NAME

Plack::Auth::SSO::CAS - implementation of Plack::Auth::SSO for CAS

SYNOPSIS

#in your app.psgi

builder {

    mount "/auth/cas" => Plack::Auth::SSO::CAS->new(

        session_key => "auth_sso",
        uri_base => "http://localhost:5000",
        authorization_path => "/auth/cas/callback",
        error_path => "/auth/error"

    )->to_app;

    mount "/auth/cas/callback" => sub {

        my $env = shift;
        my $session = Plack::Session->new($env);
        my $auth_sso = $session->get("auth_sso");

        #not authenticated yet
        unless($auth_sso){

            return [403,["Content-Type" => "text/html"],["forbidden"]];

        }

        #process auth_sso (white list, roles ..)

        [200,["Content-Type" => "text/html"],["logged in!"]];

    };

    mount "/auth/error" => sub {

        my $env = shift;
        my $session = Plack::Session->new($env);
        my $auth_sso_error = $session->get("auth_sso_error");

        unless ( $auth_sso_error ) {

            return [ 302, [ Location => $self->uri_for( "/" ) ], [] ];

        }

        [ 200, [ "Content-Type" => "text/plain" ], [
            "Something went wrong. User could not be authenticated against CAS\n",
            "Please report this error:\n",
            $auth_sso_error->{content}
        ]];

    };

};

DESCRIPTION

This is an implementation of Plack::Auth::SSO to authenticate against a CAS server.

It inherits all configuration options from its parent.

CONFIG

cas_url

base url of the CAS service

LOGGING

All subclasses of Plack::Auth::SSO use Log::Any to log messages to the category that equals the current package name.

ERRORS

Cf. https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#253-error-codes

When a ticket arrives, it is checked against the CAS Server. This can lead to the following situations:

* an error occurs. This means that the CAS server is down, or returned an unexpected response. The error type is "unknown":

{
    package => "Plack::Auth::SSO::CAS",
    package_id => "Plack::Auth::SSO::CAS",
    type => "unknown",
    content => "server could not complete request"
}

* the ticket is rejected by the CAS server. When the authentication code is "TICKET_INVALID" the user is redirected back to the CAS server. In other cases the type equals the authentication code, and content equals the error description.

{
    package => "Plack::Auth::SSO::CAS",
    package_id => "Plack::Auth::SSO::CAS",
    type => "INVALID_SERVICE",
    content => "invalid service"
}

TODO

* add an option to ignore validation of the SSL certificate of the CAS Service? For now you should set the environment like this:

export SSL_VERIFY_NONE=1
export PERL_LWP_SSL_VERIFY_HOSTNAME=0

AUTHOR

Nicolas Franck, <nicolas.franck at ugent.be>

SEE ALSO

Plack::Auth::SSO