Build a SSP debug SP

.github/workflows/build-ssp-debug-sp.yml

@@ -0,0 +1,29 @@
+name: Build docker SSP debug SP container
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build-ssp-debug-sp:
+
+    runs-on: ubuntu-latest
+
+    steps:
+
+    - name: Check out the repo
+      uses: actions/checkout@v2
+
+    - name: Log into GitHub Container Registry
+      uses: docker/login-action@v1
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build the SSP Debug SP container and push to GitHub Packages
+      uses: docker/build-push-action@v2
+      with:
+        tags: ghcr.io/openconext/openconext-containers/openconext-ssp-debug-sp:latest
+        context: docker/ssp-debug-sp/
+        push: true

README.md

@@ -1 +1,13 @@
 # OpenConext-containers
+
+## SSP Debug SP
+The SSP debug SP container is specifically targeted for use with StepUp projects. The container is configured with 
+a SP / IdP setup that tailors to use with StepUp authentication in mind. The debug SP (sp.php) can be used to fire
+SSO and SFO authentications to the Gateway. 
+
+In order to work with this container, you will need to do some small additional setting up in your own Dockerfile/Docker
+Compose. 
+
+1. Make sure you deploy a sp.key, idp.key, sp.crt and idp.crt to the `/var/cert` folder. They should match the SP 
+   certificate of the SP's defined in your Gateway SAML entity setup. E.g the entities projected in 
+   gateway.saml_entities`.

docker/ssp-debug-sp/Dockerfile

@@ -0,0 +1,39 @@
+FROM webdevops/php-nginx:7.2 AS ssp-debug-sp
+MAINTAINER Michiel Kodde (michiel@ibuildings.nl)
+
+# Install required applications & binaries to install SimpleSAMLphp
+RUN apt-get update && apt-get install -y git python zip libpng-dev nodejs
+RUN docker-php-ext-install pdo_mysql exif gd
+
+# Install Composer
+COPY --from=composer:1 /usr/bin/composer /usr/local/bin/composer
+# Install SSP: Clone and install rev adf1eb8 of SSP
+WORKDIR /app/
+RUN git clone https://github.com/simplesamlphp/simplesamlphp.git /app
+RUN git reset --hard adf1eb8
+
+# Install SSP: Copy files
+COPY conf/config.php /app/config/config.php
+COPY conf/authsources.php /app/config/authsources.php
+COPY conf/accountgen.inc /app/config/accountgen.inc
+COPY conf/saml20-idp-hosted.php /app/metadata/saml20-idp-hosted.php
+COPY conf/saml20-idp-remote.php /app/metadata/saml20-idp-remote.php
+COPY conf/saml20-sp-remote.php /app/metadata/saml20-sp-remote.php
+COPY conf/SURFconext_short_to_urn.php /app/attributemap/SURFconext_short_to_urn.php
+
+# Install SSP: Install dependencies and build
+RUN composer require simplesamlphp/simplesamlphp-module-saml2debug
+RUN composer install --prefer-dist -n -o
+
+# Install SSP: Copy DebugSP files
+COPY conf/DebugSP /app/modules/DebugSP
+COPY conf/sp.php /app/www/sp.php
+COPY conf/sp-config.inc /app/www/sp-config.inc
+COPY conf/sp-utils.inc /app/www/sp-utils.inc
+
+# Enable the SSP IdP
+RUN touch modules/exampleauth/enable
+
+# Configure the webserver: deploy the nginx vhost config & set php-fpm pool config
+COPY conf/nginx.conf /opt/docker/etc/nginx/vhost.conf
+RUN echo '' > /opt/docker/etc/nginx/vhost.common.d/10-php.conf

