-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Enable the use of alternate ACS URLs
For e.g. subdomains that are served by the same Silverstripe installation. This could be subsites, translation domains (fluent), etc. Without the ability to accurately return traffic to the correct site after authentication, users are presented with a confusing and frustrating experience. At worst they get locked out of their sites (with SAMLMiddleware), as although AuthN completes successfully, the domain that carries the session is (by default) neither correct nor shared.
- Loading branch information
Showing
3 changed files
with
143 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| <?php | ||
|
|
||
| namespace SilverStripe\SAML\Tests\Services; | ||
|
|
||
| use SilverStripe\Control\Director; | ||
| use SilverStripe\Core\Config\Config; | ||
| use SilverStripe\Dev\SapphireTest; | ||
| use SilverStripe\SAML\Services\SAMLConfiguration; | ||
|
|
||
| class SAMLConfigurationTest extends SapphireTest | ||
| { | ||
| protected function setUp(): void | ||
| { | ||
| parent::setUp(); | ||
| $config = Config::modify(); | ||
| $config->set(Director::class, 'alternate_base_url', 'https://running.test'); | ||
|
|
||
| $config->set(SAMLConfiguration::class, 'extra_acs_base', [ | ||
| 'https://example.running.test/' | ||
| ]); | ||
|
|
||
| $config->set(SAMLConfiguration::class, 'SP', [ | ||
| 'entityId' => "https://running.test", | ||
| 'privateKey' => __DIR__ . '/fakeCertificate.pem', | ||
| 'x509cert' => __DIR__ . '/fakeCertificate.pem', | ||
| ]); | ||
| $config->set(SAMLConfiguration::class, 'IdP', [ | ||
| 'entityId' => "idp.example.com", | ||
| 'singleSignOnService' => "https://idp.example.com/test/saml2", | ||
| 'x509cert' => __DIR__ . '/fakeCertificate.pem', | ||
| ]); | ||
|
|
||
| $config->set(SAMLConfiguration::class, 'strict', true); | ||
| $config->set(SAMLConfiguration::class, 'debug', false); | ||
| $config->set(SAMLConfiguration::class, 'Security', [ | ||
| 'signatureAlgorithm' => "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", | ||
| ]); | ||
| } | ||
|
|
||
| public function provideBaseUrls(): array | ||
| { | ||
| return [ | ||
| [ | ||
| null, | ||
| 'https://running.test/saml/acs', | ||
| 'SP.EntityId should be used by default' | ||
| ], | ||
| [ | ||
| 'https://example.running.test/', | ||
| 'https://example.running.test/saml/acs', | ||
| 'Extra ACS should work when the loaded (or specified) domain matches' | ||
| ], | ||
| [ | ||
| 'https://not-legit.running.test/', | ||
| 'https://running.test/saml/acs', | ||
| 'Unlisted ACS base should result in the SP.EntityId being used instead', | ||
| ], | ||
| ]; | ||
| } | ||
|
|
||
| /** | ||
| * @dataProvider provideBaseUrls | ||
| * | ||
| * @param string $baseUrl | ||
| * @param string $expectedOut | ||
| * @return void | ||
| */ | ||
| public function testAcsBaseIsSetCorrectly($baseUrl, $expectedOut, $message) | ||
| { | ||
| if (isset($baseUrl)) { | ||
| Config::modify()->set(Director::class, 'alternate_base_url', $baseUrl); | ||
| } | ||
| $samlConfig = (new SAMLConfiguration())->asArray(); | ||
| $this->assertSame( | ||
| $expectedOut, | ||
| $samlConfig['sp']['assertionConsumerService']['url'], | ||
| $message | ||
| ); | ||
| } | ||
| } |
Empty file.