Upgrade to new Gitlab Version 13.9 on Saturday 19th April 20:00. Expect an interruption of about 30 to 60 minutes

default-embedded-wayf.php 15.6 KB
Newer Older
1
<?php // Copyright (c) 2019, SWITCH?>
haemmer's avatar
haemmer committed
2

haemmer's avatar
haemmer committed
3 4 5 6
<!-- EMBEDDED-WAYF-START -->
<script type="text/javascript"><!--
// To use this JavaScript, please access:
// https://<?php echo $host ?><?php echo $path ?>/embedded-wayf.js/snippet.html
7
// and copy/paste the resulting HTML snippet to an unprotected web page that
haemmer's avatar
haemmer committed
8 9 10 11 12 13
// you want the embedded WAYF to be displayed


//////////////////// ESSENTIAL SETTINGS ////////////////////

// URL of the WAYF to use
haemmer's avatar
haemmer committed
14
// Examples: "https://wayf.example.org/SWITCHwayf/WAYF"
haemmer's avatar
haemmer committed
15 16 17 18
// [Mandatory]
var wayf_URL = "https://<?php echo $host ?><?php echo $path ?>";

// EntityID of the Service Provider that protects this Resource
haemmer's avatar
haemmer committed
19 20
// Value will be overwritten automatically if the page where the Embedded WAYF
// is displayed is called with a GET argument 'entityID' as automatically set by Shibboleth
haemmer's avatar
haemmer committed
21 22 23 24
// Examples: "https://econf.switch.ch/shibboleth", "https://dokeos.unige.ch/shibboleth"
// [Mandatory]
var wayf_sp_entityID = "https://my-app.switch.ch/shibboleth";

25 26
// Shibboleth Service Provider handler URL
// Examples: "https://point.switch.ch/Shibboleth.sso", "https://rr.aai.switch.ch/aaitest/Shibboleth.sso"
haemmer's avatar
haemmer committed
27 28 29
// [Mandatory, if wayf_use_discovery_service = false]
var wayf_sp_handlerURL = "https://my-app.switch.ch/Shibboleth.sso";

haemmer's avatar
haemmer committed
30
// URL on this resource that the user should be returned to after authentication
haemmer's avatar
haemmer committed
31 32 33 34 35 36 37 38
// Examples: "https://econf.switch.ch/aai/home", "https://olat.uzh.ch/my/courses"
// [Mandatory]
var wayf_return_url = "https://my-app.switch.ch/aai/index.php?page=show_welcome";


//////////////////// RECOMMENDED SETTINGS ////////////////////

// Width of the embedded WAYF in pixels or "auto"
39 40
// This is the width of the content only (without padding and border).
// Add 2 x (10px + 1px) = 22px for padding and border to get the actual
41
// width of everything that is drawn.
haemmer's avatar
haemmer committed
42
// [Optional, default: "auto"]
43
// var wayf_width  = 250;
haemmer's avatar
haemmer committed
44 45

// Height of the embedded WAYF in pixels or "auto"
46 47
// This is the height of the content only (without padding and border).
// Add 2 x (10px + 1px) = 22px for padding and border to get the actual
48
// height of everything that is drawn.
haemmer's avatar
haemmer committed
49
// [Optional, default: "auto"]
50
// Example for fixed size:
51
// var wayf_height = 150;
haemmer's avatar
haemmer committed
52 53 54

// Whether to show the checkbox to remember settings for this session
// [Optional, default: true]
haemmer's avatar
haemmer committed
55
//var wayf_show_remember_checkbox = true;
haemmer's avatar
haemmer committed
56

57 58 59 60 61
// Hide the Logo
// If true, no logo is shown
// [Optional, default: false]
// var wayf_hide_logo = false;

haemmer's avatar
haemmer committed
62
// Logo size
haemmer's avatar
haemmer committed
63
// Choose whether the small or large logo should be used
haemmer's avatar
haemmer committed
64
// [Optional, default: true]
haemmer's avatar
haemmer committed
65
//var wayf_use_small_logo = true;
haemmer's avatar
haemmer committed
66 67 68

