Attachment #3548 for bug #6012

View | Details | Raw Unified | Return to bug 6012
Collapse All | Expand All




    }
    if ($cas) {
        require C4::Auth_with_cas;             # no import
        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
    }

}

    unless ($query->param('userid')) {
        $sessionID = $query->cookie("CGISESSID");
    }
    if ($sessionID && not $cas) {
        my $session = get_session($sessionID);
        C4::Context->_new_userenv($sessionID);
        if ($session) {

        # new login
        my $userid = $query->param('userid');
        my $password = $query->param('password');
       	my ($return, $cardnumber);

	# Proxy CAS auth
	if ($cas && $query->param('PT')) {
	my ($return, $cardnumber);
	if ($cas && $query->param('ticket')) {
	    my $retuserid;
	    $debug and print STDERR "## check_api_auth - checking CAS\n";
	    # In case of a CAS authentication, we use the ticket instead of the password
	    my $PT = $query->param('PT');
	    ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query);    # EXTERNAL AUTH
	} else {
	    # User / password auth
	    unless ($userid and $password) {
		# caller did something wrong, fail the authenticateion
		return ("failed", undef, undef);
	    }
	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
	}

        if ($return and haspermission(  $userid, $flagsrequired)) {
            my $session = get_session("");
            return ("failed", undef, undef) unless $session;




	$VERSION = 3.03;	# set the version for version checking
	$debug = $ENV{DEBUG};
	@ISA    = qw(Exporter);
	@EXPORT = qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
}



    return 0;
}

# Proxy CAS auth
sub check_api_auth_cas {
    $debug and warn "check_api_auth_cas";
    my ($dbh, $PT, $query) = @_;
    my $retnumber;
    my $url = $query->url();
    my $cas = Authen::CAS::Client->new($casserver);
    
    # If we have a Proxy Ticket
    if ($PT) {
	my $r = $cas->proxy_validate( $url, $PT );

	# If the PT is valid
	if( $r->is_success ) {

	    # We've got a username ! 
	    $debug and warn "User authenticated as: ", $r->user, "\n";
	    $debug and warn "Proxied through:\n";
	    $debug and warn "  $_\n"
	      for $r->proxies;

	    my $userid = $r->user;
	    
	    # Does it match one of our users ?
    	    my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
    	    $sth->execute($userid);
    	    if ( $sth->rows ) {
		$retnumber = $sth->fetchrow;
		return (1, $retnumber, $userid);
	    }
	    my $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
	    return $r->user;
	    $sth->execute($userid);
	    if ( $sth->rows ) {
	    	$retnumber = $sth->fetchrow;
		return (1, $retnumber, $userid);
	    }
	    
	    # If we reach this point, then the user is a valid CAS user, but not a Koha user
	    $debug and warn "User $userid is not a valid Koha user";

	} else {
	    $debug and warn "Proxy Ticket authentication failed";
	    return 0;
	}
    }
    return 0;
}


1;
__END__


Line 0 Link Here

(-)a/docs/CAS/CASProxy/README (+9 lines)
	1	As CAS Proxying is not an obvious authentication to set up, here are
	2	some documented examples showing how a foreign application can query
	3	koha webservices, being CAS authenticated.
	4
	5	The starting point is proxy_cas.pl
	6
	7	To find more about how CAS Proxy works :
	8	http://afs.berkeley.edu/~lr/presentations/cas-auth/
	9	http://www.ja-sig.org/wiki/display/CAS/Proxy+CAS+Walkthrough




#!/usr/bin/perl

# Copyright 2009 SARL BibLibre
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
# Suite 330, Boston, MA  02111-1307 USA

=head1 DESCRIPTION

# Here is an exemple of a simple phony webservice, returning "Hello World" if the user is authenticated
# The purpose is to show how CAS Proxy can work with koha
# In this configuration, this page acts as a CAS Client, instead of the user's browser.
# This page is meant to be called from a foreign application

=head1 CGI PARAMETERS

=item PT
The Proxy Ticket, needed for check_api_auth, that will try to make the CAS Server validate it.

