['HOME'] .'/code/private/simplesamlphp';) and redirect to primary custom domain
• config.php - various configuration parameters
• authsources.php
• saml20-idp-remote.php - contains metadata for Stanford IDP and  certData