25 lines
1.2 KiB
Text
25 lines
1.2 KiB
Text
|
SASL is a method for adding authentication support to connection-based
|
||
|
|
protocols. To use SASL, a protocol includes a command for identifying and
|
||
|
|
authenticating a user to a server and for optionally negotiating protection
|
||
|
|
of subsequent protocol interactions. If its use is negotiated, a security
|
||
|
|
layer is inserted between the protocol and the connection.
|
||
|
|
|
||
|
|
This package contains a SASL plugin that perform a crude check on a SAML
|
||
|
|
authentication assertion. The assertion signature and date are verified,
|
||
|
|
and access is granted on behalf ot the user taked for a onfigurable
|
||
|
|
attribute.
|
||
|
|
|
||
|
|
The only protection against replay attacks is the assertion validity dates
|
||
|
|
checks, this authentication is therefore secure only if the SAML
|
||
|
|
authentication assertion remains secret. The assertion has the same role
|
||
|
|
as a web cookie used for authentication.
|
||
|
|
|
||
|
|
Here is a PHP example of LDAP binding using www/ap2-auth-mellon:
|
||
|
|
$saml_msg = $_SERVER["MELLON_SAML_RESPONSE"];
|
||
|
|
$userid = $_SERVER["REMOTE_USER"];
|
||
|
|
if (ldap_sasl_bind($ds, NULL, $saml_msg, "SAML",
|
||
|
|
NULL, $userid, NULL, "none") == FALSE) {
|
||
|
|
printf("ldap_sasl_bind() failed: %s", ldap_error($ds));
|
||
|
|
exit;
|
||
|
|
}
|