Panduan Integrasi SSO UNRI

<?php
// composer require onelogin/php-saml:^4.3.2

use OneLogin\Saml2\Auth;

require __DIR__.'/vendor/autoload.php';

const APP = 'https://app.unri.ac.id'; // CONTOH: ganti dengan alamat aplikasi Anda
const SSO = 'https://sso.dev-app.unri.ac.id';             // alamat SSO ini, jangan diubah
const PERSISTENT = 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent';

session_start();

$auth = new Auth([
    'strict' => true,
    'sp' => [
        'entityId' => APP.'/saml/metadata',
        'assertionConsumerService' => ['url' => APP.'/saml/acs'],
        'singleLogoutService' => ['url' => APP.'/saml/slo'],
        'NameIDFormat' => PERSISTENT,
        'x509cert' => file_get_contents(__DIR__.'/saml/sp.crt'),
        'privateKey' => file_get_contents(__DIR__.'/saml/sp.key'),
    ],
    'idp' => [
        'entityId' => SSO.'/saml/metadata',
        'singleSignOnService' => ['url' => SSO.'/saml/sso'],
        'singleLogoutService' => ['url' => SSO.'/saml/slo'],
        'x509cert' => file_get_contents(__DIR__.'/saml/idp.crt'),
    ],
    'security' => [
        'authnRequestsSigned' => true,
        'logoutRequestSigned' => true,
        'logoutResponseSigned' => true,
        'wantAssertionsSigned' => true,
        'wantMessagesSigned' => true,
        'requestedAuthnContext' => false,
        'rejectUnsolicitedResponsesWithInResponseTo' => true,
        'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
        'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
    ],
]);

switch (parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)) {
    case '/saml/login':
        $url = $auth->login(APP.'/', [], false, false, true);
        $_SESSION['saml_request_id'] = $auth->getLastRequestID();
        header('Location: '.$url);
        exit;

    case '/saml/acs':
        $auth->processResponse($_SESSION['saml_request_id'] ?? null);
        unset($_SESSION['saml_request_id']);

        if ($auth->getErrors() || ! $auth->isAuthenticated()) {
            error_log('Login SSO gagal: '.$auth->getLastErrorReason());
            http_response_code(403);
            exit('Login SSO gagal.');
        }

        session_regenerate_id(true);
        $_SESSION['user'] = [
            'id' => $auth->getNameId(),                       // pegawai:123 atau mahasiswa:2107110001
            'type' => $auth->getAttribute('account_type')[0], // pegawai atau mahasiswa
            'name' => $auth->getAttribute('name')[0] ?? null,
            'email' => $auth->getAttribute('email')[0] ?? null,
        ];
        $_SESSION['saml'] = ['name_id' => $auth->getNameId(), 'session_index' => $auth->getSessionIndex()];
        header('Location: /');
        exit;

    case '/saml/logout':
        $saml = $_SESSION['saml'] ?? [];
        $url = $auth->logout(APP.'/', [], $saml['name_id'] ?? null, $saml['session_index'] ?? null, true, PERSISTENT);
        $_SESSION['saml_logout_id'] = $auth->getLastRequestID();
        header('Location: '.$url);
        exit;

    case '/saml/slo':
        // Menangani dua hal: SSO meminta logout, atau SSO menjawab logout dari aplikasi ini.
        $url = $auth->processSLO(false, $_SESSION['saml_logout_id'] ?? null, false, fn () => session_destroy(), true);
        header('Location: '.($url ?: '/'));
        exit;

    case '/saml/metadata':
        header('Content-Type: application/xml');
        echo $auth->getSettings()->getSPMetadata();
        exit;
}

# pip install python3-saml flask
import os
from urllib.parse import urlparse

from flask import Flask, abort, make_response, redirect, request, session
from onelogin.saml2.auth import OneLogin_Saml2_Auth

APP = "https://app.unri.ac.id"  # CONTOH: ganti dengan alamat aplikasi Anda
SSO = "https://sso.dev-app.unri.ac.id"  # alamat SSO ini, jangan diubah
PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"


def read(path):
    with open(path) as f:
        return f.read()


