1<?php 2// (c) Copyright by authors of the Tiki Wiki CMS Groupware Project 3// 4// All Rights Reserved. See copyright.txt for details and a complete list of authors. 5// Licensed under the GNU LESSER GENERAL PUBLIC LICENSE. See license.txt for details. 6 7function prefs_saml_list() 8{ 9 return [ 10 'saml_auth_enabled' => [ 11 'name' => tra('Enable SAML Auth'), 12 'type' => 'flag', 13 'perspective' => false, 14 'default' => 'n', 15 'packages_required' => ['onelogin/php-saml' => 'OneLogin_Saml2_Auth'], 16 ], 17 'saml_idp_entityid' => [ 18 'name' => tra('IdP Entity Id'), 19 'description' => tra('Identifier of the IdP entity ("Issuer")'), 20 'type' => 'text', 21 'size' => 50, 22 'perspective' => false, 23 'default' => '', 24 ], 25 'saml_idp_sso' => [ 26 'name' => tra('Single sign-on service URL'), 27 'description' => tra('SSO endpoint info of the IdP, the URL target of the IdP where the SP will send the Authentication Request ("SAML 2.0 Endpoint (HTTP)")'), 28 'type' => 'text', 29 'size' => 50, 30 'perspective' => false, 31 'default' => '', 32 ], 33 'saml_idp_slo' => [ 34 'name' => tra('Single log-out service URL'), 35 'description' => tra('SLO endpoint info of the IdP, the URL target of the IdP where the SP will send the SLO Request ("SLO Endpoint (HTTP)")'), 36 'type' => 'text', 37 'size' => 50, 38 'perspective' => false, 39 'default' => '', 40 ], 41 'saml_idp_x509cert' => [ 42 'name' => tra('X.509 certificate'), 43 'description' => tra('Public x509 certificate of the IdP. ("X.509 certificate")'), 44 'type' => 'textarea', 45 'perspective' => false, 46 'default' => '', 47 ], 48 'saml_options_autocreate' => [ 49 'name' => tra('Create user if not registered in Tiki'), 50 'description' => tra('Auto-provisioning - if the user doesn\'t exist, Tiki will create a new user with the data provided by the IdP.<br>Review the Mapping section.'), 51 'type' => 'flag', 52 'perspective' => false, 53 'default' => false, 54 ], 55 'saml_options_sync_group' => [ 56 'name' => tra('Sync user group with IdP data'), 57 'description' => tra('This should be enabled to sync groups with the IdP.'), 58 'type' => 'flag', 59 'perspective' => false, 60 'default' => false, 61 ], 62 'saml_options_slo' => [ 63 'name' => tra('Enable Single Logout Service'), 64 'description' => tra('The "logout" function logs out the user from the Tiki site, the identity provider and all connected service providers'), 65 'type' => 'flag', 66 'perspective' => false, 67 'default' => false, 68 ], 69 'saml_options_skip_admin' => [ 70 'name' => tra('Use Tiki authentication for Admin log-in'), 71 'description' => tra('The user “admin” will be authenticated by <b>only</b> using Tiki’s user database. This option has no effect on users other than “admin”.'), 72 'type' => 'flag', 73 'perspective' => false, 74 'default' => 'y', 75 ], 76 'saml_option_default_group' => [ 77 'name' => tra('Default group'), 78 'description' => tra('When provisioning a new user and not group found, assign that group'), 79 'type' => 'text', 80 'size' => 20, 81 'perspective' => false, 82 'default' => 'Registered', 83 ], 84 'saml_option_account_matcher' => [ 85 'name' => tra('Account matcher'), 86 'description' => tra('Select the field to be used to find the user account. If the "email" field is selected, keep in mind that if users change their email address, then the link with the IdP account will be lost.'), 87 'type' => 'list', 88 'perspective' => false, 89 'options' => [ 90 'username' => tra('Username'), 91 'email' => tra('Email'), 92 ], 93 'default' => 'email', 94 ], 95 'saml_option_login_link_text' => [ 96 'name' => tra('Log-in link text'), 97 'description' => tra('The text that appears on the log-in page'), 98 'type' => 'text', 99 'perspective' => false, 100 'default' => 'Log in through SAML2 IdP', 101 ], 102 'saml_attrmap_username' => [ 103 'name' => tra('SAML attribute that will be mapped to the Tiki username'), 104 'description' => tra('The SAML attribute that will be mapped to the Tiki username.'), 105 'type' => 'text', 106 'size' => 25, 107 'perspective' => false, 108 'default' => '', 109 ], 110 'saml_attrmap_mail' => [ 111 'name' => tra('SAML attribute that will be mapped to the Tiki email'), 112 'description' => tra('The SAML attribute that will be mapped to the Tiki email.'), 113 'type' => 'text', 114 'size' => 25, 115 'perspective' => false, 