Authentication

Collaboration diagram for Authentication:

Functions
	CAS_Client::_setUser ($user)
	This method sets the CAS user's login name. More...
	CAS_Client::getUser ()
	This method returns the CAS user's login name. More...
	CAS_Client::_getUser ()
	This method returns the CAS user's login name. More...
	CAS_Client::setAttributes ($attributes)
	Set an array of attributes. More...
	CAS_Client::getAttributes ()
	Get an key values arry of attributes. More...
	CAS_Client::hasAttributes ()
	Check whether attributes are available. More...
	CAS_Client::hasAttribute ($key)
	Check whether a specific attribute with a name is available. More...
	CAS_Client::_hasAttribute ($key)
	Check whether a specific attribute with a name is available. More...
	CAS_Client::getAttribute ($key)
	Get a specific attribute by name. More...
	CAS_Client::renewAuthentication ()
	This method is called to renew the authentication of the user If the user is authenticated, renew the connection If not, redirect to CAS. More...
	CAS_Client::forceAuthentication ()
	This method is called to be sure that the user is authenticated. More...
	CAS_Client::setCacheTimesForAuthRecheck ($n)
	Set the number of times authentication will be cached before rechecked. More...
	CAS_Client::checkAuthentication ()
	This method is called to check whether the user is authenticated or not. More...
	CAS_Client::isAuthenticated ($renew=false)
	This method is called to check if the user is authenticated (previously or by tickets given in the URL). More...
	CAS_Client::isSessionAuthenticated ()
	This method tells if the current session is authenticated. More...
	CAS_Client::_wasPreviouslyAuthenticated ()
	This method tells if the user has already been (previously) authenticated by looking into the session variables. More...
	CAS_Client::redirectToCas ($gateway=false, $renew=false)
	This method is used to redirect the client to the CAS server. More...
	CAS_Client::logout ($params)
	This method is used to logout from CAS. More...
	CAS_Client::_isLogoutRequest ()
	Check of the current request is a logout request. More...
	CAS_Client::handleLogoutRequests ($check_client=true, $allowed_clients=false)
	This method handles logout requests. More...

Variables
	CAS_Client::$_user
	The Authenticated user. More...
	CAS_Client::$_attributes
	The Authenticated users attributes. More...
	CAS_Client::$_cache_times_for_auth_recheck
	An integer that gives the number of times authentication will be cached before rechecked. More...

Detailed Description

Function Documentation

_getUser()

CAS_Client::_getUser ( )

private

This method returns the CAS user's login name.

Returns

string the login name of the authenticated user

Warning

should be called only after CAS_Client::forceAuthentication() or CAS_Client::isAuthenticated(), otherwise halt with an error.

Definition at line 1150 of file Client.php.

    {
        // This is likely a duplicate check that could be removed....
        if (empty($this->_user)) {
            phpCAS::error(
                'this method should be used only after ' . __CLASS__
                . '::forceAuthentication() or ' . __CLASS__ . '::isAuthenticated()'
            );
        }
        return $this->_user;
    }

References CAS_Client\$_user, and phpCAS\error().

Referenced by CAS_Client\getProxiedService(), CAS_Client\getUser(), and CAS_Client\isAuthenticated().

Here is the call graph for this function:

Here is the caller graph for this function:

_hasAttribute()

CAS_Client::_hasAttribute (   $key )

private

Check whether a specific attribute with a name is available.

Parameters

string

$key

name of attribute

Returns

bool is attribute available

Definition at line 1237 of file Client.php.

    {
        return (is_array($this->_attributes)
            && array_key_exists($key, $this->_attributes));
    }

Referenced by CAS_Client\getAttribute(), and CAS_Client\hasAttribute().

Here is the caller graph for this function:

_isLogoutRequest()

CAS_Client::_isLogoutRequest ( )

private

Check of the current request is a logout request.

Returns

bool is logout request.

Definition at line 1749 of file Client.php.

    {
        return !empty($_POST['logoutRequest']);
    }

References $_POST.

