andreasergenzinger / user_shibboleth

ownCloud authentication app relying on the Shibboleth Service Provider

#user_shibboleth

user_shibboleth is an ownCloud (version 5.0) user authentication app relying on the Shibboleth Service Provider. This app is no longer maintained, so compatibility with more recent ownCloud versions is very unlikely.

At the current stage, this project is only intended to serve as a starting point for reimplementation and as an example for federated authentication in a PHP + Apache + mod_shib + Shibboleth2 environment, in general.

###Deployment

If you have downloaded the app folder as a zip file from github, rename the app folder from "user_shibboleth-master" to "user_shibboleth".

Assuming a running configuration of Apache and the Shibboleth SP, some additional changes are required in order to protect the /owncloud location via lazy Shibboleth authentication.

• Configuring Apache:

  The following Location directive must be added to the VirtualHost configuration for HTTPS connections. Usually this would be in /etc/apache2/sites-available/default-ssl.

  <Location /owncloud>
      AuthType shibboleth
      Require shibboleth
      RewriteRule ^apps/user_shibboleth/login.php - [L]
  </Location>

• Configuring Shibboleth:

  Next, add the new path in /etc/shibboleth/shibboleth2.xml like this:

  <RequestMapper type="Native">
      <RequestMap applicationId="default">
          <Host name="example.com">
              <Path name="owncloud" authType="shibboleth" requireSession="false"/>
          </Host>
     </RequestMap>
  </RequestMapper>

  Take care to use the server's actual host name.

  While you have the shibboleth2.xml file open, write down the values of both the handlerURL attribute of the Sessions node and the Location attribute of the SessionInitiator node, as these must be specified on the app's settings menu.

  The app requires two user attributes, persistent-id and mail, so make sure that the nodes with those ids are uncommented in /etc/shibboleth/attribute-map.xml.

The user_shibboleth app itself can be installed and enabled just like any other ownCloud app.

Fill in the two transcribed values from the SP configuration file on the app settings page, save, and you are done.

###Mapping Internal Users to LDAP User Accounts

If your ownCloud installation uses the LDAP User and Group Backend, then chances are, that the connected LDAP server is also used for authenticating users in the SP's Shibboleth federation. A single user could then create two ownCloud user accounts, one via the LDAP backend and one via the Shibboleth backend. We refer to these kinds of users as internal. External users, on the other hand, are those users who are only retrievable from the Shibboleth backend.

To prevent internal users from creating secondary accounts, check the Link to LDAP Backend checkbox. Internal users will then always use their LDAP backend account, irrespective of the way they log into the system.

The user mapping is based on the Shibboleth and LDAP mail attributes. This allows a malicious IdP to hijack mapped user accounts by authenticating users with spoofed email addresses. To prevent this and other kinds of user impersonation, it is strongly recommended to check the Enforce Domain Similarity checkbox. This way users whose email address domain part does not match the domain of their respective IdP are rejected.

At the moment the internal user mapping feature only works with the first configured LDAP server.

###Version History

0.5      - mapping users to LDAP accounts 
0.5.0.1  - improved LDAP user authentication
0.5.0.2  - accomodating PHP/DBS combinations returning SQL COUNT(*) as a string value

user_shibboleth's Issues

Checkboxes broken in Chromium.

When using the Chromium web browser checking checkboxes of the settings template and clicking save does not save the checked state. Unchecking works.

Things work fine in Firefox.

app settings menu

Hello,

This text from readme file

While you have the shibboleth2.xml file open, write down the values of both the handlerURL attribute of the Sessions node and the Location attribute of the SessionInitiator node, as these must be specified on the app's settings menu.

Where I can find app settings menu?

"Error while enabling app" OC 5.0.4 on RHEL6.4

(first time on GitHub, please excuse n00b mistakes!)

Downloaded the user_shibboleth app today (11.04.2013) as I've been trying out OwnCloud and wanted to see if Shib integration was possible/easy.

When I try enabling the app, I get the infamous "Error while enabling app".

In owncloud.log I get the following entries:

{"app":"PHP","message":"Invalid argument supplied for foreach() at /var/www/html/owncloud/lib/installer.php#415","level":2,"time":1365686393}
{"app":"PHP","message":"Invalid argument supplied for foreach() at /var/www/html/owncloud/lib/installer.php#418","level":2,"time":1365686393}
{"app":"PHP","message":"SQLSTATE[23000]: Integrity constraint violation: 1048 Column 'appid' cannot be null at /var/www/html/owncloud/lib/db.php#965","level":4,"time":1365686393}

It's not liking the $info['remote'] & $info['public'] params it's being passed (which doesn't mean much to me really!)

Any ideas what could be the problem?

Thank you very much for the app, I look forward to testing it!

Fatal errors after auth

Hi all,

I had used user_saml for OC4.5 with a simplesamlphp SP, but doesn't work with OC5.
I try our user_shibboleth with a Shibboleth SP, i have several fatal errors in OC5 after auth at first user's login. I have a blanck page after login on user_shibboleth/login.php and in owncloud log i can see :
{"app":"PHP","message":"opendir(/data/owncloud/ec687ba39b1d1ed51d605089ae5d2a2bd32a03ed050a8d1dcbf3991d9fefxxxx/cache/): failed to open dir: No such file or directory at /var/www/owncloud/lib/files/storage/local.php#40","level":2,"time":1370266793}
{"app":"PHP","message":"readdir() expects parameter 1 to be resource, boolean given at /var/www/owncloud/lib/cache/file.php#88","level":2,"time":1370266793}


The folder /data/owncloud is writable for apache users and mkdir command in a shell work fine with this folder name.

mkdir /data/owncloud/ec687ba39b1d1ed51d605089ae5d2a2bd32a03ed050a8d1dcbf3991d9fefxxxx


My local conf :
Apache location in vhost spécific conf :


Order allow,deny
Allow from all

                    # Auth Shibb
                    AuthType shibboleth
                    ShibRequestSetting requireSession 0
                    ShibRequestSetting applicationId partage
                    Require shibboleth

                    ShibUseHeaders On
            </Location>

(note: my owncloud is behind a reverse proxy and i map requested attributes)

And user_shibboleth conf :

Sessions HandlerURL: /Shibboleth.sso/Login?target=https://mydomain/apps/user_shibboleth/login.php
SessionInitiator Location: /
Federation Name: Fédération Education-Recherche
Quota: 2GB
Enforce Domain Similarity uncheck
Link to LDAP Backend uncheck


Do you have some hints about failed directory creation ?
Regards, Gamb.

Feature request : Attributes mapping

Hi all,

By defaut, user_shibboleth search for fix attributes, ie he looks for persistent-id, mail and Shib-Identity-Provider.
In my identity federation, attributes names are diffrents. so, i need can map user_shibboleth attributes with real attributes.
Moreover, if the owncloud server are behind a reverse proxy, all attributes are prefixed with HTTP_ cause of ShibUseHeaders directive.

Please add in settings menu, a text box for attributes map and load them in lib/auth.php.
Regards, Gamb.

ownCloud 6 support

Hi.

We plan to deploy an oC 6 instance at CNRS, and i would like to know if you still work on this app, and if you plan to support version 6 ?

Thanks in advance.
Best regards.
David.