Skip to content

Commit 78fc49c

Browse files
tvdijentvdijen
committed
deploy: 56b0c9b 
1 parent a2e55a9 commit 78fc49c

2 files changed

Lines changed: 110 additions & 19 deletions

File tree

‎contrib_modules/cas/cas.html‎

Lines changed: 93 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -87,14 +87,17 @@
8787
Using the CAS authentication source with SimpleSAMLphp
8888
</h1>
8989
<p>
90-
This is completely based on the original cas authentication,
91-
the only difference is this is authentication module and not a script.
90+
This is completely based on the original CAS authentication;
91+
the only difference is this is an authentication module, not a script.
9292
</p>
9393
<h2 id="setting-up-the-cas-authentication-module">
9494
Setting up the CAS authentication module
9595
</h2>
96-
<p>
96+
<h3 id="adding-an-authentication-source">
9797
Adding an authentication source
98+
</h3>
99+
<p>
100+
In new deployments using ldap v2.5+, configure LDAP as a separate authsource in the ldap module and reference it by id from CAS.
98101
</p>
99102
<p>
100103
Example authsource.php:
@@ -103,18 +106,71 @@ <h2 id="setting-up-the-cas-authentication-module">
103106
<pre><span></span><code><span class="x">'example-cas' =&gt; [</span>
104107
<span class="x"> 'cas:CAS',</span>
105108
<span class="x"> 'cas' =&gt; [</span>
106-
<span class="x"> 'login' =&gt; 'https://cas.example.com/login',</span>
107-
<span class="x"> 'validate' =&gt; 'https://cas.example.com/validate',</span>
108-
<span class="x"> 'logout' =&gt; 'https://cas.example.com/logout'</span>
109+
<span class="x"> 'login' =&gt; 'https://cas.example.com/login',</span>
110+
<span class="x"> 'validate' =&gt; 'https://cas.example.com/validate', // CAS v2</span>
111+
<span class="x"> 'logout' =&gt; 'https://cas.example.com/logout',</span>
109112
<span class="x"> ],</span>
110113
<span class="x"> 'ldap' =&gt; [</span>
111-
<span class="x"> 'servers' =&gt; 'ldaps://ldaps.example.be:636/',</span>
112-
<span class="x"> 'enable_tls' =&gt; true,</span>
113-
<span class="x"> 'searchbase' =&gt; 'ou=people,dc=org,dc=com',</span>
114-
<span class="x"> 'searchattributes' =&gt; 'uid',</span>
115-
<span class="x"> 'attributes' =&gt; ['uid','cn'],</span>
116-
<span class="x"> 'priv_user_dn' =&gt; 'cn=simplesamlphp,ou=applications,dc=org,dc=com',</span>
117-
<span class="x"> 'priv_user_pw' =&gt; 'password',</span>
114+
<span class="x"> 'authsource' =&gt; 'ldap-backend',</span>
115+
<span class="x"> ],</span>
116+
<span class="x">],</span>
117+
118+
<span class="x">// LDAP authsource (dnpattern mode)</span>
119+
<span class="x">'ldap-backend' =&gt; [</span>
120+
<span class="x"> 'ldap:Ldap',</span>
121+
122+
<span class="x"> // REQUIRED in v2.5: one or more LDAP URLs</span>
123+
<span class="x"> 'connection_string' =&gt; 'ldaps://ldap.example.com',</span>
124+
125+
<span class="x"> // Optional extras</span>
126+
<span class="x"> 'encryption' =&gt; 'ssl',</span>
127+
<span class="x"> 'version' =&gt; 3,</span>
128+
<span class="x"> 'options' =&gt; [</span>
129+
<span class="x"> 'network_timeout' =&gt; 3,</span>
130+
<span class="x"> 'referrals' =&gt; false,</span>
131+
<span class="x"> ],</span>
132+
133+
<span class="x"> // Dnpattern mode (no search)</span>
134+
<span class="x"> 'dnpattern' =&gt; 'uid=%username%,cn=people,dc=example,dc=com',</span>
135+
<span class="x"> 'search.enable' =&gt; false,</span>
136+
137+
<span class="x"> // 'attributes' =&gt; ['uid', 'cn', 'mail'],</span>
138+
<span class="x">]</span>
139+
</code></pre>
140+
</div>
141+
<p>
142+
OR:
143+
</p>
144+
<div class="highlight">
145+
<pre><span></span><code><span class="x">'example-cas' =&gt; [</span>
146+
<span class="x"> 'cas:CAS',</span>
147+
<span class="x"> 'cas' =&gt; [</span>
148+
<span class="x"> 'login' =&gt; 'https://cas.example.com/login',</span>
149+
<span class="x"> 'serviceValidate' =&gt; 'https://cas.example.com/serviceValidate', // CAS v3</span>
150+
<span class="x"> 'logout' =&gt; 'https://cas.example.com/logout',</span>
151+
<span class="x"> ],</span>
152+
<span class="x"> 'ldap' =&gt; [</span>
153+
<span class="x"> 'authsource' =&gt; 'ldap-backend',</span>
154+
<span class="x"> ],</span>
155+
<span class="x">],</span>
156+
157+
<span class="x">// LDAP authsource (search mode)</span>
158+
<span class="x">'ldap-backend' =&gt; [</span>
159+
<span class="x"> 'ldap:Ldap',</span>
160+
<span class="x"> 'connection_string' =&gt; 'ldaps://ldap1.example.com ldaps://ldap2.example.com',</span>
161+
<span class="x"> 'search' =&gt; [</span>
162+
<span class="x"> 'username' =&gt; 'cn=simplesamlphp,ou=apps,dc=example,dc=com',</span>
163+
<span class="x"> 'password' =&gt; 'secret',</span>
164+
<span class="x"> 'base' =&gt; ['ou=people,dc=example,dc=com'],</span>
165+
<span class="x"> 'filter' =&gt; '(uid=%username%)',</span>
166+
<span class="x"> 'scope' =&gt; 'sub',</span>
167+
<span class="x"> ],</span>
168+
<span class="x"> 'attributes' =&gt; ['*'],</span>
169+
<span class="x"> 'attributes.binary' =&gt; ['jpegPhoto'],</span>
170+
<span class="x"> 'timeout' =&gt; 3,</span>
171+
<span class="x"> 'options' =&gt; [</span>
172+
<span class="x"> 'network_timeout' =&gt; 3,</span>
173+
<span class="x"> 'referrals' =&gt; false,</span>
118174
<span class="x"> ],</span>
119175
<span class="x">],</span>
120176
</code></pre>
@@ -147,7 +203,7 @@ <h2 id="querying-attributes">
147203
</p>
148204
<div class="highlight">
149205
<pre><span></span><code><span class="x">'cas' =&gt; [</span>
150-
<span class="x"> 'serviceValidate' =&gt; 'https://cas.example.com/serviceValidate',</span>
206+
<span class="x"> 'serviceValidate' =&gt; 'https://cas.example.com/serviceValidate', // CAS v3</span>
151207
<span class="x">]</span>
152208
</code></pre>
153209
</div>
@@ -185,8 +241,8 @@ <h3 id="optional-enabling-slate-extensions">
185241
<span class="x"> // Optional XPath-based attribute mappings</span>
186242
<span class="x"> 'attributes' =&gt; [</span>
187243
<span class="x"> // Standard CAS attributes</span>
188-
<span class="x"> 'uid' =&gt; 'cas:user',</span>
189-
<span class="x"> 'mail' =&gt; 'cas:attributes/cas:mail',</span>
244+
<span class="x"> 'uid' =&gt; 'cas:user',</span>
245+
<span class="x"> 'mail' =&gt; 'cas:attributes/cas:mail',</span>
190246