Referenced by CAS_Client\__construct(), and CAS_Client\handleLogoutRequests().

Here is the caller graph for this function:

_setUser()

CAS_Client::_setUser (   $user )

private

This method sets the CAS user's login name.

Parameters

string

$user

the login name of the authenticated user.

Returns

void

Definition at line 1121 of file Client.php.

    {
        $this->_user = $user;
    }

Referenced by CAS_Client\_wasPreviouslyAuthenticated().

Here is the caller graph for this function:

_wasPreviouslyAuthenticated()

CAS_Client::_wasPreviouslyAuthenticated ( )

private

This method tells if the user has already been (previously) authenticated by looking into the session variables.

Note

This function switches to callback mode when needed.

Returns

true when the user has already been authenticated; false otherwise.

Definition at line 1578 of file Client.php.

    {
        phpCAS::traceBegin();
 
        if ($this->_isCallbackMode()) {
            // Rebroadcast the pgtIou and pgtId to all nodes
            if ($this->_rebroadcast && !isset($_POST['rebroadcast'])) {
                $this->_rebroadcast(self::PGTIOU);
            }
            $this->_callback();
        }
 
        $auth = false;
 
        if ($this->isProxy()) {
            // CAS proxy: username and PGT must be present
            if ($this->isSessionAuthenticated()
                && !empty($_SESSION['phpCAS']['pgt'])
            ) {
                // authentication already done
                $this->_setUser($_SESSION['phpCAS']['user']);
                if (isset($_SESSION['phpCAS']['attributes'])) {
                    $this->setAttributes($_SESSION['phpCAS']['attributes']);
                }
                $this->_setPGT($_SESSION['phpCAS']['pgt']);
                phpCAS::trace(
                    'user = `' . $_SESSION['phpCAS']['user'] . '\', PGT = `'
                    . $_SESSION['phpCAS']['pgt'] . '\''
                );
 
                // Include the list of proxies
                if (isset($_SESSION['phpCAS']['proxies'])) {
                    $this->_setProxies($_SESSION['phpCAS']['proxies']);
                    phpCAS::trace(
                        'proxies = "'
                        . implode('", "', $_SESSION['phpCAS']['proxies']) . '"'
                    );
                }
 
                $auth = true;
            } elseif ($this->isSessionAuthenticated()
                && empty($_SESSION['phpCAS']['pgt'])
            ) {
                // these two variables should be empty or not empty at the same time
                phpCAS::trace(
                    'username found (`' . $_SESSION['phpCAS']['user']
                    . '\') but PGT is empty'
                );
                // unset all tickets to enforce authentication
                unset($_SESSION['phpCAS']);
                $this->setTicket('');
            } elseif (!$this->isSessionAuthenticated()
                && !empty($_SESSION['phpCAS']['pgt'])
            ) {
                // these two variables should be empty or not empty at the same time
                phpCAS::trace(
                    'PGT found (`' . $_SESSION['phpCAS']['pgt']
                    . '\') but username is empty'
                );
                // unset all tickets to enforce authentication
                unset($_SESSION['phpCAS']);
                $this->setTicket('');
            } else {
                phpCAS::trace('neither user nor PGT found');
            }
        } else {
            // `simple' CAS client (not a proxy): username must be present
            if ($this->isSessionAuthenticated()) {
                // authentication already done
                $this->_setUser($_SESSION['phpCAS']['user']);
                if (isset($_SESSION['phpCAS']['attributes'])) {
                    $this->setAttributes($_SESSION['phpCAS']['attributes']);
                }
                phpCAS::trace('user = `' . $_SESSION['phpCAS']['user'] . '\'');
 
                // Include the list of proxies
                if (isset($_SESSION['phpCAS']['proxies'])) {
                    $this->_setProxies($_SESSION['phpCAS']['proxies']);
                    phpCAS::trace(
                        'proxies = "'
                        . implode('", "', $_SESSION['phpCAS']['proxies']) . '"'
                    );
                }
 
                $auth = true;
            } else {
                phpCAS::trace('no user found');
            }
        }
 
        phpCAS::traceEnd($auth);
        return $auth;
    }

References $_POST, $_SESSION, $auth, CAS_Client\_callback(), CAS_Client\_isCallbackMode(), CAS_Client\_rebroadcast(), CAS_Client\_setPGT(), CAS_Client\_setProxies(), CAS_Client\_setUser(), CAS_Client\isProxy(), CAS_Client\isSessionAuthenticated(), CAS_Client\setAttributes(), CAS_Client\setTicket(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Referenced by CAS_Client\isAuthenticated().

Here is the call graph for this function:

Here is the caller graph for this function:

checkAuthentication()

CAS_Client::checkAuthentication

(

)

This method is called to check whether the user is authenticated or not.

Returns

true when the user is authenticated, false when a previous gateway login failed or the function will not return if the user is redirected to the cas server for a gateway login attempt

Definition at line 1344 of file Client.php.

    {
        phpCAS::traceBegin();
        $res = false;
        if ($this->isAuthenticated()) {
            phpCAS::trace('user is authenticated');
            /* The 'auth_checked' variable is removed just in case it's set. */
            unset($_SESSION['phpCAS']['auth_checked']);
            $res = true;
        } elseif (isset($_SESSION['phpCAS']['auth_checked'])) {
            // the previous request has redirected the client to the CAS server
            // with gateway=true
            unset($_SESSION['phpCAS']['auth_checked']);
            $res = false;
        } else {
            // avoid a check against CAS on every request
            if (!isset($_SESSION['phpCAS']['unauth_count'])) {
                $_SESSION['phpCAS']['unauth_count'] = -2; // uninitialized
            }
 
            if (($_SESSION['phpCAS']['unauth_count'] != -2
                && $this->_cache_times_for_auth_recheck == -1)
                || ($_SESSION['phpCAS']['unauth_count'] >= 0
                && $_SESSION['phpCAS']['unauth_count'] < $this->_cache_times_for_auth_recheck)
            ) {
                $res = false;
 
                if ($this->_cache_times_for_auth_recheck != -1) {
                    $_SESSION['phpCAS']['unauth_count']++;
                    phpCAS::trace(
                        'user is not authenticated (cached for '
                        . $_SESSION['phpCAS']['unauth_count'] . ' times of '
                        . $this->_cache_times_for_auth_recheck . ')'
                    );
                } else {
                    phpCAS::trace(
                        'user is not authenticated (cached for until login pressed)'
                    );
                }
            } else {
                $_SESSION['phpCAS']['unauth_count'] = 0;
                $_SESSION['phpCAS']['auth_checked'] = true;
                phpCAS::trace('user is not authenticated (cache reset)');
                $this->redirectToCas(true/* gateway */);
                // never reached
                $res = false;
            }
        }
        phpCAS::traceEnd($res);
        return $res;
    }

References $_SESSION, $res, CAS_Client\isAuthenticated(), CAS_Client\redirectToCas(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Here is the call graph for this function:

forceAuthentication()

CAS_Client::forceAuthentication

(

)

This method is called to be sure that the user is authenticated.

When not authenticated, halt by redirecting to the CAS server; otherwise return true.

Returns

true when the user is authenticated; otherwise halt.

Definition at line 1292 of file Client.php.

    {
        phpCAS::traceBegin();
 
        if ($this->isAuthenticated()) {
            // the user is authenticated, nothing to be done.
            phpCAS::trace('no need to authenticate');
            $res = true;
        } else {
            // the user is not authenticated, redirect to the CAS server
            if (isset($_SESSION['phpCAS']['auth_checked'])) {
                unset($_SESSION['phpCAS']['auth_checked']);
            }
            $this->redirectToCas(false/* no gateway */);
            // never reached
            $res = false;
        }
        phpCAS::traceEnd($res);
        return $res;
    }

References $_SESSION, $res, CAS_Client\isAuthenticated(), CAS_Client\redirectToCas(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Here is the call graph for this function:

getAttribute()

CAS_Client::getAttribute

(

$key

)

Get a specific attribute by name.

