Docker Test SAML 2.0 Identity Provider (IdP)

Docker container with a plug and play SAML 2.0 Identity Provider (IdP) for development and testing.

Built with SimpleSAMLphp. Based on official PHP7 Apache image.

SimpleSAMLphp is logging to stdout on debug log level. Apache is logging error and access log to stdout.

You must not use at your production. This is for test.

Usage

Using docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -d kenchan0130/simplesamlphp

Using docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp

There are two static users configured in the IdP with the following data:

And there is one admin:

Environment Variables

Advanced Usage

Customize IdP Users

If you want to customize IdP users, you can define your own users by mounting a configuration file.

<?php
// These attributes mimic those of Azure AD.
$test_user_base = array(
    'http://schemas.microsoft.com/identity/claims/tenantid' => 'ab4f07dc-b661-48a3-a173-d0103d6981b2',
    'http://schemas.microsoft.com/identity/claims/objectidentifier' => '',
    'http://schemas.microsoft.com/identity/claims/displayname' => '',
    'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups' => array(),
    'http://schemas.microsoft.com/identity/claims/identityprovider' => 'https://sts.windows.net/da2a1472-abd3-47c9-95a4-4a0068312122/',
    'http://schemas.microsoft.com/claims/authnmethodsreferences' => array('http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password', 'http://schemas.microsoft.com/claims/multipleauthn'),
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => '',
    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => ''
);

$config = array(
    'admin' => array(
        'core:AdminPassword',
    ),
    'example-userpass' => array(
        'exampleauth:UserPass',
        'user1:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2d75402-e1ae-40fe-8cc9-98ca1ab9cd5e',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User1 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User1',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
        'user2:password' => array_merge($test_user_base, array(
            'http://schemas.microsoft.com/identity/claims/objectidentifier' => 'f2a94916-2fcb-4b68-9eb1-5436309006a3',
            'http://schemas.microsoft.com/identity/claims/displayname' => 'User2 Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => '[email protected]',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname' => 'Taro',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname' => 'User2',
            'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => '[email protected]'
        )),
    ),
);

If you save this source as authsources.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -e SIMPLESAMLPHP_SP_ENTITY_ID=http://app.example.com \
  -e SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp \
  -e SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE=http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp \
  -v $PWD/authsources.php:/var/www/simplesamlphp/config/authsources.php \
  -d kenchan0130/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: http://app.example.com
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: http://localhost/simplesaml/module.php/saml/sp/saml2-logout.php/test-sp
    volumes:
      - authsources.php:/var/www/simplesamlphp/config/authsources.php

For detailed attributes, see SimpleSAMLphp Identity Provider QuickStart#Authentication module.

Customize SP remote metadata reference

If you want to customize SP remote metadata reference, you can define your own users by mounting a configuration file.

<?php
/* The index of the array is the entity ID of this SP. */
$metadata['entity-id-1'] = array(
    'AssertionConsumerService' => 'http://localhost/simplesaml/module.php/saml/sp/saml2-acs.php/test-sp',
    ForceAuthn => true
);
$metadata['entity-id-2'] = array(
    'AssertionConsumerService' => 'http://localhost/saml/acs',
    'SingleLogoutService' => 'http://localhost/saml/logout'
);

If you save this source as saml20-sp-remote.php, you can customize IdP users by volume mount like:

docker run command

docker run --name=idp \
  -p 8080:8080 \
  -v saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php \
  -d kenchan0130/simplesamlphp

docker-compose

version: "3"
services:
  idp:
    image: kenchan0130/simplesamlphp
    container_name: idp
    ports:
      - "8080:8080"
    volumes:
      - saml20-sp-remote.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php

For detailed attributes, see SP remote metadata reference#SAML 2.0 options.

Inspired By

• https://github.com/kristophjunge/docker-test-saml-idp

License

MIT