Nginx&SimpleSAMLphpをOIDC対応RP化してAzure AD(Entra ID)認証

# apt update
# add-apt-repository ppa:ondrej/php -y
# apt update
# apt -y install php8.3 php8.3-gd php8.3-mbstring php8.3-common php8.3-curl
# php -v
PHP 8.3.0 (cli) (built: Nov 24 2023 08:50:08) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.0, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.0, Copyright (c), by Zend Technologies
# apt list --installed | grep apache2

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

apache2-bin/jammy-updates,jammy-security,now 2.4.52-1ubuntu4.7 amd64 [インストール済み、自動]
apache2-data/jammy-updates,jammy-updates,jammy-security,jammy-security,now 2.4.52-1ubuntu4.7 all [インストール済み、自動]
apache2-utils/jammy-updates,jammy-security,now 2.4.52-1ubuntu4.7 amd64 [インストール済み、自動]
apache2/jammy-updates,jammy-security,now 2.4.52-1ubuntu4.7 amd64 [インストール済み、自動]
libapache2-mod-php8.3/jammy,now 8.3.0-1+ubuntu22.04.1+deb.sury.org+1 amd64 [インストール済み、自動]
# apt -y remove apache2-*
# apt install -y php-fpm
# apt install nginx -y
# nginx -v
nginx version: nginx/1.18.0 (Ubuntu)
# vi /etc/nginx/fastcgi_params

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
↓
fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;

# mkdir -p /opt/webapps/php
# chown -R www-data: /opt/webapps
# mkdir -p /var/log/webapps/php
# vi /opt/webapps/php/info.php

<?php
phpinfo();

# openssl genrsa -out ca.key 2048
# openssl req -new -key ca.key -out ca.csr
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Aichi
Locality Name (eg, city) []:Toyota
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:webapps-php.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# echo "subjectAltName=DNS:*.example.com,IP:192.168.12.200" > san.txt
# openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt -extfile san.txt
Signature ok
subject=C = JP, ST = Aichi, L = Toyota, O = Default Company Ltd, CN = webapp.example.com
Getting Private key
# mkdir -p /etc/pki/tls/certs
# mkdir /etc/pki/tls/private
# mv ca.crt /etc/pki/tls/certs/webapps-php.crt
# mv ca.key /etc/pki/tls/private/webapps-php.key
# mv ca.csr /etc/pki/tls/private/webapps-php.csr
# vi /etc/nginx/conf.d/webapps-info.conf

server  # サーバーブロックの開始
{
  listen 443 ssl; # サーバーが待ち受けるポート番号
  ssl_certificate /etc/pki/tls/certs/webapps-php.crt; # TLS証明書
  ssl_certificate_key /etc/pki/tls/private/webapps-php.key; # TLS秘密鍵
  server_name webapps-php.example.com;  # サーバーの名前
  access_log /var/log/webapps/php/access.log;  # アクセスログのパス
  error_log /var/log/webapps/php/error.log;  # エラーログのパス

  root /opt/webapps/php;  # サーバーのルートディレクトリ

  location /  # ルートディレクトリに対する設定
  {
    index index.html index.htm index.php;  # デフォルトで使用するインデックスファイル
  }

  location ~ [^/]\.php(/|$)  # .phpで終わるリクエストに対する設定
  {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;  # パス情報を分割
    if (!-f $document_root$fastcgi_script_name)  # スクリプトファイルが存在しない場合
    {
      return 404;  # 404エラーを返す
    }

    client_max_body_size 100m;  # クライアントからの最大ボディサイズ

    # Mitigate https://httpoxy.org/ vulnerabilities
    fastcgi_param HTTP_PROXY "";  # HTTP_PROXYを空に設定してhttpoxy脆弱性を緩和

    # fastcgi_pass 127.0.0.1:9000;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;  # FastCGIサーバーへのパス
    fastcgi_index index.php;  # デフォルトのFastCGIスクリプト

    # include the fastcgi_param setting
    include fastcgi_params;  # FastCGIパラメータの設定を含む

    # SCRIPT_FILENAME parameter is used for PHP FPM determining
    #  the script name. If it is not set in fastcgi_params file,
    # i.e. /etc/nginx/fastcgi_params or in the parent contexts,
    # please comment off following line:
    # fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;  # スクリプト名を決定するためのパラメータ
  }
}

