CAS認證Symfony2

Question

我正在尋找一個捆綁集成CAS認證Symfony 2.3。我發現了這些選項，事實是我沒有說服任何東西，因爲幾乎所有的捆綁包似乎都沒有更新就放棄了。

1.- sensiolabs/CasBundle：https://github.com/sensiolabs/CasBundle 該文檔是稀疏和不完整的。我還沒有找到任何如何使用它的例子。

2.- BeSimple/BeSimpleSsoAuthBundle：https://github.com/BeSimple/BeSimpleSsoAuthBundle 有了這個我正在測試，我有一些問題。我想我已經解決了第四個問題，並且我落後於另一個問題。

3.- Symfony的CAS客戶：https://wiki.jasig.org/display/CASC/Symfony+CAS+Client 完全過時

真的，有這麼幾個選項的symfony與CAS認證？

Answer 1

我以前有同樣的問題，我使用BeSimpleSsoAuthBundle解決它，但你必須做一些改變： 假設你的用戶實體已經實現在你的UserBundle中，並且必須覆蓋一個唯一的屬性sgid ： 1- BeSimple \ SsoAuthBundle \安全\核心\用戶：

<?php 

namespace Application\UserBundle\Security\BeSimple\SpawnedUserProvider; 

use BeSimple\SsoAuthBundle\Security\Core\User\SpawnedUserProvider; 
use Symfony\Component\Security\Core\User\UserInterface; 
use Symfony\Component\Security\Core\User\User; 
use Symfony\Component\HttpFoundation\RedirectResponse; 


class SsoUserProvider extends SpawnedUserProvider 
{ 
/** 
* @var array 
*/ 
private $roles; 

/** 
* Constructor. 
* 
* @param array $roles An array of roles 
*/ 
private $entityManager; 
private $securityContext; 

public function __construct($em, $securityContext) { 
    $this->em = $em; 
    $this->securityContext = $securityContext; 
} 

/** 
* {@inheritdoc} 
*/ 
public function loadUserByUsername($username) 
{ 
    $session = $this->securityContext; 

    $qb = $this->em->createQueryBuilder(); 
    $qb->select("u") 
     ->from('ApplicationUserBundle:User', 'u') 
     ->where('u.sgid = :sgid') 
     ->AndWhere('u.status = 1') 
     ->setParameter("sgid", $username); 

    $result = $qb->getQuery()->getOneOrNullResult(); 

    if ($result == NULL) { 
     $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte est désactivé'); 
     return new RedirectResponse('login'); 
    } 

    $user_name = $result->getFirstName().' '.$result->getLastName(); 
    $session->set('userId', $result->getId()); 
    if ($result->getUserType() == 1) { 
     $this->roles = array('ROLE_ADMIN'); 
    }else if ($result->getUserType() == 0){ 
     $this->roles = array('ROLE_USER'); 
    }else{ 
     $session->getFlashBag()->add('error', 'Vous ne pouvez pas vous connecter car votre compte n\'a pas de rôle'); 
     return new RedirectResponse('logout'); 
    } 
    return $this->spawnUser($user_name); 
} 

/** 
* {@inheritDoc} 
*/ 
public function refreshUser(UserInterface $user) 
{ 
    if (!$user instanceof User) { 
     throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', get_class($user))); 
    } 

    return $this->spawnUser($user->getUsername()); 
} 

/** 
* {@inheritDoc} 
*/ 
public function supportsClass($class) 
{ 
    return $class === 'Symfony\Component\Security\Core\User\User'; 
} 

/** 
* Spawns a new user with given username. 
* 
* @param string $username 
* 
* @return \Symfony\Component\Security\Core\User\User 
*/ 
private function spawnUser($username) 
{ 
    //$this->roles = $this->userType; 
    return new User($username, null, (array)$this->roles, true, true, true, true); 
    } 
} 

2-覆蓋也BeSimple \ SsoAuthBundle \安全\核心\認證\提供者：

<?php 

namespace Application\UserBundle\Security\BeSimple\Authentication\Provider; 

use Symfony\Component\Security\Core\User\UserInterface; 
use Symfony\Component\Security\Core\Exception\UsernameNotFoundException; 
use Symfony\Component\Security\Core\Exception\BadCredentialsException; 
use BeSimple\SsoAuthBundle\Security\Core\User\UserFactoryInterface; 

/* 
* @Override 
*/ 
use BeSimple\SsoAuthBundle\Security\Core\Authentication\Provider\SsoAuthenticationPr ovider; 

class AppAuthenticationProvider extends SsoAuthenticationProvider 
{ 
/** 
* @var UserProviderInterface 
*/ 
private $userProvider; 

/** 
* @var bool 
*/ 
private $createUsers; 

