I try to implément cas-server module but i would like to change the way the logout works.
Is it possible to redirect to "destination url" without passing by "you have been logout" screen.
Possibility of "drupal_goto($url)" in a gateway situation, maybe a parameter in settings ?

Many thanks

CommentFileSizeAuthor
#13 cas-redirect-on-login-1151600-13.patch3.27 KBreswild
#6 cas_server.module.diff237 bytesmab974
#4 1151600.patch588 bytesbfroehle

Comments

bfroehle’s picture

bfroehle commented

Hi mab974,

This feature is not likely to be included as it does not conform to the CAS protocol.

2.3. /logout
/logout destroys a client's single sign-on CAS session. The ticket-granting cookie (Section 3.6) is destroyed, and subsequent requests to /login will not obtain service tickets until the user again presents primary credentials (and thereby establishes a new single sign-on session).

2.3.1. parameters
The following HTTP request parameter MAY be specified to /logout. It is case sensitive and SHOULD be handled by /logout.

url [OPTIONAL] - if "url" is specified, the URL specified by "url" SHOULD be on the logout page with descriptive text. For example, "The application you just logged out of has provided a link it would like you to follow. Please click here to access http://www.go-back.edu."
2.3.2. response
/logout MUST display a page stating that the user has been logged out. If the "url" request parameter is implemented, /logout SHOULD also provide a link to the provided URL as described in Section 2.3.1.

That said, you should be able to figure out how to hack the module to get it to do what you desire.

mab974’s picture

mab974 commented

Hi bfroehle,

Thank you for the answer.
I've verified the Rubycas server i used for many years and which i would like to replace in some cases where Drupal is present.

Rubycas receive, added to the url (logoutwithurl), a "&gateway=true" parameter and interpret it so it give an ability to do a "gateway logout" such that CAS does not present logout UI but just redirects back to the application.

This way, Cas protocol is safe and i think this feature may be interesting here like it was for Rubycas.

As you said i've already hacked the module but it's so comfortable to update modules without correct them every time.

Regards

bfroehle’s picture

bfroehle commented

Oh, that's nice to know (from the changelog):

If gateway=true is specified as part of the logout URI, the server will
log the user out and immediately redirect them back to the specified
service. In other words, you can now do "gatewayed logouts" as well
as logins.

If you want to provide a patch which implements this feature I'd be willing to commit it.

bfroehle’s picture

bfroehle commented
Status: Active » Needs review
StatusFileSize
new 1151600.patch588 bytes

Is this what you had in mind? I don't use the CAS Server module regularly, so it'd be best if somebody else could test this out and report back.

Status: Needs review » Needs work

The last submitted patch, 1151600.patch, failed testing.

mab974’s picture

mab974 commented
Component: Code » CAS
StatusFileSize
new cas_server.module.diff237 bytes

Sorry for my long absence.
My patch is almost the same as yours except
$ _GET ['Gateway']
which is replaced by a test of 'url'
(strpos($_GET['url'], "?gateway"))

bfroehle’s picture

bfroehle commented

I don't understand why you would use (strpos($_GET['url'], "?gateway")) --- this would mean you are looking for a redirection URL which has '?gateway' in it... Is that really what you want?

mab974’s picture

mab974 commented

I've tried to use $ _GET ['Gateway'] which is not accessible there.
I think that '?gateway' is part of the url which is not treated by phpcas (v1.2.0) but just passed to cas_server logout function.
Maybe, there is a prettier solution for passing this information without modifying phpcas and the concerned web apps.
I don't know how rubycas is doing that job.

bfroehle’s picture

bfroehle commented

Are there any security issues with automatically redirecting to an arbitrary location (rather than just providing a link?)

bfroehle’s picture

bfroehle commented
Version: 6.x-2.3 » 6.x-3.x-dev
Component: CAS » CAS Server
thecarlhall’s picture

thecarlhall commented

"gateway" has defined use in the /login area of the CAS protocol spec (section 2.1). The Rubycas impl doesn't really deviate from that but the intentions are subtly different. The Jasig CAS server uses "service" to redirect after login but also requires that the functionality be enabled.

I don't see the two approaches as being in conflict and together could provide an interesting setup.

  • If gateway=true, redirect the user to the referrer. I suggest referrer as "url" has some definition by the spec (section 2.3.1)
  • If followServiceRedirects=true (need to add to server admin config), allow referrer to specify a "service" parameter in the url that the user is redirected to.

What do y'all think?

bfroehle’s picture

bfroehle commented
Status: Needs work » Active

As long as we stay near the CAS specification or what other comparable CAS servers are doing, I'm okay with it.

reswild’s picture

reswild commented
Version: 6.x-3.x-dev » 7.x-1.x-dev
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new cas-redirect-on-login-1151600-13.patch3.27 KB

Here is a patch that should conform to the CAS specification. It adds a setting in the CAS Server module whether to allow redirects, and then redirects on logout if the "service" parameter is used, and prints a link if the "url" parameter is used instead. If both "service" and "url" is used, it redirects if allowed in the settings, and prints a link if redirect is disallowed.

I also added a setting in the cas module for whether to pass the redirect url as "service", "url", or both when logging out.