docker/ssp-debug-sp/conf/DebugSP/lib/Auth/Source/SP.php

@@ -0,0 +1,83 @@
+<?php
+
+/**
+ * Copyright 2018 SURFnet bv
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Installation: copy this file to the "modules/saml/lib/Auth/Source/" directory of your SimpleSAMLphp installation
+   Usage:
+   - In authsourcesphp use "DebugSP:SP" where you would otherwise use "saml:SP"
+   - In the call to AuthSimple::requireAuth($params), AuthSimple::login($params) set 'saml:AssertionConsumerServiceURL'
+     and 'DebugSP:extraPOSTvars' to the desired values.
+     E.g.:
+     $params=array(
+        'DebugSP:AssertionConsumerServiceURL' => 'https://...',
+        'DebugSP:extraPOSTvars' => array(
+           'SomePOSTvariable'    => 'SomeValue',
+           'AnotherPOSTvariable' => 'AnotherValue'
+        ),
+     );
+     $as->login($params);
+*/
+
+// Extend from the SimpleSAMLphp SAML 2.0 authentication source "saml:SP"
+class sspmod_DebugSP_Auth_Source_SP extends sspmod_saml_Auth_Source_SP {
+
+    public function __construct($info, $config) {
+        parent::__construct($info, $config);
+    }
+
+    public function sendSAML2AuthnRequest(array &$state, \SAML2\Binding $binding, \SAML2\AuthnRequest $ar) {
+
+        if ( isset( $state['DebugSP:AssertionConsumerServiceURL'] ) ) {
+            // Set the AssertionConsumerServiceURL in the AuthnRequest
+            $ar->setAssertionConsumerServiceURL( $state['DebugSP:AssertionConsumerServiceURL'] );
+        }
+
+        if ($binding instanceof \SAML2\HTTPPost) {
+            // replicate \SAML2\HTTPPost::send(Message $message) so we can set additional POST variables
+            $destination = $ar->getDestination();
+            $relayState = $ar->getRelayState();
+            $post = array();
+
+            // Set extra POST variables
+            if (isset($state['DebugSP:extraPOSTvars'])) {
+                assert(is_array($state['DebugSP:extraPOSTvars']), 'DebugSP:extraPOSTvars must be array()');
+                foreach ($state['DebugSP:extraPOSTvars'] as $key => $value) {
+                    $post[$key] = $value;
+                }
+            }
+
+            // Create SAMLRequest
+            $msgStr = $ar->toSignedXML();
+            $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
+
+            \SAML2\Utils::getContainer()->debugMessage($msgStr, 'out');
+
+            $post['SAMLRequest'] = base64_encode($msgStr);
+
+            if ($relayState !== null) {
+                $post['RelayState'] = $relayState;
+            }
+
+            \SAML2\Utils::getContainer()->postRedirect($destination, $post);
+
+            return;
+        }
+
+        // Use partent implementation
+        parent::sendSAML2AuthnRequest($state, $binding, $ar);
+    }
+}

docker/ssp-debug-sp/conf/DebugSP/www/sp/saml2-acs.php

@@ -0,0 +1,26 @@
+<?php
+
+/**
+ * Copyright 2018 SURFnet bv
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Rename the "_SAMLResponse" variable that used by the ADFS SFO extension back to the SAML HTTP-POST standard
+// "SAMLResponse" and then hand over processing to the standard SSP ACS processing
+
+if (isset($_POST['_SAMLResponse'])) {
+    $_POST['SAMLResponse'] = $_POST['_SAMLResponse'];
+}
+
+require(__DIR__.'/../../../saml/www/sp/saml2-acs.php');

docker/ssp-debug-sp/conf/SURFconext_short_to_urn.php

@@ -0,0 +1,19 @@
+<?php
+
+$attributemap = array(
+	// urn:mace:dir
+	'sn'						=> 'urn:mace:dir:attribute-def:sn',
+	'givenName'					=> 'urn:mace:dir:attribute-def:givenName',
+	'cn'						=> 'urn:mace:dir:attribute-def:cn',
+	'displayName'				=> 'urn:mace:dir:attribute-def:displayName',
+	'mail'						=> 'urn:mace:dir:attribute-def:mail',
+	'uid'						=> 'urn:mace:dir:attribute-def:uid',
+	'eduPersonAffiliation'      => 'urn:mace:dir:attribute-def:eduPersonAffiliation',
+	'eduPersonEntitlement'      => 'urn:mace:dir:attribute-def:eduPersonEntitlement',
+	'eduPersonPrincipalName'    => 'urn:mace:dir:attribute-def:eduPersonPrincipalName',
+	'preferredLanguage' 		=> 'urn:mace:dir:attribute-def:preferredLanguage',
+	'eduPersonTargetedID'       => 'urn:mace:dir:attribute-def:eduPersonTargetedID',
+    // urn:mace:terena.org
+	'schacHomeOrganization'		=> 'urn:mace:terena.org:attribute-def:schacHomeOrganization',
+	'schacHomeOrganizationType'	=> 'urn:mace:terena.org:attribute-def:schacHomeOrganizationType',
+);

