anz.casclient

This is a Zope PAS plugin that authenticates users against a CAS (Central Authentication Service) server.

These details have not been verified by PyPI

Project links

Homepage

Project description

=====================
anz.casclient README
=====================

:author: jiangdongjin
:contact: eastxing@gmail.com
:date: 2010/09/25
:abstract: This is a Zope PAS plugin that authenticates users against a
CAS (Central Authentication Service) server.

.. contents::
.. sectnum::

Introduction
============
anz.casclient is a PAS plugin that authenticates users against a CAS
(Central Authentication Service) server.

Overview
========
anz.casclient implement a new PAS plugin 'Anz CAS Client'. It enabling you
to integrate your Zope sites into your CAS SSO solutions.

Credits
========
Thanks to those guys who developed the following products, without your
works anz.casclient will never happen.

- CAS_
- `JA-SIG CAS Client for Java 3.1`_
- CAS4PAS_

.. _CAS: http://www.jasig.org/cas
.. _`JA-SIG CAS Client for Java 3.1`: https://wiki.jasig.org/display/CASC/CAS+Client+for+Java+3.1
.. _CAS4PAS: http://plone.org/products/cas4pas

Comparison with CAS4PAS
=======================
CAS4PAS is the first(if not the only)CAS client used in Zope world, but it
has only implemented partial CAS
`protocol <http://www.jasig.org/cas/protocol>`_, so comes anz.casclient.

anz.casclient have some advantages:

- anz.casclient provides full CAS 1.0/2.0 protocol implementation.
- anz.casclient implemented Single-Sign-Out.
- anz.casclient provides a framework that similar as the official java
client implementation, this will make it easy to follow the evolution of
CAS client.

Requirements
============
- Plone 3 or Plone 4
- ZODB3>=3.8.3 (test under 3.8.3 only)
- zope.proxy>=3.4.1 (test under 3.4.1 only)
- zope.bforest

Installation
============
To install anz.casclient into the global Python environment (or a
workingenv), using a traditional Zope 2 instance, you can do this:

* When you're reading this you have probably already run
``easy_install anz.casclient``. Find out how to install setuptools
(and EasyInstall) here:
http://peak.telecommunity.com/DevCenter/EasyInstall

* Create a file called ``anz.casclient-configure.zcml`` in the
``/path/to/instance/etc/package-includes`` directory. The file
should only contain this::

<include package="anz.casclient" />

Alternatively, if you are using zc.buildout and the
plone.recipe.zope2instance recipe to manage your project, you can do this:

* Add ``anz.casclient`` to the list of eggs to install, e.g.:

::

[buildout]
...
eggs =
...
anz.casclient

* Tell the plone.recipe.zope2instance recipe to install a ZCML slug:

::

[instance]
recipe = plone.recipe.zope2instance
...
zcml =
anz.casclient

* Re-run buildout, e.g. with:

::

. / b i n / b u i l d o u t Y o u c a n s k i p t h e Z C M L s l u g i f y o u a r e g o i n g t o e x p l i c i t l y i n c l u d e t h e p a c k a g e f r o m a n o t h e r p a c k a g e^{'} s c o n f i g u r e . z c m l f i l e . H o w t o u s e a n z . c a s c l i e n t ======================== C r e a t e^{'} A n z C A S C l i e n t^{'} p l u g i n - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - G o i n t o Z M I, y o u r p l o n e s i t e \acl_{u} s e r s, a d d a n^{'} A n z C A S C l i e n t^{'} i n s t a n c e, c h o o s e a n y I d y o u l i k e, w e i n p u t^{'} a n z_{c} a s c l i e n t^{'} f o r e x a m p l e . C o n f i g u r e^{'} A n z C A S C l i e n t^{'} p l u g i n - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - G o i n t o y o u r p l o n e s i t e \acl_{u} s e r s \anz_{c} a s c l i e n t, i n^{'} A c t i v e^{'} t a b a c t i v e a l l f o u r i n t e r f a c e . C l i c k^{'} A u t h e n t i c a t i o n^{'} t o c o n f i g u r e^{'} A u t h e n t i c a t i o n P l u g i n s^{'}, m o v e^{'} a n z_{c} a s c l i e n t^{'} t o t h e t o p . C l i c k^{'} C h a l l e n g e^{'} t o c o n f i g u r e^{'} C h a l l e n g e P l u g i n s^{'}, m o v e^{'} a n z_{c} a s c l i e n t^{'} t o t h e t o p . C l i c k^{'} E x t r a c t i o n^{'} t o c o n f i g u r e^{'} E x t r a c t i o n P l u g i n s^{'}, m o v e^{'} a n z_{c} a s c l i e n t^{'} t o t h e t o p . G o i n t o^{'} P r o p e r t i e s^{'} t a b t o c o n f i g u r e C A S r e l a t e d p r o p e r t i e s . ======================================================================= P r o p e r t y R e q u i r e d N o t e s e r v i c e U r l F a l s e A n i d e n t i f y o f c u r r e n t s e r v i c e . C A S w i l l r e d i r e c t s t o h e r e a f t e r l o g i n . S e t t h i s e x p l i c i t l y b u t n o t d e t e r m i n e i t a u t o m a t i c a l l y f r o m r e q u e s t m a k e s u s g e t m o r e s e c u r i t y a s s u r a n c e . S e e ‘ h e r e < h t t p s : / / w i k i . j a s i g . o r g / d i s p l a y / C A S C / C A S F i l t e r > ‘_{.} c a s S e r v e r U r l P r e f i x T r u e T h e s t a r t o f t h e C A S s e r v e r U R L . u s e S e s s i o n F a l s e W h e t h e r t o s t o r e t h e A s s e r t i o n i n s e s s i o n o r n o t . I f s e s s i o n s a r e n o t u s e d, p r o x y g r a n t i n g t i c k e t w i l l b e r e q u i r e d f o r e a c h r e q u e s t . D e f a u l t s e t t o T r u e . r e n e w F a l s e I f s e t t o T r u e, C A S w i l l a s k u s e r f o r c r e d e n t i a l s a g a i n t o a u t h e n t i c a t e, t h i s m a y b e u s e d f o r h i g h - s e c u r i t y a p p l i c a t i o n s . D e f a u l t s e t t o F a l s e . g a t e w a y F a l s e I f s e t t o T r u e, C A S w i l l n o t a s k t h e u s e r f o r c r e d e n t i a l s . I f t h e u s e r h a s a p r e - e x i s t i n g s i n g l e s i g n - o n s e s s i o n w i t h C A S, o r i f a s i n g l e s i g n - o n s e s s i o n c a n b e e s t a b l i s h e d t h r o u g h n o n - i n t e r a c t i v e m e a n s (i . e . t r u s t a u t h e n t i c a t i o n), C A S M A Y r e d i r e c t t h e c l i e n t t o t h e U R L s p e c i f i e d b y t h e " s e r v i c e " p a r a m e t e r, a p p e n d i n g a v a l i d s e r v i c e t i c k e t . (C A S a l s o M A Y i n t e r p o s e a n a d v i s o r y p a g e i n f o r m i n g t h e c l i e n t t h a t a C A S a u t h e n t i c a t i o n h a s t a k e n p l a c e .) I f t h e c l i e n t d o e s n o t h a v e a s i n g l e s i g n - o n s e s s i o n w i t h C A S, a n d a n o n - i n t e r a c t i v e a u t h e n t i c a t i o n c a n n o t b e e s t a b l i s h e d, C A S M U S T r e d i r e c t t h e c l i e n t t o t h e U R L s p e c i f i e d b y t h e " s e r v i c e " p a r a m e t e r w i t h n o " t i c k e t " p a r a m e t e r a p p e n d e d t o t h e U R L . I f t h e " s e r v i c e " p a r a m e t e r i s n o t s p e c i f i e d a n d " g a t e w a y " i s s e t, t h e b e h a v i o r o f C A S i s u n d e f i n e d . I t i s R E C O M M E N D E D t h a t i n t h i s c a s e, C A S r e q u e s t c r e d e n t i a l s a s i f n e i t h e r p a r a m e t e r w a s s p e c i f i e d . T h i s p a r a m e t e r i s n o t c o m p a t i b l e w i t h t h e " r e n e w " p a r a m e t e r . B e h a v i o r i s u n d e f i n e d i f b o t h a r e s e t t o T r u e . S e e d e t a i l s ‘ h e r e_{<} h t t p : / / w w w . j a s i g . o r g / c a s / c l i e n t - i n t e g r a t i o n / g a t e w a y > ‘_{.} t i c k e t V a l i d a t i o n S p e c i f i c a t i o n T r u e U s e w h i c h C A S p r o t o c o l t o v a l i d a t e t i c k e t . o n e o f [^{'} C A S {1.0}^{'},^{'} C A S {2.0}^{'}] p r o x y C a l l b a c k U r l P r e f i x F a l s e T h e s t a r t o f t h e p r o x y c a l l b a c k u r l . Y o u s h o u l d s e t i t p o i n t t o c u r r e n t p l u g i n w i t h p r o t o c o l^{'} h t t p s^{'} . T h e r e s u l t u r l w i l l b e^{'} p r o x y C a l l b a c k U r l P r e f i x / p r o x y C a l l b a c k^{'} . I f s e t, i t m e a n s t h i s s e r v i c e w i l l b e u s e d a s a p r o x i e r t o a c c e s s b a c k - e n d s e r v i c e o n b e h a l f o f a p a r t i c u l a r u s e r . a c c e p t A n y P r o x y F a l s e W h e t h e r a n y p r o x y i s O K . A l l o w e d P r o x y C h a i n s F a l s e A l l o w e d p r o x y c h a i n s . E a c h a c c e p t a b l e p r o x y c h a i n s h o u l d i n c l u d e a s p a c e - s e p a r a t e d l i s t o f U R L s . T h e s e U R L s a r e p r o x i e r^{'} s p r o x y C a l l b a c k U r l . ======================================================================= E x a m p l e c o n f i g u r e s : - S e t^{'} s e r v i c e U r l^{'} t o^{'} h t t p : / / m y p l o n e s i t e d o m a i n : p o r t / p l o n e^{'} - S e t^{'} c a s S e r v e r U r l P r e f i x^{'} t o^{'} h t t p s : / / m y c a s s e r v e r d o m a i n : p o r t / c a s^{'} - S e t^{'} u s e S e s s i o n^{'} t o T r u e - S e t^{'} r e n e w^{'} t o F a l s e - S e t^{'} g a t e w a y^{'} t o F a l s e - S e t^{'} t i c k e t V a l i d a t i o n S p e c i f i c a t i o n^{'} t o^{'} C A S {2.0}^{'} - S e t^{'} p r o x y C a l l b a c k U r l P r e f i x^{'} t o^{'} h t t p s : / / m y p l o n e s i t e d o m a i n : p o r t / p l o n e / a c l_{u} s e r s / a n z_{c} a s c l i e n t^{'} - S e t^{'} a c c e p t A n y P r o x y^{'} t o F a l s e - S e t^{'} A l l o w e d P r o x y C h a i n s^{'} t o N o n e C o n f i g u r e^{'} C A S l o g i n^{'} e n t r a n c e - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - I f y o u u s e^{'} L o g i n^{'} l i n k a t t h e u p p e r - r i g h t o f t h e P l o n e p a g e t o l o g i n, y o u s h o u l d h i d e t h e s t o c k P l o n e^{'} L o g i n^{'} a c t i o n f i r s t . T h e n a d d a n e w o n e n a m e d^{'} C A S l o g i n^{'} t h e r e, s e t U R L (E x p r e s s i o n) t o * *^{'} s t r i n g :

