README.md
1# SAML Authentication
2
3The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
4"SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
5in this document are to be interpreted as described in
6[RFC 2119](https://www.ietf.org/rfc/rfc2119.txt).
7
8**Table of Contents**
9
10* [Server Configuration](#web-server-configuration)
11
12## Web Server Configuration
13
14The `PATH_INFO` directive for your web server MUST be enabled
15and properly configured. Otherwise HTTP requests
16targeting *SimpleSAMLphp* will not be routed to the
17corresponding PHP script.
18
19You SHOULD verifiy this by creating an example/a temporary
20PHP script in the ILIAS root directory.
21
22```php
23<?php
24phpinfo();
25```
26
27Cal this script via your browser and append a trailing /,
28followed by an arbitrary string.
29
30 https://your.ilias.de/phpinfo.php/saml/sp/saml2-acs.php/default-sp
31
32When now searching `PATH_INFO` within the delivered
33HTML document, the contents PHP variable `$_SERVER['PATH_INFO']`
34MUST be `/saml/sp/saml2-acs.php/default-sp`.
35
36### Apache
37
38See: [AcceptPathInfo Directive](https://httpd.apache.org/docs/2.4/mod/core.html#AcceptPathInfo)
39
40### Nginx
41
42See: [SimpleSAMLphp: Configuring Nginx](https://simplesamlphp.org/docs/development/simplesamlphp-install#section_7)
43
44#### Example
45```
46[...]
47
48location ~ \.php$ {
49 fastcgi_split_path_info ^(.+?\.php)(/.*)$; # SimpleSAMLphp
50
51 # Bypass the fact that try_files resets $fastcgi_path_info
52 # see: http://trac.nginx.org/nginx/ticket/321
53 set $path_info $fastcgi_path_info;
54 fastcgi_param PATH_INFO $path_info;
55
56 fastcgi_pass unix:/run/php/php7.0-fpm.sock;
57 fastcgi_keep_conn on;
58 fastcgi_index index.php;
59 fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
60 include /etc/nginx/fastcgi_params;
61}
62
63[...]
64```