Skip to content

Commit 717009a

Browse files
jfritschijfritschi
committed
PHPCAS-69 Merging of the PHPCAS-69 branch into trunk. The brings one API change. By default being proxied is denied. With ProxyChains it can be allowed now. This patch also contains a big refactoring of the whole ST/PT/SA decision making which is more straight forward now.
git-svn-id: https://source.jasig.org/cas-clients/phpcas/trunk@24917 f5dbab47-78f9-eb45-b975-e544023573eb
2 parents 7eacc40 + 1e86bce commit 717009a

15 files changed

+1213
-292
lines changed

‎docs/examples/config.php.example‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ $serviceUrl = $curbase.$curdir.'example_service.php';
6666
// access to a second service
6767
$serviceUrl2 = $curbase.$curdir.'example_service_that_proxies.php';
6868

69+
$pgtBase = preg_quote(preg_replace('/^http:/', 'https:', $curbase.$curdir),'/');
70+
$pgtUrlRegexp = '/^'.$pgtbase.'.*$/';
71+
6972
$cas_url = 'https://'.$cas_host;
7073
if ($cas_port != '443')
7174
{

‎docs/examples/example_service.php‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,42 @@
2121
// VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS PROTOCOL!
2222
phpCAS::setNoCasServerValidation();
2323

24+
// If you want your service to be proxied you have to enable it (default
25+
// disabled) and define an accepable list of proxies that are allowed to
26+
// proxy your service.
27+
//
28+
// Add each allowed proxy definition object. For the normal CAS_ProxyChain
29+
// class, the constructor takes an array of proxies to match. The list is in
30+
// reverse just as seen from the service. Proxies have to be defined in reverse
31+
// from the service to the user. If a user hits service A and gets proxied via
32+
// B to service C the list of acceptable on C would be array(B,A). The definition
33+
// of an individual proxy can be either a string or a regexp (preg_match is used)
34+
// that will be matched against the proxy list supplied by the cas server
35+
// when validating the proxy tickets. The strings are compared starting from
36+
// the beginning and must fully match with the proxies in the list.
37+
// Example:
38+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
39+
// 'https://app.example.com/'
40+
// )));
41+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
42+
// '/^https:\/\/app[0-9]\.example\.com\/rest\//',
43+
// 'http://client.example.com/'
44+
// )));
45+
phpCAS::allowProxyChain(new CAS_ProxyChain(array($pgtUrlRegexp)));
46+
phpCAS::allowProxyChain(new CAS_ProxyChain(array(
47+
'/^'.$pgtBase.'example_service_that_proxies.php$/',
48+
'/^'.$pgtBase.'example_proxy_serviceWeb_chaining.php$/'
49+
)));
50+
51+
// For quick testing or in certain production screnarios you might want to
52+
// allow allow any other valid service to proxy your service. To do so, add
53+
// the "Any" chain:
54+
// phpcas::allowProxyChain(new CAS_ProxyChain_Any);
55+
// THIS SETTING IS HOWEVER NOT RECOMMENDED FOR PRODUCTION AND HAS SECURITY
56+
// IMPLICATIONS: YOU ARE ALLOWING ANY SERVICE TO ACT ON BEHALF OF A USER
57+
// ON THIS SERVICE.
58+
//phpcas::allowProxyChain(new CAS_ProxyChain_Any);
59+
2460
// force CAS authentication
2561
phpCAS::forceAuthentication();
2662

‎docs/examples/example_service_POST.php‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,40 @@
2121
// VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS PROTOCOL!
2222
phpCAS::setNoCasServerValidation();
2323

24+
25+
// If you want your service to be proxied you have to enable it (default
26+
// disabled) and define an accepable list of proxies that are allowed to
27+
// proxy your service.
28+
//
29+
// Add each allowed proxy definition object. For the normal CAS_ProxyChain
30+
// class, the constructor takes an array of proxies to match. The list is in
31+
// reverse just as seen from the service. Proxies have to be defined in reverse
32+
// from the service to the user. If a user hits service A and gets proxied via
33+
// B to service C the list of acceptable on C would be array(B,A). The definition
34+
// of an individual proxy can be either a string or a regexp (preg_match is used)
35+
// that will be matched against the proxy list supplied by the cas server
36+
// when validating the proxy tickets. The strings are compared starting from
37+
// the beginning and must fully match with the proxies in the list.
38+
// Example:
39+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
40+
// 'https://app.example.com/'
41+
// )));
42+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
43+
// '/^https:\/\/app[0-9]\.example\.com\/rest\//',
44+
// 'http://client.example.com/'
45+
// )));
46+
phpCAS::allowProxyChain(new CAS_ProxyChain(array($pgtUrlRegexp)));
47+
48+
// For quick testing or in certain production screnarios you might want to
49+
// allow allow any other valid service to proxy your service. To do so, add
50+
// the "Any" chain:
51+
// phpcas::allowProxyChain(new CAS_ProxyChain_Any);
52+
// THIS SETTING IS HOWEVER NOT RECOMMENDED FOR PRODUCTION AND HAS SECURITY
53+
// IMPLICATIONS: YOU ARE ALLOWING ANY SERVICE TO ACT ON BEHALF OF A USER
54+
// ON THIS SERVICE.
55+
//phpcas::allowProxyChain(new CAS_ProxyChain_Any);
56+
57+
2458
// force CAS authentication
2559
phpCAS::forceAuthentication();
2660

‎docs/examples/example_service_that_proxies.php‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,38 @@
2121
// VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS PROTOCOL!
2222
phpCAS::setNoCasServerValidation();
2323