=cut 

use utf8;
use strict;
use warnings;
binmode(STDOUT, ":utf8");

use C4::Auth qw(check_api_auth);
use C4::Output;
use C4::Context;
use CGI;

my $cgi = new CGI;

print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8');

# The authentication : if $cgi contains a PT parameter, and CAS is enabled (casAuthentication syspref),
# a CAS Proxy authentication will take place
my ( $status, $cookie_, $sessionID ) = check_api_auth( $cgi, {circulate => 'override_renewals'});

if ($status ne 'ok') {
    print "Authentication failed : $status";
} else {
    print "Hello World!";
}
exit 0;





#!/usr/bin/perl

# Copyright 2009 SARL BibLibre
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
# Suite 330, Boston, MA  02111-1307 USA

=head1 DESCRIPTION

# Here is an exemple of a CAS Proxy
# The proxy is a foreign application that will authenticate the user against CAS
# Once authenticated as a proxy, the foreign application will be able to call some
# Koha webservices, proving authentication only by giving a proxy ticket

# Note: please keep in mind that all url's must be https and their certificates must be trusted

=cut

use strict;
use warnings;
use CGI;
use Authen::CAS::Client;

# URL Of the CAS Server
my $casServerUrl = 'https://localhost:8443/cas/';
my $cas = Authen::CAS::Client->new($casServerUrl);
my $cgi = new CGI;

# URL of the service we're requesting a Service Ticket for (typically this very same page)
my $proxy_service = $cgi->url;


# Callback URL (this is an URL the CAS Server will query, providing the Proxy Ticket we'll need 
# to query the koha webservice). It can be this page or another. In this example, another page will be 
# called back
my $pgtUrl = "https://.../proxy_cas_callback.pl";

print $cgi->header({-type  =>  'text/html'});
print $cgi->start_html("proxy cas");

# If we already have a service ticket
if ($cgi->param('ticket')) {

    print "Got a ticket :" . $cgi->param('ticket') . "<br>\n";
  
    # We validate it against the CAS Server, providing the callback URL
    my $r = $cas->service_validate( $proxy_service, $cgi->param('ticket'), pgtUrl => $pgtUrl);

    # If it is sucessful, we are authenticated
    if( $r->is_success() ) {
	print "User authenticated as: ", $r->user(), "<br>\n";
    } else {
	print "User authentication failed<br />\n";
    }

    # If we have a PGTIou ticket, the proxy validation was sucessful 
    if (defined $r->iou) {
      print "Proxy granting ticket IOU: ", $r->iou, "<br />\n";
      my $pgtIou = $r->iou;

      print '<a href="proxy_cas_data.pl?PGTIOU=', $r->iou, '">Next</a>';

      
     	    
    } else {
      print "Service validation for proxying failed\n";
   }

# If we don't have a Service Ticket, we ask for one (ie : the user will be redirected to the CAS Server for authentication)
} else {

    my $url = $cas->login_url($proxy_service);
    print "<a href=\"$url\">Please log in</a>";
}

print $cgi->end_html;







#!/usr/bin/perl

# Copyright 2009 SARL BibLibre
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
# Suite 330, Boston, MA  02111-1307 USA

=head1 DESCRIPTION

# Here is an exemple of a callback page for a CAS Proxy
# This is the page the CAS server will call back with a Proxy Ticket, allowing us (the foreign application)
# to query koha webservices, being CAS authenticated 

=cut

use strict;
use warnings;
use CGI;
use Authen::CAS::Client;
use Storable qw(nstore_fd);

my $casServerUrl = 'https://localhost:8443/cas/';
my $cas = Authen::CAS::Client->new($casServerUrl);

my $cgi = new CGI;

my $proxy_service = $cgi->url;

print $cgi->header({-type  =>  'text/html'});
print $cgi->start_html("proxy cas callback");

# If we have a pgtId, it means the cas server called us back
if ($cgi->param('pgtId')) {
    warn "Got a pgtId :" . $cgi->param('pgtId');
    warn "Got a pgtIou :" . $cgi->param('pgtIou');
    my $pgtIou =  $cgi->param('pgtIou');
    my $pgtId =  $cgi->param('pgtId');

    # Now we store the pgtIou and the pgtId in the application vars (in our case a storable object in a file), 
    # so that the page requesting the webservice can retrieve the pgtId matching it's PgtIou 
    open FILE, ">", "casSession.tmp" or die "Unable to open file";
    nstore_fd({$pgtIou => $pgtId}, \*FILE);
    close FILE;