Parameters

string

$key

name of attribute

Returns

string attribute values

Definition at line 1250 of file Client.php.

    {
        // Sequence validation
        $this->ensureAuthenticationCallSuccessful();
 
        if ($this->_hasAttribute($key)) {
            return $this->_attributes[$key];
        }
    }

References CAS_Client\_hasAttribute(), and CAS_Client\ensureAuthenticationCallSuccessful().

Here is the call graph for this function:

getAttributes()

CAS_Client::getAttributes

(

)

Get an key values arry of attributes.

Returns

arry of attributes

Definition at line 1188 of file Client.php.

    {
        // Sequence validation
        $this->ensureAuthenticationCallSuccessful();
        // This is likely a duplicate check that could be removed....
        if (empty($this->_user)) {
            // if no user is set, there shouldn't be any attributes also...
            phpCAS::error(
                'this method should be used only after ' . __CLASS__
                . '::forceAuthentication() or ' . __CLASS__ . '::isAuthenticated()'
            );
        }
        return $this->_attributes;
    }

References CAS_Client\$_attributes, CAS_Client\ensureAuthenticationCallSuccessful(), and phpCAS\error().

Here is the call graph for this function:

getUser()

CAS_Client::getUser

(

)

This method returns the CAS user's login name.

Returns

string the login name of the authenticated user

Warning

should be called only after CAS_Client::forceAuthentication() or CAS_Client::isAuthenticated(), otherwise halt with an error.

Definition at line 1134 of file Client.php.

    {
        // Sequence validation
        $this->ensureAuthenticationCallSuccessful();
 
        return $this->_getUser();
    }

References CAS_Client\_getUser(), and CAS_Client\ensureAuthenticationCallSuccessful().

Here is the call graph for this function:

handleLogoutRequests()

CAS_Client::handleLogoutRequests	(		$check_client = true,
			$allowed_clients = false
	)

This method handles logout requests.

Parameters

bool	$check_client	true to check the client bofore handling the request, false not to perform any access control. True by default.
bool	$allowed_clients	an array of host names allowed to send logout requests.

Returns

void

Definition at line 1764 of file Client.php.

    {
        phpCAS::traceBegin();
        if (!$this->_isLogoutRequest()) {
            phpCAS::trace("Not a logout request");
            phpCAS::traceEnd();
            return;
        }
        if (!$this->getChangeSessionID()
            && is_null($this->_signoutCallbackFunction)
        ) {
            phpCAS::trace(
                "phpCAS can't handle logout requests if it is not allowed to change session_id."
            );
        }
        phpCAS::trace("Logout requested");
        $decoded_logout_rq = urldecode($_POST['logoutRequest']);
        phpCAS::trace("SAML REQUEST: " . $decoded_logout_rq);
        $allowed = false;
        if ($check_client) {
            if (!$allowed_clients) {
                $allowed_clients = array( $this->_getServerHostname() );
            }
            $client_ip = $_SERVER['REMOTE_ADDR'];
            $client = gethostbyaddr($client_ip);
            phpCAS::trace("Client: " . $client . "/" . $client_ip);
            foreach ($allowed_clients as $allowed_client) {
                if (($client == $allowed_client)
                    || ($client_ip == $allowed_client)
                ) {
                    phpCAS::trace(
                        "Allowed client '" . $allowed_client
                        . "' matches, logout request is allowed"
                    );
                    $allowed = true;
                    break;
                } else {
                    phpCAS::trace(
                        "Allowed client '" . $allowed_client . "' does not match"
                    );
                }
            }
        } else {
            phpCAS::trace("No access control set");
            $allowed = true;
        }
        // If Logout command is permitted proceed with the logout
        if ($allowed) {
            phpCAS::trace("Logout command allowed");
            // Rebroadcast the logout request
            if ($this->_rebroadcast && !isset($_POST['rebroadcast'])) {
                $this->_rebroadcast(self::LOGOUT);
            }
            // Extract the ticket from the SAML Request
            preg_match(
                "|<samlp:SessionIndex>(.*)</samlp:SessionIndex>|",
                $decoded_logout_rq,
                $tick,
                PREG_OFFSET_CAPTURE,
                3
            );
            $wrappedSamlSessionIndex = preg_replace(
                '|<samlp:SessionIndex>|',
                '',
                $tick[0][0]
            );
            $ticket2logout = preg_replace(
                '|</samlp:SessionIndex>|',
                '',
                $wrappedSamlSessionIndex
            );
            phpCAS::trace("Ticket to logout: " . $ticket2logout);
 
