4 ms·

Hmm. I use simplesamlphp. What would be the easiest thing to change to?

cosarara 7y ago
I implemented simplesamlphp idp two weeks ago, seeing we are a PHP shop it was the obvious choice. Somewhat rethinking that decision now, wondering the same thing.
- amaccuish 7y ago
  It's been great for us. Run fine for years, I have docker set to build a new image anytime there's a security issue. Still... I've looked hard at keycloak, but it misses a key feature for us, that you can't store an TOTP secret in LDAP. That's important for us so we just have one code to use, that gets us into SAML, Radius or some of the other stuff we have.
- porjo 7y ago
  > seeing we are a PHP shop it was the obvious choice A Google search for 'php saml' has php-saml as the top result. I'm curious to know why you chose simplesamlphp over php-saml ?
  - johnmaguire2013 7y ago
    php-saml is a toolkit for making your application a service provider (i.e. able to accept Responses/Assertions from IdPs) so that users can single sign-on to your application. SimpleSAMLphp is a framework/application for creating your own SAMl IdP (i.e. able to send Responses/Assertions to service providers) so that your users (e.g. in an enterprise) can login once and then single sign-on to the rest of your applications.
fart_ratty 7y ago
According to the article there is currently nothing that can be done for simplesamlphp. You could open an issue on Github for it. > SimpleSAMLphp’s IDP supports key rollover but no way to specify unique keys for individual service providers. There might be a way to configure it but if so, it’s not mentioned in the documention and I’m not excited to try it myself.
johnmaguire2013 7y ago
I replied on Twitter, but I'll include it here as well: > Correction: SimpleSAMLphp easily allows for per-SP signing certs/keys. See https://simplesamlphp.org/docs/stable/simplesamlphp-reference-sp-remote#section_2 https://simplesamlphp.org/docs/stable/simplesamlphp-referenc... (signature.certificate and signature.privatekey)

I implemented simplesamlphp idp two weeks ago, seeing we are a PHP shop it was the obvious choice. Somewhat rethinking that decision now, wondering the same thing.

amaccuish 7y ago
It's been great for us. Run fine for years, I have docker set to build a new image anytime there's a security issue. Still... I've looked hard at keycloak, but it misses a key feature for us, that you can't store an TOTP secret in LDAP. That's important for us so we just have one code to use, that gets us into SAML, Radius or some of the other stuff we have.
porjo 7y ago
> seeing we are a PHP shop it was the obvious choice A Google search for 'php saml' has php-saml as the top result. I'm curious to know why you chose simplesamlphp over php-saml ?
- johnmaguire2013 7y ago
  php-saml is a toolkit for making your application a service provider (i.e. able to accept Responses/Assertions from IdPs) so that users can single sign-on to your application. SimpleSAMLphp is a framework/application for creating your own SAMl IdP (i.e. able to send Responses/Assertions to service providers) so that your users (e.g. in an enterprise) can login once and then single sign-on to the rest of your applications.

fart_ratty 7y ago

According to the article there is currently nothing that can be done for simplesamlphp. You could open an issue on Github for it. > SimpleSAMLphp’s IDP supports key rollover but no way to specify unique keys for individual service providers. There might be a way to configure it but if so, it’s not mentioned in the documention and I’m not excited to try it myself.

johnmaguire2013 7y ago

I replied on Twitter, but I'll include it here as well: > Correction: SimpleSAMLphp easily allows for per-SP signing certs/keys. See https://simplesamlphp.org/docs/stable/simplesamlphp-reference-sp-remote#section_2 https://simplesamlphp.org/docs/stable/simplesamlphp-referenc... (signature.certificate and signature.privatekey)