} else {
    warn "Failed to get a Proxy Ticket\n";
}

print $cgi->end_html;





#!/usr/bin/perl

# Copyright 2009 SARL BibLibre
#
# This file is part of Koha.
#
# Koha is free software; you can redistribute it and/or modify it under the
# terms of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
#
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
# Suite 330, Boston, MA  02111-1307 USA

=head1 DESCRIPTION

# This page will display the result of the call to the koha webservice

=head1 CGI PARAMETERS

=item PGTIOU

The Proxy Granting Ticket IOU the CAS Server returned to us when we gave him the Service Ticket
This PGTIOU will allow us to retrive the matching PGTID

=cut 

use strict;
use warnings;
use CGI;
use Authen::CAS::Client;
use Storable qw(fd_retrieve);
use LWP::Simple;
use URI::Escape;

my $casServerUrl = 'https://localhost:8443/cas/';
my $cas = Authen::CAS::Client->new($casServerUrl);

# URL of the service we'd like to be proxy for (typically the Koha webservice we want to query)
my $target_service = "https://.../koha_webservice.pl";

my $cgi = new CGI;

print $cgi->header({-type  =>  'text/html'});
print $cgi->start_html("proxy cas");


if ($cgi->param('PGTIOU')) {

      # At this point, we must retrieve the PgtId by matching the PgtIou we
      # just received and the PgtIou given by the CAS Server to the callback URL
      # The callback page stored it in the application vars (in our case a storable object in a file)
      open FILE, "casSession.tmp" or die "Unable to open file";
      my $hashref = fd_retrieve(\*FILE);
      my $pgtId = %$hashref->{$cgi->param('PGTIOU')};
      close FILE;

      # Now that we have a PgtId, we can ask the cas server for a proxy ticket...
      my $rp = $cas->proxy( $pgtId, $target_service );
      if( $rp->is_success ) {
        print "Proxy Ticket issued: ", $rp->proxy_ticket, "<br />\n";

	# ...which we will provide to the target service (the koha webservice) for authentication !
	my $data = get($target_service . "?PT=" . $rp->proxy_ticket);
	
	# And finally, we can display the data gathered from the koha webservice !
	print "This is the output of the koha webservice we just queried, CAS authenticated : <br/>";
	print "<code>$data</code>";

      } else {
	print "Cannot get Proxy Ticket";
      }


}

Return to bug 6012

Lines 52-58 BEGIN { Link Here

(-)a/C4/Auth.pm (-10 / +16 lines)
52	}	52	}
53	if ($cas) {	53	if ($cas) {
54	require C4::Auth_with_cas; # no import	54	require C4::Auth_with_cas; # no import
55	import C4::Auth_with_cas qw(checkpw_cas login_cas logout_cas login_cas_url);	55	import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
56	}	56	}
57		57
58	}	58	}
Lines 1046-1052 sub check_api_auth { Link Here
1046	unless ($query->param('userid')) {	1046	unless ($query->param('userid')) {
1047	$sessionID = $query->cookie("CGISESSID");	1047	$sessionID = $query->cookie("CGISESSID");
1048	}	1048	}
1049	if ($sessionID) {	1049	if ($sessionID && not $cas) {
1050	my $session = get_session($sessionID);	1050	my $session = get_session($sessionID);
1051	C4::Context->_new_userenv($sessionID);	1051	C4::Context->_new_userenv($sessionID);
1052	if ($session) {	1052	if ($session) {
Lines 1096-1113 sub check_api_auth { Link Here
1096	# new login	1096	# new login
1097	my $userid = $query->param('userid');	1097	my $userid = $query->param('userid');
1098	my $password = $query->param('password');	1098	my $password = $query->param('password');
1099	unless ($userid and $password) {	1099	my ($return, $cardnumber);
1100	# caller did something wrong, fail the authenticateion	1100
1101	return ("failed", undef, undef);	1101	# Proxy CAS auth
1102	}	1102	if ($cas && $query->param('PT')) {
1103	my ($return, $cardnumber);
1104	if ($cas && $query->param('ticket')) {
1105	my $retuserid;	1103	my $retuserid;
1106	( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );	1104	$debug and print STDERR "## check_api_auth - checking CAS\n";
1107	$userid = $retuserid;	1105	# In case of a CAS authentication, we use the ticket instead of the password
		1106	my $PT = $query->param('PT');
		1107	($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query); # EXTERNAL AUTH
1108	} else {	1108	} else {
		1109	# User / password auth
		1110	unless ($userid and $password) {
		1111	# caller did something wrong, fail the authenticateion
		1112	return ("failed", undef, undef);
		1113	}
1109	( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );	1114	( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1110	}	1115	}
		1116
1111	if ($return and haspermission( $userid, $flagsrequired)) {	1117	if ($return and haspermission( $userid, $flagsrequired)) {
1112	my $session = get_session("");	1118	my $session = get_session("");
1113	return ("failed", undef, undef) unless $session;	1119	return ("failed", undef, undef) unless $session;

