Il 19/07/2017 21:11, David Curry ha scritto:
You need to have mod_auth_cas configured to use the "samlValidate"
endpoint on the CAS server, and also have the "CASAuthNHeader" setting
turned on in /etc/httpd/conf.d/cas.conf (or wherever your config file
is). Like this:
<Directory "/var/www/html/secure">
<IfModule mod_auth_cas.c>
AuthType CAS
CASAuthNHeader On
</IfModule>
Require valid-user
</Directory>
<IfModule mod_auth_cas.c>
CASLoginUrl https://cas.example.com/cas/login
CASValidateUrl https://cas.example.com/cas/samlValidate
CASCookiePath /var/cache/httpd/mod_auth_cas/
CASValidateSAML On
CASSSOEnabled On
CASDebug Off
</IfModule>
This will give you a bunch of headers whose names begin with "CAS_".
If you want a different prefix instead of "CAS_", you can set it with
the "CASAttributePrefix" option.
Anyway, then in your PHP script, you can have something like this:
<?php
echo "<pre>";
if (array_key_exists('REMOTE_USER', $_SERVER)) {
echo "REMOTE_USER = " . $_SERVER['REMOTE_USER'] . "</br>";
}
$headers = getallheaders();
foreach ($headers as $key => $value) {
if (strpos($key, 'CAS_') === 0) {
echo substr($key, 4) . " = " . $value . "</br>";
}
}
echo "</pre>";
?>
to print them all out. Note that you will get more than just the
attributes you released; you'll also get some other information from
the CAS server. For example, on my current devel setup, which
authenticates against Active Directory first and LDAP second, and
merges attributes from both, I get:
REMOTE_USER = curryd
AuthenticationMethod = Active Directory
displayName = David Curry
successfulAuthenticationHandlers = Active Directory
cn = xxxxxxxxx
EmailAddress = [email protected]
<mailto:[email protected]>
Role = staff
samlAuthenticationStatementAuthMethod =
urn:oasis:names:tc:SAML:1.0:am:password
uid = curryd
UDC_IDENTIFIER = xxxxxxx
Active-Directory.curryd =
cn=curryd,ou=TNSUsers,dc=tns,dc=newschool,dc=edu
sn = Curry
Formatted-Name = David
Hope this helps,
--Dave
Hi David, thank you for your reply.
I did as you suggested successfully. Please note: to have the
configuration working fine mod_auth_cas master is required (as reported
into [1]).
Thank you again and best regards,
F.
[1] https://www.mail-archive.com/[email protected]/msg17023.html
--
DAVID A. CURRY, CISSP
*DIRECTOR OF INFORMATION SECURITY*
INFORMATION TECHNOLOGY
71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
+1 212 229-5300 x4728 • [email protected]
<mailto:[email protected]>
The New School
On Wed, Jul 19, 2017 at 1:19 PM, Kapetanakis Giannis
<[email protected] <mailto:[email protected]>> wrote:
On 19/07/17 18:27, Fabio Martelli wrote:
Hi All, I would like to retrieve user principal attributes
from a php application.
I successfully configured mod_auth_cas but at the moment I'm
just able to retrieve the principal name in HTTP Header.
Can you share a piece of code that can help me with my php
application?
Thank you in advance.
BR,
F.
Maybe you can get it from $_SERVER['REMOTE_USER']
alternative options:
a) do the authentication in PHP with phpCAS and not in apache
b) check if user is authenticated in php (again with phpCAS) and
get what ever attribute you need (including attributed returned by
CAS)
G
ps.
https://github.com/apereo/phpCAS/blob/master/docs/examples/example_hardening.php
<https://github.com/apereo/phpCAS/blob/master/docs/examples/example_hardening.php>
https://wiki.jasig.org/display/casc/phpcas+examples
<https://wiki.jasig.org/display/casc/phpcas+examples>
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines:
https://apereo.github.io/cas/Mailing-Lists.html
<https://apereo.github.io/cas/Mailing-Lists.html>
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
--- You received this message because you are subscribed to the
Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it,
send an email to [email protected]
<mailto:cas-user%[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/ea919a47-a804-89e6-7a24-9563f2b2f4a6%40edu.physics.uoc.gr
<https://groups.google.com/a/apereo.org/d/msgid/cas-user/ea919a47-a804-89e6-7a24-9563f2b2f4a6%40edu.physics.uoc.gr>.
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines:
https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google
Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected]
<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CA%2Bd9XANeJTz4F-YMqstp%3DNtXd-LAUqXefas3jPvPJJXiT9fguQ%40mail.gmail.com
<https://groups.google.com/a/apereo.org/d/msgid/cas-user/CA%2Bd9XANeJTz4F-YMqstp%3DNtXd-LAUqXefas3jPvPJJXiT9fguQ%40mail.gmail.com?utm_medium=email&utm_source=footer>.
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/index.html?pk_campaign=email&pk_kwd=fm
Apache Syncope PMC
http://people.apache.org/~fmartelli/
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/5f36a4fe-1d6d-bba6-12d2-dc520477e859%40gmail.com.
