Package: wcs.samlauth
wcs.samlauthwcs.samlauth is a saml authentication plugin based on python3-saml for plone 6.
It turns your plone site into a SP (Service Provider).
IDP (Identity Provider) is not supported.The package is tested with plone 6 and python 3.11. It does not officially support other versions.GoalMake it as easy as possible to configure plone as a SP (Service Provider), without having a in depth knowledge of SAML and how it works under the hood. This package uses the high level API of python3-saml, which makes it easy to configure and use.TL;DRInstall wcs.samlauth pluginAdd PAS plugin via ZMI (in acl_users)Go tohttp://localhost:8080/Plone/acl_users/saml/idp_metadataFetch or upload IDP metadata -> Click "Get and store metadata"Go tohttp://localhost:8080/Plone/acl_users/saml/metadataand configure your IDPUsehttp://localhost:8080/Plone/acl_users/saml/slsto login via IDPArchitecureThe plugin is based on a similar architecture/concept aspas.plugins.oidc. It basically means that all endpoints are directly on the plugin.
The plugin does not override plones login/logout views. This is up to you.
If you only have one saml plugin it's possible to enable theChallengeplugin, which redirects to the saml login endpoint.This enables you to add multiple saml plugins as well.Dependecies:Seepython3-samlMake especially sure the following packages can be installed, since the have some system dependencies as well:xmlseclxmlFor example, on a recent Ubuntu, you should run:aptinstallpkg-configlibxml2-devlibxmlsec1-devlibxmlsec1-opensslEndpointsGiven the ID of the SAML plugin is "saml":Expose SP metadata onhttp://localhost:8080/Plone/acl_users/saml/metadatathe SP metadata is partially generated and partially static. entityId, assertionConsumerService and singleLogoutService are generatedSAML Login endpoint ishttp://localhost:8080/Plone/acl_users/saml/slsSAML ACS endpoint ishttp://localhost:8080/Plone/acl_users/saml/acsSAML Logout endpoint ishttp://localhost:8080/Plone/acl_users/saml/sloSAML SP initiated logout endpointhttp://localhost:8080/Plone/acl_users/saml/logoutFetch IDP metadatahttp://localhost:8080/Plone/acl_users/saml/idp_metadataFeaturesFetch and store IDP metadata via IDP metadata endpointUpload and store IDP metadata via file uploadMultiple saml plugins at the same timeImplements almost everything from python3-saml, this includes SP signing of the AuthnRequest and metadataCreate a plone session and/or restapi tokenEnable/Disable the creation of a plone userAutomatically updates user data (hardcoded, currently limited to email and fullname)Enable/Disable the validation of authn requests (Uses temporarly a__samlcookie)Prevent Redirect attacks, by validating the RelayState parameter and a and an "allowed" list of domains, where we can redirect toE2E tests with Keykloak as IDP in different configuration variationsManually tested with Azure AD as IDPDocumentation use azure and keycloak as IDPInstallationAdd plugin to your buildout[buildout]

...

eggs =
    wcs.samlauthAdd wcs.samlauth to plone docker image$ docker run -p 8080:8080 -e SITE="mysite" -e ADDONS="wcs.samlauth" ploneFrom the ZMI go toacl_usersand add the saml plugin.DevelopmentIt's best to use a local IDP, for example keycloak in order to make changes to this package.Start a local keycloak server using docker:$ docker run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:22.0.2 start-devInstall and run a test plone instance:$ git clone git@github.com:webcloud7/wcs.samlauth.git && cd wcs.samlauth
$ make install
$ make runTestYou need a local docker installation to run tests.The package provides a docker test layer, which spins up keycloak and loads various configuration files into keycloak.$ make testRun individual tests:$ ./bin/test -t test_whateverHowTo'sThe tests/assets folder contains some keycloak configurations you can use for your test setup.
It inclues examples with SP signed autn requests and metadata.The examples below do not use this specific saml feature which is required by most IDP.Manuall configuirationYou can configure everythin manully as well. Please see thepython3-saml documentationfor detailsThe configuration needs to be applied directly on the property tab of the saml plugin.Configure with keycloak as IDPFor both create a new saml pas plugin via ZMI in acl_usersIDP part on keycloakLogin to your Keycloak admin console.Create a new realm or use one that's already there. If not there create a test user.With the data fromhttp://localhost:8080/Plone/acl_users/saml/metadatacreate a new Client.Client type is SAML.Important note here: The client ID is identical to the SAMLEntityIDFor examplehttp://localhost:8080/keycloak/acl_users/saml/metadataClick "next"Configure Home URL and Valid redirect URLsClick "Save"Go to "Keys" tab and disable "Client signature required"Configure attribute bindingsUnter "Client scopes" click on URL which ends with /metadata-dedicatedClick on "Add predefined mapper"Chose the following mappersClick "Add"Go to the Advance tab and configure the logout service redirect binding (python3-saml only supports the redirect binding here)Copy the metadataa saml config URLSP part on your Plone siteGo to URL:http://localhost:8080/Plone/acl_users/saml/idp_metadataEnter the Url and Click on "Get and store metadata"Hints: Keycloak hasauthnRequestsSigned: truehardcoded.THATS IT!! Go Tohttp://localhost:8080/Plone/acl_users/saml/slsto login via azureIf this is the only saml plugin on your site and want all users to login via saml, then you can enable the Challenge Plugin and change the login and logout actions on your plone site to use the saml endpoints.Configure with Azure as IDPThis is a tutorial how to configure an azure cloud enterprise app as IDP for this plugin.IDP part on azure cloudGo to your azure AD and create a new enterprise app.Go to the "Single Sign on" section.Add SAML authentification to app.Gather the metadata from the SAML plugin.URL:http://localhost:8080/Plone/acl_users/saml/metadataManually edit "Basic SAML Configuration" (Info's can be taken from the SP metadata xml)Add EntityID and ACS. Optionally also add the Logout URL. Azure wants https there, so depending on your setup
just leave it blank.Edit "Attributes & Claims"The plugin only supports the email address, given name and surename
You can configure more attributes, but they will be ignored.Important: The clame names need to be givenName, surename and email.
Also remove the namespace and leave empty.Download Federation metadata XMLSP part on your Plone siteGo to URL:http://localhost:8080/Plone/acl_users/saml/idp_metadataUpload and store configuration from IDP (azure)The upload form also shows you what information has been gathered from the Metadata XML and what will be stored in your saml pluginTHATS IT!! Go Tohttp://localhost:8080/Plone/acl_users/saml/slsto login via azureIf this is the only saml plugin on your site and want all users to login via saml, then you can enable the Challenge Plugin and change the login and logout actions on your plone site to use the saml endpoints.Changelog1.0.0a4 (2024-02-20)Do not use SCRIPT_NAME for the callback URL. [mathias.leimgruber]1.0.0a3 (2023-09-28)Fix typo for boolean property. [mathias.leimgruber]1.0.0a2 (2023-09-28)Disable csrf protection on acs (callback view). [mathias.leimgruber]1.0.0a1 (2023-09-28)Init release [mathias.leimgruber]