SETTINGS = {
    "strict": True,
    "sp": {
        "entityId": f"{APP}/saml/metadata",
        "assertionConsumerService": {"url": f"{APP}/saml/acs"},
        "singleLogoutService": {"url": f"{APP}/saml/slo"},
        "NameIDFormat": PERSISTENT,
        "x509cert": read("saml/sp.crt"),
        "privateKey": read("saml/sp.key"),
    },
    "idp": {
        "entityId": f"{SSO}/saml/metadata",
        "singleSignOnService": {"url": f"{SSO}/saml/sso"},
        "singleLogoutService": {"url": f"{SSO}/saml/slo"},
        "x509cert": read("saml/idp.crt"),
    },
    "security": {
        "authnRequestsSigned": True,
        "logoutRequestSigned": True,
        "logoutResponseSigned": True,
        "wantAssertionsSigned": True,
        "wantMessagesSigned": True,
        "requestedAuthnContext": False,
        "rejectUnsolicitedResponsesWithInResponseTo": True,
        "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
        "digestAlgorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
    },
}

app = Flask(__name__)
app.secret_key = os.environ["SECRET_KEY"]


def saml_auth():
    # Host diambil dari APP, bukan dari request, supaya tetap benar di balik proxy.
    return OneLogin_Saml2_Auth({
        "https": "on",
        "http_host": urlparse(APP).netloc,
        "script_name": request.path,
        "get_data": request.args.copy(),
        "post_data": request.form.copy(),
    }, SETTINGS)


@app.get("/saml/login")
def login():
    auth = saml_auth()
    url = auth.login(return_to=f"{APP}/")
    session["saml_request_id"] = auth.get_last_request_id()
    return redirect(url)


@app.post("/saml/acs")
def acs():
    auth = saml_auth()
    auth.process_response(request_id=session.pop("saml_request_id", None))

    if auth.get_errors() or not auth.is_authenticated():
        app.logger.warning("Login SSO gagal: %s", auth.get_last_error_reason())
        abort(403)

    attrs = auth.get_attributes()
    session.clear()
    session["user"] = {
        "id": auth.get_nameid(),           # pegawai:123 atau mahasiswa:2107110001
        "type": attrs["account_type"][0],  # pegawai atau mahasiswa
        "name": attrs.get("name", [None])[0],
        "email": attrs.get("email", [None])[0],
    }
    session["saml"] = {"name_id": auth.get_nameid(), "session_index": auth.get_session_index()}
    return redirect("/")


@app.get("/saml/logout")
def logout():
    auth = saml_auth()
    saml = session.get("saml", {})
    url = auth.logout(
        return_to=f"{APP}/",
        name_id=saml.get("name_id"),
        session_index=saml.get("session_index"),
        name_id_format=PERSISTENT,
    )
    session["saml_logout_id"] = auth.get_last_request_id()
    return redirect(url)


# Menangani dua hal: SSO meminta logout, atau SSO menjawab logout dari aplikasi ini.
@app.get("/saml/slo")
def slo():
    auth = saml_auth()
    url = auth.process_slo(request_id=session.get("saml_logout_id"), delete_session_cb=session.clear)
    if auth.get_errors():
        abort(400)
    return redirect(url or "/")


@app.get("/saml/metadata")
def metadata():
    response = make_response(saml_auth().get_settings().get_sp_metadata())
    response.headers["Content-Type"] = "application/xml"
    return response

// npm i express express-session @node-saml/node-saml
import fs from "node:fs";
import express from "express";
import session from "express-session";
import { SAML, ValidateInResponseTo } from "@node-saml/node-saml";

const APP = "https://app.unri.ac.id"; // CONTOH: ganti dengan alamat aplikasi Anda
const SSO = "https://sso.dev-app.unri.ac.id"; // alamat SSO ini, jangan diubah
const spCert = fs.readFileSync("saml/sp.crt", "utf8");

const saml = new SAML({
  issuer: `${APP}/saml/metadata`,
  audience: `${APP}/saml/metadata`,
  callbackUrl: `${APP}/saml/acs`,
  logoutCallbackUrl: `${APP}/saml/slo`,
  entryPoint: `${SSO}/saml/sso`,
  logoutUrl: `${SSO}/saml/slo`,
  idpIssuer: `${SSO}/saml/metadata`,
  idpCert: fs.readFileSync("saml/idp.crt", "utf8"),
  privateKey: fs.readFileSync("saml/sp.key", "utf8"),
  publicCert: spCert,
  identifierFormat: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
  signatureAlgorithm: "sha256",
  digestAlgorithm: "sha256",
  wantAssertionsSigned: true,
  wantAuthnResponseSigned: true,
  validateInResponseTo: ValidateInResponseTo.always,
  disableRequestedAuthnContext: true,
});

const app = express();
app.set("trust proxy", 1);
app.use(express.urlencoded({ extended: false }));
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true },
}));

app.get("/saml/login", async (req, res, next) => {
  try {
    res.redirect(await saml.getAuthorizeUrlAsync("", undefined, {}));
  } catch (err) {
    next(err);
  }
});

