Consider using OneLogin Simple SAML toolkit for PHP

[danielbachhuber]

OneLogin has a Simple SAML toolkit for PHP, which looks robust. We may be able to package this directly with the plugin, instead of requiring SimpleSAMLphp to be installed separately.

[stevector]

Last year @davidstrauss mentioned positively it in Power Users: https://groups.google.com/a/pantheon.io/d/msg/power-users/uBHYj1c8lqY/PsIbFvZHEgAJ

From what I see it looks like a much nicer option. And between LCache and Solr Power we have better conventions for handling a Composer dependency like OneLogin's library than what is currently recommended here with SimpleSAML.

[joshkoenig]

+1 for this. There was a time when I thought that SimpleSamlPHP support was important, and retaining it as an option could be nice.

HOWEVER - if we can do SAML out of the box with OneLogin's library, operating as a Service Provider only, and with a single configuration file to set up, that would be... preferable. Worth a spike at least.

[tobeycodes]

@danielbachhuber what's the status of this? Just integrated a site with this plugin and SimpleSamlPHP. No rush, just want to put it into the timeline to switch

@stevector how do you currently handle this? I opted with a post composer hook to rsync the config, certs and metadata to the vendor/simplesamlphp folder

[danielbachhuber]

@schrapel Functional work in progress on #68. Remaining work is:

• Fix failing integration tests.
• Document setup.

[stevector]

@schrapel I haven't used the onelogin library myself yet.

I opted with a post composer hook to rsync the config, certs and metadata to the vendor/simplesamlphp folder

I assume you are using the web_docroot option such that your vendor directory is not web accessible?

[tobeycodes]

I was talking about simplesamlphp. You have to store the config files in the simplesaml folder unless you define a nginx/apache env variable which I wasn't sure if they were possible on pantheon. So I chose to copy these files into the vendor folder after composer install. And yes using the web folder

[stevector]

Ah, right. rsync after Composer install/update makes sense to me. To set up a site for the Behat tests we just do a lot of file copying/wrangling. https://github.com/pantheon-systems/wp-saml-auth/blob/master/bin/behat-prepare.sh It's not very elegant.

[danielbachhuber]

🚢