<commit_before>privacyidea module
==================

This module provides an authentication module for simpleSAMLphp to talk
to the privacyIDEA authentication server.

`privacyidea:privacyidea`
: Authenticate a user against a privacyidea server.

The module contacts the privacyIDEA server via the API

  https://privacyidea/validate/samlcheck
 
and authenticates the user according to the token assigned to the user.

The response can also contain some attributes.

To enable this module, create a file 'enable' in the
directorpy 'modules/privacyidea/'.


You can use this plugin in two different ways
Method 1) authenticate against privacyIDEA only
Method 2) authenticate the 1st factor against your authsource and the 2nd factor against privacyIDEA



Method 1
========


You need to add the authentication source 'privacyidea:privacyidea' to
'config/authsources.php'. Do it like this:

    'example-privacyidea' => array(
        'privacyidea:privacyidea',

        /* 
         * The URI (including protocol and port) of the privacyidea server
         * Required.
         */
        'privacyideaserver' => 'https://your.server.com',

        /*
         * Check if the hostname matches the name in the certificate
         * Optional.
         */
        'sslverifyhost' => False,

        /*
         * Check if the certificate is valid, signed by a trusted CA
         * Optional.
         */
        'sslverifypeer' => False,
        
        /*
         * The realm where the user is located in.
         * Optional.
         */
        'realm' => '',

        /*
         * OTP Extra
         * 0: (default) one password field for PIN and OTP
         * 1: Password field for password and extra field for OTP
         */
        'otpextra' => 1,
        
        /*
         * This is the translation from privacyIDEA attribute names to 
         * SAML attribute names.
         * Optional.
         */
         'attributemap' => array(
         			 'username' => 'samlLoginName',
         			 'surname' => 'surName',
         			 'givenname' => 'givenName',
         			 'email' => 'emailAddress',
         			 'phone' => 'telePhone',
         			 'mobile' => 'mobilePhone'
         			 ),

        /*
         * You are able to concatenate attributes like the given and surname.
         * Optional.
         */
         'concatenationmap' => array(
         			'givenname,surname' => 'fullName',
         			),

         /*
          * Here the detail attributes can be edited.
          * If they should not be listed, just remove them.
          * Optional.
          */
          'detailmap' => array(
          			 'message' => 'message',
          			 'type' => 'otpType',
          			 'serial' => 'otpSerial',
          			 'otplen' => 'otpLength'
          			 ),
    ),


User attributes
---------------
At the moment privacyIDEA will know and return the following attributes by default, 
that can be mapped to SAML attributes:

username:	The login name
surname:	The real world name of the user as it is retrieved from the user source
givenname:	The real world name of the user as it is retrieved from the user source
mobile:		The mobile phone number of the user as it is retrieved from the user source
phone:		The phone number of the user as it is retrieved from the user source
email:		The email address of the user as it is retrieved from the user source                                
                                
The list can be extended by including custom attributes in the attributemap. If the 
privacyIDEA server returns an attribute 'groups', you can map that to 'groups' if
you include it in the attributemap. Otherwise, it is discarded.




Method 2
========


If you want to use privacyIDEA as an auth proc filter, you have to change the config.php file.
Use the following example:

'authproc.idp' => array(

  // The number indicates the priority
  25 => array(

  // You must not change the class name
    'class'             => 'privacyidea:privacyidea',

  // Other authproc filters can disable 2FA if you want to.
  // If privacyIDEA should listen to the setting, you have to enter the state's path and key,
  // which will be edit by previous auth proc filters.
  // privacyIDEA will only be disabled, if the value of the key is set to false,
  // in any other situation (e.g. the key is not set or does not exist), privacyIDEA will be enabled.
    'enabledPath'       => '',
    'enabledKey'        => '',

  // This is the URL to your privacyidea server
    'privacyideaserver' => 'https://privacyidea.local',

  // Enter the realm, where your users are stored
    'realm'             => 'test',

  // The uidKey is the username's attribute key
    'uidKey'            => 'uid',<commit_msg>tune some wording<commit_after>privacyidea module
==================

This module provides an authentication module for simpleSAMLphp to talk
to the privacyIDEA authentication server.

