SAML Identity Provider

Support for Moodle-4.3 and php8.2

2018061302 - initial version
2018061303 - implement hmac algorithm instead of sha1 for cookie value
2018061304 - remove deprecation warnings, test for Moodle 3.10
2018061305 - remove deprecation warnings, test for Moodle 4.0

2018061302 - initial version
2018061303 - implement hmac algorithm instead of sha1 for cookie value
2018061304 - fix deprecation issues, test with Moodle 3.9 and 3.10

This is a plugin that makes Moodle an Identity Provider site: other application can use Moodle as a login portal

Requires SimpleSAMLphp, configured as IdP: https://simplesamlphp.org/docs/stable/simplesamlphp-idp

ATTENTION: SimpleSAMLphp's session store (config/config.php, 'store.type') MUST BE "sql". "phpsession" will not work, "memcache" is not tested
ATTENTION: SimpleSAMLphp's baseurlpath (config/config.php, 'baseurlpath') MUST BE in the full URL format

To make the plugin work:
1: use standard Moodle instalation mechanism;
2: enable and configure the plugin via Moodle (Site administration -> Plugins -> Authentication). "Auth source" is the name from step 4, here it's "moodle-userpass"
3: in SimplesamlPHP, add the plugin's ./moodle directory to SimpleSAMLphp' /modules directory. Since these must be on the same physical server, a symlink works perfectly
4: in SimpleSAMLphp config/authsources.php, add following to $config:
'moodle-userpass' => array(
'moodle:External',
'moodle_coderoot' => '/var/www/ticket/moodle314/www',
'logout_url' => 'https://10.0.0.28/moodle314/auth/samlidp/logout.php', // plugin's logout page
'login_url' => 'https://10.0.0.28/moodle314/login/index.php', // standard Moodle login page
'cookie_name' => 'MoodleSAMLIDPSessionID',
),
5: in SimpleSAMLphp, in metadata/saml20-idp-hosted.php, modify 'auth' with the name from step 4:
'auth' => 'moodle-userpass',

KNOWN ISSUES

1. If a user logs out from Moodle, it will not log them out from their SP application. The logout process is one-directional, from the SP app to Moodle

This is a plugin that makes Moodle an Identity Provider site: other application can use Moodle as a login portal

Requires SimpleSAMLphp, configured as IdP: https://simplesamlphp.org/docs/stable/simplesamlphp-idp

ATTENTION: SimpleSAMLphp's session store (config/config.php, 'store.type') MUST BE "sql". "phpsession" will not work, "memcache" is not tested
ATTENTION: SimpleSAMLphp's baseurlpath (config/config.php, 'baseurlpath') MUST BE in the full URL format

To make the plugin work:
1: use standard Moodle instalation mechanism;
2: enable and configure the plugin via Moodle (Site administration -> Plugins -> Authentication). "Auth source" is the name from step 4, here it's "moodle-userpass"
3: in SimplesamlPHP, add the plugin's ./moodle directory to SimpleSAMLphp' /modules directory. Since these must be on the same physical server, a symlink works perfectly
4: in SimpleSAMLphp config/authsources.php, add following to $config:
'moodle-userpass' => array(
'moodle:External',
'moodle_coderoot' => '/var/www/ticket/moodle314/www',
'logout_url' => 'https://10.0.0.28/moodle314/auth/samlidp/logout.php', // plugin's logout page
'login_url' => 'https://10.0.0.28/moodle314/login/index.php', // standard Moodle login page
'cookie_name' => 'MoodleSAMLIDPSessionID',
),
5: in SimpleSAMLphp, in metadata/saml20-idp-hosted.php, modify 'auth' with the name from step 4:
'auth' => 'moodle-userpass',

KNOWN ISSUES

1. If a user logs out from Moodle, it will not log them out from their SP application. The logout process is one-directional, from the SP app to Moodle

This is a plugin that makes Moodle an Identity Provider site: other application can use Moodle as a login portal.

Requires SimpleSAMLphp, configured as IdP: https://simplesamlphp.org/docs/stable/simplesamlphp-idp.

ATTENTION: SimpleSAMLphp's session store (config/config.php, 'store.type') MUST BE "sql" - "phpsession" will not work, "memcache" is not tested.
ATTENTION: SimpleSAMLphp's baseurlpath (config/config.php, 'baseurlpath') MUST BE in the full URL format.

This instruction describes the situation, when we have two Moodle instances and use one of them as Identity Provider (IdP) server and another as Service Provider (SP). In our example we have:

• samlsp.enovation.lan as Service Provider (SP)


• idp.enovation.lan as Identity Provider(IDP)

First of all, you need to install Simple SAMLphp according to its instructions and locate it in the folder near IPD site installation directory.

Use standard Moodle installation mechanism to install the plugin to auth/samlidp on idp.enovation.lan.

In config/config.php configure session datastore:

As one of the possible options please use Moodle DB credentials. SQLite should also work.

In SimpleSAMLphp config/authsources.php, add following to $config var:
'moodle-userpass' => array(
'moodle:External',
'moodle_coderoot' => '/var/www/ticket/moodle314/www',
'logout_url' => 'https://idp.enovation.lan/auth/samlidp/logout.php', // plugin's logout page
'login_url' => 'https://idp.enovation.lan/login/index.php', // standard Moodle login page
'cookie_name' => 'MoodleSAMLIDPSessionID',
)

In SimpleSAMLphp, in metadata/saml20-idp-hosted.php, modify 'auth' with the name from previous step:
'auth' => 'moodle-userpass'

Now lets config the plugin in Moodle:
Go to Site administration -> Plugins -> Authentication -> SAML Identity Provider and set two parameters:
SimpleSAMLphp installation directory: /opt/vhosts/idp.enovation.lan/www-simplesamlphp
Auth source: moodle-userpass - the string from two previous steps.

Lets configure SP samlsp.enovation.lan. Download the SAML2 plugin and install it (https://moodle.org/plugins/auth_saml2). Go to Site administration -> Plugins -> Authentication ->SAML2 and set parameters. Some of them are described below:

• IdP metadata XML - copy metadata from idp.enovation.lan/idp_simplesaml/saml2/idp/metadata.php?output=xhtml


• Idp label override - any string for display the link on logging page for using SAML IdP logging.


• IdP to Moodle mapping - it is better to map users by email. If you use user id it can cause conflicts between two systems.


• Data mapping - describe how to match data from idp.enovation.lan to samlsp.enovation.lan


• SP metadata - allow you to download SP metadata. Download it and convert to PHP format - use metadata converter: http://idp.enovation.lan/idp_simplesaml/admin/metadata-converter.php. Converted code put in opt/vhosts/idp.enovation.lan/www-simplesamlphp/metadata/saml20-sp-remote.php

Now you can test the logging via SAML_IdP plugin. Create a new user or use existing idp.enovation.lan. Go to samlsp.enovation.lan login page and choose the SAML2 option. Enter username and password of a user from idp.enovation.lan and log in. After logging in the user will be added do samlsp.enovation.lan. That's all.

KNOWN ISSUES

1. If a user logs out from Moodle, it will not log them out from their SP application. The logout process is one-directional, from the SP app to Moodle