# 開発用の SAML セットアップ
## 経緯
以前までの[./旧: 開発用のSAMLサーバーセットアップ](https://dev.growi.org/632bf6fd4a0e56cdd8c249c0)の手順が使用できなくなっていた。
以前まで使用できていた jboss/keycloak の docker image が削除されてしまった新しく手順を作成する必要があった。
## 実装方法
### GROWI の設定
#### GROWI のセキュリティ設定から以下の設定を行う
- SAML を有効化する
- 基本設定
- エントリーポイント
- http://localhost:18080/realms/growi/protocol/saml
- 発行者
- growi-client
- 証明書
- 後で設定します
- Mapping の設定
### keycloak の立ち上げ
#### 1. 以下の docker-compose.yml を作成する
docker-compose.yml
```docker-compose.yml
version: "3"
services:
mysql:
image: mysql:8.0
environment:
MYSQL_ROOT_PASSWORD: password
MYSQL_DATABASE: keycloak
MYSQL_USER: keycloak
MYSQL_PASSWORD: password
volumes:
- mysql_data:/var/lib/mysql
keycloak:
image: quay.io/keycloak/keycloak:latest
environment:
DB_VENDOR: mysql
DB_ADDR: mysql
DB_DATABASE: keycloak
DB_USER: keycloak
DB_PASSWORD: password
KEYCLOAK_ADMIN: admin
KEYCLOAK_ADMIN_PASSWORD: password
command: ["start-dev"]
depends_on:
- mysql
ports:
- "18080:8080"
volumes:
mysql_data:
```
realm-client.json
```json
{
"clientId": "growi-client",
"rootUrl": "http://localhost:3000/",i
"adminUrl": "http://localhost:3000/passport/saml/callback",
"baseUrl": "http://localhost:3000/",
"redirectUris": [
"http://localhost:3000/*"
],
"webOrigins": [
"http://localhost:3000"
],
"frontchannelLogout": true,
"protocol": "saml",
"attributes": {
"saml.assertion.signature": "true",
"saml.encrypt": "false",
"post.logout.redirect.uris": "http://localhost:3000/passport/saml/callback",
"saml.server.signature": "true",
"saml.server.signature.keyinfo.ext": "false",
"saml.signing.certificate": "MIICpzCCAY8CBgGQL8JlPzANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxncm93aS1jbGllbnQwHhcNMjQwNjE5MDkwODA3WhcNMzQwNjE5MDkwOTQ3WjAXMRUwEwYDVQQDDAxncm93aS1jbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4+7l1AKkg/g2kt4H+iLkGRB+JaeoxvLu+XNox8pmWVyxgP5PKXPmhCOFc8kqCgDqsbtY8SpsKfqa+82vPeck2UESSp2a3mrI/3341eUpFeeSiUzk9fXX2eG8X3Q4U70lqww5jmUDjRkkipHloSxinMo2Ik3NqLU6c0SZGKSCQwm2MbePEuPy0JPbpsjioAVAEoAAmguknLUUKcVs2ZbhQe2f7YJJf7eRnh8Lro4fgtOGpmxtKa9DYzqT6Z9EMiJzpEQ5B1FHL1A1o94k2QgZ0bTggZj9ccN1NYxbTHDrEgmjsbcgRusNv293glwmvwLWefs2vCl5h0FGgHyIlMOn5AgMBAAEwDQYJKoZIhvcNAQELBQADggEBAAXpqlLH1rI+qKTFkr6msDJWHZ9epmr32KfbUukVPjy3s4oxCDTQ0S5jlY2n5/GiAMLvCWZWhq2xCKTOkCvCwS8J68luj/VKXexxyPikA+9X7lsZaWUNfQavkrqS81FumkC/daHFO5j/C74vZXKRjIwfgvaDIx36R+T+w2G6Je9FOwdW48AZqB33yd8i9D90xV19bnMapesW+tYoPKrlhsbLn/je8ylVuwuZwO6HoJysEHasET3a67Zc1nO3NvdFWELXMHRg7LnTW2ppzD6xtBM39+F0xkiZAPqr8gQjul3/04IX4SAN/5wqJs5cc4TMlLnxaPQUA6J5Mmrc/W6NQYw=",
"saml.signature.algorithm": "RSA_SHA256",
"saml.client.signature": "false",
"display.on.consent.screen": "false",
"saml_name_id_format": "username",
