Added support for serviceValidate and getting attributes from cas response by...

Added support for serviceValidate and getting attributes from cas response by specifying a list of attribute to XPath mappings


git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@508 44740490-163a-0410-bde0-09ae8108e29a

www/auth/login-cas-ldap.php

@@ -32,7 +32,9 @@ try {
 		throw new Exception('No CAS authentication configuration for this SAML 2.0 entity ID [' . $idpentityid . ']');
 	}
 
-	$idpconfig = $casldapconfig[$idpentityid];
+	$casconfig = $casldapconfig[$idpentityid]['cas'];
+	$ldapconfig = $casldapconfig[$idpentityid]['ldap'];
+	
 	
 } catch (Exception $exception) {
 	SimpleSAML_Utilities::fatalError($session->getTrackID(), 'METADATA', $exception);
@@ -61,13 +63,44 @@ function casValidate($cas) {
 		$ticket = urlencode($_GET['ticket']);
 	
 		#ini_set('default_socket_timeout', 15);
-		$result = file_get_contents($cas['validate'] . '?ticket=' . $ticket . '&service=' . urlencode($service) );
-		$res = preg_split("/\n/",$result);
-		
-		if (strcmp($res[0], "yes") == 0) {
-			return $res[1];
+
+		if (isset($cas['validate'])) { # cas v1 yes|no\r<username> style
+			$paramPrefix = strpos($cas['validate'], '?') ? '&' : '?';
+			$result = file_get_contents($cas['validate'] . $paramPrefix . 'ticket=' . $ticket . '&service=' . urlencode($service) );
+			$res = preg_split("/\n/",$result);
+			
+			if (strcmp($res[0], "yes") == 0) {
+				return array($res[1], array());
+			} else {
+				throw new Exception("Failed to validate CAS service ticket: $ticket");
+			}
+		} elseif (isset($cas['serviceValidate'])) { # cas v2 xml style
+			$paramPrefix = strpos($cas['serviceValidate'], '?') ? '&' : '?';
+
+			$result = file_get_contents($cas['serviceValidate'] . $paramPrefix . 'ticket=' . $ticket . '&service=' . urlencode($service) );
+
+			$dom = DOMDocument::loadXML($result);
+			$xPath = new DOMXpath($dom);
+			$xPath->registerNamespace("cas", 'http://www.yale.edu/tp/cas');
+			$success = $xPath->query("/cas:serviceResponse/cas:authenticationSuccess/cas:user");
+			if ($success->length == 0) {
+				$failure = $xPath->evaluate("/cas:serviceResponse/cas:authenticationFailure");
+				throw new Exception("Error when validating CAS service ticket: " . $failure->item(0)->textContent);
+			} else {
+				
+				$attributes = array();
+				if ($casattributes = $cas['attributes']) { # some has attributes in the xml - attributes is a list of XPath expressions to get them
+					foreach ($casattributes as $name => $query) {
+						$attrs = $xPath->query($query);
+						foreach ($attrs as $attrvalue) $attributes[$name][] = $attrvalue->textContent;
+					}
+				}
+				$casusername = $success->item(0)->textContent;
+				
+				return array($casusername, $attributes);
+			}
 		} else {
-			throw new Exception("Failed to validate CAS service ticket: $ticket");
+			throw new Exception("validate or serviceValidate not specified");
 		}
 	
 	/**
@@ -76,7 +109,6 @@ function casValidate($cas) {
 	} else {
 		SimpleSAML_Logger::info("AUTH - cas-ldap: redirecting to {$cas['login']}");
 		SimpleSAML_Utilities::redirect($cas['login'], array(
-			'renew' => 'true',
 			'service' => $service
 		));		
 	}
@@ -85,41 +117,19 @@ function casValidate($cas) {
 
 
 try {
-
-
-
-
-
+	
 	$relaystate = $_REQUEST['RelayState'];
 
-	$username = casValidate($idpconfig['cas']);
-	SimpleSAML_Logger::info('AUTH - cas-ldap: '. $username . ' authenticated by ' . $idpconfig['cas']['validate']);
-	
+	list($username, $casattributes) = casValidate($casconfig);
 	
-	
-	/*
-	 * Connecting to LDAP.
-	 */
-	$ldap = new SimpleSAML_Auth_LDAP($idpconfig['ldap']['servers'], $idpconfig['ldap']['enable_tls']);
-	
-	if ($idpconfig['ldap']['priv_user_dn']) {
-	
-		if (!$ldap->bind($idpconfig['ldap']['priv_user_dn'], $idpconfig['ldap']['priv_user_pw']) ) {
-			throw new Exception('Could not bind with system user: ' . $idpconfig['ldap']['priv_user_dn']);
-		}
-	}
-	
-	/*
-	 * Search for user in LDAP.
-	 */
-	$dn = $ldap->searchfordn($idpconfig['ldap']['searchbase'], $idpconfig['ldap']['searchattributes'], $username);
-	
-	/*
-	 * Retrieve attributes from LDAP
-	 */
-	$attributes = $ldap->getAttributes($dn, $idpconfig['ldap']['attributes']);
+	SimpleSAML_Logger::info('AUTH - cas-ldap: '. $username . ' authenticated by ' . $casconfig['validate']);
 
-	
+	$ldapattributes = array();
+	if ($ldapconfig['servers']) {
+		$ldap = new SimpleSAML_Auth_LDAP($ldapconfig['servers'], $ldapconfig['enable_tls']);
+		$ldapattributes = $ldap->validate($ldapconfig, $username);
+	}
+	$attributes = array_merge_recursive($casattributes, $ldapattributes);
 	$session->setAuthenticated(true, 'login-cas-ldap');
 	$session->setAttributes($attributes);