# vi /etc/php/8.3/fpm/php.ini

date.timezone = Asia/Tokyo
# 新規設定

display_errors = On
display_startup_errors = On
# 確認（最初から設定されている。）

# vi /etc/hosts
192.168.12.200 webapps-php.example.com

# systemctl restart nginx
# systemctl restart php8.3-fpm

# apt install -y php8.3-dom php8.3-xml
# tar xzf simplesamlphp-2.1.1-full.tar.gz
# mv simplesamlphp-2.1.1 /var/simplesamlphp

# openssl genrsa -out ca.key 2048
# openssl req -new -key ca.key -out ca.csr
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Aichi
Locality Name (eg, city) []:Toyota
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:ssp2.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# echo "subjectAltName=DNS:*.example.com,IP:192.168.12.200" > san.txt
# openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt -extfile san.txt
Signature ok
subject=C = JP, ST = Aichi, L = Toyota, O = Default Company Ltd, CN = webapp.example.com
Getting Private key
# mv ca.crt /etc/pki/tls/certs/ssp2.example.com.crt
# mv ca.key /etc/pki/tls/private/ssp2.example.com.key
# mv ca.csr /etc/pki/tls/private/ssp2.example.com.csr
# vi /etc/nginx/conf.d/simplesaml.conf

server {
    listen 443 ssl;
    server_name ssp2.example.com;

    ssl_certificate        /etc/pki/tls/certs/ssp2.example.com.crt;
    ssl_certificate_key    /etc/pki/tls/private/ssp2.example.com.key;
    ssl_protocols          TLSv1.3 TLSv1.2;
    ssl_ciphers            EECDH+AESGCM:EDH+AESGCM;

    location ^~ /simplesaml {
        index index.php;
        alias /var/simplesamlphp/public;

        location ~^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
            include          fastcgi_params;
            # fastcgi_pass     $fastcgi_pass;
            fastcgi_pass     unix:/run/php/php8.3-fpm.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$phpfile;

            # Must be prepended with the baseurlpath
            fastcgi_param SCRIPT_NAME /simplesaml$phpfile;

            fastcgi_param PATH_INFO $pathinfo if_not_empty;
        }
    }
}

# chown -R www-data: /var/simplesamlphp
# vi /etc/hosts
192.168.12.200	ssp2.example.com
# systemctl restart nginx
# systemctl restart php8.3-fpm
# cd /var/simplesamlphp
# cp config/config.php.dist config/config.php
# cp config/authsources.php.dist config/authsources.php
# cp metadata/saml20-idp-hosted.php.dist metadata/saml20-idp-hosted.php
# cp metadata/saml20-idp-remote.php.dist metadata/saml20-idp-remote.php
# cp metadata/saml20-sp-remote.php.dist metadata/saml20-sp-remote.php

# openssl rand -base64 32
RCN2jfGolAsfOb1J4UXQrbrwevYIyz/O/o9sJWRzxTc=
# vi /var/simplesamlphp/config/config.php

//'secretsalt' => 'defaultsecretsalt',
// ↓ 変更
'secretsalt' => 'RCN2jfGolAsfOb1J4UXQrbrwevYIyz/O/o9sJWRzxTc=',

//'auth.adminpassword' => '123',
// ↓ 変更
'auth.adminpassword' => 'admin',

//'timezone' => null,
// ↓ 変更
'timezone' => 'Asia/Tokyo',

// 'technicalcontact_name' => 'Administrator',
// 'technicalcontact_email' => 'na@example.org',
// ↓ 変更
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'admin@ssp2.example.com',

# cd /var/simplesamlphp
# apt update -y
# apt install composer -y

# apt install php8.3-sqlite3 -y
# apt install php8.3-ldap -y
# apt install php8.3-intl -y

# composer require cirrusidentity/simplesamlphp-module-authoauth2
...
  - Installing symfony/translation (v6.0.19): Extracting archive
Generating autoload files
66 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> php bin/translations translations:update:binary