"saml.signing.private.key": "MIIEpAIBAAKCAQEAuPu5dQCpIP4NpLeB/oi5BkQfiWnqMby7vlzaMfKZllcsYD+Tylz5oQjhXPJKgoA6rG7WPEqbCn6mvvNrz3nJNlBEkqdmt5qyP99+NXlKRXnkolM5PX119nhvF90OFO9JasMOY5lA40ZJIqR5aEsYpzKNiJNzai1OnNEmRikgkMJtjG3jxLj8tCT26bI4qAFQBKAAJoLpJy1FCnFbNmW4UHtn+2CSX+3kZ4fC66OH4LThqZsbSmvQ2M6k+mfRDIic6REOQdRRy9QNaPeJNkIGdG04IGY/XHDdTWMW0xw6xIJo7G3IEbrDb9vd4JcJr8C1nn7NrwpeYdBRoB8iJTDp+QIDAQABAoIBABGWqra5qDspONQgeDFi39/dBpge3FwcD0hdhQgignDBa2hf5y4iusARa3c2WPgRV/LZC5D6QYVlDzcBB29X67Y4udptZRaAVKI+3n3YYWPbgA4gpmTGuvqDT0HYPIxoR6VpdELrWZh6kH3lIF+Wo1qTc5Jovby639qIhvB9HNnynvZLZr4CXS8Jfj06ZiT6NLPdArTuvr2Er3QLjA1ka26nkRoUjZRKhJPF07uYxZoRz1ftLMn6uvQtdINQZeSSVq1rOjHPS4sNyEk24tx8ElW/FBBoLiRZMmZVAxc62OVuyXB9X3yyHfe9ED6DBpGw/9OSUCxERjsopsF6SnY0PMECgYEA9zwfc9lHcTWRFp1XqMsGqGikIWOpSAv4zNIDePu2IIW53nUJYFuGi/v6X7q3/OWtvU4R8fXiUfkOjPTaVAkhq37fpLqzz209SNfiiWSZeay1+hvSQn0HutmGhIcNLqiGwgv3msM/ctV2LRk2l4+5622VCU0do9i3y2T554B4s8ECgYEAv4qc9FehNo+DAXADRF0plYEolzP4+SaGtnDItoPQU9K/H5PRzfESBxnWkLf7xxc2zRv8U8HDopa1pVwfRWYyIwGR/LmChxcD3mmv6wLKZNMepj1NiNgv0c0sXKIuLB3NvLtHi1N1av6GKrqZay2rD/I0ksRe4vP/Qcw90xR55DkCgYAV/k01+xA16/P6NQkFRPpUpOpk5f67IAWEAvK4InwzLHI6beLlpX60mTfOqEeRwcTQ4E8MXTlC3YsD0wxRCXbrUKAIgWtZenhHMJ1AZ6iXgFu34h20OHclkhA7XeA4VFmYjYP7Sn8scfzPSjznAqwhW2A0sZ1/Y9oFx/fLNkyGgQKBgQCPv1dLiPhUGiAXVBkflUtACE6OK1MOqPswsDPxxbrzLZaB/E3YYLNG4P1GXs11/NYD2JzlvuUzgCeSkjBlxOybmPIW2KI8/+jHYknD9bQvNsIpwJgPuy8oJPLGEnDUawmcOnDW/yt/wMSwDJpW9U8MCJmsC/OqH7PRjZZYc2WHAQKBgQCJejkkWh1BwYEozwGGG1iK9Me0gbOPxzi9QpFseExA3QDksxElUZ1e3VIsWTiy2CvAB13JvcI+Q096kEhJgvebm0a2vL0lJR5ff2ocZsrJA16XYvuid7WiEQcBh4a67ya0Dtyhehg+/fYbhud980nvdPedbDm4iczhUGC/XPWFWw==",
"saml_signature_canonicalization_method": "http://www.w3.org/2001/10/xml-exc-c14n#",
"saml.server.signature.keyinfo.xmlSigKeyInfoKeyNameTransformer": "NONE"
},
"protocolMappers": [
{
"name": "uid",
"protocol": "saml",
"protocolMapper": "saml-user-property-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "username",
"friendly.name": "uid",
"attribute.name": "uid"
}
},
{
"name": "lastname",
"protocol": "saml",
"protocolMapper": "saml-user-property-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "lastName",
"friendly.name": "lastname",
"attribute.name": "lastname"
}
},
{
"name": "id",
"protocol": "saml",
"protocolMapper": "saml-user-property-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "id",
"friendly.name": "id",
"attribute.name": "id"
}
},
{
"name": "email",
"protocol": "saml",
"protocolMapper": "saml-user-property-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "email",
"friendly.name": "email",
"attribute.name": "email"
}
},
{
"name": "firstname",
"protocol": "saml",
"protocolMapper": "saml-user-property-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "firstName",
"friendly.name": "firstname",
"attribute.name": "firstname"
}
}
],
"defaultClientScopes": [
"role_list"
],
"optionalClientScopes": [],
"access": {
"view": true,
"configure": true,
"manage": true
}
}
```