// Font size
// [Optional, default: 12]
haemmer's avatar
haemmer committed
69
//var wayf_font_size = 12;
haemmer's avatar
haemmer committed
70

haemmer's avatar
haemmer committed
71
// Font color as CSS color value, e.g. 'black' or '#000000'
haemmer's avatar
haemmer committed
72
// [Optional, default: #000000]
haemmer's avatar
haemmer committed
73
//var wayf_font_color = '#000000';
haemmer's avatar
haemmer committed
74

haemmer's avatar
haemmer committed
75
// Border color as CSS color value, e.g. 'black' or '#000000'
76
// [Optional, default: #848484]
haemmer's avatar
haemmer committed
77
//var wayf_border_color = '#848484';
haemmer's avatar
haemmer committed
78

haemmer's avatar
haemmer committed
79
// Background color as CSS color value, e.g. 'black' or '#000000'
80
// [Optional, default: #F0F0F0]
haemmer's avatar
haemmer committed
81
//var wayf_background_color = '#F0F0F0';
haemmer's avatar
haemmer committed
82 83 84 85

// Whether to automatically log in user if he has a session/permanent redirect
// cookie set at central wayf
// [Optional, default: true]
haemmer's avatar
haemmer committed
86
//var wayf_auto_login = true;
haemmer's avatar
haemmer committed
87 88

// Whether to hide the WAYF after the user was logged in
89
// This requires that the _shib_session_* cookie is set when a user
haemmer's avatar
haemmer committed
90 91 92 93
// could be authenticated, which is the default case when Shibboleth is used.
// For other Service Provider implementations have a look at the setting
// wayf_check_login_state_function that allows you to customize this
// [Optional, default: true]
haemmer's avatar
haemmer committed
94
// var wayf_hide_after_login = true;
haemmer's avatar
haemmer committed
95 96 97 98

// Whether or not to show the categories in the drop-down list
// Possible values are: true or false
// [Optional, default: true]
haemmer's avatar
haemmer committed
99
// var wayf_show_categories =  true;
haemmer's avatar
haemmer committed
100

101
// Most used Identity Providers will be shown as top category in the drop down
haemmer's avatar
haemmer committed
102
// list if this feature is used.
103
// Will not be shown if wayf_show_categories is false
104
// [Optional, default: none]
105
// var wayf_most_used_idps =  new Array("https://aai-logon.unibas.ch/idp/shibboleth", "https://aai.unil.ch/idp/shibboleth");
haemmer's avatar
haemmer committed
106

haemmer's avatar
haemmer committed
107
// Categories of Identity Provider that should not be shown
haemmer's avatar
haemmer committed
108
// Possible values are: <?php echo $types ?>, "all"
109 110
// Example of how to hide categories
// var wayf_hide_categories =  new Array("other", "library");
111
// [Optional, default: none]
haemmer's avatar
haemmer committed
112 113
// var wayf_hide_categories =  new Array();

haemmer's avatar
haemmer committed
114
// EntityIDs of Identity Provider whose category is hidden but that should be shown anyway
haemmer's avatar
haemmer committed
115
// Example of how to unhide certain Identity Providers
116
// var wayf_unhide_idps = new Array("https://aai-login.uzh.ch/idp/shibboleth");
117
// [Optional, default: none]
haemmer's avatar
haemmer committed
118 119
// var wayf_unhide_idps = new Array();

haemmer's avatar
haemmer committed
120
// EntityIDs of Identity Provider that should not be shown at all
haemmer's avatar
haemmer committed
121
// Example of how to hide certain Identity Provider
haemmer's avatar
haemmer committed
122
// var wayf_hide_idps = new Array("https://idp.unige.ch/idp/shibboleth", "https://aai-logon.switch.ch/idp/shibboleth");
123
// [Optional, default: none]
haemmer's avatar
haemmer committed
124 125 126 127
// var wayf_hide_idps = new Array();

//////////////////// ADVANCED SETTINGS ////////////////////

haemmer's avatar
haemmer committed
128
// Use the SAML2/Shibboleth 2 Discovery Service protocol where
129 130
// the user is sent back to the Service Provider after selection
// of his Home Organisation.
131
// This feature should only be uncommented and set to false if there
132
// is a good reason why to use the old and deprecated Shibboleth WAYF
133
// protocol instead.
134
// [Optional, default: true]
135
// var wayf_use_discovery_service = false;
haemmer's avatar
haemmer committed
136

137 138
// If enabled, the Embedded WAYF will activate the
// improved drop down list feature, which will transform the list of
139
// organisations into a search-field while keeping its original function as
140
// a select list. To make this work, the JQuery library will dynamically be
141 142
// loaded if it is not yet present. Additionally, another Javascript and CSS
// file are loaded to perform the actual transformation.
143 144 145 146
// Please note that this feature will also display the organisations' logos,
// which might be loaded from a remote domain. While generally not especially
// dangerous, there is always a risk when loading content (in this case
// images) from third party hosts.
haemmer's avatar
haemmer committed
147
// [Optional, default: false]
haemmer's avatar
haemmer committed
148
// var wayf_use_improved_drop_down_list = false;
haemmer's avatar
haemmer committed
149

150 151
// Whether or not use Select2 drop down
// Attention: setting this to true, overrides $useImprovedDropDownList param
152 153 154
// For this to fully work, one must also add useSelect2 query Param to the
// embedded-wayf.js script loading URL.
// Page size is contrrolled by WAYF server directly.
155 156
// var wayf_use_select2 = false;

haemmer's avatar
haemmer committed
157 158 159
// If true the improved drop-down-list will not display IdP logos that
// have to be loaded from remote URLs. That way the web browser
// does not have to make requests to third party hosts.
160
// Logos that are embedded using data URIs
haemmer's avatar
haemmer committed
161 162 163 164 165 166
// (src="data:image/png;base64...") will however still be displayed
// Don't confuse this with wayf_hide_logo, which shows or hides
// the logo of this WAYF instance
// [Optional, default: false]
//  wayf_disable_remote_idp_logos = false;

Lukas Haemmerle's avatar
Lukas Haemmerle committed
167 168
// If true the improved drop-down-list automatic filtering
// of entries while typing content in the search box will
169
// allow matching IdPs either by their name or entityID,
Lukas Haemmerle's avatar
Lukas Haemmerle committed
170 171 172 173
// whereas otherwise only the name is considered
// [Optional, default: true]
// wayf_enable_entityid_matching = true;

haemmer's avatar
haemmer committed
174 175 176 177
// Force the user's Home Organisation selection to be remembered for the
// current browser session. If wayf_show_remember_checkbox is true
// the checkbox will be shown but will be read only.
// WARNING: Only use this feature if you know exactly what you are doing
178
//          This option will cause problems that are difficult to find
haemmer's avatar
haemmer committed
179
//          in case they accidentially select a wrong Home Organisation
haemmer's avatar
haemmer committed
180
// [Optional, default: false]
haemmer's avatar
haemmer committed
181 182
//var wayf_force_remember_for_session = false;

haemmer's avatar
haemmer committed
183
// Session Initiator URL of the Service Provider
haemmer's avatar
haemmer committed
184
// Examples: "https://interact.switch.ch/Shibboleth.sso/Login", "https://dokeos.unige.ch/Shibboleth.sso/DS"
185
// This will implicitely be set to wayf_sp_samlDSURL = wayf_sp_handlerURL + "/Login";
haemmer's avatar
haemmer committed
186 187
// or will be set automatically if the page where the Embedded WAYF is placed is called
// with a 'return' and an 'entityID' GET Arguments
188
// [Optional, if wayf_use_discovery_service = true
189
//  or if wayf_additional_idps is not empty, default: wayf_sp_handlerURL + "/Login"]
haemmer's avatar
haemmer committed
190 191 192 193
// var wayf_sp_samlDSURL = wayf_sp_handlerURL + "/Login";

// Default IdP to preselect when central WAYF couldn't guess IdP either
// This is usually the case the first time ever a user accesses a resource
194
// [Optional, default: none]
haemmer's avatar
haemmer committed
195
// var wayf_default_idp = "https://aai-logon.switch.ch/idp/shibboleth";
haemmer's avatar
haemmer committed
196

197
// Number of last used IdPs to show
198
// Will not be shown if wayf_show_categories is false
199 200 201 202
// Set to 0 to deactivate
// [Optional, default: 3]
// var wayf_num_last_used_idps = 3;

haemmer's avatar
haemmer committed
203 204
// Set a custom Assertion Consumer URL instead of
// the default wayf_sp_handlerURL + '/SAML/POST'
205
// Only relevant if wayf_use_discovery_service is false and SAML1 is used.
haemmer's avatar
haemmer committed
206
// Examples: "https://my-app.switch.ch/custom/saml-implementation/samlaa"
haemmer's avatar
haemmer committed
207
// This will implicitely be set to wayf_sp_samlACURL = wayf_sp_handlerURL + "/SAML/POST";
208
// [Optional, default: wayf_sp_handlerURL + "/SAML/POST"]
haemmer's avatar
haemmer committed
209
// var wayf_sp_samlACURL = "https://my-app.switch.ch/custom/saml-implementation/samlaa";
haemmer's avatar
haemmer committed
210 211 212

