| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:saml_mediawiki [2025/04/29 01:39] – [Connecting MediaWiki to SimpleSAMLphp and mapping groups] kainhofer | en:2.0:single_sign_on:saml_mediawiki [2026/09/04 23:42] (current) – [Connecting MediaWiki to SimpleSAMLphp and mapping groups] kainhofer |
|---|
| Throughout the document we will assume you have both Admidio and MediaWiki already set up properly at https://admidio.local/ and https://mediawiki.local/. Please modify these URLs to your actual installation. | Throughout the document we will assume you have both Admidio and MediaWiki already set up properly at https://admidio.local/ and https://mediawiki.local/. Please modify these URLs to your actual installation. |
| | |
| As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to Nextcloud. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]] | As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to MediaWiki. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]]. |
| {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} |
| |
| Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. | Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**. |
| The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. | |
| | The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. |
| |
| ===== TL;DR; - Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up a client (SAML "Service Provider" - short SP) to use Admidio's user accounts for logging in consists of two steps. If both the IdP (Admidio in our case) and the SP (Nextcloud in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either. | Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (MediaWiki in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward. |
| |
| * At the **Service Provider (SP)** - MediaWiki in our case - **install the extension** to support SAML login. This also requires a working installation of SimpleSAMLphp and the PluggableAuth MediaWiki extension | * At the **Service Provider (SP)** - MediaWiki in our case - **install the extension** to support SAML login. This also requires a working installation of SimpleSAMLphp and the PluggableAuth MediaWiki extension. |
| * SimpleSAMLphp supports reading the IdP metadata from Admidio and converting it into a working config that needs to be pasted into SimpleSAMLphp's metadata/saml20-idp-remote.php file to define an IdP connection. | * SimpleSAMLphp supports reading the IdP metadata from Admidio and converting it into a working config that needs to be pasted into SimpleSAMLphp's metadata/saml20-idp-remote.php file to define an IdP connection. |
| * For SimpleSAMLphp one also has to add a minimal configuration entry to the file config/authsources.php to connect IdP connection and provide it as a SP for other apps. | * For SimpleSAMLphp one also has to add a minimal configuration entry to the file config/authsources.php to connect IdP connection and provide it as a SP for other apps. |
| 'admin.protectmetadata' => false, | 'admin.protectmetadata' => false, |
| 'enable.saml20-idp' => true, | 'enable.saml20-idp' => true, |
| 'auth.adminpassword' => 'password', // set a password here | // create the password hash via: ./bin/pwgen.php |
| | // see: https://github.com/simplesamlphp/simplesamlphp/wiki/Frequently-Asked-Questions-(FAQ) |
| | 'auth.adminpassword' => 'hashed_password', |
| 'secretsalt' => 'admidio', // choose any random salt! | 'secretsalt' => 'admidio', // choose any random salt! |
| 'baseurlpath' => 'https://mediawiki.local/simplesaml/', | 'baseurlpath' => 'https://mediawiki.local/simplesaml/', |
| ==== Connecting MediaWiki to SimpleSAMLphp and mapping groups ==== | ==== Connecting MediaWiki to SimpleSAMLphp and mapping groups ==== |
| |
| * Install the [[https://www.mediawiki.org/wiki/Extension:PluggableAuth|PluggableAuth]] extension by downloading or git-cloning the code to the ''extensions/'' directory. | * Install the [[https://www.mediawiki.org/wiki/Extension:PluggableAuth|PluggableAuth]] extension by downloading or git-cloning the code to the ''extensions/'' directory. |
| * Install the [[https://www.mediawiki.org/wiki/Extension:SimpleSAMLphp|SimpleSAMLphp]] extension by downloading or git-cloning the code to the ''extensions/'' directory. | * Install the [[https://www.mediawiki.org/wiki/Extension:SimpleSAMLphp|SimpleSAMLphp]] extension by downloading or git-cloning the code to the ''extensions/'' directory. |
| * Open the ''LocalSettings.php'' configuration file of MediaWiki and append the following lines to the end of the file:<code php> | * Open the ''LocalSettings.php'' configuration file of MediaWiki and append the following lines to the end of the file: |
| | <code php> |
| wfLoadExtension( 'PluggableAuth' ); | wfLoadExtension( 'PluggableAuth' ); |
| wfLoadExtension( 'SimpleSAMLphp' ); | wfLoadExtension( 'SimpleSAMLphp' ); |
