FQDN			IP Address	Purpose		        OS
idp.techsupportpk.com	192.168.105.70	AD FS			Windows 2019
sp.techsupportpk.com	192.168.105.69	Apache, SimpleSAMLphp	CentOS 7

 

sudo yum install -y epel-release
sudo yum install -y https://rpms.remirepo.net/enterprise/remi-release-7.rpm
sudo yum install -y httpd mod_ssl openssl php71 php71-php php71-php-fpm php71-php-gd php71-php-mysqlnd php71-php-mcrypt php71-php-mbstring php71-php-common php71-php-curl php71-php-pecl-redis php71-php-pecl-memcache php71-php-xml php71-php-ldap php71-php-cli php71-php-json php71-php-pdo git wget nano ntpdate mariadb-server 

sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo systemctl status mariadb

sudo /usr/bin/mysql_secure_installation

sudo nano /etc/opt/remi/php71/php.ini

date.timezone = Asia/Karachi

sudo systemctl start php71-php-fpm
sudo systemctl enable php71-php-fpm

cd ~
wget https://github.com/simplesamlphp/simplesamlphp/releases/download/v1.18.8/simplesamlphp-1.18.8.tar.gz
sudo tar -xf simplesamlphp-1.18.8.tar.gz -C /var/
sudo mv /var/simplesamlphp-1.18.8/ /var/simplesamlphp

sudo openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out /var/simplesamlphp/cert/sp.crt -keyout /var/simplesamlphp/cert/sp.pem

Generating a 3072 bit RSA private key
.....................................++
........++
writing new private key to '/var/simplesamlphp/cert/sp.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:PK
State or Province Name (full name) []:Sindh
Locality Name (eg, city) [Default City]:Karachi
Organization Name (eg, company) [Default Company Ltd]:Tech Support
Organizational Unit Name (eg, section) []:IT Support
Common Name (eg, your name or your server's hostname) []:sp.techsupportpk.com
Email Address []:support@techsupportpk.com

sudo openssl req -newkey rsa:3072 -new -x509 -days 3652 -nodes -out /var/simplesamlphp/cert/idp.crt -keyout /var/simplesamlphp/cert/idp.pem

Generating a 3072 bit RSA private key
.....................................++
........++
writing new private key to '/var/simplesamlphp/cert/idp.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:PK
State or Province Name (full name) []:Sindh
Locality Name (eg, city) [Default City]:Karachi
Organization Name (eg, company) [Default Company Ltd]:Tech Support
Organizational Unit Name (eg, section) []:IT Support
Common Name (eg, your name or your server's hostname) []:idp.techsupportpk.com
Email Address []:support@techsupportpk.com

sudo openssl pkcs12 -inkey /var/simplesamlphp/cert/sp.pem -in /var/simplesamlphp/cert/sp.crt -export -out /var/simplesamlphp/cert/sp.pfx

sudo tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz'</dev/urandom | dd bs=32 count=1 2>/dev/null;echo

php71 /var/simplesamlphp/bin/pwgen.php

sudo nano /var/simplesamlphp/config/config.php

'technicalcontact_name' => 'Support',
'technicalcontact_email' => 'support@techsupportpk.com',

'timezone' => 'Asia/Karachi',

'secretsalt' => 'defaultsecretsalt',

'auth.adminpassword' => '123',

sudo nano /etc/httpd/conf.d/simplesamlphp.conf

Alias /simplesaml /var/simplesamlphp/www

<Directory /var/simplesamlphp/www>
<IfModule mod_authz_core.c>
       Require all granted
</IfModule>
</Directory>

sudo mkdir -p /var/www/sp.techsupportpk.com

sudo nano /etc/httpd/conf.d/sp.techsupportpk.conf

<VirtualHost *:80>
   ServerName sp.techsupportpk.com
   Redirect / https://sp.techsupportpk.com/
</VirtualHost>

<VirtualHost _default_:443>
   ServerName sp.techsupportpk.com
   DocumentRoot /var/www/sp.techsupportpk.com
   SSLEngine On
   SSLCertificateFile /var/simplesamlphp/cert/sp.crt
   SSLCertificateKeyFile /var/simplesamlphp/cert/sp.pem
</VirtualHost>

sudo apachectl configtest

Syntax OK

sudo systemctl start httpd
sudo systemctl enable httpd
sudo systemctl status httpd

sudo ntpdate -u idp.techsupportpk.com

1 Mar 11:55:14 ntpdate[14847]: adjust time server 192.168.105.70 offset -0.321102 sec

sudo nano /var/simplesamlphp/metadata/saml20-idp-remote.php

Save and close the editor when you are finished.

sudo nano /var/simplesamlphp/config/authsources.php

'techsupportpk-sp' => array(
'saml:SP',
'entityID' => null,
'idp' => 'http://idp.techsupportpk.com/adfs/services/trust',
'discoURL' => null,
'sign.logout' => TRUE,
'SignLogoutRequest' => TRUE,
'SignLogoutResponse' => TRUE,
'redirect.sign' => TRUE,
'assertion.encryption' => TRUE,
'privatekey' => 'idp.pem',
'certificate' => 'idp.crt',
'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
),

When you have your sp.pfx file on your AD FS machine, install it like below:

Select Trusted Root Certification Authorities, click OK

Click Finish

Click Next

 

Click Next

 

Click Next

 

Click Close

 

Right-click on your Relying Party Trust entity, click Edit Claim Issuance Policy

 

Click Add Rule

 

 

Configure claim rule like below:

 

Add another rule, select Transform an Incoming Claim, click Next

 

Configure rule like below:

 

Click Apply, OK

Click on a authentication source your added for AD FS.

If everything configured correctly, you will be taken to your AD FS login page:

Enter your valid usernameand password like below to sign-in:

cd /var/www/sp.techsupportpk.com
sudo nano index.php

<?php
require_once ('/var/simplesamlphp/lib/_autoload.php');
$as = new SimpleSAML_Auth_Simple('techsupportpk-sp');
$as->requireAuth();

$attributes = $as->getAttributes();

?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Index Page</title>
</head>
<body>
<h3>Welcome <strong>Authenticated User</strong>!</h3>
<h4>Claim list:</h4>
<?php
echo '<pre>';
print_r($attributes);
echo '</pre>';

echo '<a href="logout.php">Logout</a>';

?>
</body>
</html>

<?php
require_once ('/var/simplesamlphp/lib/_autoload.php');
$as = new SimpleSAML_Auth_Simple('techsupportpk-sp');

$as->logout(array(
'ReturnTo' => '/logged_out.php',
'ReturnStateParam' => 'LogoutState',
'ReturnStateStage' => 'MyLogoutState',
));
?>

<?php
require_once ('/var/simplesamlphp/lib/_autoload.php');

try {
        if ($_REQUEST['LogoutState']) {
                $state = SimpleSAML_Auth_State::loadState((string)$_REQUEST['LogoutState'], 'MyLogoutState');
        }
        else {
                echo "Were you logged in?";
                exit;
        }
}
catch (Exception $e) {
        echo 'Caught exception: ',  $e->getMessage(), "\n";
        exit;
}
$ls = $state['saml:sp:LogoutStatus']; // Only works for SAML SP
if ($ls['Code'] === 'urn:oasis:names:tc:SAML:2.0:status:Success'&& !isset($ls['SubCode'])) {
    // Successful logout.
    echo("You have been logged out.");
    echo "<script>window.close();</script>";
} else {
    // Logout failed. Tell the user to close the browser.
   // echo("We were unable to log you out of all your sessions. To be completely sure that you are logged out, you need to
 close your web browser.");
}
?>