116 'default' => '', 117 ], 118 'saml_attrmap_group' => [ 119 'name' => tra('SAML attribute that will be mapped to the Tiki group'), 120 'description' => tra('The SAML attribute that will be mapped to the Tiki email. For example the eduPersonAffiliation'), 121 'type' => 'text', 122 'size' => 25, 123 'perspective' => false, 124 'default' => '', 125 ], 126 'saml_groupmap_admins' => [ 127 'name' => tra('Admins'), 128 'description' => tra('Set here the values of the IdP related to the user group info that will be matched with the Admins group.'), 129 'type' => 'text', 130 'size' => 25, 131 'perspective' => false, 132 'default' => '', 133 ], 134 'saml_groupmap_registered' => [ 135 'name' => tra('Registered'), 136 'description' => tra('Set here the values of the IdP related to the user group info that will be matched with the Registered group.'), 137 'type' => 'text', 138 'size' => 25, 139 'perspective' => false, 140 'default' => '', 141 ], 142 'saml_advanced_debug' => [ 143 'name' => tra('Debug Mode'), 144 'description' => tra('Enable debug mode when your are debugging the SAML workflow. Errors and warnings will be showed..'), 145 'type' => 'flag', 146 'perspective' => false, 147 'default' => '', 148 ], 149 'saml_advanced_strict' => [ 150 'name' => tra('Strict Mode'), 151 'description' => tra('Always enable strict mode on production websites. When strict mode is enabled, then Tiki will reject unsigned or unencrypted messages if it expects them to be signed or encrypted. 152 Also Tiki will reject messages that do not strictly follow the SAML standard: Destination, NameId, Conditions . . . are also validated.'), 153 'type' => 'flag', 154 'perspective' => false, 155 'default' => false, 156 ], 157 'saml_advanced_sp_entity_id' => [ 158 'name' => tra('Service Provider Entity ID'), 159 'description' => tra('Set the Entity ID for the service provider. It is recommended to set as the SP Entity ID the URL where the metadata of the service provider is published. If not provided, the toolkit will use "php-saml" as the SP entityID.'), 160 'type' => 'text', 161 'perspective' => false, 162 'default' => '', 163 ], 164 'saml_advanced_nameidformat' => [ 165 'name' => tra('Requested NameIDFormat'), 166 'description' => tra('Specifies constraints on the name identifier to be used to represent the requested subject.'), 167 'type' => 'list', 168 'perspective' => false, 169 'options' => [ 170 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' => tra('urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'), 171 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' => tra('urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'), 172 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName' => tra('urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName'), 173 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity' => tra('urn:oasis:names:tc:SAML:2.0:nameid-format:entity'), 174 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' => tra('urn:oasis:names:tc:SAML:2.0:nameid-format:transient'), 175 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' => tra('urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'), 176 'urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted' => tra('urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted'), 177 'urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos' => tra('urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos'), 178 ], 179 'default' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', 180 ], 181 'saml_advanced_requestedauthncontext' => [ 182 'name' => tra('Requested AuthnContext'), 183 'description' => tra('Authentication context: unselect all to accept any type, otherwise select the valid contexts.'), 184 'type' => 'list', 185 'perspective' => false, 186 'options' => [ 187 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'), 188 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:Password'), 189 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'), 190 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:X509'), 191 'urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard'), 192 'urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos' => tra('urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos'), 193 'urn:federation:authentication:windows' => tra('urn:federation:authentication:windows'), 