            // call the post-authenticate callback if registered.
            if ($this->_signoutCallbackFunction) {
                $args = $this->_signoutCallbackArgs;
                array_unshift($args, $ticket2logout);
                call_user_func_array($this->_signoutCallbackFunction, $args);
            }
 
            // If phpCAS is managing the session_id, destroy session thanks to
            // session_id.
            if ($this->getChangeSessionID()) {
                $session_id = preg_replace('/[^a-zA-Z0-9\-]/', '', $ticket2logout);
                phpCAS::trace("Session id: " . $session_id);
 
                // destroy a possible application session created before phpcas
                if (session_id() !== "") {
                    session_unset();
                    session_destroy();
                }
                // fix session ID
                session_id($session_id);
                $_COOKIE[session_name()] = $session_id;
                $_GET[session_name()] = $session_id;
 
                // Overwrite session
                session_start();
                session_unset();
                session_destroy();
                phpCAS::trace("Session " . $session_id . " destroyed");
            }
        } else {
            phpCAS::error("Unauthorized logout request from client '" . $client . "'");
            phpCAS::trace("Unauthorized logout request from client '" . $client . "'");
        }
        flush();
        phpCAS::traceExit();
        throw new CAS_GracefullTerminationException();
    }

References $_COOKIE, $_GET, $_POST, $_SERVER, CAS_Client\$_signoutCallbackArgs, $client, CAS_Client\_getServerHostname(), CAS_Client\_isLogoutRequest(), CAS_Client\_rebroadcast(), phpCAS\error(), CAS_Client\getChangeSessionID(), phpCAS\trace(), phpCAS\traceBegin(), phpCAS\traceEnd(), and phpCAS\traceExit().

Here is the call graph for this function:

hasAttribute()

CAS_Client::hasAttribute

(

$key

)

Check whether a specific attribute with a name is available.

Parameters

string

$key

name of attribute

Returns

bool is attribute available

Definition at line 1222 of file Client.php.

    {
        // Sequence validation
        $this->ensureAuthenticationCallSuccessful();
 
        return $this->_hasAttribute($key);
    }

References CAS_Client\_hasAttribute(), and CAS_Client\ensureAuthenticationCallSuccessful().

Here is the call graph for this function:

hasAttributes()

CAS_Client::hasAttributes

(

)

Check whether attributes are available.

Returns

bool attributes available

Definition at line 1208 of file Client.php.

    {
        // Sequence validation
        $this->ensureAuthenticationCallSuccessful();
 
        return !empty($this->_attributes);
    }

References CAS_Client\ensureAuthenticationCallSuccessful().

Here is the call graph for this function:

isAuthenticated()

CAS_Client::isAuthenticated

(

$renew = false

)

This method is called to check if the user is authenticated (previously or by tickets given in the URL).

Parameters

bool

$renew

true to force the authentication with the CAS server

Returns

true when the user is authenticated. Also may redirect to the same URL without the ticket.

Definition at line 1405 of file Client.php.

