Service parameter not being set properly when redirecting to CAS login page
| Project: | CAS |
| Version: | 5.x-4.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | needs work |
Ok.. I'm not 100% sure this is a bug because I've got a complicated set up, but this is the scenario. I'm getting my Drupal install set up to use ssl, and this is happening now. Here is the flow of my set up.
I have some URL rewrite rules in my .htaccess that send all traffic going to http://www.mydomain.com to https://www.mydomain.com
1. User goes to http://www.mydomain.com
2. User is redirected to https://www.mydomain.com
3. CAS module intercepts the user and forwards them to CAS login page
4. user logs in, and is redirected back to http://www.mydomain.com:443
Now.. the problem is that the service parm is set to http://wwww.mydomain.com:443 when they are redirected to the login page and it should be https://www.mydomain.com. I've tracked this to the the isHttps() method in client.php. It returns false when it should return true. Basically, it's because it doesn't find $_SERVER['HTTPS'] variable. So, I'm not sure if this is due to 1) a bug in phpCAS or 2) My redirection settings for apache causing this global not to be set properly somehow or 3) a bug in CAS module. I'm able to bypass the problem by adding 2 lines of code to cas.module right after the line that reads phpCAS::client($server_version, $server_cas_server, $server_port, $server_uri, $start_session);
global $base_url;
phpCAS::setFixedServiceURL($base_url);
Basically, the getURL() method of client.php tries to build the URL if it already isn't set (which is the part blowing up). By calling setFixedServiceURL(), it's getting set and the value that I set is used for the service parameter when being passed to the login page. This allows everything to work properly. I'll continue to investigate but wanted to see if someone else my be able to provide some input.

#1
Attached is a patch for the above until I can find the *real* solution.
#2
Looks like this will always set the service url to the home page. This will disable deep linking on any site using this fix. That is if the "require cas login" check returns true on a page that isn't the home page the user would be redirected to the home page instead of the page that required cas auth after doing cas auth.
#3
FYI: I'd bet option 2 is your issue (.htaccess rewrites are causing this problem). You might consider testing this to verify that this is the case.