README.md in rack-saml-0.0.4 vs README.md in rack-saml-0.0.5
- old
+ new
@@ -88,17 +88,18 @@
* *assertion_handler*: 'onelogin' / 'opensaml' (not implemented yet)
* *saml_idp*: IdP's entity ID which is used to authenticate user. This parameter can be omitted when you use Shibboleth Discovery Service (shib_ds).
* *saml_sess_timeout*: SP session timeout (default: 1800 seconds)
* *shib_app_id*: If you want to use the middleware as Shibboleth SP, you should specify an application ID. In the Shibboleth SP default configuration, 'default' is used as the application ID.
* *shib_ds*: If you want to use the middleware as Shibboleth SP and use discovery service, specify the uri of the Discovery Service.
+* *saml_sp*: Set the SAML SP's entity ID
* *sp_cert*: path to the SAML SP's certificate file, e.g. cert.pem (AuthnRequest Signing and Response Encryption are not supported yet)
* *sp_key*: path to the SAML SP's key file, e.g. key.pem (AuthnRequest Signing and Response Encryption are not supported yet)
-SAML SP's entity ID (saml_sp) is automatically generated from request URI and /rack-saml-sp (fixed path name). The Assertion Consumer Service URI is generated from request URI and protected_path.
+If not set explicitly, SAML SP's entity ID (saml_sp) is automatically generated from request URI and /rack-saml-sp (fixed path name). The Assertion Consumer Service URI is generated from request URI and protected_path.
saml_sp_prefix = "#{request.scheme}://#{request.host}#{":#{request.port}" if request.port}#{request.script_name}"
- @config['saml_sp'] = "#{saml_sp_prefix}/rack-saml-sp"
+ @config['saml_sp'] ||= "#{saml_sp_prefix}/rack-saml-sp"
@config['assertion_consumer_service_uri'] = "#{saml_sp_prefix}#{@config['protected_path']}"
**metadata.yml**
To connect to an IdP, you must describe IdP's specification. In rack-saml, it should be written in metadata.yml. metadata.yml file include the following lists. You must generate your own metadata.yml by using conv_metadata.rb.
@@ -150,17 +151,32 @@
...
<rp:RelyingParty id="http://example.com:3000/rack-saml-sp" provider="http://idp.example.com/idp/shibboleth" defaultSigningCredentialRef="IdPCredential">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true" assertionLifetime="PT5M" assertionProxyCount="0" signResponses="never" signAssertions="always" encryptAssertions="never" encryptNameIds="never"/>
</rp:RelyingParty>
+## Advanced Topics
+
+### Use with OmniAuth
+
+You can connect rack-saml to omniauth-shibboleth. Basically, you do not need any specific configuration to use with omniauth-shibboleth.
+
+### Use with Devise
+
+You can connect rack-saml to devise by using it together with omniauth and omniauth-shibboleth. The details of how to connect omniauth and devise are described in the following page:
+
+OmniAuth: Overview
+https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
+
+When you use omniauth with devise, the omniauth provider path becomes "/users/auth/shibboleth". So thus, you must set the *protected_path* parameter as "/users/auth/shibboleth/callback". After changing the configuration, you must also re-generate SP Metadata (/Shibboleth.sso/Metadata) and import it to IdP because *<AssertionConsumerService>* parameter in SP Metadata is generated by the *protected_path* parameter.
+
## TODO
* write spec files
* ruby-opensaml (I hope someone implement it :)
## License (MIT License)
-Copyright (C) 2011 by Toyokazu Akiyama.
+rack-saml is released under the MIT license.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell