in WP è possibile definire il ruolo di difetto per tutti i nuovi utenti; in #1 si propone di permettere l'override di questa impostazione per gli utenti creati dal plugin SPID; questo settaggio però dovrebbe essere opzionale in modo che se non viene impostato li crea con il ruolo default globale ...

... rather than http://example.com/wp-login.php?sso=spid&metadata

let's use the spid_ prefix; examples of SPID attributes:

• spid_placeOfBirth
• spid_countryOfBirth
• spid_dateOfBirth
• spid_gender
• spid_fiscalNumber
• spid_idCard
• spid_mobilePhone
• spid_address
• spid_expirationDate
• spid_digitalAddress

A user may gain access to a WP install once with her SPID login, then loose access / change her SPID login.
After a year, by resetting her WP password she could login with a regular WordPress user/pass, bypassing SPID, and her SPID attributes would not be refreshed (see #57).

To avoid these situations, on login with regular WP user/pass, if the user is detected as a SPID user (has a spidCode in metadata), we need to force SPID login !

once #13 and #31 are solved, we need to refresh the SPID attributes with each login

SPID credentials can be modified, as this SPID profile management screenshot for one of the production IdPs shows:

there are plugins that show any usermeta in the users table, so this may even be addressed by checking that we can use one of them, and documenting that in the README

Should these external scripts be loaded internally? I worry that changes to spid-button.min.js may break functionality in the future for the plugin or if the location of the file moves. We can push an update to the plugin but we all know people may take awhile to update. spid-smart-button looks like it's still in early development and doesn't appear to be versioned yet too. Thoughts?

dopo il 1 login SPID viene creato l'utente WP; dopodichè l'utente potrà bypassare il login SPID creandosi una password e accedendo col login WP normale ? ma in tal caso ai login successivi non avremmo più la garanzia SPID e gli eventuali attributi non verebbero aggiornati ! sarebbe una cosa da disabilitare ?

also see #14

is this feasible ? how much effort does it require ?

for comparison, the excellent https://github.com/discourse/wp-discourse does not support multi-site WP ...

A default value for the entityId of the test IdP is currenty hardwired here:
https://github.com/simevo/spid-wordpress/blob/master/templates/spid-button.php#L44

While this setting is OK for the usual docker-compose setup we use in development, it will not work for most people.

The sp_idp option has been envisaged to allow entering the entityId of the actual test IdP instace used. The code above should use that option.

write in clear letters that if the plugin user chooses to store user data in WP, she is bound by the GDPR to take care of these data, respond to user requests for access and deletion, and reporting breeches

the reported error is:

  | <b>Fatal error</b>:  Uncaught Exception: Invalid Response. Response must contain at least one signature in /var/www/html/wp-content/plugins/spid-wordpress/vendor/italia/spid-php-lib/src/Spid/Saml/In/BaseResponse.php:62
  | Stack trace:
  | #0 /var/www/html/wp-content/plugins/spid-wordpress/vendor/italia/spid-php-lib/src/Spid/Saml.php(152): Italia\Spid\Spid\Saml\In\BaseResponse-&gt;validate('-----BEGIN CERT...')
  | #1 [internal function]: Italia\Spid\Spid\Saml-&gt;isAuthenticated()
  | #2 /var/www/html/wp-content/plugins/spid-wordpress/vendor/italia/spid-php-lib/src/Sp.php(36): call_user_func_array(Array, Array)
  | #3 /var/www/html/wp-content/plugins/spid-wordpress/src/SpidWordPress.php(110): Italia\Spid\Sp-&gt;__call('isAuthenticated', Array)
  | #4 /var/www/html/wp-includes/class-wp-hook.php(286): SpidWordPress-&gt;filterAuthenticate(Object(WP_Error), '', '')
  | #5 /var/www/html/wp-includes/plugin.php(203): WP_Hook-&gt;apply_filters(Object(WP_Error), Array)
  | #6 /var/www/html/wp-includes/pluggable.php(532): apply_filters('authenticate', NULL, '', '')
  | #7 /var/www/html/wp in <b>/var/www/html/wp-content/plugins/spid-wordpress/vendor/italia/spid-php-lib/src/Spid/Saml/In/BaseResponse.php</b> on line <b>62</b><br />

what happens is that the IdP login page performs a POST http://localhost:8088/login (IdP) even if the user cancels, and that bounces back to POST http://localhost:8099/wp-login.php?sso=spid (SP) with a SAMLResponse that can be decoded to:

<?xml version="1.0"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" InResponseTo="_9b1221a863b662e9afb69278d1521a2b" ID="id_fd3480cd927ab80f40df1ea3d30803743b0db22b" Version="2.0" Destination="http://localhost:8099/wp-login.php?sso=spid" IssueInstant="2018-10-12T12:44:01Z">
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
    <samlp:StatusMessage>ErrorCode nr22</samlp:StatusMessage>
  </samlp:Status>
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" NameQualifier="http://localhost:8088" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://localhost:8088</saml:Issuer>
</samlp:Response>

not sure if this should be forwarded to spid-php-lib or testenv2 ....

