Revision: 2000
Author: olavmrk
Date: Wed Nov 18 00:15:40 2009
Log: saml: Add authentication parameter support.
http://code.google.com/p/simplesamlphp/source/detail?r=2000
Modified:
/trunk/modules/saml/docs/sp.txt
/trunk/modules/saml/lib/Auth/Source/SP.php
=======================================
--- /trunk/modules/saml/docs/sp.txt Thu Oct 8 02:55:07 2009
+++ /trunk/modules/saml/docs/sp.txt Wed Nov 18 00:15:40 2009
@@ -9,11 +9,43 @@
The metadata for your SP will be available from the federation page on
your simpleSAMLphp installation.
+Options
+-------
+
+These are options that can be used at runtime to control the
authentication.
+All these options override the equivalent option from the configuration.
+
+`saml:AuthnContextClassRef`
+: The AuthnContextClassRef that will be sent in the login request.
+
+: *Note*: SAML 2 specific.
+
+
+`saml:ForceAuthn`
+: Force authentication allows you to force re-authentication of users
even if the user has a SSO session at the IdP.
+
+: *Note*: SAML 2 specific.
+
+`saml:idp`
+: The entity ID this SP should connect to.
+
+`saml:IsPassive`
+: IsPassive allows you to enable passive authentication by default for
this SP.
+
+: *Note*: SAML 2 specific.
+
+`saml:NameIDPolicy`
+: The format of the NameID we request from the IdP.
+ Defaults to the transient format if unspecified.
+
+: *Note*: SAML 2 specific.
+
+
Examples
--------
-Here we will list some example configurations for this authentication
source.
+Here we will list some examples for this authentication source.
### Minimal
@@ -50,6 +82,12 @@
),
+### Requesting passive authentication
+
+$auth = new SimpleSAML_Auth_Simple('default-sp');
+$auth->login(array('saml:IsPassive' => TRUE));
+
+
Options
-------
=======================================
--- /trunk/modules/saml/lib/Auth/Source/SP.php Thu Nov 5 04:23:01 2009
+++ /trunk/modules/saml/lib/Auth/Source/SP.php Wed Nov 18 00:15:40 2009
@@ -185,6 +185,27 @@
$ar->setRelayState($state['SimpleSAML_Auth_Default.ReturnURL']);
}
+ if (isset($state['saml:AuthnContextClassRef'])) {
+ $accr =
SimpleSAML_Utilities::arrayize($state['saml:AuthnContextClassRef']);
+
$ar->setRequestedAuthnContext(array('AuthnContextClassRef' => $accr));
+ }
+
+ if (isset($state['saml:ForceAuthn'])) {
+ $ar->setForceAuthn((bool)$state['saml:ForceAuthn']);
+ }
+
+ if (isset($state['saml:IsPassive'])) {
+ $ar->setIsPassive((bool)$state['saml:IsPassive']);
+ }
+
+ if (isset($state['saml:NameIDPolicy'])) {
+ $ar->setNameIdPolicy(array(
+ 'Format' => (string)$state['saml:NameIDPolicy'],
+ 'AllowCreate' => TRUE,
+ ));
+ }
+
+
$id = SimpleSAML_Auth_State::saveState($state, 'saml:sp:sso',
TRUE);
$ar->setId($id);
@@ -263,12 +284,18 @@
/* We are going to need the authId in order to retrieve this
authentication source later. */
$state['saml:sp:AuthId'] = $this->authId;
- if ($this->idp === NULL) {
+ $idp = $this->idp;
+
+ if (isset($state['saml:idp'])) {
+ $idp = (string)$state['saml:idp'];
+ }
+
+ if ($idp === NULL) {
$this->startDisco($state);
assert('FALSE');
}
- $this->startSSO($this->idp, $state);
+ $this->startSSO($idp, $state);
assert('FALSE');
}
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=.
