SimpleSAMLphp IdP

simplesamlphp_idp - SimpleSAMLphp Identity Provider

This Drupal module integrates drupal with simplesamlphp configured as an identity provider

Together with it the drupalas (Drupal Authentication Source) module for simplesamlphp this creates a SAML identity provider obtaining it's user information from the drupal user base.

For the SimpleSAMLphp module drupalas see:
https://github.com/masupilamie/drupalas

Installation instructions can be found in documents/installation.txt.

The drupal page is used as a front-end (so no simplesamlphp login page is shown) and drupal validates the session with two hashes (one in a cookie and one in the _GET parameter. The hashes are generated from unique one-time salts joined together with the secretsalt already configured in simplesamlphp.

This module has lots of different error messages shown in the drupal log, hopefully making the installation procedure more straightforward. So be sure to check the drupal log when your stuck.

There are different configuration options available (most are obtained from the simplesamlphp authsources.php configuration file, see example configuration for simplesamlphp module drupalas).
The options (not all)
-use or don't use a cookie (no cookie means session hijacking is possible, right?)
-use a secure cookie
-use any hashing algorithm supported by the php hash() function for the session hashes
-choose which user attributes to load

This module creates two new permissions
-allow administer of simplesamlphp_idp settings (admin only)
-allow SAML authentication with configured (simplesamlphp) identity provider

The user is able to end his or her SAML session when already logged out of drupal so SLO requests are never blocked. Also when the user logs out of drupal this module checks if there is still a SAML session authenticated at the simplesamlphp identity provider and initiates a SLO when there is.

(Alpha) tested and fully functional on both drupal core and the panopoly distribution.

---Todo's:
-Security audit
-Upload first development version done
-allow for unique session salt length changes (or will a fixed value be ok?)
-Finish inline comments
-Finish function descriptions
-Add license information
-Add reference to author of some code used
-Create installation guide done
-Create troubleshoot guide
-Make sure all inputs are safe (the hashes and state keys obtained from _GET and COOKIE global variables)

---Questions:
-will four sha256 hashes per authentication be too cpu intensive on a production environment
-is the _GET hash even functional (is the $state array used by simplesamlphp secure enough to hold salts)?
-Will the way i structured the get_sspidpconfig function have any negative impact on site performance (there are a lot of error messages and inline comments and the function gets loaded a few times every SAML authentication)?
-Will the hook_page_build function used have any negative impact on site performance?