Our current Single Sign-Out code is pretty messy, and I've never actually tested it myself!

It'd be good if we could instead leverage some of the features in phpCAS 1.2.0 to provide Single-Sign-Out:

Changes in version 1.2.0RC2
Improvements
   * add callback hooks during authentication and single sign-out [PHPCAS-76] (Adam Franco)
CommentFileSizeAuthor
#6 1077910-6.x-3.x-draft-sso-using-phpcas.patch7.81 KBbfroehle

Comments

bfroehle’s picture

bfroehle commented 
	/**
	 * Set a callback function to be run when a single-signout request is received.
	 *
	 * The callback function will be passed a $logoutTicket as its first parameter,
	 * followed by any $additionalArgs you pass. The $logoutTicket parameter is an
	 * opaque string that can be used to map a session-id to the logout request in order
	 * to support single-signout in applications that manage their own sessions 
	 * (rather than letting phpCAS start and destroy the session).
	 * 
	 * @param callback $function
	 * @param optional array $additionalArgs
	 * @return void
	 */
	public static function setSingleSignoutCallback ($function, array $additionalArgs = array()) {

This seems like the way forward. We just pass a function which handles matching up the ticket and logging that user out. Removes any dependence on SimpleXML, etc.

metzlerd’s picture

metzlerd commented

The current code was tested by me quite recently for both the 7.x and 6.x dev branches. API research would need to be done. The place where I've stumbled on this in the past is that you need to configure a ticket storage mechanism. I want to make sure that we don't rewrite this into something that you have to hack the phpCAS libraries in order to implement single sign out.

Can we agree not to try and tackle this until after we have stable 6.x-3 and 7.x-1 releases?

bfroehle’s picture

bfroehle commented

Also, why is there a configuration option for single sign out? Shouldn't we be good citizens and always implement it?

bfroehle’s picture

bfroehle commented

Glad to hear you've tested it. I'm fine waiting on this for a while.

metzlerd’s picture

metzlerd commented

A good question.... for which I don't have a good answer ;) . I'd be happy to remove the configuration option.

Regarding the function this would mean always initializing phpCAS library, regardless of what page was loaded wouldn't it? Or maybe just load it if we have detected a logout request. I don't mind removing the simplexml dependency, as long as it doesn't require to heavy of refactoring of the base code (when to invoke login check, load libraries etc. ).

What do you think would need to change in order support it. Wouldn't we still need the table and all the code that goes with it?

I'd like to see if we can roll releases soon. I was planning on running through a full test cycle on Friday. Do you think we'll be ready to move into testing soon? How much more are we going to try and get in this release?

Dave

bfroehle’s picture

bfroehle commented
Status: Active » Needs review
StatusFileSize
new 1077910-6.x-3.x-draft-sso-using-phpcas.patch7.81 KB

I've attached an un-tested patch. As David points out, the current code works so the priority for including this is low.

bfroehle’s picture

bfroehle commented
Status: Needs review » Postponed

Okay, there's like a zero percent chance of this working, so setting to postponed.

bfroehle’s picture

bfroehle commented
Component: Code » CAS
Status: Postponed » Closed (won't fix)

Cleaning out the issue queue. Since this current approach to handling SSO in CAS works (and this approach won't), let's close this issue.