Need help with plugin for SAML authentication

Question

I'm trying to put together a plugin that allows for SAML authentication with Craft. We're working on a site that will be locked down but employees will be able to authenticate to the site using SAML. I came across a SAML toolkit from Onelogin that does the job and was able to get it configured and working outside of craft. With SAML you are not sending a username and password. It authenticates by redirecting the user to the Identity Provider(in this case the client's Proxy Server) and they enter user and password information there, and then the Provider issues a token that gets sent to the Service Provider(Our Craft Site) to allow them in. So far it's working pretty well and I'd like to get it integrated with Craft.

There are a few things I'm getting stuck on being new to Craft and also Yii.

Since we're not dealing with conventional users, is there a hook that I can use to establish a session that Craft understands but base it on the SAML attributes? Is extending userSessionService the way to go with that or should I be looking at creating a custom session?

I'd like to lock every page down on the front end and only show it if the user has authenticated. I've seen a few other plugins using the init function and if(craft()->request->isSiteRequest()). I've tried that and it works pretty well. Is this the way to go or should I be looking at something else?

If I do keep the authorization code in init, should I be offloading the heavy lifting to a Service? I'm already thinking about creating some controller actions for login and logoff along with registering some routes in the CP. That way I could include links on the front end for that.

Again, new to Craft. Any guidance would be appreciated.

Answer 1

Yii provides a CUserIdentity class that is meant for your typical username/password form/cookie-based authentication. Craft extends that a bit and uses that in it's own UserIdentity class for logging into the control panel, etc.

But ultimately, Yii's CUserIdentity implements the IUserIdentity interface, which they intend for people to use that want to implement their own custom authentication mechanisms.

So you'd probably want to write a SamlUserIdentity class that implements the interface, provides it's own authentication logic (calls the Identity Provider, etc) and handles the interactions between Yii/Craft and SAML.

If you just want to enforce an authenticated session from the template, use:

{% requireLogin %}

If you want to do it from a controller's action, use:

$this->requireLogin();