Lines 34-40 BEGIN { Link Here

(-)a/C4/Auth_with_cas.pm (-1 / +51 lines)
34	$VERSION = 3.03; # set the version for version checking	34	$VERSION = 3.03; # set the version for version checking
35	$debug = $ENV{DEBUG};	35	$debug = $ENV{DEBUG};
36	@ISA = qw(Exporter);	36	@ISA = qw(Exporter);
37	@EXPORT = qw(checkpw_cas login_cas logout_cas login_cas_url);	37	@EXPORT = qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
38	}	38	}
39		39
40		40
Lines 107-112 sub checkpw_cas { Link Here
107	return 0;	107	return 0;
108	}	108	}
109		109
		110	# Proxy CAS auth
		111	sub check_api_auth_cas {
		112	$debug and warn "check_api_auth_cas";
		113	my ($dbh, $PT, $query) = @_;
		114	my $retnumber;
		115	my $url = $query->url();
		116	my $cas = Authen::CAS::Client->new($casserver);
		117
		118	# If we have a Proxy Ticket
		119	if ($PT) {
		120	my $r = $cas->proxy_validate( $url, $PT );
		121
		122	# If the PT is valid
		123	if( $r->is_success ) {
		124
		125	# We've got a username !
		126	$debug and warn "User authenticated as: ", $r->user, "\n";
		127	$debug and warn "Proxied through:\n";
		128	$debug and warn " $_\n"
		129	for $r->proxies;
		130
		131	my $userid = $r->user;
		132
		133	# Does it match one of our users ?
		134	my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
		135	$sth->execute($userid);
		136	if ( $sth->rows ) {
		137	$retnumber = $sth->fetchrow;
		138	return (1, $retnumber, $userid);
		139	}
		140	my $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
		141	return $r->user;
		142	$sth->execute($userid);
		143	if ( $sth->rows ) {
		144	$retnumber = $sth->fetchrow;
		145	return (1, $retnumber, $userid);
		146	}
		147
		148	# If we reach this point, then the user is a valid CAS user, but not a Koha user
		149	$debug and warn "User $userid is not a valid Koha user";
		150
		151	} else {
		152	$debug and warn "Proxy Ticket authentication failed";
		153	return 0;
		154	}
		155	}
		156	return 0;
		157	}
		158
		159
110	1;	160	1;
111	__END__	161	__END__
112		162

Line 0 Link Here

(-)a/docs/CAS/CASProxy/examples/koha_webservice.pl (+58 lines)
	1	#!/usr/bin/perl
	2
	3	# Copyright 2009 SARL BibLibre
	4	#
	5	# This file is part of Koha.
	6	#
	7	# Koha is free software; you can redistribute it and/or modify it under the
	8	# terms of the GNU General Public License as published by the Free Software
	9	# Foundation; either version 2 of the License, or (at your option) any later
	10	# version.
	11	#
	12	# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
	13	# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
	14	# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
	15	#
	16	# You should have received a copy of the GNU General Public License along with
	17	# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
	18	# Suite 330, Boston, MA 02111-1307 USA
	19
	20	=head1 DESCRIPTION
	21
	22	# Here is an exemple of a simple phony webservice, returning "Hello World" if the user is authenticated
	23	# The purpose is to show how CAS Proxy can work with koha
	24	# In this configuration, this page acts as a CAS Client, instead of the user's browser.
	25	# This page is meant to be called from a foreign application
	26
	27	=head1 CGI PARAMETERS
	28
	29	=item PT
	30	The Proxy Ticket, needed for check_api_auth, that will try to make the CAS Server validate it.
	31
	32	=cut
	33
	34	use utf8;
	35	use strict;
	36	use warnings;
	37	binmode(STDOUT, ":utf8");
	38
	39	use C4::Auth qw(check_api_auth);
	40	use C4::Output;
	41	use C4::Context;
	42	use CGI;
	43
	44	my $cgi = new CGI;
	45
	46	print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8');
	47
	48	# The authentication : if $cgi contains a PT parameter, and CAS is enabled (casAuthentication syspref),
	49	# a CAS Proxy authentication will take place
	50	my ( $status, $cookie_, $sessionID ) = check_api_auth( $cgi, {circulate => 'override_renewals'});
	51
	52	if ($status ne 'ok') {
	53	print "Authentication failed : $status";
	54	} else {
	55	print "Hello World!";
	56	}
	57	exit 0;
	58