194 ], 195 'default' => 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified', 196 ], 197 'saml_advanced_idp_lowercase_url_encoding' => [ 198 'name' => tra('Enable Lowercase URL encoding'), 199 'description' => tra('Some IdPs such as ADFS can use lowercase URL encoding, but the plugin expects uppercase URL encoding, so enable it to fix incompatibility issues..'), 200 'type' => 'flag', 201 'perspective' => false, 202 'default' => false, 203 ], 204 'saml_advanced_nameid_encrypted' => [ 205 'name' => tra('Encrypt nameID'), 206 'type' => 'flag', 207 'perspective' => false, 208 'default' => false, 209 ], 210 'saml_advanced_authn_request_signed' => [ 211 'name' => tra('Sign AuthnRequest'), 212 'description' => tra('The samlp:AuthnRequest messages sent by this SP will be signed'), 213 'type' => 'flag', 214 'perspective' => false, 215 'default' => false, 216 ], 217 'saml_advanced_logout_request_signed' => [ 218 'name' => tra('Sign LogoutRequest'), 219 'description' => tra('The samlp:logoutRequest messages sent by this SP will be signed'), 220 'type' => 'flag', 221 'perspective' => false, 222 'default' => false, 223 ], 224 'saml_advanced_logout_response_signed' => [ 225 'name' => tra('Sign LogoutResponse'), 226 'description' => tra('The samlp:logoutResponse messages sent by this SP will be signed'), 227 'type' => 'flag', 228 'perspective' => false, 229 'default' => false, 230 ], 231 'saml_advanced_metadata_signed' => [ 232 'name' => tra('Sign Metadata'), 233 'description' => tra('The Metadata published by this SP will be signed'), 234 'type' => 'flag', 235 'perspective' => false, 236 'default' => false, 237 ], 238 'saml_advanced_want_message_signed' => [ 239 'name' => tra('Reject Unsigned Messages'), 240 'description' => tra('Reject unsigned samlp:Response, samlp:LogoutRequest and samlp:LogoutResponse received'), 241 'type' => 'flag', 242 'perspective' => false, 243 'default' => false, 244 ], 245 'saml_advanced_want_assertion_signed' => [ 246 'name' => tra('Reject Unsigned Assertions'), 247 'description' => tra('Reject unsigned saml:Assertion received'), 248 'type' => 'flag', 249 'perspective' => false, 250 'default' => false, 251 ], 252 'saml_advanced_want_assertion_encrypted' => [ 253 'name' => tra('Reject Unencrypted Assertions'), 254 'description' => tra('Reject unencrypted saml:Assertion received'), 255 'type' => 'flag', 256 'perspective' => false, 257 'default' => false, 258 ], 259 'saml_advanced_retrieve_parameters_from_server' => [ 260 'name' => tra('Retrieve Parameters From Server'), 261 'description' => tra('Sometimes when the app is behind a firewall or proxy, the query parameters can be modified an this affects the signature validation process on HTTP-Redirect binding. Active this when you noticed signature validation failures, the plugin will try to extract the original query parameters.'), 262 'type' => 'flag', 263 'perspective' => false, 264 'default' => false, 265 ], 266 'saml_advanced_sp_x509cert' => [ 267 'name' => tra('Service Provider X.509 certificate'), 268 'description' => tra('Public x509 certificate of the SP'), 269 'type' => 'textarea', 270 'perspective' => false, 271 'default' => '', 272 ], 273 'saml_advanced_sp_privatekey' => [ 274 'name' => tra('Service Provider Private Key'), 275 'description' => tra('Private key of the SP'), 276 'type' => 'textarea', 277 'perspective' => false, 278 'default' => '', 279 ], 280 'saml_advanced_sign_algorithm' => [ 281 'name' => tra('Signature Algorithm'), 282 'description' => tra('Algorithm that the toolkit will use on the signing process'), 283 'type' => 'list', 284 'perspective' => false, 285 'options' => [ 286 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' => tra('http://www.w3.org/2000/09/xmldsig#rsa-sha1'), 287 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' => tra('http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'), 288 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' => tra('http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'), 289 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' => tra('http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'), 290 'http://www.w3.org/2000/09/xmldsig#dsa-sha1' => tra('http://www.w3.org/2000/09/xmldsig#dsa-sha1'), 291 ], 292 'default' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', 293 ], 294 ]; 295} 296