if you log onto WP with this plugin then logout, the SPID session will stay open

trying to login again breaks it !

we should call $this->auth->logout()

when we will tag a release, github will make zip and tar.gz downloads available under releases

we do not want ship certain files with those distributables, for example composer.json and composer.lock which are meaningless to people not involved in the plugin development

within spid-php-lib we have successfully used the .gitattributes file to achieve that effect

Let's discuss the options for languages and translations

try this:

composer install
./vendor/bin/phpcs includes/class-spid-core.php 
...

while setting up travis (#39) I stumbled upon this https://travis-ci.com/simevo/spid-wordpress/jobs/153619905

$ composer install --no-interaction
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Your requirements could not be resolved to an installable set of packages.
  Problem 1
    - Installation request for doctrine/instantiator 1.1.0 -> satisfiable by doctrine/instantiator[1.1.0].
    - doctrine/instantiator 1.1.0 requires php ^7.1 -> your PHP version (7.0.25) does not satisfy that requirement.
  Problem 2
    - Installation request for myclabs/deep-copy 1.8.1 -> satisfiable by myclabs/deep-copy[1.8.1].
    - myclabs/deep-copy 1.8.1 requires php ^7.1 -> your PHP version (7.0.25) does not satisfy that requirement.
  Problem 3
    - doctrine/instantiator 1.1.0 requires php ^7.1 -> your PHP version (7.0.25) does not satisfy that requirement.
    - phpunit/phpunit-mock-objects 5.0.10 requires doctrine/instantiator ^1.0.5 -> satisfiable by doctrine/instantiator[1.1.0].
    - Installation request for phpunit/phpunit-mock-objects 5.0.10 -> satisfiable by phpunit/phpunit-mock-objects[5.0.10].

when a SPID used logs to WP for the 1st time, a WP user is created; if this user logs out (beware #12 !) then tries to login again she gets "Questo nome utente esiste già!" (this username already exists):

at the end pf the docker-compose procedure when I visit the SP metadata endpoint http://localhost:8099/wp-login.php?sso=spid&metadata instead of the XML I get to see this:

This page contains the following errors:
error on line 2 at column 1: Extra content at the end of the document
Below is a rendering of the page up to the first error.

to reproduce, just make wp.key unaccessible to the docker_wp container with:

chmod 600 wp.key

to fix it, revert that:

chmod 644 wp.key

this is known to spid-php.lib as: italia/spid-php-lib#27

I am reading from the official docs, https://spid-regole-tecniche.readthedocs.io/en/latest/metadata.html:
I metadata dei Service Provider saranno disponibili per tutte le entità SPID federate attraverso la URL https:///metadata
(Service Provider metadata will be available for all SPID entities through the URL https:///metadata)
Problem: a WP plugin (or a Drupal module, etc) cannot write in the root folder.
Can we assume this rule is NOT strict and we can provide our own metadata url?

make step fails:

# Configure SP
openssl req -x509 -nodes -sha256 -days 365 -newkey rsa:2048 -subj "/C=IT/ST=Italy/L=Rome/O=myservice/CN=localhost" -keyout wp.key -out wp.crt
...
chmod u+r wp.key
envsubst < config.php.tpl > config.php
/bin/sh: envsubst: command not found
make: *** [all] Error 127

see: https://stackoverflow.com/questions/23620827/envsubst-command-not-found-on-mac-os-x-10-8

questo dovrebbe essere aggiunto al README per macOS:

brew install gettext
brew link --force gettext

Formatting:

• spid logo

Metadata-impacting settings:

• OrganizationName, OrganizationDisplayName, OrganizationURL
• gli attributi che ci vogliamo far dare: elenco degli attributi standard SPID con checkbox attiva / disattiva
• bottone "Configura plugin", vedi #22

spiegare all'utente che se cambia uno di questi 2 settaggi deve ridistribuire il metadata del SP a tutti gli IdP, dal metadata link (attualmente http://localhost:8099/wp-login.php?sso=spid&metadata che tra l'altro è bruttino)

WP Plugin config:

• SPID level (1 or 2)
• IdP selection: checkbox to activate / deactivate available IdPs (dai files presenti in idp_metadata)
• what WP role the new user should be assigned to (i.e. Subscriber)

spid-php-lib depends on https://packagist.org/packages/robrichards/xmlseclibs

currently spid-php-lib/vendor is missing therefore the library cannot work

the current install procedure of the spid-php-lib and consequently of this plugin requires generating the SP certificates in a preconfiguration step which can be automated but requires CLI access anyway

in the spirit of keeping WP webmasters free from any kind of coding/CLI duties, we should make it possible to complete this step with a simple button click from the configuration page

detailed requirements

When the plugin is first activated from WP plugin management, but no SP certificates are found, it should be in the "unconfigured" state, i.e show the SPID button disabled (grayed out and doesn't react on click) and in the config page it should say "Il plugin deve ancora essere configurato"

To do that a botton is available: <button>Configura plugin</button>; this is a metadata-impacting change and should be shown in the separate area of the config page where the other metadata-impacting settings are.

