I'm new to Simplesaml...I feel like I'm missing something obvious in the configuration. Could someone point me in the right direction?
Drupal - 7.53
simpleSAMLphp Authentication - 7.x-2.0-alpha2
Add a comment
|
2 Answers
We have this setup running, and it does not register a new user each time but only the first time a user logs in, as expected. I just remember running into problems when unique identifier and user name where set to different values (my old bug report is possibly related). To further manage the displayed user names you could use Drupal modules like RealName.
configuring SimpleSAMLphp_auth to register new users
In the admin interface, navigate to admin/config/people/simplesamlphp_auth
Under the tabs
USER PROVISIONING
check - Register users (i.e., auto-provisioning)
and
USER INFO AND SYNCING
Which attribute from simpleSAMLphp should be used as user's name *
eduPersonPrincipalName
(enter an attribute that uniquely and consistently identifies the user in your realm and that your SAML IdP provides, some attributes change with each invocation and are therefore not suitable, eduPersonPrincipalName is suitable for most educational entities, email could also work fine here)
Which attribute from simpleSAMLphp should be used as unique identifier for
the user *
eduPersonPrincipalName
(enter an attribute that uniquely and consistently identifies the user, make sure to use the same attribute as in user's name before)
From the documentation:
Determines wether or not the module should automatically create/register new Drupal accounts for users that authenticate using SimpleSAMLphp. Unless you've done some custom work to provision Drupal accounts with the necessary authmap entries you will want this checked.
Checking which SAML attributes are available
Navigate to the admin interface of your simplesamlphp install (you might need to activate the interface and look up the password of the install from config.php). navigate to the Tab Authentication and "Test configured authentication sources" (/module.php/core/authenticate.php), log in to the same authentication source that is configured in the drupal plug-in under "Autenticaton source for this SP (default: default-sp)" and an overview of all SAML attibutes for that user will be displayed.
The attributes that can be used are possibly best obtained from the documentation of the identity provider, example: https://www.feide.no/attributelist
You may need to write something custom to handle this--I don't think the out-of-the-box config will take care of it. As you've probably experienced, when you have "Register users" checked (under User Provisioning), that will create a new account for every new SimpleSAML login--even if it is duplicating an existing Drupal user's email address or other user information.
Based on the help text there, I think you'll need to write something custom (probably checking the authmap entries before provisioning the account):
From the config page (admin/config/people/simplesamlphp_auth)
Unless you've done some custom work to provision Drupal accounts with the necessary authmap entries you will want this checked.
It looks to me like you'll need to provide authmap entries for your existing Drupal accounts, and then you can write a check for SimpleSAML. But that is theory; I've never tried to do what you're looking for. Hope this helps.