`privacyidea:privacyidea`
: Authenticate a user against a privacyidea server.

The module contacts the privacyIDEA server via the API

  https://privacyidea/validate/samlcheck
 
and authenticates the user according to the token assigned to the user.

The response can also contain some attributes.

To enable this module, create a file 'enable' in the
directorpy 'modules/privacyidea/'.


You can use this plugin in two different ways
Method 1) authenticate against privacyIDEA only
Method 2) authenticate the 1st factor against your authsource and the 2nd factor against privacyIDEA



Method 1
========


You need to add the authentication source 'privacyidea:privacyidea' to
'config/authsources.php'. Do it like this:

    'example-privacyidea' => array(
        'privacyidea:privacyidea',

        /* 
         * The URI (including protocol and port) of the privacyidea server
         * Required.
         */
        'privacyideaserver' => 'https://your.server.com',

        /*
         * Check if the hostname matches the name in the certificate
         * Optional.
         */
        'sslverifyhost' => False,

        /*
         * Check if the certificate is valid, signed by a trusted CA
         * Optional.
         */
        'sslverifypeer' => False,
        
        /*
         * The realm where the user is located in.
         * Optional.
         */
        'realm' => '',

        /*
         * OTP Extra
         * 0: (default) one password field for PIN and OTP
         * 1: Password field for password and extra field for OTP
         */
        'otpextra' => 1,
        
        /*
         * This is the translation from privacyIDEA attribute names to 
         * SAML attribute names.
         * Optional.
         */
         'attributemap' => array(
         			 'username' => 'samlLoginName',
         			 'surname' => 'surName',
         			 'givenname' => 'givenName',
         			 'email' => 'emailAddress',
         			 'phone' => 'telePhone',
         			 'mobile' => 'mobilePhone'
         			 ),

        /*
         * You are able to concatenate attributes like the given and surname.
         * Optional.
         */
         'concatenationmap' => array(
         			'givenname,surname' => 'fullName',
         			),

         /*
          * Here the detail attributes can be edited.
          * If they should not be listed, just remove them.
          * Optional.
          */
          'detailmap' => array(
          			 'message' => 'message',
          			 'type' => 'otpType',
          			 'serial' => 'otpSerial',
          			 'otplen' => 'otpLength'
          			 ),
    ),


User attributes
---------------
At the moment privacyIDEA will know and return the following attributes by default, 
that can be mapped to SAML attributes:

username:	The login name
surname:	The real world name of the user as it is retrieved from the user source
givenname:	The real world name of the user as it is retrieved from the user source
mobile:		The mobile phone number of the user as it is retrieved from the user source
phone:		The phone number of the user as it is retrieved from the user source
email:		The email address of the user as it is retrieved from the user source                                
                                
The list can be extended by including custom attributes in the attributemap. If the 
privacyIDEA server returns an attribute 'groups', you can map that to 'groups' if
you include it in the attributemap. Otherwise, it is discarded.




Method 2
========


If you want to use privacyIDEA as an auth proc filter, you have to change the config.php file.
Use the following example:

'authproc.idp' => array(

  // The number indicates the priority
  25 => array(

  // You must not change the class name
    'class'             => 'privacyidea:privacyidea',

  // Other authproc filters can disable 2FA if you want to.
  // If privacyIDEA should listen to the setting, you have to enter the state's path and key.
  // The value of this key will be set by a previous auth proc filger.
  // privacyIDEA will only be disabled, if the value of the key is set to false,
  // in any other situation (e.g. the key is not set or does not exist), privacyIDEA will be enabled.
    'enabledPath'       => '',
    'enabledKey'        => '',

  // This is the URL to your privacyidea server
    'privacyideaserver' => 'https://privacyidea.local',

  // Enter the realm, where your users are stored
    'realm'             => 'test',

  // The uidKey is the username's attribute key
    'uidKey'            => 'uid',
{'fraction_non_alphanumeric': 0.08627946127946128, 'fraction_numerical': 0.0025252525252525255, 'mean_word_length': 2.107224583197123, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 59, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '311404', 'n_tokens_mistral': 2635, 'n_tokens_neox': 2449, 'n_words': 1086}