app.post("/saml/acs", async (req, res) => {
  try {
    const { profile } = await saml.validatePostResponseAsync(req.body);
    req.session.regenerate(() => {
      req.session.user = {
        id: profile.nameID,                    // pegawai:123 atau mahasiswa:2107110001
        type: profile.attributes.account_type, // pegawai atau mahasiswa
        name: profile.attributes.name,
        email: profile.attributes.email,
      };
      req.session.saml = {
        issuer: profile.issuer,
        nameID: profile.nameID,
        nameIDFormat: profile.nameIDFormat,
        sessionIndex: profile.sessionIndex,
      };
      res.redirect("/");
    });
  } catch (err) {
    console.warn("Login SSO gagal:", err.message);
    res.status(403).send("Login SSO gagal.");
  }
});

app.get("/saml/logout", async (req, res, next) => {
  try {
    if (!req.session.saml) return req.session.destroy(() => res.redirect("/"));
    res.redirect(await saml.getLogoutUrlAsync(req.session.saml, "", {}));
  } catch (err) {
    next(err);
  }
});

// Menangani dua hal: SSO meminta logout, atau SSO menjawab logout dari aplikasi ini.
app.get("/saml/slo", async (req, res) => {
  try {
    const originalQuery = req.originalUrl.split("?")[1] ?? "";
    const { profile } = await saml.validateRedirectAsync(req.query, originalQuery);

    if (req.query.SAMLRequest) {
      const url = await saml.getLogoutResponseUrlAsync(profile, req.query.RelayState ?? "", {}, true);
      return req.session.destroy(() => res.redirect(url));
    }

    req.session.destroy(() => res.redirect("/"));
  } catch (err) {
    console.warn("Logout SSO gagal:", err.message);
    res.status(400).send("Logout SSO gagal.");
  }
});

app.get("/saml/metadata", (req, res) => {
  res.type("application/xml").send(saml.generateServiceProviderMetadata(null, spCert));
});

app.listen(3000);

// Spring Boot 3 + Spring Security 6.1 ke atas.
// Dependensi: spring-boot-starter-security dan spring-security-saml2-service-provider.
// OpenSAML diambil dari repositori Shibboleth: https://build.shibboleth.net/maven/releases/

# ---- src/main/resources/application.yml ----
spring:
  security:
    saml2:
      relyingparty:
        registration:
          unri:
            # CONTOH: ganti app.unri.ac.id dengan alamat aplikasi Anda
            entity-id: "https://app.unri.ac.id/saml2/metadata/unri"
            signing:
              credentials:
                # CONTOH: lokasi kunci di server aplikasi Anda
                - private-key-location: "file:/etc/app/saml/sp.key"
                  certificate-location: "file:/etc/app/saml/sp.crt"
            singlelogout:
              url: "{baseUrl}/logout/saml2/slo"
              binding: REDIRECT
            assertingparty:
              metadata-uri: "https://sso.dev-app.unri.ac.id/saml/metadata" # alamat SSO ini, jangan diubah

// ---- SecurityConfig.java ----
@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain security(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .saml2Login(Customizer.withDefaults())
            .saml2Logout(Customizer.withDefaults())
            .saml2Metadata(Customizer.withDefaults());

        return http.build();
    }
}

// ---- HomeController.java ----
@RestController
public class HomeController {

    @GetMapping("/")
    public Map<String, Object> home(@AuthenticationPrincipal Saml2AuthenticatedPrincipal user) {
        return Map.of(
            "id", user.getName(),                           // pegawai:123 atau mahasiswa:2107110001
            "type", user.getFirstAttribute("account_type"), // pegawai atau mahasiswa
            "name", Objects.toString(user.getFirstAttribute("name"), ""),
            "email", Objects.toString(user.getFirstAttribute("email"), "")
        );
    }
}

// dotnet add package Sustainsys.Saml2.AspNetCore2
// Kunci SP diubah ke PFX dulu:
//   openssl pkcs12 -export -in sp.crt -inkey sp.key -out sp.pfx

using System.Security.Claims;
using System.Security.Cryptography.X509Certificates;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Sustainsys.Saml2;
using Sustainsys.Saml2.AspNetCore2;
using Sustainsys.Saml2.Metadata;

const string App = "https://app.unri.ac.id"; // CONTOH: ganti dengan alamat aplikasi Anda
const string Sso = "https://sso.dev-app.unri.ac.id"; // alamat SSO ini, jangan diubah