    {
        phpCAS::traceBegin();
        $res = false;
        $validate_url = '';
        if ($this->_wasPreviouslyAuthenticated()) {
            if ($this->hasTicket()) {
                // User has a additional ticket but was already authenticated
                phpCAS::trace(
                    'ticket was present and will be discarded, use renewAuthenticate()'
                );
                if ($this->_clearTicketsFromUrl) {
                    phpCAS::trace("Prepare redirect to : " . $this->getURL());
                    session_write_close();
                    header('Location: ' . $this->getURL());
                    flush();
                    phpCAS::traceExit();
                    throw new CAS_GracefullTerminationException();
                } else {
                    phpCAS::trace(
                        'Already authenticated, but skipping ticket clearing since setNoClearTicketsFromUrl() was used.'
                    );
                    $res = true;
                }
            } else {
                // the user has already (previously during the session) been
                // authenticated, nothing to be done.
                phpCAS::trace(
                    'user was already authenticated, no need to look for tickets'
                );
                $res = true;
            }
 
            // Mark the auth-check as complete to allow post-authentication
            // callbacks to make use of phpCAS::getUser() and similar methods
            $this->markAuthenticationCall($res);
        } else {
            if ($this->hasTicket()) {
                switch ($this->getServerVersion()) {
                case CAS_VERSION_1_0:
                    // if a Service Ticket was given, validate it
                    phpCAS::trace(
                        'CAS 1.0 ticket `' . $this->getTicket() . '\' is present'
                    );
                    $this->validateCAS10(
                        $validate_url,
                        $text_response,
                        $tree_response,
                        $renew
                    ); // if it fails, it halts
                    phpCAS::trace(
                        'CAS 1.0 ticket `' . $this->getTicket() . '\' was validated'
                    );
                    $_SESSION['phpCAS']['user'] = $this->_getUser();
                    $res = true;
                    $logoutTicket = $this->getTicket();
                    break;
                case CAS_VERSION_2_0:
                case CAS_VERSION_3_0:
                    // if a Proxy Ticket was given, validate it
                    phpCAS::trace(
                        'CAS ' . $this->getServerVersion() . ' ticket `' . $this->getTicket() . '\' is present'
                    );
                    $this->validateCAS20(
                        $validate_url,
                        $text_response,
                        $tree_response,
                        $renew
                    ); // note: if it fails, it halts
                    phpCAS::trace(
                        'CAS ' . $this->getServerVersion() . ' ticket `' . $this->getTicket() . '\' was validated'
                    );
                    if ($this->isProxy()) {
                        $this->_validatePGT(
                            $validate_url,
                            $text_response,
                            $tree_response
                        ); // idem
                        phpCAS::trace('PGT `' . $this->_getPGT() . '\' was validated');
                        $_SESSION['phpCAS']['pgt'] = $this->_getPGT();
                    }
                    $_SESSION['phpCAS']['user'] = $this->_getUser();
                    if (!empty($this->_attributes)) {
                        $_SESSION['phpCAS']['attributes'] = $this->_attributes;
                    }
                    $proxies = $this->getProxies();
                    if (!empty($proxies)) {
                        $_SESSION['phpCAS']['proxies'] = $this->getProxies();
                    }
                    $res = true;
                    $logoutTicket = $this->getTicket();
                    break;
                case SAML_VERSION_1_1:
                    // if we have a SAML ticket, validate it.
                    phpCAS::trace(
                        'SAML 1.1 ticket `' . $this->getTicket() . '\' is present'
                    );
                    $this->validateSA(
                        $validate_url,
                        $text_response,
                        $tree_response,
                        $renew
                    ); // if it fails, it halts
                    phpCAS::trace(
                        'SAML 1.1 ticket `' . $this->getTicket() . '\' was validated'
                    );
                    $_SESSION['phpCAS']['user'] = $this->_getUser();
                    $_SESSION['phpCAS']['attributes'] = $this->_attributes;
                    $res = true;
                    $logoutTicket = $this->getTicket();
                    break;
                default:
                    phpCAS::trace('Protocoll error');
                    break;
                }
            } else {
                // no ticket given, not authenticated
                phpCAS::trace('no ticket found');
            }
 