// Overwites the text of the checkbox if
// wayf_show_remember_checkbox is set to true
213
// [Optional, default: none]
haemmer's avatar
haemmer committed
214 215 216
// var wayf_overwrite_checkbox_label_text = 'Save setting for today';

// Overwrites the text of the submit button
217
// [Optional, default: none]
haemmer's avatar
haemmer committed
218 219 220
// var wayf_overwrite_submit_button_text = 'Go';

// Overwrites the intro text above the drop-down list
221
// [Optional, default: none]
haemmer's avatar
haemmer committed
222 223
// var wayf_overwrite_intro_text = 'Select your Home Organisation to log in';

224
// Overwrites the category name of the most used IdP category in the drop-down list
225
// [Optional, default: none]
226 227
// var wayf_overwrite_most_used_idps_text = 'Most popular';

228 229 230
// Overwrites the category name of the last used IdP category in the drop-down list
// [Optional, default: none]
// var wayf_overwrite_last_used_idps_text = 'Previously used';
231

232 233 234 235
// Overwrites the category name of IdPs from other federations in the drop-down list
// [Optional, default: none]
// var wayf_overwrite_from_other_federations_text = 'Other organisations';

haemmer's avatar
haemmer committed
236
// Whether to hide the WAYF after the user was logged in
237
// This requires that the _shib_session_* cookie is set when a user
haemmer's avatar
haemmer committed
238 239 240
// could be authenticated
// If you want to hide the embedded WAYF completely, uncomment
// the property and set it to "". This then won't draw anything
241
// [Optional, default: none]
haemmer's avatar
haemmer committed
242 243
// var wayf_logged_in_messsage = "";

haemmer's avatar
haemmer committed
244 245
// If the user is already logged in and this variable is set to true, the WAYF
// will automatically redirect the user to the URL set in wayf_return_url.
246
// If the WAYF is embedded on a dedicated login page, this value should be set
haemmer's avatar
haemmer committed
247 248 249 250
// to true. Else, it should be left at its default value 'false'.
// [Optional, default: false]
// var wayf_auto_redirect_if_logged_in = true;

haemmer's avatar
haemmer committed
251 252 253
// Provide the name of a JavaScript function that checks whether the user
// already is logged in. The function should return true if the user is logged
// in or false otherwise. If the user is logged in, the Embedded WAYF will
254
// hide itself or draw a custom message depending on the
255 256 257
// setting wayf_logged_in_messsage. The default check will access a Shibboleth
// session handler which typically is found at /Shibboleth.sso/Session.
// [Optional, default: none]
258
// var wayf_check_login_state_function = function() {
haemmer's avatar
haemmer committed
259 260
// if (# specify user-is-logged-in condition#)
//   return true;
261
// else
haemmer's avatar
haemmer committed
262 263 264
//   return false;
// }

265 266
// EntityIDs, Names and SSO URLs of Identity Providers from other federations
// that should be added to the drop-down list.
haemmer's avatar
haemmer committed
267 268 269 270 271 272 273
// name: Name of the Identity Provider to display
// entityID: SAML entityID/providerID of this Identity Provider
// SAML1SSOurl: Endpoint for the SAML1 SSO handler
// logoURL: URL or inline image data of that IdP. Image must be a 16x16 pixel image
//          and it should be loaded from an HTTPS URL. Otherwise IE and other
//          browsers complain
// data: Non-visible data that may be used to find this Identity Provider when the
274 275
//       improve drop-down feature is enabled. This string for example can  include
//       the domain names, abbreviations, localities or alternative names of the
haemmer's avatar
haemmer committed
276
//       organisation. Basically, anything the user could use to search his institution.
277
//
haemmer's avatar
haemmer committed
278
// The IdPs will be displayed in the order they are defined
279
// [Optional, default: none]
haemmer's avatar
haemmer committed
280 281 282
// var wayf_additional_idps = [ ];