{globals_view/navigationRootUrl}/caslogin'**

Then add a Script(Python) named '**caslogin**' into 'portal_skins/custom',
its contents looks like:

::

## Script (Python) "caslogin"
##bind container=container
##bind context=context
##bind namespace=
##bind script=script
##bind subpath=traverse_subpath
##parameters=
##title=CAS Login
##
request = container.REQUEST

portal = context.portal_url.getPortalObject()
plugin = portal.acl_users.anz_casclient

if plugin.casServerUrlPrefix:
url = plugin.getLoginURL() + '?service=' + plugin.getService()
if plugin.renew:
url += '&renew=true'
if plugin.gateway:
url += '&gateway=true'

request.RESPONSE.redirect( url, lock=1 )

If you use 'login portlet' to login, you should remove the stock Plone
'login portlet' first so as not to confuse users. Then you should write a
new 'CAS login portlet' to authenticate users against CAS or customize
collective.castle_ to work with anz.casclient.

.. _collective.castle: http://plone.org/products/collective.castle/

Configure 'CAS logout' entrance
-------------------------------
If you use 'Log out' link at the upper-right of the Plone page to logout,
you should hide the stock Plone 'Log out' action first. Then add a new one
named 'CAS log out' there, set URL(Expression) to
**'string:${globals_view/navigationRootUrl}/caslogout'**

Then add a Script(Python) named '**caslogout**' into 'portal_skins/custom',
its contents looks like:

::

## Script (Python) "caslogout"
##bind container=container
##bind context=context
##bind namespace=
##bind script=script
##bind subpath=traverse_subpath
##parameters=
##title=CAS Logout
##
from Products.CMFCore.utils import getToolByName

request = container.REQUEST
portal = context.portal_url.getPortalObject()
cas_client_plugin = portal.acl_users.anz_casclient

mt = getToolByName( context, 'portal_membership' )
mt.logoutUser( REQUEST=request )

request.RESPONSE.redirect( cas_client_plugin.casServerUrlPrefix + '/logout' )

How to use proxy authentication
===============================
Proxy authentication is added by CAS 2.0, for the reason why do we need
it, you can see the details `here. <http://www.jasig.org/cas/proxy-authentication>`_

1. Create two plone sites in one Zope instance, called them **plone** and
**backend**.
2. Create and configure 'Anz CAS Client' plugin on them(make sure both sites
can authenticate users against your CAS server).
3. anz.casclient carried a simple example to show how to use it, but it need
you to do a little customization. Open
**anz.casclient\anz\casclient\proxyauthexample\view.py** with your
favorite editor, find **__init__** method and modify it to suit your
situation:

::

def __init__( self, context, request ):
super(ProxyAuthExampleView, self).__init__( context, request )

# eg. http://xx.xx.xx.xx:8080/backend
self.BACK_END_SERVICE_URL = 'http://{domain of your zope instance}:{port}/backend'

# eg. /plone/acl_users/anz_casclient
self.PATH_TO_PROXIER_PLUGIN = '/plone/acl_users/anz_casclient'

# eg. /backend/acl_users/anz_casclient
self.PATH_TO_BACK_END_PLUGIN = '/backend/acl_users/anz_casclient'

4. After that restart your Zope, open a browser and login into site
**plone** ( suppose user name is **tom** ).
5. Modify location in your browser to
**http://{domain of your zope instance}:{port}/plone/@@proxyAuthExample/getUserInfoFromTargetService**
and click Enter, if all things goes well, you'll see:

::

Hello, tom!

SAML service ticket validation
==============================
From version 1.1, the server is able to connect to a CAS server 3.x and above
and validate the service ticket (ST) against the CAS server using SAML, in order
to retrieve the extra fields for the authenticated user that the CAS server may
be providing. To use his feature, it's required to configure the plugin to use
the SAML validation by configuring the **SAMLValidate** property to ``True``.

In order to do something with the retrieved properties an event
``ISAMLPropertiesExist`` is emmited for a subscriber to be hooked into it.

ToDo
====
* Add automation tests ( I really don't know how to automation test this
kind of package :) )

Changelog
=========

1.1.1 (2015-08-06)
----------------

- Fix release.

1.1 (2015-08-06)
----------------
- Fixed a problem in Plone 4.3 that forces to cast the resultant username to an
str before passing it to plone.session for session creation. It's needed to
cast username which is an unicode type to an str as plone.session does a
direct concatenation of unicode username and other string types that leads to
an UnicodeDecode error otherwise. It's needed to address plone.session to do
not so. Meanwhile, casting the username assumes that there are non ascii
chars in it [sneridagh]

- Fixed a problem when used in a Zope/ZEO environment with multiple Zope
clients. Make it work using the default Plone session factory solved the
problem. [sneridagh]

- Clean paster plugins in setup.py [sneridagh]

- Add an extra validation for CAS2.0 service ticket via SAML. This enables the
extraction of extra user properties. [sneridagh]

1.0.1
-----

- Update to support Plone4.

Note: When used under Plone3, please pin products version like this::

ZODB3==3.8.3
zope.proxy==3.4.1

1.0
---

- Initial release

Algorithm	Hash digest
SHA256	`e04a10b6202377af9b509e76a0d851be9e55409fb682a0dda3dd1e3d5101a41f`
MD5	`5afd15f0cf40a2bf85928fb00a4dde08`
BLAKE2b-256	`ae6d93e8d9f49d86446d30990b6c8cfe27fb67cf5b4302af1efbdb27ccad9ecc`

anz.casclient 1.1.1

Navigation

Verified details

Maintainers

Unverified details

Project links

Meta

Classifiers

Project description

Project details

Verified details

Maintainers

Unverified details

Project links

Meta

Classifiers

Release history Release notifications | RSS feed

Download files

Source Distribution

File details

File metadata

File hashes