This package provides an easy way to implement Shibboleth Authentication for 6, 7 and 8. It can either use an existing Shibboleth SP (like apache mod_shib) or it can serve as its own Shib SP.
Because this is a fork, you'll need to add the fork to your composer.json file. Add this entry to your repositories array:
{
"type": "vcs",
"url": "https://github.com/UMN-LATIS/laravel-shibboleth"
},Use composer to require the latest release into your project:
composer require "razorbacks/laravel-shibboleth":"dev-umn"
Publish the default configuration file and entitlement migrations:
php artisan vendor:publish --provider="StudentAffairsUwm\Shibboleth\ShibbolethServiceProvider"
You can also publish the views for the shibalike emulated IdP login:
php artisan vendor:publish --provider="StudentAffairsUwm\Shibboleth\ShibalikeServiceProvider"
Change the driver to shibboleth in
your config/auth.php file.
'providers' => [
'users' => [
'driver' => 'shibboleth',
'model' => App\User::class,
],
],The published shibboleth.php config file allows for a wide range of customization. If you're leveraging the local-sp functionality, you'll need to provide a variety of information about your Shibboleth IdP. If you're leveraging the Apache shibboleth SP, you should only need to verify the Shibboleth attributes that you'll be using.
For local development, add SHIB_EMULATE=true to your .env file. This will enable you to login with any of the users defined in the emulate_idp_users array of shibboleth.php. You may add additional users if you wish.
UMN users: the shibboleth.php local-sp config is mostly ready for the UMN IdP. You'll need to provide your private key and cert in the .env file. See the example below.
SHIB_SP_TYPE=local_shib
SHIB_EMULATE=false
SHIB_ENTITY_ID=your-shibboleth-entity
SHIB_ASSERTION_CONSUMER_URL=https://your-hostname/local-sp/ACS
SHIB_LOGOUT_SERVICE_URL=https://your-hostname/local-sp/Logout
SHIB_X509_CERT="Certificate here, no line returns"
SHIB_PRIVATE_KEY="Private Key Here, no Line Returns"
SHIB_IDP_ENTITY=https://idp2.shib.umn.edu/idp/shibboleth
SHIB_IDP_SSO=https://login.umn.edu/idp/profile/SAML2/Redirect/SSO
SHIB_IDP_SLO=https://login.umn.edu/idp/profile/SAML2/Redirect/SLO
SHIB_IDP_X509_SIGNING="MIIDHzCCAgegAwIBAgIUah2ROh5+3z9VKbgAKYi4SezMYjwwDQYJKoZIhvcNAQEL\nBQAwGDEWMBQGA1UEAwwNbG9naW4udW1uLmVkdTAeFw0xNjA2MjkxNzQ4MTRaFw0z\nNjA2MjkxNzQ4MTRaMBgxFjAUBgNVBAMMDWxvZ2luLnVtbi5lZHUwggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQClv5lE5Zxd/r1Yq3/72oszyYiLtZO+dD2y\nn8pyOJPndzewSMWtbvO0UWQssYMx6jZ/MsPbySgnuP/FZCUyISs6oSVzPkSLwulv\nSbbG5+VPouoxR1u2+POWw6KXQ5Yy/ZMIj9w6XF0PWiQx+NCZwV39r+oNgi9SY3zl\nsa00bLfp1+gqho2rzA/jkud2ZCzK58Cerit4CBSma1atSYGLoFIWpG9bk3TFFZXs\ngAiP7hzmzgtt1fD9560psgviUR1iydV+xcVzAz/MVzTyKWdi0Z4lyOocUfkZKh33\nvQYzqq4J0wxjaICdJAzciM+CsOU/HN1hyEqDn8jwgAeWwFckbXFdAgMBAAGjYTBf\nMB0GA1UdDgQWBBTsPJYGoIIIMAoU9dcM4Yjw4RO06TA+BgNVHREENzA1gg1sb2dp\nbi51bW4uZWR1hiRodHRwczovL2xvZ2luLnVtbi5lZHUvaWRwL3NoaWJib2xldGgw\nDQYJKoZIhvcNAQELBQADggEBAFSp+18J5bVS+NDfJzwRYizcchBYSLFdLBwXXYM3\nvxe5JLB2eKOkaxMLmxWYuAvLTXS2tuCmjHsEknl9L8o6ETbYi4yIeXRysmCpANiU\n6T5e0Btwf9CIA35BefOr4MRcnoiRdA0w0NVvjzK/6cVJyyiYp3Ywpp5zmqCHnV5A\n1o5YTNP2ewuMoDdbjdEo+eZFaga12owt642uiLh5TjdRZ3H70HtuXNlDcE7JLOt6\n6aEJfHfnJV15VwUrztmn9cBF9Bx0ognJkZmQUpqvF5jSYPmPaSakENimUHLbqKg6\npJMA7hVJR3RTayarc64cm7vRNPn2FC6WBd39++5+wF2Yhoc="
