README

The bundle make and authenicator with and phpCas based on the login of user. If you want multiple authenticator anser yes for does need passwords => yes.

offical documentation.

Requirements

PHP 8.5
Symfony ^7.4 || ^8.0
apereo/phpcas ^1.6.2

installation

The authenticator use 2 role:

USER
ADMIN

Applications that use Symfony Flex

Open a command console, enter your project directory and execute:

$ composer require dsi-iepg/cas-connection

Create User with login

$ php bin/console make:user

name class => User
store user data in the database => yes
property name => any (the templates use getUserIdentifier())
does need passwords => no

make and play migrations with Doctrine.

files modifications

Add in config/bundles.php

    return [
      ...
        Iepg\Bundle\Cas\CasConnectionBundle::class => ['all' => true],
    ]

Add in .env

#.env
...
#### Parameters for CAS connection ###
CAS_HOST=cas-adresse.com
# This value is optional
# If it's empty the path will the base url"
# example: scheme://httpHost+BasePath"
CAS_PATH=
# Default value 443"
CAS_PORT=443
# This value is optional
# if it's 'false' you don't use ceretificat
# THIS SETTING IS NOT RECOMMENDED FOR PRODUCTION!
CAS_CA=false
# The path start to the DocumentRoot generaly public
# example if your file was at the root of project 
# CAS_CA_PATH=../certificat
CAS_CA_PATH=
# this value is optional. You can custome the NAME of the dispatcher route
# Where does the user go according to his role 
# The default value is 'cas_dispatcher', also used if the route you name does not exist
CAS_DISPATCHER_NAME=
# this value is optional. YOU CAN CUSTOMIZE THE PAGE WHEN A USER IS SUCCESSFULLY AUTHENTICATED 
# BUT DOES NOT HAVE ACCESS RIGHTS TO THIS APPLICATION
# The variable MUST be defined, even if empty
CAS_USER_UNKNOW=
#### end of Cas-connection ####
...

Add in config/packages/security.yaml

#config/packages/security.yaml
...
   firewalls:
      main:
         provider: app_user_provider
         custom_authenticator: Iepg\Bundle\Cas\Controller\CasAuthenticator
...

Or if you use multiple authenticators

#config/packages/security.yaml
   ...
   firewalls:
      main:
         ...
         #choose the first authenticator you want.
         entry_point: App\Security\AppAuthenticator
         custom_authenticator: 
               - Iepg\Bundle\Cas\Controller\CasAuthenticator
               - App\Security\AppAuthenticator
         ...

And add

 access_control:
        - { path: ^/cas_, roles: PUBLIC_ACCESS  }
        - ...

WARNING! For attention reasons, please avoid starting your own route with 'cas_'

add Files

Add file in config/packages/cas_connection.yaml

#config/packages/cas_connection.yaml
cas_connection:
    cas_host: "%env(CAS_HOST)%"
    cas_path: "%env(CAS_PATH)%"
    cas_port: "%env(int:CAS_PORT)%"
    cas_ca: "%env(bool:CAS_CA)%"
    cas_ca_path: "%env(CAS_CA_PATH)%"
    cas_dispatcher_name: "%env(CAS_DISPATCHER_NAME)%"
    cas_user_unknown: "%env(CAS_USER_UNKNOW)%"

twig:
    paths:
        "%kernel.project_dir%/vendor/dsi-iepg/cas-connection/src/Resources/views": cas_connection

Add in file config/routes.yaml

#config/routes.yaml
cas_connection:
    resource: '@CasConnectionBundle/Resources/config/routes.yaml'

The bundle declares the routes cas_login, cas_dispatcher, cas_unknow-home and cas_logout. No prefix is applied: if you add prefix: /xxx, the URLs become /xxx/cas_login...

redirection after login

If an anonymous user requests a protected page, he is sent back to this page once authenticated (target path stored by the firewall). Otherwise he goes to the dispatcher route.

logout

Enable the logout on your firewall in config/packages/security.yaml, the bundle listens to LogoutEvent and redirects the user to the logout of the CAS server.

#config/packages/security.yaml
   firewalls:
      main:
         ...
         logout:
            path: cas_logout

No custom subscriber is needed anymore (the former logoutSubcriber.php can be deleted).

upgrade from v2 to v3

PHP ^8.5 and Symfony ^7.4 || ^8.0 are now required.
The bundle routes are imported with @CasConnectionBundle/Resources/config/routes.yaml (see above).
The logout is handled by the bundle: enable logout: path: cas_logout on your firewall and delete your own logoutSubcriber.php.
CAS_USER_UNKNOW must be defined in your .env, even if empty.
The user class no longer needs a login property.

dsi-iepg / cas-connection

Package info

Security

Statistics