24+
// If you want your service to be proxied you have to enable it (default
25+
// disabled) and define an accepable list of proxies that are allowed to
26+
// proxy your service.
27+
//
28+
// Add each allowed proxy definition object. For the normal CAS_ProxyChain
29+
// class, the constructor takes an array of proxies to match. The list is in
30+
// reverse just as seen from the service. Proxies have to be defined in reverse
31+
// from the service to the user. If a user hits service A and gets proxied via
32+
// B to service C the list of acceptable on C would be array(B,A). The definition
33+
// of an individual proxy can be either a string or a regexp (preg_match is used)
34+
// that will be matched against the proxy list supplied by the cas server
35+
// when validating the proxy tickets. The strings are compared starting from
36+
// the beginning and must fully match with the proxies in the list.
37+
// Example:
38+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
39+
// 'https://app.example.com/'
40+
// )));
41+
// phpCAS::allowProxyChain(new CAS_ProxyChain(array(
42+
// '/^https:\/\/app[0-9]\.example\.com\/rest\//',
43+
// 'http://client.example.com/'
44+
// )));
45+
phpCAS::allowProxyChain(new CAS_ProxyChain(array($pgtUrlRegexp)));
46+
47+
// For quick testing or in certain production screnarios you might want to
48+
// allow allow any other valid service to proxy your service. To do so, add
49+
// the "Any" chain:
50+
// phpcas::allowProxyChain(new CAS_ProxyChain_Any);
51+
// THIS SETTING IS HOWEVER NOT RECOMMENDED FOR PRODUCTION AND HAS SECURITY
52+
// IMPLICATIONS: YOU ARE ALLOWING ANY SERVICE TO ACT ON BEHALF OF A USER
53+
// ON THIS SERVICE.
54+
//phpcas::allowProxyChain(new CAS_ProxyChain_Any);
55+
2456
// force CAS authentication
2557
phpCAS::forceAuthentication();
2658

‎source/CAS.php‎

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1655,7 +1655,52 @@ public static function setExtraCurlOption($key, $value) {
16551655
phpCAS :: traceEnd();
16561656
}
16571657

1658-
1658+
/**
1659+
* If you want your service to be proxied you have to enable it (default
1660+
* disabled) and define an accepable list of proxies that are allowed to
1661+
* proxy your service.
1662+
*
1663+
* Add each allowed proxy definition object. For the normal CAS_ProxyChain
1664+
* class, the constructor takes an array of proxies to match. The list is in
1665+
* reverse just as seen from the service. Proxies have to be defined in reverse
1666+
* from the service to the user. If a user hits service A and gets proxied via
1667+
* B to service C the list of acceptable on C would be array(B,A). The definition
1668+
* of an individual proxy can be either a string or a regexp (preg_match is used)
1669+
* that will be matched against the proxy list supplied by the cas server
1670+
* when validating the proxy tickets. The strings are compared starting from
1671+
* the beginning and must fully match with the proxies in the list.
1672+
* Example:
1673+
* phpCAS::allowProxyChain(new CAS_ProxyChain(array(
1674+
* 'https://app.example.com/'
1675+
* )));
1676+
* phpCAS::allowProxyChain(new CAS_ProxyChain(array(
1677+
* '/^https:\/\/app[0-9]\.example\.com\/rest\//',
1678+
* 'http://client.example.com/'
1679+
* )));
1680+
*
1681+
* For quick testing or in certain production screnarios you might want to
1682+
* allow allow any other valid service to proxy your service. To do so, add
1683+
* the "Any" chain:
1684+
* phpcas::allowProxyChain(new CAS_ProxyChain_Any);
1685+
* THIS SETTING IS HOWEVER NOT RECOMMENDED FOR PRODUCTION AND HAS SECURITY
1686+
* IMPLICATIONS: YOU ARE ALLOWING ANY SERVICE TO ACT ON BEHALF OF A USER
1687+
* ON THIS SERVICE.
1688+
*
1689+
* @param CAS_ProxyChain_Interface $proxy_chain A proxy-chain that will be matched against the proxies requesting access
1690+
*/
1691+
public static function allowProxyChain(CAS_ProxyChain_Interface $proxy_chain){
1692+
global $PHPCAS_CLIENT;
1693+
phpCAS :: traceBegin();
1694+
if (!is_object($PHPCAS_CLIENT)) {
1695+
phpCAS :: error('this method should only be called after ' . __CLASS__ . '::client() or' . __CLASS__ . '::proxy()');
1696+
}
1697+
if($PHPCAS_CLIENT->getServerVersion() !== CAS_VERSION_2_0){
1698+
phpCAS :: error('this method can only be used with the cas 2.0 protool');
1699+
}
1700+
$PHPCAS_CLIENT->getAllowedProxyChains()->allowProxyChain($proxy_chain);
1701+
phpCAS :: traceEnd();
1702+
}
1703+
16591704
/**
16601705
* Answer an array of proxies that are sitting in front of this application.
16611706
*
@@ -1787,7 +1832,7 @@ public static function addRebroadcastHeader($header) {
17871832
/** @defgroup internalProxyServices Proxy other services
17881833
* @ingroup internalProxy */
17891834

1790-
/** @defgroup internalProxied CAS proxied client features (CAS 2.0, Proxy Tickets)
1835+
/** @defgroup internalService CAS client features (CAS 2.0, Proxied service)
17911836
* @ingroup internal */
17921837

17931838
/** @defgroup internalConfig Configuration

0 commit comments

Comments
 (0)