Plugins/Auth/Saml

Authentication plugin for SAML 2.0 based SSO integration. This uses the excellent SimpleSAMLPHP software as a Service Provider.

The plugin is shipped as part of core Mahara.

To use / test the plugin you will need to do the following:

Have a memcached server running

And know what the IP address / port number you can use to connect on.

To install one locally (on linux) go

sudo apt-get install memcached

This should set you up with one running on port 11211 - to test that this is correct you can go

telnet 127.0.0.1 11211

and you should get a connection

Have the php-memcached module installed

To install it go

sudo apt-get install php-memcached
sudo phpenmod memcached
sudo service apache2 restart

Update your config.php file so that it knows to use memcached for SAML sessions

Add the following settings

$cfg->ssphpsessionhandler = 'memcached';
$cfg->memcacheservers = '127.0.0.1:11211'; // change if your memcached server is on different IP/port

Ensure the correct SSPHP files are present

If you are installing/using Mahara via git you will need to install the ssphp module via running the command in the parent to the htdocs directory (where the Makefile file lives)

make cleanssphp && make ssphp

This should remove any older version and install the latest version, via composer, for the Mahara version you are using

Ensure the plugin is active in Mahara

Under Administration menu (wrench icon) -> Extensions -> Plugin administration. See Manual - SAML config for more information

Click on the configuration for auth SAML (cog) icon to check that the plugin is set up correctly.

Follow the 'View metadata' link to fetch the Service Provider (SP) metadata that you will need to provide to the IdPs that you wish to authenticate against.

Now we need to perform the institution level configuration

Within each institution, add the SAML 2.0 Identity Provider:

See Manual - SAML institution config for more information

To customise your SAML IdP Metadata

If you site has more than one Identity Provider being used then when a user tries logging into the site via the SSO button they are taken to a 'Identity Provider discovery' page to choose which IdP they should login with.

If the metadata supplied by the IdP is containing the values for

• OrganizationName
• OrganizationDisplayName
• Logo

then these will be used on the discovery page.

If your IdP's metadata doesn't supply them - please ask if they can update things at their end and supply updated metadata.xml file. This will be the best option especially if you are using the metadata refresh url!

If they can't (or won't) then you can add in the changes manually. To do this

1) Log in as site admin and edit an institution that is using the SAML metadata

2) Edit the SAML auth instance

3) In the 'Institution Identity Provider SAML metadata' field make the following changes

a) If you want a logo image Inside the metadata.xml file:

Place just before </IDPSSODescriptor> line

   <Extensions>
     <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
       <mdui:Logo width="120" height="30" xml:lang="en">[URL to logo]</mdui:Logo>
     </mdui:UIInfo>
   </Extensions>

And update the [URL to logo] to point to a logo for the IdP, eg https://mahara.org/theme/mahara-org/images/site-logo.svg and alter height / width values if needed

b) To set the provider details

Place just after </IDPSSODescriptor> line

 <Organization>
   <OrganizationName xml:lang="en">[Provider name]</OrganizationName>
   <OrganizationDisplayName xml:lang="en">[Identity provider name]</OrganizationDisplayName>
 </Organization>

- Change [Provider name] to the name of the organization the IdP belongs to, eg Mahara.org

- Change [Identity Provider name] to the name of the IdP system, eg Mahara Single Sign On

Note Depending on the way your IdP structures it's metadata you may need to prefix the new Extensions and Organization* lines with same prefix as in the </IDPSSODescriptor> line, eg if that line looks like </md:IDPSSODescriptor> then you will need to add 'md:' to the lines that don't start it