saml_sp_configuration.conf

# SAML SSO configuration
#
# Each map block allows multiple values so that multiple IdPs can be supported,
# the $host variable is used as the default input parameter but can be changed.
#
map $host $saml_sp_entity_id {
    # Unique identifier that identifies the SP to the IdP.
    # Must be URL or URN.
    default "http://sp.example.com";
}

map $host $saml_sp_acs_url {
    # The ACS URL, an endpoint on the SP where the IdP 
    # will redirect to with its authentication response.
    # Must match the ACS location defined in the "saml_sp.serer_conf" file.
    default "http://sp.example.com:8010/saml/acs";
}

map $host $saml_sp_request_binding {
    # Refers to the method by which an authentication request is sent from
    # the SP to an IdP during the Single Sign-On (SSO) process.
    # Only HTTP-POST or HTTP-Redirect methods are allowed.
    default 'HTTP-POST';
}

map $host $saml_sp_sign_authn {
    # Whether the SP should sign the AuthnRequest sent to the IdP.
    default "true";
}

map $host $saml_sp_signing_key {
    # Maps SP to the private key file that will be used to sign
    # the AuthnRequest or LogoutRequest sent to the IdP.
    default "conf.d/saml_sp_sign.key";
}

map $host $saml_sp_decryption_key {
    # Specifies the private key that the SP uses to decrypt encrypted assertion
    # or NameID from the IdP.
    default "";
}

map $host $saml_sp_force_authn {
    # Whether the SP should force re-authentication of the user by the IdP.
    default "false";
}

map $host $saml_sp_nameid_format {
    # Indicates the desired format of the name identifier in the SAML assertion
    # generated by the IdP. Check section 8.3 of the SAML 2.0 Core specification
    # (http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf)
    # for the list of allowed NameID Formats.
    default "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
}

map $host $saml_sp_relay_state {
    # Relative or absolute URL the SP should redirect to
    # after successful sign on.
    default "";
}

map $host $saml_sp_want_signed_response {
    # Whether the SP wants the SAML Response from the IdP
    # to be digitally signed.
    default "true";
}

map $host $saml_sp_want_signed_assertion {
    # Whether the SP wants the SAML Assertion from the IdP
    # to be digitally signed.
    default "true";
}

map $host $saml_sp_want_encrypted_assertion {
    # Whether the SP wants the SAML Assertion from the IdP
    # to be encrypted.
    default "false";
}

map $host $saml_idp_entity_id {
    # Unique identifier that identifies the IdP to the SP.
    # Must be URL or URN.
    default "http://idp.example.com";
}

map $host $saml_idp_sso_url {
    # IdP endpoint that the SP will send the SAML AuthnRequest to initiate
    # an authentication process.
    default "http://idp.example.com:8080/saml2/idp";
}

map $host $saml_idp_verification_certificate {
    # Certificate file that will be used to verify the digital signature
    # on the SAML Response, LogoutRequest or LogoutResponse received from IdP.
    # Must be public key in PKCS#1 format. See documentation on how to convert
    # X.509 PEM to DER format.
    default "conf.d/saml_idp_verify.spki";
}

######### Single Logout (SLO) #########

map $host $saml_sp_slo_url {
    # SP endpoint that the IdP will send the SAML LogoutRequest to initiate
    # a logout process or LogoutResponse to confirm the logout.
    default "http://sp.example.com:8010/saml/sls";
}

map $host $saml_sp_slo_binding {
    # Refers to the method by which a LogoutRequest or LogoutResponse
    # is sent from the SP to an IdP during the Single Logout (SLO) process.
    # Only HTTP-POST or HTTP-Redirect methods are allowed.
    default 'HTTP-POST';
}

map $host $saml_sp_sign_slo {
    # Whether the SP must sign the LogoutRequest or LogoutResponse
    # sent to the IdP.
    default "true";
}

map $host $saml_idp_slo_url {
    # IdP endpoint that the SP will send the LogoutRequest to initiate
    # a logout process or LogoutResponse to confirm the logout.
    # If not set, the SAML Single Logout (SLO) feature is DISABLED and
    # requests to the 'logout' location will result in the termination
    # of the user session and a redirect to the logout landing page.
    default "http://idp.example.com:8080/saml2/idp/sls";
}

map $host $saml_sp_want_signed_slo {
    # Whether the SP wants the SAML LogoutRequest or LogoutResponse from the IdP
    # to be digitally signed.
    default "true";
}

map $host $saml_logout_landing_page {
    # Where to redirect user after requesting /logout location. This can be
    # replaced with a custom logout page, or complete URL.
    default "/_logout"; # Built-in, simple logout page
}

map $proto $saml_cookie_flags {
    http  "Path=/; SameSite=lax;"; # For HTTP/plaintext testing
    https "Path=/; SameSite=lax; HttpOnly; Secure;"; # Production recommendation
}

map $http_x_forwarded_port $redirect_base {
    ""      $proto://$host:$server_port;
    default $proto://$host:$http_x_forwarded_port;
}

map $http_x_forwarded_proto $proto {
    ""      $scheme;
    default $http_x_forwarded_proto;
}