191247
<span class="x"> // Slate namespaced attributes inside cas:attributes</span>
192248
<span class="x"> 'slate_person' =&gt; 'cas:attributes/slate:person',</span>
@@ -230,10 +286,10 @@ <h3 id="optional-enabling-slate-extensions">
230286
<div class="highlight">
231287
<pre><span></span><code><span class="x">'cas' =&gt; [</span>
232288
<span class="x"> 'attributes' =&gt; [</span>
233-
<span class="x"> 'uid' =&gt; 'cas:user',</span>
234-
<span class="x"> 'sn' =&gt; 'cas:attributes/cas:sn',</span>
289+
<span class="x"> 'uid' =&gt; 'cas:user',</span>
290+
<span class="x"> 'sn' =&gt; 'cas:attributes/cas:sn',</span>
235291
<span class="x"> 'givenName' =&gt; 'cas:attributes/cas:firstname',</span>
236-
<span class="x"> 'mail' =&gt; 'cas:attributes/cas:mail',</span>
292+
<span class="x"> 'mail' =&gt; 'cas:attributes/cas:mail',</span>
237293
<span class="x"> ],</span>
238294
<span class="x">],</span>
239295
</code></pre>
@@ -267,5 +323,23 @@ <h3 id="optional-enabling-slate-extensions">
267323
<span class="x">]</span>
268324
</code></pre>
269325
</div>
326+
<h3 id="troubleshooting">
327+
Troubleshooting
328+
</h3>
329+
<ul>
330+
<li>
331+
Mismatch between validate (v2) and serviceValidate (v3): ensure you use the correct endpoint for your CAS server.
332+
</li>
333+
<li>
334+
Attribute mappings: verify XPath keys match your CAS response (case‑sensitive).
335+
</li>
336+
<li>
337+
LDAP connection issues: confirm connection_string, credentials, and base DN; consider increasing
338+
<code>
339+
network_timeout
340+
</code>
341+
while testing.
342+
</li>
343+
</ul>
270344
</main></body>
271345
</html>

‎contributed_modules.html‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -659,6 +659,23 @@
659659
</li>
660660
</ul>
661661
</li>
662+
<li>
663+
<dl>
664+
<dt>
665+
simplesamlphp-module-oidanchor
666+
</dt>
667+
<dd>
668+
OpenID Anchor module
669+
</dd>
670+
</dl>
671+
<ul>
672+
<li>
673+
<a href="https://github.com/simplesamlphp/simplesamlphp-module-oidanchor">
674+
Repository
675+
</a>
676+
</li>
677+
</ul>
678+
</li>
662679
<li>
663680
<dl>
664681
<dt>

0 commit comments

Comments
 (0)