Symfony 4.4 hslavich/oneloginsaml-bundle如何从文件路径加载证书

默认1.x版本仅支持在config.yml中直接写入SAML证书明文完成配置，可通过重写依赖注入扩展类的方式，支持配置证书文件路径自动读取加载，具体实现步骤如下：

1. 新建重写的扩展类 #

在自身项目Bundle的DependencyInjection目录下，新建继承原扩展类的自定义扩展类，在配置加载逻辑中增加证书路径判断与内容读取逻辑：

<?php
namespace YourProject\MainBundle\DependencyInjection;

use Hslavich\OneloginSamlBundle\DependencyInjection\HslavichOneloginSamlExtension as BaseExtension;
use Symfony\Component\DependencyInjection\ContainerBuilder;

class CustomOneloginSamlExtension extends BaseExtension
{
    // 定义支持文件路径加载的证书字段
    protected $certConfigKeys = [
        'idp' => ['x509cert'],
        'sp'  => ['x509cert', 'privateKey']
    ];

    public function load(array $configs, ContainerBuilder $container)
    {
        // 先走原配置解析流程拿到标准化配置
        $configuration = $this->getConfiguration($configs, $container);
        $config = $this->processConfiguration($configuration, $configs);

        // 遍历证书字段，判断为有效文件路径时读取内容替换
        foreach ($this->certConfigKeys as $section => $fields) {
            if (!isset($config[$section])) {
                continue;
            }
            foreach ($fields as $field) {
                $value = trim($config[$section][$field] ?? '');
                if ($value && is_file($value) && is_readable($value)) {
                    $config[$section][$field] = file_get_contents($value);
                }
            }
        }

        // 传入处理完成的配置走原加载逻辑
        parent::load([$config], $container);
    }
}

2. 注册自定义扩展覆盖原扩展 #

通过编译器Pass将自定义扩展注册到容器，替换原Bundle自带的扩展类，在自身项目Bundle中添加如下编译器Pass：

<?php
namespace YourProject\MainBundle\DependencyInjection\Compiler;

use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
use Symfony\Component\DependencyInjection\ContainerBuilder;
use YourProject\MainBundle\DependencyInjection\CustomOneloginSamlExtension;

class OverrideSamlExtensionPass implements CompilerPassInterface
{
    public function process(ContainerBuilder $container)
    {
        $container->registerExtension(new CustomOneloginSamlExtension());
    }
}

在Bundle入口类中加载该编译器Pass：

<?php
namespace YourProject\MainBundle;

use Symfony\Component\HttpKernel\Bundle\Bundle;
use Symfony\Component\DependencyInjection\ContainerBuilder;
use YourProject\MainBundle\DependencyInjection\Compiler\OverrideSamlExtensionPass;

class MainBundle extends Bundle
{
    public function build(ContainerBuilder $container)
    {
        parent::build($container);
        $container->addCompilerPass(new OverrideSamlExtensionPass());
    }
}

3. 配置文件使用路径配置证书 #

修改app/config/config.yml中的SAML配置，直接填写证书文件的绝对路径即可，原有直接填写证书明文的配置方式依然兼容：

hslavich_onelogin_saml:
    idp:
        entityId: 'https://idp.your-domain.com/entity'
        singleSignOnService:
            url: 'https://idp.your-domain.com/sso'
            binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
        x509cert: '%kernel.root_dir%/config/saml/certs/idp_x509.crt'
    sp:
        entityId: 'https://app.your-domain.com/saml/metadata'
        assertionConsumerService:
            url: 'https://app.your-domain.com/saml/acs'
            binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
        privateKey: '%kernel.root_dir%/config/saml/certs/sp_private.key'
        x509cert: '%kernel.root_dir%/config/saml/certs/sp_x509.crt'

注意事项：证书文件需要放在web根目录之外的非公开路径，权限设置为Symfony运行进程用户可读即可，避免证书泄露。

内容的提问来源于stack exchange，提问作者Jakub Kleban