security/cy2-saml 1.11nb20 NetBSD

SASL is a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.

This package contains a SASL plugin that perform a crude check on a SAML authentication assertion. The assertion signature and date are verified, and access is granted on behalf ot the user taked for a onfigurable attribute.

The only protection against replay attacks is the assertion validity dates checks, this authentication is therefore secure only if the SAML authentication assertion remains secret. The assertion has the same role as a web cookie used for authentication.

Here is a PHP example of LDAP binding using www/ap2-auth-mellon: $saml_msg = $_SERVER["MELLON_SAML_RESPONSE"]; $userid = $_SERVER["REMOTE_USER"]; if (ldap_sasl_bind($ds, NULL, $saml_msg, "SAML", NULL, $userid, NULL, "none") == FALSE) { printf("ldap_sasl_bind() failed: %s", ldap_error($ds)); exit; }