Line 0 Link Here

(-)a/docs/CAS/CASProxy/examples/proxy_cas.pl (+91 lines)
		1	#!/usr/bin/perl
		2
		3	# Copyright 2009 SARL BibLibre
		4	#
		5	# This file is part of Koha.
		6	#
		7	# Koha is free software; you can redistribute it and/or modify it under the
		8	# terms of the GNU General Public License as published by the Free Software
		9	# Foundation; either version 2 of the License, or (at your option) any later
		10	# version.
		11	#
		12	# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
		13	# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
		14	# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
		15	#
		16	# You should have received a copy of the GNU General Public License along with
		17	# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
		18	# Suite 330, Boston, MA 02111-1307 USA
		19
		20	=head1 DESCRIPTION
		21
		22	# Here is an exemple of a CAS Proxy
		23	# The proxy is a foreign application that will authenticate the user against CAS
		24	# Once authenticated as a proxy, the foreign application will be able to call some
		25	# Koha webservices, proving authentication only by giving a proxy ticket
		26
		27	# Note: please keep in mind that all url's must be https and their certificates must be trusted
		28
		29	=cut
		30
		31	use strict;
		32	use warnings;
		33	use CGI;
		34	use Authen::CAS::Client;
		35
		36	# URL Of the CAS Server
		37	my $casServerUrl = 'https://localhost:8443/cas/';
		38	my $cas = Authen::CAS::Client->new($casServerUrl);
		39	my $cgi = new CGI;
		40
		41	# URL of the service we're requesting a Service Ticket for (typically this very same page)
		42	my $proxy_service = $cgi->url;
		43
		44
		45	# Callback URL (this is an URL the CAS Server will query, providing the Proxy Ticket we'll need
		46	# to query the koha webservice). It can be this page or another. In this example, another page will be
		47	# called back
		48	my $pgtUrl = "https://.../proxy_cas_callback.pl";
		49
		50	print $cgi->header({-type => 'text/html'});
		51	print $cgi->start_html("proxy cas");
		52
		53	# If we already have a service ticket
		54	if ($cgi->param('ticket')) {
		55
		56	print "Got a ticket :" . $cgi->param('ticket') . "<br>\n";
		57
		58	# We validate it against the CAS Server, providing the callback URL
		59	my $r = $cas->service_validate( $proxy_service, $cgi->param('ticket'), pgtUrl => $pgtUrl);
		60
		61	# If it is sucessful, we are authenticated
		62	if( $r->is_success() ) {
		63	print "User authenticated as: ", $r->user(), "<br>\n";
		64	} else {
65	print "User authentication failed<br />\n";
66	}
67
68	# If we have a PGTIou ticket, the proxy validation was sucessful
69	if (defined $r->iou) {
70	print "Proxy granting ticket IOU: ", $r->iou, "<br />\n";
71	my $pgtIou = $r->iou;
72
73	print '<a href="proxy_cas_data.pl?PGTIOU=', $r->iou, '">Next</a>';
74
75
76
77	} else {
78	print "Service validation for proxying failed\n";
79	}
80
81	# If we don't have a Service Ticket, we ask for one (ie : the user will be redirected to the CAS Server for authentication)
82	} else {
83
84	my $url = $cas->login_url($proxy_service);
85	print "<a href=\"$url\">Please log in</a>";
86	}
87
88	print $cgi->end_html;
89
90
91