<commit_before>privacyidea module
==================

This module provides an authentication module for simpleSAMLphp to talk to the privacyIDEA authentication server.

The module contacts the privacyIDEA server via the API

https://privacyidea/validate/check

and authenticates the user according to the token assigned to the user.

The response can also contain some attributes.

You can use this plugin in two different ways Method 1) authenticate against privacyIDEA only Method 2) authenticate the
1st factor against your authsource and the 2nd factor against privacyIDEA

NOTE: This plugin is enabled by default, you do not need to enable it manually.

Method 1 (authsource)
========


You need to add the authentication source 'privacyidea' to
'config/authsources.php'. Do it like this:

```PHP
'example-privacyidea' => array(
    'privacyidea:PrivacyideaAuthSource',

    /* 
     * The URI (including protocol and port) of the privacyidea server
     * Required.
     */
    'privacyideaServerURL' => 'https://your.server.com',

    /*
     * Check if the hostname matches the name in the certificate.
     * The value have to be a string.
     * Optional.
     */
    'sslVerifyHost' => 'false',

    /*
     * Check if the certificate is valid, signed by a trusted CA.
     * The value have to be a string.
     * Optional.
     */
    'sslVerifyPeer' => 'false',
        
    /*
     * The realm where the user is located in.
     * Optional.
     */
    'realm' => '',
    
    /**
     *  Here you need to enter the username of your service account
     */
    'serviceAccount'    => 'service',

    /**
     *  Enter here the password for your service account
     */
    'servicePass'       => '<PASSWORD>',
    
    /**
     *  Set this to 'true' to trigger challenges prior to the login 
     *  using the configured service account. 
     *  This setting takes precedence over 'doSendPassword'.
     *  The value have to be a string.
     */
    'doTriggerChallenge' => 'true',
    
    /**
     *  Set this to 'true' to send a request to validate/check with the username
     *  and an empty pass prior to the login. 
     *  This can be used to trigger challenges depending on the configuration in privacyIDEA 
     *  and requires no service account. If 'doTriggerChallenge' is enabled, this setting has no effect.
     *  The value have to be a string.
     */
    'doSendPassword' => 'true',
    
    /**
     * Set custom hints for the OTP and password fields
     */
    'otpFieldHint' => 'OTP'
    'passFieldHint' => 'Password'

    /*
     * This is the translation from privacyIDEA attribute names to 
     * SAML attribute names.
     * Optional.
     */
    'attributemap' => array(
        'username' => 'samlLoginName',
        'surname' => 'surName',
        'givenname' => 'givenName',
        'email' => 'emailAddress',
        'phone' => 'telePhone',
        'mobile' => 'mobilePhone'
    ),

    /*
     * You are able to concatenate attributes like the given and surname.
     * Optional.
     */
    'concatenationmap' => array(
        'givenname,surname' => 'fullName',
    ),

    /*<commit_msg>Update privacyidea.md<commit_after>privacyidea module
==================

This module provides an authentication module for simpleSAMLphp to talk to the privacyIDEA authentication server.

The module contacts the privacyIDEA server via the API

https://privacyidea/validate/check

and authenticates the user according to the token assigned to the user.

The response can also contain some attributes.

You can use this plugin in two different ways Method 1) authenticate against privacyIDEA only Method 2) authenticate the
1st factor against your authsource and the 2nd factor against privacyIDEA

NOTE: This plugin is enabled by default, you do not need to enable it manually.

Method 1 (authsource)
========


You need to add the authentication source 'privacyidea' to
'config/authsources.php'. Do it like this:

```PHP
'example-privacyidea' => array(
    'privacyidea:PrivacyideaAuthSource',

    /* 
     * The URI (including protocol and port) of the privacyidea server
     * Required.
     */
    'privacyideaServerURL' => 'https://your.server.com',

    /*
     * Check if the hostname matches the name in the certificate.
     * The value have to be a string.
     * Optional.
     */
    'sslVerifyHost' => 'false',

    /*
     * Check if the certificate is valid, signed by a trusted CA.
     * The value have to be a string.
     * Optional.
     */
    'sslVerifyPeer' => 'false',
        
    /*
     * The realm where the user is located in.
     * Optional.
     */
    'realm' => '',
    
    /**
     *  Here you need to enter the username of your service account
     */
    'serviceAccount'    => 'service',

    /**
     *  Enter here the password for your service account
     */
    'servicePass'       => '<PASSWORD>',
    
    /**
     *  Set this to 'true' to trigger challenges prior to the login 
     *  using the configured service account. 
     *  This setting takes precedence over 'doSendPassword'.
     *  The value have to be a string.
     */
    'doTriggerChallenge' => 'true',
    
    /**
     *  Set this to 'true' to send a request to validate/check with the username
     *  and an empty pass prior to the login. 
     *  This can be used to trigger challenges depending on the configuration in privacyIDEA 
     *  and requires no service account. If 'doTriggerChallenge' is enabled, this setting has no effect.
     *  The value have to be a string.
     */
    'doSendPassword' => 'true',
    
    /**
     * Set custom hints for the OTP and password fields
     */
    'otpFieldHint' => 'OTP',
    'passFieldHint' => 'Password',

    /*
     * This is the translation from privacyIDEA attribute names to 
     * SAML attribute names.
     * Optional.
     */
    'attributemap' => array(
        'username' => 'samlLoginName',
        'surname' => 'surName',
        'givenname' => 'givenName',
        'email' => 'emailAddress',
        'phone' => 'telePhone',
        'mobile' => 'mobilePhone'
    ),

    /*
     * You are able to concatenate attributes like the given and surname.
     * Optional.
     */
    'concatenationmap' => array(
        'givenname,surname' => 'fullName',
    ),

    /*
{'fraction_non_alphanumeric': 0.10038180082723512, 'fraction_numerical': 0.001590836780146357, 'mean_word_length': 2.4715626725565985, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 45, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6844309', 'n_tokens_mistral': 1789, 'n_tokens_neox': 1718, 'n_words': 687}