0

I'm new to Simplesaml...I feel like I'm missing something obvious in the configuration. Could someone point me in the right direction?

Drupal - 7.53

simpleSAMLphp Authentication - 7.x-2.0-alpha2

1

We have this setup running, and it does not register a new user each time but only the first time a user logs in, as expected. I just remember running into problems when unique identifier and user name where set to different values (my old bug report is possibly related). To further manage the displayed user names you could use Drupal modules like RealName.

configuring SimpleSAMLphp_auth to register new users

In the admin interface, navigate to admin/config/people/simplesamlphp_auth

Under the tabs

USER PROVISIONING
check - Register users (i.e., auto-provisioning)

and

USER INFO AND SYNCING
Which attribute from simpleSAMLphp should be used as user's name *
eduPersonPrincipalName 

(enter an attribute that uniquely and consistently identifies the user in your realm and that your SAML IdP provides, some attributes change with each invocation and are therefore not suitable, eduPersonPrincipalName is suitable for most educational entities, email could also work fine here)

Which attribute from simpleSAMLphp should be used as unique identifier for 
the user *
eduPersonPrincipalName

(enter an attribute that uniquely and consistently identifies the user, make sure to use the same attribute as in user's name before)

From the documentation:

Determines wether or not the module should automatically create/register new Drupal accounts for users that authenticate using SimpleSAMLphp. Unless you've done some custom work to provision Drupal accounts with the necessary authmap entries you will want this checked.

Checking which SAML attributes are available

Navigate to the admin interface of your simplesamlphp install (you might need to activate the interface and look up the password of the install from config.php). navigate to the Tab Authentication and "Test configured authentication sources" (/module.php/core/authenticate.php), log in to the same authentication source that is configured in the drupal plug-in under "Autenticaton source for this SP (default: default-sp)" and an overview of all SAML attibutes for that user will be displayed.

The attributes that can be used are possibly best obtained from the documentation of the identity provider, example: https://www.feide.no/attributelist

-1

You may need to write something custom to handle this--I don't think the out-of-the-box config will take care of it. As you've probably experienced, when you have "Register users" checked (under User Provisioning), that will create a new account for every new SimpleSAML login--even if it is duplicating an existing Drupal user's email address or other user information.

Based on the help text there, I think you'll need to write something custom (probably checking the authmap entries before provisioning the account):

From the config page (admin/config/people/simplesamlphp_auth)

Unless you've done some custom work to provision Drupal accounts with the necessary authmap entries you will want this checked.

It looks to me like you'll need to provide authmap entries for your existing Drupal accounts, and then you can write a check for SimpleSAML. But that is theory; I've never tried to do what you're looking for. Hope this helps.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.