From iLLin in #1043640-8: CAS Single Sign Out:
I also had another issue with hooking into the hook_auth_filter. When denying access I sent a user to an unauthorized page. By pressing logout /caslogout, It would never log me out correctly. I think it kept killing the script execution before it had a chance to logout, or maybe I never fully logged them in... I'm under a heavy time constraint so I worked around it by adding the caslogout url to skip checking.
I "think" because they never get a drupal account they are never logged in, so they are always running through cas_login_check(), which returns out since they are denied. I wish I had more info and can provide more later, just no time right now.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | 1050398-Fixed-hook_auth_filter-can-interfere-w.patch | 918 bytes | bfroehle |
| #6 | 1050398-6.x-3.x-Check-session-variables-to-see-if-caslogout-menu.patch | 877 bytes | bfroehle |
Comments
Comment #1
metzlerd commentedThis is an interesting problem. One shouldn't see the CAS_logout menu item unless you're logged into drupal should you? When you use auth_filter, you may in fact be logged into cas but not ever logged into the drupal site. That's by design, but that makes me wonder why they see a cas logout link, to be able to press?
Hmmm.... can you give some more info regarding your site configuration?
Comment #2
iLLin commentedI added the link manually. Here is the workflow:
User is browsing in Site A and are authenticated with CAS. They click a link to pop over to Drupal but I am calling a webservice to verify their subscription to Drupal.
So they hit Drupal, bounce to CAS, bounce back since they are already authenticated in CAS and while logging into Drupal, I call a webservice, returns no access and so I fail out in hook_auth_filter. So now they are presented with an unauthorized page, that says no acesss yadda yadda, and there is a logout link for CAS. That turns into a infinite loop as its always login_checking.... and never actually gets to the logout code. So they are authenticated with CAS so they should have a logout link, but they never can execute the code since they are never logged into Drupal.
Make sense?
Comment #3
metzlerd commentedYep. The cas logout piece wasn't really designed for that, but I can envision a patch that would work. Since you've found the work around, I'm going to bump this to the 6.x-3 version.
Comment #4
bfroehle commentedIs this still an issue in 6.x-3.x-dev? I suspect it still is.
This begs the question of what to do with users who successfully authenticate with CAS but then do not get a user account. Do we log them out of CAS for them? Should we provide a link on the "not authorized" dsm that they can click on to log out?
We could check for the presence of $_SESSION['phpcas']['name'] which indicates a successful CAS authentication without a successful Drupal authentication.
Comment #5
metzlerd commentedIn most of the sites that I have, users of this class are treated as unauthenticated users (user 0). There are pages that they have access to on the site, but there are pages that they don't. I let the drupal permissions system manage what gets access denied and what doesn't.
When the "check to see if a user is logged in first", it's important to honor that, but when you're asking for a login redirect, an access denied message seems appropriate, but I generally like the idea of letting the existing customizable access denied page handle that. In either case you raise an interesting point about whether a Logout link should be present. The cas_logout menu item could be configured to display in such cases when the user is logged into cas regardless as to whether they have a user id, yes?
Comment #6
bfroehle commentedHere's a patch which should make the logout link appear when the session is authenticated with CAS.
Comment #7
bfroehle commentedHere's an updated patch for consideration in 7.x-1.x. The D6 version is likely the same.
Here we show (and allow access to) the 'caslogout' link if the user is logged into Drupal or phpCAS.
Comment #8
bfroehle commentedCommitted the patch in #7 to 7.x-1.x and 6.x-3.x. This changes the behavior of the CAS logout link to also appear in situations whether the user has authenticated with CAS, but a Drupal login was denied.