On 19 July 2017 at 15:11, David Curry <[email protected]> wrote: > > You need to have mod_auth_cas configured to use the "samlValidate" endpoint > on the CAS server, and also have the "CASAuthNHeader" setting turned on in > /etc/httpd/conf.d/cas.conf (or wherever your config file is). Like this: > > <Directory "/var/www/html/secure"> > <IfModule mod_auth_cas.c> > AuthType CAS > CASAuthNHeader On > </IfModule> > > Require valid-user > </Directory> > > <IfModule mod_auth_cas.c> > CASLoginUrl https://cas.example.com/cas/login > CASValidateUrl https://cas.example.com/cas/samlValidate > CASCookiePath /var/cache/httpd/mod_auth_cas/ > CASValidateSAML On > CASSSOEnabled On > CASDebug Off > </IfModule> > > > This will give you a bunch of headers whose names begin with "CAS_". If you > want a different prefix instead of "CAS_", you can set it with the > "CASAttributePrefix" option. > > Anyway, then in your PHP script, you can have something like this: > > <?php > echo "<pre>"; > > if (array_key_exists('REMOTE_USER', $_SERVER)) { > echo "REMOTE_USER = " . $_SERVER['REMOTE_USER'] . "</br>"; > } > > $headers = getallheaders(); > foreach ($headers as $key => $value) { > if (strpos($key, 'CAS_') === 0) { > echo substr($key, 4) . " = " . $value . "</br>"; > } > } > > echo "</pre>"; > ?> > > to print them all out. Note that you will get more than just the attributes > you released; you'll also get some other information from the CAS server. For > example, on my current devel setup, which authenticates against Active > Directory first and LDAP second, and merges attributes from both, I get: > > REMOTE_USER = curryd > AuthenticationMethod = Active Directory > displayName = David Curry > successfulAuthenticationHandlers = Active Directory > cn = xxxxxxxxx > EmailAddress = [email protected] > Role = staff > samlAuthenticationStatementAuthMethod = > urn:oasis:names:tc:SAML:1.0:am:password > uid = curryd > UDC_IDENTIFIER = xxxxxxx > Active-Directory.curryd = cn=curryd,ou=TNSUsers,dc=tns,dc=newschool,dc=edu > sn = Curry > Formatted-Name = David
Just wanted to +1 Dave's reply. Good stuff. I also wanted to note that CASv2 attributes from /serviceValicate are now supported in git master, if you need to go that route. https://github.com/apereo/mod_auth_cas/pull/110 -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAAgu-wBGy142k8aLGkC8B1O852jWz%2BVQ4OXdGRhQAAotDGPKrA%40mail.gmail.com.