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = Saml2Defaults.Scheme;
    })
    .AddCookie()
    .AddSaml2(options =>
    {
        options.SPOptions.EntityId = new EntityId($"{App}/Saml2");
        options.SPOptions.PublicOrigin = new Uri($"{App}/");
        options.SPOptions.OutboundSigningAlgorithm = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
        options.SPOptions.ServiceCertificates.Add(
            new X509Certificate2("saml/sp.pfx", builder.Configuration["Saml:PfxPassword"]));

        options.IdentityProviders.Add(new IdentityProvider(new EntityId($"{Sso}/saml/metadata"), options.SPOptions)
        {
            MetadataLocation = $"{Sso}/saml/metadata",
            LoadMetadata = true,
        });
    });

builder.Services.AddAuthorization();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/login", () => Results.Challenge(
    new AuthenticationProperties { RedirectUri = "/" }, [Saml2Defaults.Scheme]));

app.MapGet("/logout", () => Results.SignOut(
    new AuthenticationProperties { RedirectUri = "/" },
    [CookieAuthenticationDefaults.AuthenticationScheme, Saml2Defaults.Scheme]));

app.MapGet("/", (ClaimsPrincipal user) => new
{
    Id = user.FindFirstValue(ClaimTypes.NameIdentifier), // pegawai:123 atau mahasiswa:2107110001
    Type = user.FindFirstValue("account_type"),          // pegawai atau mahasiswa
    Name = user.FindFirstValue("name"),
    Email = user.FindFirstValue("email"),
}).RequireAuthorization();

app.Run();

// go get github.com/crewjam/saml@latest
package main

import (
	"context"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net/http"
	"net/url"

	"github.com/crewjam/saml/samlsp"
)

const (
	appURL = "https://app.unri.ac.id" // CONTOH: ganti dengan alamat aplikasi Anda
	ssoURL = "https://sso.dev-app.unri.ac.id" // alamat SSO ini, jangan diubah
)

func main() {
	keyPair, err := tls.LoadX509KeyPair("saml/sp.crt", "saml/sp.key")
	if err != nil {
		panic(err)
	}
	keyPair.Leaf, err = x509.ParseCertificate(keyPair.Certificate[0])
	if err != nil {
		panic(err)
	}

	metadataURL, _ := url.Parse(ssoURL + "/saml/metadata")
	idpMetadata, err := samlsp.FetchMetadata(context.Background(), http.DefaultClient, *metadataURL)
	if err != nil {
		panic(err)
	}

	rootURL, _ := url.Parse(appURL)
	sp, err := samlsp.New(samlsp.Options{
		URL:            *rootURL,
		Key:            keyPair.PrivateKey.(*rsa.PrivateKey),
		Certificate:    keyPair.Leaf,
		IDPMetadata:    idpMetadata,
		SignRequest:    true,
		CookieSameSite: http.SameSiteNoneMode, // wajib HTTPS
	})
	if err != nil {
		panic(err)
	}

	// /saml/metadata dan /saml/acs disediakan oleh middleware.
	http.Handle("/saml/", sp)
	http.Handle("/", sp.RequireAccount(http.HandlerFunc(home)))
	http.ListenAndServe(":8000", nil)
}

func home(w http.ResponseWriter, r *http.Request) {
	claims := samlsp.SessionFromContext(r.Context()).(samlsp.JWTSessionClaims)

	id := claims.Subject                                                    // pegawai:123 atau mahasiswa:2107110001
	accountType := samlsp.AttributeFromContext(r.Context(), "account_type") // pegawai atau mahasiswa
	name := samlsp.AttributeFromContext(r.Context(), "name")

	fmt.Fprintf(w, "%s (%s) %s", name, accountType, id)
}

# Gemfile: gem "ruby-saml", ">= 1.18.0"
#
# config/routes.rb:
#   get  "saml/login",    to: "saml#login"
#   post "saml/acs",      to: "saml#acs"
#   get  "saml/logout",   to: "saml#logout"
#   get  "saml/slo",      to: "saml#slo"
#   get  "saml/metadata", to: "saml#metadata"

class SamlController < ApplicationController
  skip_forgery_protection only: :acs

