CAS Basic client features (CAS 1.0, Service Tickets)

Collaboration diagram for CAS Basic client features (CAS 1.0, Service Tickets):

Modules
	CAS Proxy features (CAS 2.0, Proxy Granting Tickets)
	CAS proxied client features (CAS 2.0, Proxy Tickets)
	Miscellaneous

Functions
	CASClient::getST ()
	This method returns the Service Ticket provided in the URL of the request. More...
	CASClient::setST ($st)
	This method stores the Service Ticket. More...
	CASClient::hasST ()
	This method tells if a Service Ticket was stored. More...
	CASClient::setCasServerCert ($cert)
	Set the certificate of the CAS server. More...
	CASClient::setCasServerCACert ($cert)
	Set the CA certificate of the CAS server. More...
	CASClient::setNoCasServerValidation ()
	Set no SSL validation for the CAS server. More...
	CASClient::validateST ($validate_url, &$text_response, &$tree_response)
	This method is used to validate a ST; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success. More...
	CASClient::validateSA ($validate_url, &$text_response, &$tree_response)
	This method is used to validate a SAML TICKET; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success. More...
	CASClient::setSessionAttributes ($text_response)
	This method will parse the DOM and pull out the attributes from the SAML payload and put them into an array, then put the array into the session. More...

Variables
	CASClient::$_st
	the Service Ticket provided in the URL of the request if present (empty otherwise). More...
	CASClient::$_cas_server_cert
	the certificate of the CAS server. More...
	CASClient::$_cas_server_ca_cert
	the certificate of the CAS server CA. More...
	CASClient::$_no_cas_server_validation
	Set to true not to validate the CAS server. More...

Detailed Description

Function Documentation

getST()

CASClient::getST ( )

private

This method returns the Service Ticket provided in the URL of the request.

Returns

The service ticket.

Definition at line 1298 of file client.php.

                { return $this->_st; }

References CASClient\$_st.

Referenced by CASClient\isAuthenticated(), and CASClient\validateST().

Here is the caller graph for this function:

hasST()

CASClient::hasST ( )

private

This method tells if a Service Ticket was stored.

Returns

TRUE if a Service Ticket has been stored.

Definition at line 1314 of file client.php.

                { return !empty($this->_st); }

Referenced by CASClient\isAuthenticated().

Here is the caller graph for this function:

setCasServerCACert()

CASClient::setCasServerCACert

(

$cert

)

Set the CA certificate of the CAS server.

Parameters

$cert

the PEM certificate of the CA that emited the cert of the server

Definition at line 1366 of file client.php.

                {
                $this->_cas_server_ca_cert = $cert;
                }

setCasServerCert()

CASClient::setCasServerCert

(

$cert

)

Set the certificate of the CAS server.

Parameters

$cert

the PEM certificate

Definition at line 1356 of file client.php.

                {
                $this->_cas_server_cert = $cert;
                }

setNoCasServerValidation()

CASClient::setNoCasServerValidation

(

)

Set no SSL validation for the CAS server.

Definition at line 1374 of file client.php.

                {
                $this->_no_cas_server_validation = true;
                }

setSessionAttributes()

CASClient::setSessionAttributes (   $text_response )

private

This method will parse the DOM and pull out the attributes from the SAML payload and put them into an array, then put the array into the session.

Parameters

$text_response

the SAML payload.

Returns

bool TRUE when successfull and FALSE if no attributes a found

Definition at line 1600 of file client.php.

                {
                phpCAS::traceBegin();
                
                $result = FALSE;
                
                if (isset($_SESSION[SAML_ATTRIBUTES])) {
                        phpCAS::trace("session attrs already set.");  //testbml - do we care?
                }
                
                $attr_array = array();
                
                if (($dom = domxml_open_mem($text_response))) {
                        $xPath = $dom->xpath_new_context();
                        $xPath->xpath_register_ns('samlp', 'urn:oasis:names:tc:SAML:1.0:protocol');
                        $xPath->xpath_register_ns('saml', 'urn:oasis:names:tc:SAML:1.0:assertion');
                        $nodelist = $xPath->xpath_eval("//saml:Attribute");
                        if($nodelist){
                                $attrs = $nodelist->nodeset;
                                foreach($attrs as $attr){
                                        $xres = $xPath->xpath_eval("saml:AttributeValue", $attr);
                                        $name = $attr->get_attribute("AttributeName");
                                        $value_array = array();
                                        foreach($xres->nodeset as $node){
                                                $value_array[] = $node->get_content();
                                        }
                                        $attr_array[$name] = $value_array;
                                }
                                $_SESSION[SAML_ATTRIBUTES] = $attr_array;
                                // UGent addition...
                                foreach($attr_array as $attr_key => $attr_value) {
                                        if(count($attr_value) > 1) {
                                                $this->_attributes[$attr_key] = $attr_value;
                                                phpCAS::trace("* " . $attr_key . "=" . $attr_value);
                                        }
                                        else {
                                                $this->_attributes[$attr_key] = $attr_value[0];
                                                phpCAS::trace("* " . $attr_key . "=" . $attr_value[0]);
                                        }
                                }
                                $result = TRUE;
                        }else{
                                phpCAS::trace("SAML Attributes are empty");
                                $result = FALSE;
                        }
                }
                phpCAS::traceEnd($result);
                return $result;
                }