docker/ssp-debug-sp/conf/accountgen.inc

@@ -0,0 +1,85 @@
+<?php
+
+/*
+Generate accounts for simpleSAMLphp "example-userpass" auth source
+
+$config: simplesaml php config array
+$prefix: account name prefix
+$email: An existing email address, if you want to receive mail
+$scope: Used as schachome, EPPN scope and names
+$slugs: array of account variants
+*/
+
+function account_gen(&$config, $prefix, $email, $scope, $slugs)
+{
+    foreach($slugs as $slug)
+    {
+        $uid=$prefix.$slug;
+        $account=array(
+            'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
+            'uid' => array($uid),
+            'eduPersonPrincipalName' => $uid.'@'.$scope,
+            'givenName' => 'gn-'.$uid,
+            'sn' => 'sn-'.$scope,
+            'cn' => $uid.' '.$scope,
+            'mail' => str_replace('@', '+'.$uid.'@', $email),
+            'displayName' => 'd-'.$uid.' '.$scope,
+            'eduPersonAffiliation' => array('student'),
+            'schacHomeOrganization' => $scope,
+            'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
+        );
+        $config['example-userpass'][$uid.':'.$uid]=$account;
+    }
+
+    // Without SHO
+    $uid=$prefix.'-nosho';
+    $account=array(
+        'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
+        'uid' => array($uid),
+        'eduPersonPrincipalName' => $uid.'@'.$scope,
+        'givenName' => 'gn-'.$uid,
+        'sn' => 'sn-'.$scope,
+        'cn' => $uid.' '.$scope,
+        'mail' => str_replace('@', '+'.$uid.'@', $email),
+        'displayName' => 'd-'.$uid.' '.$scope,
+        'eduPersonAffiliation' => array('student'),
+        //'schacHomeOrganization' => $scope,
+        'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
+    );
+    $config['example-userpass'][$uid.':'.$uid]=$account;
+
+    // Without mail
+    $uid=$prefix.'-nomail';
+    $account=array(
+        'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
+        'uid' => array($uid),
+        'eduPersonPrincipalName' => $uid.'@'.$scope,
+        'givenName' => 'gn-'.$uid,
+        'sn' => 'sn-'.$scope,
+        'cn' => $uid.' '.$scope,
+        //'mail' => str_replace('@', '+'.$uid.'@', $email),
+        'displayName' => 'd-'.$uid.' '.$scope,
+        'eduPersonAffiliation' => array('student'),
+        'schacHomeOrganization' => $scope,
+        'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
+    );
+    $config['example-userpass'][$uid.':'.$uid]=$account;
+
+    // Without cn
+    $uid=$prefix.'-nocn';
+    $account=array(
+        'NameID' => 'urn:collab:person:'.$scope.':'.$uid,
+        'uid' => array($uid),
+        'eduPersonPrincipalName' => $uid.'@'.$scope,
+        'givenName' => 'gn-'.$uid,
+        'sn' => 'sn-'.$scope,
+        //'cn' => $uid.' '.$scope,
+        'mail' => str_replace('@', '+'.$uid.'@', $email),
+        'displayName' => 'd-'.$uid.' '.$scope,
+        'eduPersonAffiliation' => array('student'),
+        'schacHomeOrganization' => $scope,
+        'schacHomeOrganizationType' => 'urn:mace:terena.org:schac:homeOrganizationType:int:university',
+    );
+    $config['example-userpass'][$uid.':'.$uid]=$account;
+
+}