  APP = "https://app.unri.ac.id" # CONTOH: ganti dengan alamat aplikasi Anda
  SSO = "https://sso.dev-app.unri.ac.id" # alamat SSO ini, jangan diubah

  def login
    auth_request = OneLogin::RubySaml::Authrequest.new
    url = auth_request.create(saml_settings)
    session[:saml_request_id] = auth_request.uuid
    redirect_to url, allow_other_host: true
  end

  def acs
    response = OneLogin::RubySaml::Response.new(
      params[:SAMLResponse],
      settings: saml_settings,
      matches_request_id: session.delete(:saml_request_id)
    )

    unless response.is_valid?
      Rails.logger.warn("Login SSO gagal: #{response.errors.join(', ')}")
      return head :forbidden
    end

    reset_session
    session[:user] = {
      "id" => response.nameid,                       # pegawai:123 atau mahasiswa:2107110001
      "type" => response.attributes["account_type"], # pegawai atau mahasiswa
      "name" => response.attributes["name"],
      "email" => response.attributes["email"]
    }
    session[:saml] = { "name_id" => response.nameid, "session_index" => response.sessionindex }
    redirect_to "/"
  end

  def logout
    settings = saml_settings
    settings.name_identifier_value = session.dig(:saml, "name_id")
    settings.sessionindex = session.dig(:saml, "session_index")

    logout_request = OneLogin::RubySaml::Logoutrequest.new
    url = logout_request.create(settings)
    session[:saml_logout_id] = logout_request.uuid
    redirect_to url, allow_other_host: true
  end

  # Menangani dua hal: SSO meminta logout, atau SSO menjawab logout dari aplikasi ini.
  def slo
    if params[:SAMLRequest]
      logout_request = OneLogin::RubySaml::SloLogoutrequest.new(
        params[:SAMLRequest], settings: saml_settings, get_params: request.query_parameters
      )
      return head :bad_request unless logout_request.is_valid?

      reset_session
      url = OneLogin::RubySaml::SloLogoutresponse.new.create(
        saml_settings, logout_request.id, nil, RelayState: params[:RelayState]
      )
      redirect_to url, allow_other_host: true
    else
      logout_response = OneLogin::RubySaml::Logoutresponse.new(
        params[:SAMLResponse], saml_settings,
        matches_request_id: session[:saml_logout_id], get_params: request.query_parameters
      )
      return head :bad_request unless logout_response.validate && logout_response.success?

      reset_session
      redirect_to "/"
    end
  end

  def metadata
    render xml: OneLogin::RubySaml::Metadata.new.generate(saml_settings)
  end

  private

  def saml_settings
    OneLogin::RubySaml::Settings.new.tap do |s|
      s.sp_entity_id = "#{APP}/saml/metadata"
      s.assertion_consumer_service_url = "#{APP}/saml/acs"
      s.single_logout_service_url = "#{APP}/saml/slo"
      s.idp_entity_id = "#{SSO}/saml/metadata"
      s.idp_sso_service_url = "#{SSO}/saml/sso"
      s.idp_slo_service_url = "#{SSO}/saml/slo"
      s.idp_cert = File.read(Rails.root.join("config/saml/idp.crt"))
      s.certificate = File.read(Rails.root.join("config/saml/sp.crt"))
      s.private_key = File.read(Rails.root.join("config/saml/sp.key"))
      s.name_identifier_format = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
      s.security[:authn_requests_signed] = true
      s.security[:logout_requests_signed] = true
      s.security[:logout_responses_signed] = true
      s.security[:want_assertions_signed] = true
      s.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
      s.security[:digest_method] = XMLSecurity::Document::SHA256
    end
  end
end

# apt install libapache2-mod-auth-mellon
# curl -o /etc/apache2/saml/idp-metadata.xml https://sso.dev-app.unri.ac.id/saml/metadata

<VirtualHost *:443>
    # CONTOH: ganti app.unri.ac.id dan 127.0.0.1:8000 dengan alamat aplikasi Anda
    ServerName app.unri.ac.id

    <Location />
        MellonEnable info
        MellonSPentityId "https://app.unri.ac.id/mellon/metadata"
        MellonSPPrivateKeyFile /etc/apache2/saml/sp.key
        MellonSPCertFile /etc/apache2/saml/sp.crt
        MellonIdPMetadataFile /etc/apache2/saml/idp-metadata.xml
        MellonEndpointPath /mellon
        MellonSignatureMethod rsa-sha256
        MellonSecureCookie On
        MellonCookieSameSite None
    </Location>

    # Bagian yang wajib login.
    <Location /app>
        AuthType Mellon
        MellonEnable auth
        Require valid-user

        # Diteruskan ke aplikasi di belakangnya, apa pun bahasanya.
        RequestHeader set X-SSO-Id   "%{MELLON_NAME_ID}e"
        RequestHeader set X-SSO-Type "%{MELLON_account_type}e"
        RequestHeader set X-SSO-Name "%{MELLON_name}e"
    </Location>

    ProxyPass        /app http://127.0.0.1:8000/app
    ProxyPassReverse /app http://127.0.0.1:8000/app
</VirtualHost>