1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8" />
<title>documentation:1.9:authcas</title>
<meta name="generator" content="DokuWiki"/>
<meta name="robots" content="index,follow"/>
<meta name="keywords" content="documentation,1.9,authcas"/>
<link rel="search" type="application/opensearchdescription+xml" href="lib/exe/opensearch.html" title="LemonLDAP::NG"/>
<link rel="start" href="authcas.html"/>
<link rel="contents" href="authcas.html" title="Sitemap"/>
<link rel="stylesheet" type="text/css" href="lib/exe/css.php.t.bootstrap3.css"/>
<!-- //if:usedebianlibs
<link rel="stylesheet" type="text/css" href="/javascript/bootstrap/css/bootstrap.min.css" />
//elsif:useexternallibs
<link rel="stylesheet" type="text/css" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"></script>
//elsif:cssminified
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.min.css" />
//else -->
<link rel="stylesheet" type="text/css" href="/static/bwr/bootstrap/dist/css/bootstrap.css" />
<!-- //endif -->
<script type="text/javascript">/*<![CDATA[*/var NS='documentation:1.9';var JSINFO = {"id":"documentation:1.9:authcas","namespace":"documentation:1.9"};
/*!]]>*/</script>
<script type="text/javascript" charset="utf-8" src="lib/exe/js.php.t.bootstrap3.js"></script>
<!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery/jquery.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/jquery-2.2.0.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.min.js"></script>
//else -->
<script type="text/javascript" src="/static/bwr/jquery/dist/jquery.js"></script>
<!-- //endif -->
<!-- //if:usedebianlibs
<script type="text/javascript" src="/javascript/jquery-ui/jquery-ui.min.js"></script>
//elsif:useexternallibs
<script type="text/javascript" src="http://code.jquery.com/ui/1.10.4/jquery-ui.min.js"></script>
//elsif:jsminified
<script type="text/javascript" src="/lib/scripts/jquery-ui.min.js"></script>
//else -->
<script type="text/javascript" src="/lib/scripts/jquery-ui.js"></script>
<!-- //endif -->
</head>
<body>
<div class="dokuwiki export container">
<!-- TOC START -->
<div id="dw__toc">
<h3 class="toggle">Table of Contents</h3>
<div>
<ul class="toc">
<li class="level1"><div class="li"><a href="#presentation">Presentation</a></div></li>
<li class="level1"><div class="li"><a href="#perl-cas_module_installation">Perl-CAS module installation</a></div></li>
<li class="level1"><div class="li"><a href="#configuration">Configuration</a></div></li>
</ul>
</div>
</div>
<!-- TOC END -->
<h1 class="sectionedit1" id="cas">CAS</h1>
<div class="level1">
<div class="table sectionedit2"><table class="inline table table-bordered table-striped">
<thead>
<tr class="row0 roweven">
<th class="col0">Authentication </th><th class="col1"> Users </th><th class="col2"> Password </th>
</tr>
</thead>
<tr class="row1 rowodd">
<td class="col0 centeralign"> ✔ </td><td class="col1"> </td><td class="col2"> </td>
</tr>
</table></div>
<!-- EDIT2 TABLE [19-69] -->
</div>
<!-- EDIT1 SECTION "CAS" [1-70] -->
<h2 class="sectionedit3" id="presentation">Presentation</h2>
<div class="level2">
<p>
<abbr title="LemonLDAP::NG">LL::NG</abbr> can delegate authentication to a <abbr title="Central Authentication Service">CAS</abbr> server. This requires <a href="http://sourcesup.cru.fr/projects/perlcas/" class="urlextern" title="http://sourcesup.cru.fr/projects/perlcas/" rel="nofollow">Perl CAS module</a>.
</p>
<div class="notetip"><abbr title="LemonLDAP::NG">LL::NG</abbr> can also act as <a href="idpcas.html" class="wikilink1" title="documentation:1.9:idpcas">CAS server</a>, that allows to interconnect two <abbr title="LemonLDAP::NG">LL::NG</abbr> systems.