References $_SESSION, $result, domxml_open_mem(), SAML_ATTRIBUTES, phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Here is the call graph for this function:

setST()

CASClient::setST (   $st )

private

This method stores the Service Ticket.

Parameters

$st	The Service Ticket.

Definition at line 1306 of file client.php.

                { $this->_st = $st; }

Referenced by CASClient\wasPreviouslyAuthenticated().

Here is the caller graph for this function:

validateSA()

CASClient::validateSA (   $validate_url, &  $text_response, &  $tree_response  )

private

This method is used to validate a SAML TICKET; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success.

These parameters are used later by CASClient::validatePGT() for CAS proxies.

Parameters

$validate_url	the URL of the request to the CAS server.
$text_response	the response of the CAS server, as is (XML text).
$tree_response	the response of the CAS server, as a DOM XML tree.

Returns

bool TRUE when successfull, halt otherwise by calling CASClient::authError().

Definition at line 1522 of file client.php.

                {
                phpCAS::traceBegin();
                
                // build the URL to validate the ticket
                $validate_url = $this->getServerSamlValidateURL();
                
                // open and read the URL
                if ( !$this->readURL($validate_url,''/*cookies*/,$headers,$text_response,$err_msg) ) {
                        phpCAS::trace('could not open URL \''.$validate_url.'\' to validate ('.$err_msg.')');
                        $this->authError('SA not validated', $validate_url, TRUE/*$no_response*/);
                }
                
                phpCAS::trace('server version: '.$this->getServerVersion());
                
                // analyze the result depending on the version
                switch ($this->getServerVersion()) {
                        case SAML_VERSION_1_1:
                                
                                // read the response of the CAS server into a DOM object
                                if ( !($dom = domxml_open_mem($text_response))) {
                                        phpCAS::trace('domxml_open_mem() failed');
                                        $this->authError('SA not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // read the root node of the XML tree
                                if ( !($tree_response = $dom->document_element()) ) {
                                        phpCAS::trace('document_element() failed');
                                        $this->authError('SA not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // insure that tag name is 'Envelope'
                                if ( $tree_response->node_name() != 'Envelope' ) {
                                        phpCAS::trace('bad XML root node (should be `Envelope\' instead of `'.$tree_response->node_name().'\'');
                                        $this->authError('SA not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // check for the NameIdentifier tag in the SAML response
                                if ( sizeof($success_elements = $tree_response->get_elements_by_tagname("NameIdentifier")) != 0) {
                                        phpCAS::trace('NameIdentifier found');
                                        $user = trim($success_elements[0]->get_content());
                                        phpCAS::trace('user = `'.$user.'`');
                                        $this->setUser($user);
                                        $this->setSessionAttributes($text_response);
                                } else {
                                        phpCAS::trace('no <NameIdentifier> tag found in SAML payload');
                                        $this->authError('SA not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                break;
                }
                $this->renameSession($this->getSA());
                // at this step, ST has been validated and $this->_user has been set,
                phpCAS::traceEnd(TRUE);
                return TRUE;
                }

References domxml_open_mem(), phpCAS\trace(), and phpCAS\traceBegin().

Here is the call graph for this function:

validateST()

CASClient::validateST (   $validate_url, &  $text_response, &  $tree_response  )

private

This method is used to validate a ST; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success.

These parameters are used later by CASClient::validatePGT() for CAS proxies. Used for all CAS 1.0 validations

Parameters

$validate_url	the URL of the request to the CAS server.
$text_response	the response of the CAS server, as is (XML text).
$tree_response	the response of the CAS server, as a DOM XML tree.

Returns

bool TRUE when successfull, halt otherwise by calling CASClient::authError().

Definition at line 1392 of file client.php.