// Example of how to add Identity Provider from other federations
283 284
// var wayf_additional_idps = [
//
haemmer's avatar
haemmer committed
285
//        {name:"International University X",
haemmer's avatar
haemmer committed
286
//        entityID:"urn:mace:example.org:example.university.org",
haemmer's avatar
haemmer committed
287 288
//        SAML1SSOurl:"https://int.univ.org/shibboleth-idp/SSO",
//        logoURL:"https://int.univ.org/favicon.ico",
289
//        data:"univ.org université intérnationale X"},
haemmer's avatar
haemmer committed
290 291 292
//
//        {name:"Some Other University",
//        entityID:"https://other.univ.edu/idp/shibboleth",
haemmer's avatar
haemmer committed
293 294
//        SAML1SSOurl:"https://other.univ.edu/shibboleth-idp/SSO",
//        logoURL:"https://other.univ.edu/favicon.ico",
295
//        data:"other.univ.org autre université intérnationale X"},
haemmer's avatar
haemmer committed
296 297 298
// ];


haemmer's avatar
haemmer committed
299
// Whether to load Identity Providers from the Discovery Feed provided by
300 301
// the Service Provider.
// IdPs that are not listed in the Discovery Feed and that the SP therefore is
302 303
// not  are able to accept assertions from, are hidden by the Embedded WAYF
// IdPs that are in the Discovery Feed but are unknown to the SWITCHwayf
304
// are added to the wayf_additional_idps.
305
// The list wayf_additional_idps will be sorted alphabetically
306
// The SP must have configured the discovery feed handler that generates a
307
// JSON object. Otherwise it won't generate the JSON data containing the IdPs.
308 309
// [Optional, default: false]
// var wayf_use_disco_feed = false;
haemmer's avatar
haemmer committed
310 311

// URL where to load the Discovery Feed from in case wayf_use_disco_feed is true
312
// [Optional, default: none]
313
// var wayf_discofeed_url = "/Shibboleth.sso/DiscoFeed";
haemmer's avatar
haemmer committed
314 315


haemmer's avatar
haemmer committed
316 317 318
//////////////////// ADDITIONAL CSS CUSTOMIZATIONS ////////////////////

// To further customize the appearance of the Embedded WAYF you could
319
// define CSS rules for the following CSS IDs that are used within the
haemmer's avatar
haemmer committed
320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
// Embedded WAYF:
// #wayf_div                     - Container for complete Embedded WAYF
// #wayf_logo_div                - Container for logo
// #wayf_logo                    - Image for logo
// #wayf_intro_div               - Container of drop-down list intro label
// #wayf_intro_label             - Label of intro text
// #IdPList                      - The form element
// #user_idp                     - Select element for drop-down list
// #wayf_remember_checkbox_div   - Container of checkbox and its label
// #wayf_remember_checkbox       - Checkbox for remembering settings for session
// #wayf_remember_checkbox_label - Text of checkbox
// #wayf_submit_button           - Submit button
//
// Use these CSS IDs carefully and at own risk because future updates could
// interfere with the rules you created and the IDs may change without notice!


//-->
</script>
339 340
<!-- To fully enable select2, one have to add useSelect2 query param: --> 
<!-- <script type="text/javascript" src="https://<?php echo $host ?><?php echo $path ?>/embedded-wayf.js?useSelect2=true"></script> -->
haemmer's avatar
haemmer committed
341 342 343
<script type="text/javascript" src="https://<?php echo $host ?><?php echo $path ?>/embedded-wayf.js"></script>

<noscript>
344 345 346 347
  <!--
  Fallback to Shibboleth DS Session Initiator for non-JavaScript users
  Value of the target GET parameter should be set to an URL-encoded
  absolute URL that points to a Shibboleth protected web page where the user
haemmer's avatar
haemmer committed
348 349 350
  is logged in into your application.
  -->
  <p>
haemmer's avatar
haemmer committed
351
    <strong>Login:</strong> Javascript is not enabled for your web browser. Please use the <a href="/Shibboleth.sso/Login?target=">non-Javascript Login</a>.
haemmer's avatar
haemmer committed
352 353 354 355
  </p>
</noscript>

<!-- EMBEDDED-WAYF-END -->