</div>
<p>
<abbr title="LemonLDAP::NG">LL::NG</abbr> can also request proxy tickets for its protected services. Proxy tickets will be collected at authentication phase and stored in user session under the form:
</p>
<p>
<code>_casPT</code><strong>serviceID</strong> = <strong>Proxy ticket value</strong>
</p>
<p>
They can then be forwarded to applications trough <a href="writingrulesand_headers.html#headers" class="wikilink1" title="documentation:1.9:writingrulesand_headers">HTTP headers</a>.
</p>
<div class="notetip"><abbr title="Central Authentication Service">CAS</abbr> authentication will automatically add a <a href="logoutforward.html" class="wikilink1" title="documentation:1.9:logoutforward">logout forward rule</a> on <abbr title="Central Authentication Service">CAS</abbr> server logout <abbr title="Uniform Resource Locator">URL</abbr> in order to close <abbr title="Central Authentication Service">CAS</abbr> session on <abbr title="LemonLDAP::NG">LL::NG</abbr> logout.
</div>
</div>
<!-- EDIT3 SECTION "Presentation" [71-828] -->
<h2 class="sectionedit4" id="perl-cas_module_installation">Perl-CAS module installation</h2>
<div class="level2">
<p>
Download the latest version:
</p>
<pre class="code">wget https://sourcesup.cru.fr/frs/download.php/2476/AuthCAS-1.4.tar.gz</pre>
<p>
Extract and build the module:
</p>
<pre class="code">tar zxvf AuthCAS-1.4.tar.gz
cd AuthCAS-1.4/
perl Makefile.PL
make
make test</pre>
<p>
Install the module:
</p>
<pre class="code">sudo make install</pre>
</div>
<!-- EDIT4 SECTION "Perl-CAS module installation" [829-1162] -->
<h2 class="sectionedit5" id="configuration">Configuration</h2>
<div class="level2">
<p>
In Manager, go in <code>General Parameters</code> > <code>Authentication modules</code> and choose <abbr title="Central Authentication Service">CAS</abbr> for authentication.
</p>
<div class="notetip">You can then choose any other module for users and password.
</div>
<p>
Then, go in <code><abbr title="Central Authentication Service">CAS</abbr> parameters</code>:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Authentication level</strong>: authentication level for this module.</div>
</li>
<li class="level1"><div class="li"> <strong>Server <abbr title="Uniform Resource Locator">URL</abbr></strong>: <abbr title="Central Authentication Service">CAS</abbr> server <abbr title="Uniform Resource Locator">URL</abbr> (must use https://)</div>
</li>
<li class="level1"><div class="li"> <strong>CA file</strong>: CA certificate used to validate <abbr title="Central Authentication Service">CAS</abbr> server certificate</div>
</li>
<li class="level1"><div class="li"> <strong>Renew authentication</strong>: force authentication renewal on <abbr title="Central Authentication Service">CAS</abbr> server</div>
</li>
<li class="level1"><div class="li"> <strong>Gateways authentication</strong>: force transparent authentication on <abbr title="Central Authentication Service">CAS</abbr> server</div>
</li>
<li class="level1"><div class="li"> <strong><abbr title="Proxy Granting Ticket">PGT</abbr> file</strong>: temporary file where proxy tickets are stored (by default, <code>/tmp/pgt.txt</code>)</div>
</li>
<li class="level1"><div class="li"> <strong>Proxied services</strong>: list of services for which a proxy ticket is requested:</div>
<ul>
<li class="level2"><div class="li"> <strong>Key</strong>: Service ID</div>
</li>
<li class="level2"><div class="li"> <strong>Value</strong> Service <abbr title="Uniform Resource Locator">URL</abbr> (<abbr title="Central Authentication Service">CAS</abbr> service identifier)</div>
</li>
</ul>
</li>
</ul>
<div class="notetip">If no proxied services defined, <abbr title="Central Authentication Service">CAS</abbr> authentication will not activate the <abbr title="Central Authentication Service">CAS</abbr> proxy mode.
</div><div class="noteimportant">If you activate proxy mode, you must create the <abbr title="Proxy Granting Ticket">PGT</abbr> file on your system, for example:
<pre class="code">touch /tmp/pgt.txt</pre>
</div>
</div>
<!-- EDIT5 SECTION "Configuration" [1163-] --></div>
</body>
</html>
|