            // Mark the auth-check as complete to allow post-authentication
            // callbacks to make use of phpCAS::getUser() and similar methods
            $this->markAuthenticationCall($res);
 
            if ($res) {
                // call the post-authenticate callback if registered.
                if ($this->_postAuthenticateCallbackFunction) {
                    $args = $this->_postAuthenticateCallbackArgs;
                    array_unshift($args, $logoutTicket);
                    call_user_func_array(
                        $this->_postAuthenticateCallbackFunction,
                        $args
                    );
                }
 
                // if called with a ticket parameter, we need to redirect to the
                // app without the ticket so that CAS-ification is transparent
                // to the browser (for later POSTS) most of the checks and
                // errors should have been made now, so we're safe for redirect
                // without masking error messages. remove the ticket as a
                // security precaution to prevent a ticket in the HTTP_REFERRER
                if ($this->_clearTicketsFromUrl) {
                    phpCAS::trace("Prepare redirect to : " . $this->getURL());
                    session_write_close();
                    header('Location: ' . $this->getURL());
                    flush();
                    phpCAS::traceExit();
                    throw new CAS_GracefullTerminationException();
                }
            }
        }
        phpCAS::traceEnd($res);
        return $res;
    }

References $_SESSION, $res, CAS_Client\_getPGT(), CAS_Client\_getUser(), CAS_Client\_validatePGT(), CAS_Client\_wasPreviouslyAuthenticated(), CAS_VERSION_1_0, CAS_VERSION_2_0, CAS_VERSION_3_0, error(), CAS_Client\getServerVersion(), CAS_Client\getTicket(), CAS_Client\getURL(), CAS_Client\hasTicket(), CAS_Client\isProxy(), CAS_Client\markAuthenticationCall(), phpCAS\trace(), phpCAS\traceBegin(), phpCAS\traceEnd(), phpCAS\traceExit(), user(), and CAS_Client\validateSA().

Referenced by CAS_Client\checkAuthentication(), CAS_Client\forceAuthentication(), and CAS_Client\renewAuthentication().

Here is the call graph for this function:

Here is the caller graph for this function:

isSessionAuthenticated()

CAS_Client::isSessionAuthenticated

(

)

This method tells if the current session is authenticated.

Returns

true if authenticated based soley on $_SESSION variable

Definition at line 1565 of file Client.php.

    {
        return !empty($_SESSION['phpCAS']['user']);
    }

References $_SESSION.

Referenced by CAS_Client\__construct(), and CAS_Client\_wasPreviouslyAuthenticated().

Here is the caller graph for this function:

logout()

CAS_Client::logout

(

$params

)

This method is used to logout from CAS.

Parameters

array

$params

an array that contains the optional url and service parameters that will be passed to the CAS server

Returns

void

Definition at line 1710 of file Client.php.

    {
        phpCAS::traceBegin();
        $cas_url = $this->getServerLogoutURL();
        $paramSeparator = '?';
        if (isset($params['url'])) {
            $cas_url = $cas_url . $paramSeparator . "url="
                . urlencode($params['url']);
            $paramSeparator = '&';
        }
        if (isset($params['service'])) {
            $cas_url = $cas_url . $paramSeparator . "service="
                . urlencode($params['service']);
        }
        header('Location: ' . $cas_url);
        phpCAS::trace("Prepare redirect to : " . $cas_url);
 
        phpCAS::trace("Destroying session : " . session_id());
        session_unset();
        session_destroy();
        if (session_status() === PHP_SESSION_NONE) {
            phpCAS::trace("Session terminated");
        } else {
            phpCAS::error("Session was not terminated");
            phpCAS::trace("Session was not terminated");
        }
        $lang = $this->getLangObj();
        $this->printHTMLHeader($lang->getLogout());
        printf('<p>' . $lang->getShouldHaveBeenRedirected() . '</p>', $cas_url);
        $this->printHTMLFooter();
        phpCAS::traceExit();
        throw new CAS_GracefullTerminationException();
    }

References $lang, phpCAS\error(), CAS_Client\getLangObj(), CAS_Client\getServerLogoutURL(), CAS_Client\printHTMLFooter(), CAS_Client\printHTMLHeader(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceExit().