# ADVANCED CONFIGURATION BELOW THIS LINE
# Additional advanced configuration (server context) in saml_sp.server_conf

######### Shared memory zones that keep the SAML-related key-value databases

# Zone for storing AuthnRequest and LogoutRequest message identifiers (ID)
# to prevent replay attacks. (REQUIRED)
# Timeout determines how long the SP waits for a response from the IDP,
# i.e. how long the user authentication process can take.
keyval_zone zone=saml_request_id:1M                 state=/var/lib/nginx/state/saml_request_id.json                  timeout=5m;

# Zone for storing SAML Response message identifiers (ID) to prevent replay attacks. (REQUIRED)
# Timeout determines how long the SP keeps IDs to prevent reuse.
keyval_zone zone=saml_response_id:1M                state=/var/lib/nginx/state/saml_response_id.json                 timeout=1h;

# Zone for storing SAML session access information. (REQUIRED)
# Timeout determines how long the SP keeps session access decision (the session lifetime).
keyval_zone zone=saml_session_access:1M             state=/var/lib/nginx/state/saml_session_access.json              timeout=1h;

# Zone for storing SAML NameID values. (REQUIRED)
# Timeout determines how long the SP keeps NameID values. Must be equal to session lifetime.
keyval_zone zone=saml_name_id:1M                    state=/var/lib/nginx/state/saml_name_id.json                     timeout=1h;

# Zone for storing SAML NameID format values. (REQUIRED)
# Timeout determines how long the SP keeps NameID format values. Must be equal to session lifetime.
keyval_zone zone=saml_name_id_format:1M             state=/var/lib/nginx/state/saml_name_id_format.json              timeout=1h;

# Zone for storing SAML SessionIndex values. (REQUIRED)
# Timeout determines how long the SP keeps SessionIndex values. Must be equal to session lifetime.
keyval_zone zone=saml_session_index:1M              state=/var/lib/nginx/state/saml_session_index.json               timeout=1h;

# Zone for storing SAML AuthnContextClassRef values. (REQUIRED)
# Timeout determines how long the SP keeps AuthnContextClassRef values. Must be equal to session lifetime.
keyval_zone zone=saml_authn_context_class_ref:1M    state=/var/lib/nginx/state/saml_authn_context_class_ref.json     timeout=1h;

# Zones for storing SAML attributes values. (OPTIONAL)
# Timeout determines how long the SP keeps attributes values. Must be equal to session lifetime.
keyval_zone zone=saml_attrib_uid:1M                 state=/var/lib/nginx/state/saml_attrib_uid.json                  timeout=1h;
keyval_zone zone=saml_attrib_name:1M                state=/var/lib/nginx/state/saml_attrib_name.json                 timeout=1h;
keyval_zone zone=saml_attrib_memberOf:1M            state=/var/lib/nginx/state/saml_attrib_memberOf.json             timeout=1h;

######### SAML-related variables whose value is looked up by the key (session cookie) in the key-value database.

# Required:
keyval $saml_request_id     $saml_request_redeemed          zone=saml_request_id;               # SAML Request ID
keyval $saml_response_id    $saml_response_redeemed         zone=saml_response_id;              # SAML Response ID
keyval $cookie_auth_token   $saml_access_granted            zone=saml_session_access;           # SAML Access decision
keyval $cookie_auth_token   $saml_name_id                   zone=saml_name_id;                  # SAML NameID
keyval $cookie_auth_token   $saml_name_id_format            zone=saml_name_id_format;           # SAML NameIDFormat
keyval $cookie_auth_token   $saml_session_index             zone=saml_session_index;            # SAML SessionIndex
keyval $cookie_auth_token   $saml_authn_context_class_ref   zone=saml_authn_context_class_ref;  # SAML AuthnContextClassRef

# Optional:
keyval $cookie_auth_token   $saml_attrib_uid                zone=saml_attrib_uid;
keyval $cookie_auth_token   $saml_attrib_name               zone=saml_attrib_name;
keyval $cookie_auth_token   $saml_attrib_memberOf           zone=saml_attrib_memberOf;

######### Imports a module that implements SAML SSO and SLO functionality
js_import samlsp from conf.d/saml_sp.js;