                {
                phpCAS::traceBegin();
                // build the URL to validate the ticket
                $validate_url = $this->getServerServiceValidateURL().'&ticket='.$this->getST();
                if ( $this->isProxy() ) {
                        // pass the callback url for CAS proxies
                        $validate_url .= '&pgtUrl='.urlencode($this->getCallbackURL());
                }
                
                // open and read the URL
                if ( !$this->readURL($validate_url,''/*cookies*/,$headers,$text_response,$err_msg) ) {
                        phpCAS::trace('could not open URL \''.$validate_url.'\' to validate ('.$err_msg.')');
                        $this->authError('ST not validated',
                                $validate_url,
                                TRUE/*$no_response*/);
                }
                
                // analyze the result depending on the version
                switch ($this->getServerVersion()) {
                        case CAS_VERSION_1_0:
                                if (preg_match('/^no\n/',$text_response)) {
                                        phpCAS::trace('ST has not been validated');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                FALSE/*$bad_response*/,
                                                $text_response);
                                }
                                if (!preg_match('/^yes\n/',$text_response)) {
                                        phpCAS::trace('ill-formed response');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // ST has been validated, extract the user name
                                $arr = preg_split('/\n/',$text_response);
                                $this->setUser(trim($arr[1]));
                                break;
                        case CAS_VERSION_2_0:
                                // read the response of the CAS server into a DOM object
                                if ( !($dom = domxml_open_mem($text_response))) {
                                        phpCAS::trace('domxml_open_mem() failed');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // read the root node of the XML tree
                                if ( !($tree_response = $dom->document_element()) ) {
                                        phpCAS::trace('document_element() failed');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                // insure that tag name is 'serviceResponse'
                                if ( $tree_response->node_name() != 'serviceResponse' ) {
                                        phpCAS::trace('bad XML root node (should be `serviceResponse\' instead of `'.$tree_response->node_name().'\'');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                if ( sizeof($success_elements = $tree_response->get_elements_by_tagname("authenticationSuccess")) != 0) {
                                        // authentication succeded, extract the user name
                                        if ( sizeof($user_elements = $success_elements[0]->get_elements_by_tagname("user")) == 0) {
                                                phpCAS::trace('<authenticationSuccess> found, but no <user>');
                                                $this->authError('ST not validated',
                                                        $validate_url,
                                                        FALSE/*$no_response*/,
                                                        TRUE/*$bad_response*/,
                                                        $text_response);
                                        }
                                        $user = trim($user_elements[0]->get_content());
                                        phpCAS::trace('user = `'.$user);
                                        $this->setUser($user);
                                        
                                } else if ( sizeof($failure_elements = $tree_response->get_elements_by_tagname("authenticationFailure")) != 0) {
                                        phpCAS::trace('<authenticationFailure> found');
                                        // authentication failed, extract the error code and message
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                FALSE/*$bad_response*/,
                                                $text_response,
                                                $failure_elements[0]->get_attribute('code')/*$err_code*/,
                                                trim($failure_elements[0]->get_content())/*$err_msg*/);
                                } else {
                                        phpCAS::trace('neither <authenticationSuccess> nor <authenticationFailure> found');
                                        $this->authError('ST not validated',
                                                $validate_url,
                                                FALSE/*$no_response*/,
                                                TRUE/*$bad_response*/,
                                                $text_response);
                                }
                                break;
                }
                $this->renameSession($this->getST());
                // at this step, ST has been validated and $this->_user has been set,
                phpCAS::traceEnd(TRUE);
                return TRUE;
                }

References domxml_open_mem(), CASClient\getCallbackURL(), CASClient\getServerServiceValidateURL(), CASClient\getST(), CASClient\isProxy(), CASClient\readURL(), CASClient\setUser(), phpCAS\trace(), and phpCAS\traceBegin().

Here is the call graph for this function:

Variable Documentation

$_cas_server_ca_cert

CASClient::$_cas_server_ca_cert

private

the certificate of the CAS server CA.

Definition at line 1341 of file client.php.

$_cas_server_cert

CASClient::$_cas_server_cert

private

the certificate of the CAS server.

Definition at line 1333 of file client.php.

$_no_cas_server_validation

CASClient::$_no_cas_server_validation

private

Set to true not to validate the CAS server.

Definition at line 1349 of file client.php.

$_st

CASClient::$_st

private

the Service Ticket provided in the URL of the request if present (empty otherwise).

Written by CASClient::CASClient(), read by CASClient::getST() and CASClient::hasPGT().

Definition at line 1291 of file client.php.

Referenced by CASClient\getST().