/** 
* @var bool 
*/ 
private $hideUserNotFound; 

/** 
* @Override file 
* @throws \Symfony\Component\Security\Core\Exception\UsernameNotFoundException 
* @throws \Symfony\Component\Security\Core\Exception\BadCredentialsException 
* 
* @param string $username 
* @param array $attributes 
* 
* @return UserInterface 
*/ 
protected function provideUser($username, array $attributes = array()) 
{ 
    try { 
     $user = $this->retrieveUser($username); 
    } catch (UsernameNotFoundException $notFound) { 
     if ($this->createUsers && $this->userProvider instanceof UserFactoryInterface) { 
      $user = $this->createUser($username, $attributes); 
     } elseif ($this->hideUserNotFound) { 
      throw new BadCredentialsException('Bad credentials', 0, $notFound); 
     } else { 
      throw $notFound; 
     } 
    } 

    return $user; 
    } 

} 

3-當用戶登錄到您的應用程序保存在會話所需的信息：

<?php 

namespace Application\UserBundle\Security\Authentication\Handler; 

use Symfony\Component\HttpFoundation\Request; 
use Symfony\Component\HttpFoundation\RedirectResponse; 
use Symfony\Component\Routing\Router; 
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; 
use Symfony\Component\Security\Core\SecurityContext; 
use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface; 
use Doctrine\ORM\EntityManager; 

class LoginSuccessHandler implements AuthenticationSuccessHandlerInterface 
{ 
protected 
    $router, 
    $security, 
    $entityManager; 

public function __construct(Router $router, SecurityContext $security, EntityManager $entityManager) 
{ 
    $this->router = $router; 
    $this->security = $security; 
    $this->entityManager = $entityManager; 
} 

public function onAuthenticationSuccess(Request $request, TokenInterface $token) 
{ 
    $session = $request->getSession(); 

    $attributes = $this->security->getToken()->getAttributes(); 
    $sgid = $attributes['sso:validation']['sgid']; 

    $em = $this->entityManager; 
    $qb = $em->createQueryBuilder(); 
    $qb->select("u") 
     ->from('ApplicationUserBundle:User', 'u') 
     ->where('u.sgid = :sgid') 
     ->AndWhere('u.status = 1') 
     ->setParameter("sgid", $sgid); 

    $result = $qb->getQuery()->getOneOrNullResult(); 

    //en cas où utilisateur est désactivée 
    //Malgre que si il arrive a cette handler ça veut dire qu'il activé car le test se fait sur le bundle BeSimple 
    if ($result == NULL) { 
     return new RedirectResponse($this->router->generate('login')); 
    } 

    $session->set('userId', $result->getId()); 

    $response = new RedirectResponse('admin'); 

    return $response; 
    } 
} 

4-現在定義的應用程序/ UserBundle/Ressources /配置/ security_listeners.yml安全聽者：

parameters: 
    security.authentication.provider.sso.class: Application\UserBundle\Security\BeSimple\Authentication\Provider\AppAuthenticationProvider 

services: 
    security.authentication.provider.sso: 
     class: %security.authentication.provider.sso.class% 
     public: false 
     arguments: ['', '@security.user_checker', '', '', false] 

5- BeSimple配置應是這樣的：

be_simple_sso_auth: 
admin_sso: 
    protocol: 
     id: cas 
     version: 2 
    server: 
     id: cas 
     login_url: https://adresse ip:8443/cas-server-webapp-4.0.0/login 
     logout_url: https://adresse ip:8443/cas-server-webapp-4.0.0/logout 
     validation_url: https://adresse ip:8443/cas-server-webapp-4.0.0/serviceValidate 
services: 

    spawned_user_provider: 
     class:  Application\UserBundle\Security\BeSimple\SpawnedUserProvider\SsoUserProvider 
    arguments: [@doctrine.orm.entity_manager, @session] 

6-的parameters.yml

be_simple.sso_auth.client.option.curlopt_ssl_verifypeer.value: false 
    be_simple.sso_auth.client.option.curlopt_sslversion.value: 4 (Optionale) 

7的security.yml

main: 
     pattern: ^/admin 
     context: marketshare_context 
     logout: 
      path: /admin/logout 
      target:/
     #provider: sso 
     trusted_sso: 
      manager: admin_sso 
      login_action: ApplicationUserBundle:TrustedSso:login 
      logout_action: false 
      login_path: /admin/login 
      check_path: /admin/check 
      always_use_default_target_path: true 
      default_target_path: /admin/potentiel 
      failure_path: /admin/logout 

Answer 2

您還可以測試l3-team/CasBundle似乎更近&活躍，比BeSimpleSSoBundle更清晰的文檔。

它似乎也支持單點登出。