# cd /var/simplesamlphp
# vi config/authsources.php

    'microsoftOIDCSource' => [
        'authoauth2:OpenIDConnect',
        'issuer' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0',
        // When using the 'common' discovery endpoint it allows any Azure user to authenticate, however
        // the token issuer is tenant specific and will not match what is in the common discovery document.
        'validateIssuer' => false,  // issuer is just used to confirm correct discovery endpoint loaded
        'discoveryUrl' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0/.well-known/openid-configuration',
        'clientId' => '3******6-0**9-4**b-85bd-f**********8',
        'clientSecret' => 'sv************************************Z_',
    ],

# apt install curl -y
# apt install jq -y
# curl https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0/.well-known/openid-configuration | jq

{
  "token_endpoint": "https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/oauth2/v2.0/token",
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "private_key_jwt",
    "client_secret_basic"
  ],
  "jwks_uri": "https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/discovery/v2.0/keys",
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "subject_types_supported": [
    "pairwise"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "response_types_supported": [
    "code",
    "id_token",
    "code id_token",
    "id_token token"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "issuer": "https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0",
  "request_uri_parameter_supported": false,
...

# vi config/config.php

    'module.enable' => [
        'exampleauth' => false,
        'core' => true,
        'admin' => true,
        'saml' => true,//末尾に , 追加必要なのに注意
        'authoauth2' => true//追加
    ],

    //'loggingdir' => '/var/log/',
    'loggingdir' => '/var/log/simplesaml',
...
    //'logging.level' => SimpleSAML\Logger::NOTICE,
    'logging.level' => SimpleSAML\Logger::DEBUG,
    //'logging.handler' => 'syslog',
    'logging.handler' => 'file',

# mkdir /var/log/simplesaml
# chown www-data: /var/log/simplesaml

# cd /var/simplesamlphp
# vi config/authsources.php

    'microsoftOIDCSource' => [
        'authoauth2:OpenIDConnect',
        'issuer' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0',
        // When using the 'common' discovery endpoint it allows any Azure user to authenticate, however
        // the token issuer is tenant specific and will not match what is in the common discovery document.
        'validateIssuer' => false,  // issuer is just used to confirm correct discovery endpoint loaded
        'discoveryUrl' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0/.well-known/openid-configuration',
        'clientId' => '3******6-0**9-4**b-85bd-f**********8',
        'clientSecret' => 'sv************************************Z_',
        'proxy' => 'http://192.168.0.158:3128',//←追加
    ],

# vi /etc/nginx/fastcgi_params
fastcgi_param	HTTP_PROXY	http://192.168.0.158:3128;
fastcgi_param	HTTPS_PROXY	http://192.168.0.158:3128;
fastcgi_param	NO_PROXY	.example.com;
# systemctl restart nginx

# cd /var/simplesamlphp
# vi config/authsources.php

    'microsoftOIDCSource' => [
        'authoauth2:OpenIDConnect',
        'issuer' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0',
        // When using the 'common' discovery endpoint it allows any Azure user to authenticate, however
        // the token issuer is tenant specific and will not match what is in the common discovery document.
        'validateIssuer' => false,  // issuer is just used to confirm correct discovery endpoint loaded
        'discoveryUrl' => 'https://login.microsoftonline.com/0******2-f**7-4**c-9**4-1**********b/v2.0/.well-known/openid-configuration',
        'clientId' => '3******6-0**9-4**b-85bd-f**********8',
        'clientSecret' => 'sv************************************Z_',
        'proxy' => 'http://192.168.0.158:3128',
        'timeout' => 10,//←追加
    ],

# vi /opt/webapps/php/info.php

<?php
require_once('/var/simplesamlphp/lib/_autoload.php');
use SimpleSAML\Auth\Simple;
$as = new Simple('microsoftOIDCSource');
$as->requireAuth();
phpinfo();

# vi /etc/nginx/conf.d/webapps-info.conf

# location / の上に追記
  location ^~ /simplesaml {
    index index.php;
    alias /var/simplesamlphp/public;

    location ~^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
      include      fastcgi_params;
      # fastcgi_pass   $fastcgi_pass;
      fastcgi_pass   unix:/run/php/php8.3-fpm.sock;
      fastcgi_param SCRIPT_FILENAME $document_root$phpfile;

      # Must be prepended with the baseurlpath
      fastcgi_param SCRIPT_NAME /simplesaml$phpfile;

      fastcgi_param PATH_INFO $pathinfo if_not_empty;
    }
  }
  location /

# systemctl restart nginx