Here is the call graph for this function:

redirectToCas()

CAS_Client::redirectToCas	(		$gateway = false,
			$renew = false
	)

This method is used to redirect the client to the CAS server.

It is used by CAS_Client::forceAuthentication() and CAS_Client::checkAuthentication().

Parameters

bool	$gateway	true to check authentication, false to force it
bool	$renew	true to force the authentication with the CAS server

Returns

void

Definition at line 1682 of file Client.php.

    {
        phpCAS::traceBegin();
        $cas_url = $this->getServerLoginURL($gateway, $renew);
        session_write_close();
        if (php_sapi_name() === 'cli') {
            @header('Location: ' . $cas_url);
        } else {
            header('Location: ' . $cas_url);
        }
        phpCAS::trace("Redirect to : " . $cas_url);
        $lang = $this->getLangObj();
        $this->printHTMLHeader($lang->getAuthenticationWanted());
        printf('<p>' . $lang->getShouldHaveBeenRedirected() . '</p>', $cas_url);
        $this->printHTMLFooter();
        phpCAS::traceExit();
        throw new CAS_GracefullTerminationException();
    }

References $lang, CAS_Client\getLangObj(), CAS_Client\getServerLoginURL(), CAS_Client\printHTMLFooter(), CAS_Client\printHTMLHeader(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceExit().

Referenced by CAS_Client\checkAuthentication(), CAS_Client\forceAuthentication(), and CAS_Client\renewAuthentication().

Here is the call graph for this function:

Here is the caller graph for this function:

renewAuthentication()

CAS_Client::renewAuthentication

(

)

This method is called to renew the authentication of the user If the user is authenticated, renew the connection If not, redirect to CAS.

Returns

true when the user is authenticated; otherwise halt.

Definition at line 1267 of file Client.php.

    {
        phpCAS::traceBegin();
        // Either way, the user is authenticated by CAS
        if (isset($_SESSION['phpCAS']['auth_checked'])) {
            unset($_SESSION['phpCAS']['auth_checked']);
        }
        if ($this->isAuthenticated(true)) {
            phpCAS::trace('user already authenticated');
            $res = true;
        } else {
            $this->redirectToCas(false, true);
            // never reached
            $res = false;
        }
        phpCAS::traceEnd();
        return $res;
    }

References $_SESSION, $res, CAS_Client\isAuthenticated(), CAS_Client\redirectToCas(), phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Here is the call graph for this function:

setAttributes()

CAS_Client::setAttributes

(

$attributes

)

Set an array of attributes.

Parameters

array

$attributes

a key value array of attributes

Returns

void

Definition at line 1178 of file Client.php.

    {
        $this->_attributes = $attributes;
    }

References $attributes.

Referenced by CAS_Client\_wasPreviouslyAuthenticated().

Here is the caller graph for this function:

setCacheTimesForAuthRecheck()

CAS_Client::setCacheTimesForAuthRecheck

(

$n

)

Set the number of times authentication will be cached before rechecked.

Parameters

int

$n

number of times to wait for a recheck

Returns

void

Definition at line 1328 of file Client.php.

    {
        if (gettype($n) != 'integer') {
            throw new CAS_TypeMismatchException($n, '$n', 'string');
        }
 
        $this->_cache_times_for_auth_recheck = $n;
    }

References $n.

Variable Documentation

$_attributes

CAS_Client::$_attributes

private

The Authenticated users attributes.

Written by CAS_Client::setAttributes(), read by CAS_Client::getAttributes().

Attention

client applications should use phpCAS::getAttributes().

Definition at line 1169 of file Client.php.

Referenced by CAS_Client\getAttributes().

$_cache_times_for_auth_recheck

CAS_Client::$_cache_times_for_auth_recheck

private

An integer that gives the number of times authentication will be cached before rechecked.

Definition at line 1319 of file Client.php.

$_user

CAS_Client::$_user

private

The Authenticated user.

Written by CAS_Client::_setUser(), read by CAS_Client::getUser().

Definition at line 1112 of file Client.php.

Referenced by CAS_Client\_getUser().