How to configure a SAML configuration by customer for my SaaS application

For my SaaS application i want to configure a SAML configuration by customer. I want to be aible to change the configuration of my Symfony One Login Bundle to fit witht he configuration of my customer for their need.

This guide will help you configure SAML SSO for your Symfony application on a per-customer basis. You'll need to adjust the configuration of the Symfony One Login Bundle to match the specific requirements of each customer.

First, determine the appropriate bundle based on your Symfony version:

* For Symfony 6, install the nbgrp/onelogin-saml-bundle from GitHub.

* For earlier Symfony versions, start with the hslaovich/OneloginSamlBundle from GitHub.

Next, add the default configuration. If this step is skipped, the application will fail to function properly. Edit the config/packages/nbgrp_onelogin_saml.yaml file as follows:

```yaml

nbgrp_onelogin_saml:

idp:

default:

settings:

assertionConsumerService:

url: '%env(SAML_ASSERTION_CONSUMER_SERVICE)%'

issuer: '%env(SAML_ISSUER)%'

spEntityId: '%env(SAML_SP_ENTITY_ID)%'

x509cert: '%env(SAML_X509_CERT)%'

```

Update the config/packages/security.yaml file as well:

```yaml

security:

encoders:

SymfonyComponentSecurityCoreUserUser: plaintext

providers:

saml:

nbgrp_onelogin_saml

firewalls:

main:

saml:

path: ^/saml

provider: saml

entry_point: nbgrp_onelogin_saml_entry_point

logout_entry_point: nbgrp_onelogin_saml_logout_entry_point

logout_success_handler: nbgrp_onelogin_saml_logout_success_handler

logout:

path: ^/logout$

```

The nbgrp/onelogin-saml-bundle utilizes compilerpass to inject configuration into a registry in an array indexed by idp, which is then used throughout the application. We'll override this functionality and load the configuration dynamically from the database based on the hostname.

Create a new service in the api/config/services.yaml file:

```yaml

services:

app.saml_configuration_loader:

class: AppSecuritySamlConfigurationLoader

arguments:

- '@doctrine.orm.default_entity_manager'

```

Override relevant portions of the bundle:

Those files will be overridden to enable dynamic configuration of the login controller, metadata, and authenticator.

Login Controller

Override the api/vendor/nbgrp/onelogin-saml-bundle/src/Controller/Login.php file to utilize our configuration.

In the __construct method, we autowire and add our service.

```php

use AppSecuritySamlConfigurationLoader;

use SymfonyBundleFrameworkBundleControllerAbstractController;

use SymfonyComponentDependencyInjectionContainerInterface;

use SymfonyComponentHttpFoundationRequest;

use SymfonyComponentHttpFoundationResponse;

use SymfonyComponentRoutingAnnotationRoute;

use SymfonyComponentSecurityHttpAuthenticationAuthenticationUtils;

class LoginController extends AbstractController

{

private $samlConfigurationLoader;

public function __construct(ContainerInterface $container, SamlConfigurationLoader $samlConfigurationLoader)

{

parent::__construct($container);

$this->samlConfigurationLoader = $samlConfigurationLoader;

}

public function login(AuthenticationUtils $authenticationUtils, Request $request): Response

{

$host = $request->server->get('HTTP_HOST');

$samlSettings = $this->samlConfigurationLoader->getSettingsFromHost($host);

// ...

}

}

```

Metadata

Line 19: Add our service.

```php

use AppSecuritySamlConfigurationLoader;

use SymfonyComponentDependencyInjectionContainerInterface;

class MetadataController extends Controller

{

public static function create(ContainerInterface $container): MetadataController

{

$samlConfigurationLoader = $container->get(SamlConfigurationLoader::class);

return new self($samlConfigurationLoader);

}

public function __invoke(Request $request): Response

{

$host = $request->server->get('HTTP_HOST');

$samlSettings = $this->samlConfigurationLoader->getSettingsFromHost($host);

// ...

}

}

```