You need to have mod_auth_cas configured to use the "samlValidate" endpoint
on the CAS server, and also have the "CASAuthNHeader" setting turned on in
/etc/httpd/conf.d/cas.conf (or wherever your config file is). Like this:
<Directory "/var/www/html/secure">
<IfModule mod_auth_cas.c>
AuthType CAS
CASAuthNHeader On
</IfModule>
Require valid-user
</Directory>
<IfModule mod_auth_cas.c>
CASLoginUrl https://cas.example.com/cas/login
CASValidateUrl https://cas.example.com/cas/samlValidate
CASCookiePath /var/cache/httpd/mod_auth_cas/
CASValidateSAML On
CASSSOEnabled On
CASDebug Off
</IfModule>
This will give you a bunch of headers whose names begin with "CAS_". If you
want a different prefix instead of "CAS_", you can set it with the
"CASAttributePrefix" option.
Anyway, then in your PHP script, you can have something like this:
<?php
echo "<pre>";
if (array_key_exists('REMOTE_USER', $_SERVER)) {
echo "REMOTE_USER = " . $_SERVER['REMOTE_USER'] . "</br>";
}
$headers = getallheaders();
foreach ($headers as $key => $value) {
if (strpos($key, 'CAS_') === 0) {
echo substr($key, 4) . " = " . $value . "</br>";
}
}
echo "</pre>";
?>
to print them all out. Note that you will get more than just the attributes
you released; you'll also get some other information from the CAS server.
For example, on my current devel setup, which authenticates against Active
Directory first and LDAP second, and merges attributes from both, I get:
REMOTE_USER = curryd
AuthenticationMethod = Active Directory
displayName = David Curry
successfulAuthenticationHandlers = Active Directory
cn = xxxxxxxxx
EmailAddress = [email protected]
Role = staff
samlAuthenticationStatementAuthMethod =
urn:oasis:names:tc:SAML:1.0:am:password
uid = curryd
UDC_IDENTIFIER = xxxxxxx
Active-Directory.curryd = cn=curryd,ou=TNSUsers,dc=tns,dc=newschool,dc=edu
sn = Curry
Formatted-Name = David
Hope this helps,
--Dave
--
DAVID A. CURRY, CISSP
*DIRECTOR OF INFORMATION SECURITY*
INFORMATION TECHNOLOGY
71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
+1 212 229-5300 x4728 • [email protected]
[image: The New School]
On Wed, Jul 19, 2017 at 1:19 PM, Kapetanakis Giannis <
[email protected]> wrote:
> On 19/07/17 18:27, Fabio Martelli wrote:
>
>> Hi All, I would like to retrieve user principal attributes from a php
>> application.
>>
>> I successfully configured mod_auth_cas but at the moment I'm just able to
>> retrieve the principal name in HTTP Header.
>>
>> Can you share a piece of code that can help me with my php application?
>>
>> Thank you in advance.
>>
>> BR,
>>
>> F.
>>
>>
> Maybe you can get it from $_SERVER['REMOTE_USER']
>
> alternative options:
>
> a) do the authentication in PHP with phpCAS and not in apache
> b) check if user is authenticated in php (again with phpCAS) and get what
> ever attribute you need (including attributed returned by CAS)
>
> G
> ps.
> https://github.com/apereo/phpCAS/blob/master/docs/examples/
> example_hardening.php
> https://wiki.jasig.org/display/casc/phpcas+examples
>
> --
> - CAS gitter chatroom: https://gitter.im/apereo/cas
> - CAS mailing list guidelines: https://apereo.github.io/cas/M
> ailing-Lists.html
> - CAS documentation website: https://apereo.github.io/cas
> - CAS project website: https://github.com/apereo/cas
> --- You received this message because you are subscribed to the Google
> Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit https://groups.google.com/a/ap
> ereo.org/d/msgid/cas-user/ea919a47-a804-89e6-7a24-9563f2b2f4
> a6%40edu.physics.uoc.gr.
>
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CA%2Bd9XANeJTz4F-YMqstp%3DNtXd-LAUqXefas3jPvPJJXiT9fguQ%40mail.gmail.com.