When the SP certificates are found, on clicking on the "Configura plugin" button it should additionally present a modal pop-up saying "Attenzione stai per sovrascrivere i certificati ! Questo invaliderà il metadata corrente"

Implementation

we need support from spid-smart-button and from spid-php-lib

• in spid-smart-button we need an API to disable the button
• in spid-php-lib we need two new functions in the Italia\Spid\Sp class:
  • isConfigured() returns true if the SP certificates are found where the $settings says they are, and they are valid (i.e. the plugin has been configured correctly)
  • generateCerts($ountryName, stateName, localityName, commonName, emailAddress): generates with openssl the certificates where the $settings says they should be

on trying to complete round trip I get:

  | <br />
-- | --
  | <b>Fatal error</b>:  Uncaught Error: Class 'RobRichards\XMLSecLibs\Utils\XPath' not found in /var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php:493
  | Stack trace:
  | #0 /var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php(591): RobRichards\XMLSecLibs\XMLSecurityDSig-&gt;processRefNode(Object(DOMElement))
  | #1 /var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/src/Spid/Saml/SignatureUtils.php(96): RobRichards\XMLSecLibs\XMLSecurityDSig-&gt;validateReference()
  | #2 /var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/src/Spid/Saml/In/BaseResponse.php(95): Italia\Spid\Spid\Saml\SignatureUtils::validateXmlSignature(Object(DOMElement), '-----BEGIN CERT...')
  | #3 /var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/src/Spid/Saml.php(191): Italia\Spid\Spid\Saml\In\BaseResponse-&gt;validate('-----BEGIN CERT...')
  | #4 [internal function]: Italia\Spid\Spid\Saml-&gt;isAuthenticated()
  | #5 /var/www/html/wp-content/plug in <b>/var/www/html/wp-content/plugins/spid-wordpress/spid-php-lib/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php</b> on line <b>493</b><br />

Let's talk about what will go in the admin settings page. I made this https://balsamiq.cloud/syds1m/p1djrkb to help get a feel of the options. It doesn't need to be 100% finalized but it'd help to get a good start before I start coding in the fields.

a reasonable default is putting wp.crt and wp.key in /var/www/html/spid-conf (i.e. in a spid-conf dir under the WP home where wp-config.php sits)

here: https://github.com/simevo/spid-wordpress/blob/master/includes/class-spid-core.php#L42 we would then have: $home = 'spid-conf';

to be evaluated: should we allow a user to access "anonymously" WP without any SPID user attributes ?

this could be used to allow controlled access to read-only, non user-specific data

a generic WP user "guest" could be used for all logins

integrate the download of IdP metadata in the plugin setup process so that the plugin can be installed without shell access

on hold, to be evaluated: this needs to be integrated with an automated process for updating SP metadata !

as in:

http://example.com/wp-login.php?sso=spid&metadata:

This is related to:
italia/spid-php-lib#64
if we can get a list of the test IDPs from the main library then we can activate, deactivate and even rename the test IDPs

see #17 and italia/spid-smart-button#16 (comment)

build on #33 and make that user-configurable

I don't think Docker is needed here. Testing can and should be done in any environment that the plugin supports. Any test scripts can be made separately and used on any WP install. For anyone that would like to continue to use Docker, install the basic WordPress Docker then install the plugin manually. No need to complicate this with our own Dockerfile. Thoughts?

se qualcuno ha più plugin per il single-sign-on attivi, ad esempio CNS, SAML aziendale interno e SPID, l'url per fare il sso con uno dei SP SPID è: https://example.com/wp-login.php?sso=spid
invece se voglio la CNS https://example.com/wp-login.php?sso=cns e se voglio SAML https://example.com/wp-login.php?sso=cns

con l'opzione sp_sso possiamo fare la possibilità di personalizzare l'url sso:
https://github.com/simevo/spid-wordpress/blob/master/includes/class-spid-core.php#L78-L83

questa url dovrebbe essere usata anche qui:
https://github.com/simevo/spid-wordpress/blob/master/includes/class-spid-core.php#L90
per rilevare quando deve iniziare il processo di login SPID

e qui:
https://github.com/simevo/spid-wordpress/blob/master/templates/spid-button.php#L24
per configurare lo SPID button