Setting up Flarum
Flarum uses the flarum_saml extension in order to handle SAML2 authentication.
You must first install this extension on your instance, then enable the SAML2 SSO extension in the Administration panel and fill in the following parameters.
Identity Provider Metadata URL (Alternative to XML)
{{ url_for("sso.saml_metadata", service_uuid=service.uuid, _external=True) }}
NameID format
Persistent
Attribute to map the username to
urn:oid:0.9.2342.19200300.100.1.1
Sign authn requests?
Yes
Sign logout requests?
Yes
Sign logout responses?
Yes
Sign metadata?
Yes
Want Assertions Encrypted?
Not supported
Want Assertions Signed?
Not supported
Want Messages Signed?
Yes
Enable SLO? If your IDP does not support this, this will do nothing.
Yes
Use SAML2 SSO as only login option?
Remember to have an SAML user as Flarum admin if enabled
x509 Private Key (needed for signing, if enabled)
{{ "".join(service.config["sp_key"].strip().split("\n")[1:-1]) }}
x509 Certificate (needed for signing, if enabled)
{{ "".join(service.config["sp_cert"].strip().split("\n")[1:-1]) }}
{% include "application_saml.html" %}