SHIB_IDP_X509_ENCRYPTION="MIIDHzCCAgegAwIBAgIUSM2i3FZUSYOcPx+9WwQrsSRtYC8wDQYJKoZIhvcNAQEL\nBQAwGDEWMBQGA1UEAwwNbG9naW4udW1uLmVkdTAeFw0xNjA2MjkxNzQ5MzhaFw0z\nNjA2MjkxNzQ5MzhaMBgxFjAUBgNVBAMMDWxvZ2luLnVtbi5lZHUwggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLDAv0oprzAfYf1jlqqY3msym9MqE1OSvJ\nK+AryDVcx6GD+U0Bp96fxjvA1w5jvt+0LQnrYkAQChvj0uRxzH1R8VYqfnBlCHgw\n6P1aOrppu7jjiJEvNKDxwVz+lDdHWMM+PBLW3ye7DeZs6U0onxIdiNubmSAw+M6R\nGuC5B/FEsmx32AEk69hPW6syxgzfsp0RLJtAna6ZgppPZ6QsSJgcGHkcNZLLzSJj\nYBpZXgt4Jk7BT03O/41mXiu77sie8gVkiL7so6cg4SvZNks/oPx1uULP6qaHbmRq\n8mTJEoO8WIiNSIPGSCIn/uguizk6ZDwvKQ5dTq9P/MFB5DJ4VeznAgMBAAGjYTBf\nMB0GA1UdDgQWBBR1Yf/+kEdXFb0khrjxSleVRoGS6zA+BgNVHREENzA1gg1sb2dp\nbi51bW4uZWR1hiRodHRwczovL2xvZ2luLnVtbi5lZHUvaWRwL3NoaWJib2xldGgw\nDQYJKoZIhvcNAQELBQADggEBAGsEfHxJWYMyVKHcm4h9lzwzTScjRopdaG9CgsC5\nB4Q2JhZfijiBQwADQH9NLiYA7iIW2qPG8/qmVmcHRa/0JxB16s5EQ984oTX5JL4N\nHA50P1L8CR86zpDr/dbAtePQqB/1+nEMOAyIxXcuJbQF7Slt55X8gk8j5yW6ILGx\n3p4lpQ7yv1z8cLYZrxRrCY4MJqxw1udbJNjUgXQ6kkNZYfxFM4SnaSukVvEk1IyK\nzGLokdPcU8d99asDyUD3czSfGmcPx1CorIqnyWN12MEiO7ganj8ftRpVkpMJ75Sq\nhE9g7oWFs2lrdJWeBrk+rYesB1SfrzYiFh7bgUvEfNj1ZDY="Also, if you use the built in local-sp module for metadata generation by accessing hostname/local-sp/Metadata, be sure to remove md:NameIDFormat from the metadata before submitting it to OIT.
If you're using the local SP option, you'll need to modify app/Http/Middleware/VerifyCsrfToken.php within your Laravel project, adding an exception for the assertion consumer.
protected $except = [
'/local-sp/ACS'
];
If everything is right with the world, users may now login via Shibboleth by going to https://example.com/shibboleth-login
and logout using https://example.com/shibboleth-logout so you can provide a custom link
or redirect based on email address in the login form.
@if (Auth::guest())
<a href="/shibboleth-login">Login</a>
@else
<a href="/shibboleth-logout">
Logout {{ Auth::user()->name }}
</a>
@endifYou may configure server variable mappings in config/shibboleth.php such as
the user's first name, last name, entitlements, etc. You can take a look at them
by reading what's been populated into the $_SERVER variable after authentication.
<?php print_r($_SERVER);This was designed to work side-by-side with the native authentication system for projects where you want to have both Shibboleth and local users. If you would like to allow local registration as well as authenticate Shibboleth users, then use laravel's built-in auth system.
php artisan make:auth
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent