CAS SSO與Silex後衛身份驗證處理程序

我在My Silex應用程序中實現了jasig/phpCas身份驗證。即將完成，但我無法處理authfailure Response correclty。CAS SSO與Silex後衛身份驗證處理程序

$app['app.token_authenticator'] = function ($app) { 
return new MyApp\Domain\MyTokenAuthenticator($app['security.encoder_factory'],$app['cas'],$app['dao.usersso']); 
}; 

$app['security.firewalls'] = array(
    'default' => array(
      'pattern' => '^/.*$', 
      'anonymous' => true, 

      'guard' => array(
        'authenticators' => array(
          'app.token_authenticator' 
        ), 
      ), 
      'logout' => array ('logout_path' => '/logout', 'target_url' => '/goodbye'), 
      'form' => array('login_path' =>'/login', 'check_path' =>'/admin/login_check', 'authenticator' => 'time_authenticator'), 
      'users' => function() use ($app) { 
       return new MyApp\DAO\UserDAO($app['db']); 
      }, 
    ), 
);

MyTokenAuthenticator類：

class MyTokenAuthenticator extends AbstractGuardAuthenticator 
{ 
    private $encoderFactory; 
    private $cas_settings; 
    private $sso_dao; 

    public function __construct(EncoderFactoryInterface $encoderFactory, $cas_settings, MyApp\DAO\UserSsoDAO $userdao) 
{ 
    $this->encoderFactory = $encoderFactory; 
    $this->cas_settings = $cas_settings; 
    $this->sso_dao = $userdao; 
} 

public function getCredentials(Request $request) 
{ 
    $bSSO = false; 

    //Test request for sso 
    if (strpos($request->get("ticket"),"cas-intra") !==false) 
     $bSSO = true; 
    if($request->get("sso") == "1") 
     $bSSO=true; 

    if ($bSSO) 
    { 
     if ($this->cas_settings['debug']) 
     { 
      \CAS_phpCAS::setDebug(); 
      \CAS_phpCAS::setVerbose(true); 
     } 

     \CAS_phpCAS::client(CAS_VERSION_2_0, 
       $this->cas_settings['server'], 
       $this->cas_settings['port'], 
       $this->cas_settings['context'], 
       false); 

     \CAS_phpCAS::setCasServerCACert('../app/config/cas.pem'); 
     // force CAS authentication 
     \CAS_phpCAS::forceAuthentication(); 
     $username = \CAS_phpCAS::getUser(); 
     return array ( 
       'username' => $username, 
       'secret' => 'SSO' 
     ); 
    } 

    //Nothing to do, skip custom auth 
    return; 
} 

/** 
* Get User from the SSO database. 
* Add it into the MyApp users database (Update if already exists) 
* {@inheritDoc} 
* @see \Symfony\Component\Security\Guard\GuardAuthenticatorInterface::getUser() 
*/ 
public function getUser($credentials, UserProviderInterface $userProvider) 
{ 
    //Get user stuf 
    .... 
    //return $userProvider->loadUserByUsername($credentials['username']); 
    return $user; 
} 

/** 
* 
* {@inheritDoc} 
* @see \Symfony\Component\Security\Guard\GuardAuthenticatorInterface::checkCredentials() 
*/ 
public function checkCredentials($credentials, UserInterface $user) 
{ 
    // check credentials - e.g. make sure the password is valid 
    // return true to cause authentication success 

    if ($this->sso_dao->isBAllowed($user->getLogin())) 
     return true; 
    else 
     throw new CustomUserMessageAuthenticationException("Sorry, you're not alllowed tu use this app."); 
} 

public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey) 
{ 
    // on success, let the request continue 
    return; 
} 

public function onAuthenticationFailure(Request $request, AuthenticationException $exception) 
{ 
    $data = array(
      'message' => strtr($exception->getMessageKey(), $exception->getMessageData()), 

      // or to translate this message 
      // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData()) 
    ); 

    return new JsonResponse($data,403); 

}

的問題是，當從SSO有效的用戶在應用程序被拒絕。它顯示帶有json消息的頁面，沒有任何呈現。我的解決方法是使用最小的html頁面與sso註銷鏈接作爲迴應，並且session_destroy()，但它的快速和骯髒的修復程序。

我想要一個很好的錯誤信息通過樹枝redenring。也許還有其他一些課程要延續？ Silex的文檔無濟於事。謝謝！

來源

2017-04-05 raphr

如果你想要一個HTML呈現的錯誤，爲什麼你要返回一個'''JsonResponse'''？我在這裏錯過了什麼嗎？如果你只是想要一個HTML響應，你可以嘗試在你的類中注入小枝，然後''返回新的響應（$ this-> twig-> render（'error-template.twig'，[「data」=> $ data ]），Response :: HTTP_FORBIDDEN）;''' – mTorres

這是[documentation example]的一個愚笨的複製/粘貼（http://silex.sensiolabs.org/doc/2.0/cookbook/guard_authentication.html）。由於'onAuthenticationFailure'需要響應一些很好的原因（預配置表單？）。您的渲染作爲響應對象似乎是一個很好的方法來做到這一點。我是新來的Silex，並不知道所有的可能性。我會試一試。 – raphr

回到這個問題，因爲我是在開發者的其他apsects。 @mTorres解決方案正在工作。我必須通過構造函數存儲整個應用程序對象，因爲此時在服務註冊表中不會設置樹枝。

class MyTokenAuthenticator extends AbstractGuardAuthenticator 
{ 
    private $app; 

    public function __construct($app) 
    { 
     $this->app=$app; 
    }

然後自定義事件

public function onAuthenticationFailure(Request $request, AuthenticationException $exception) 
{ 
    return new \Symfony\Component\HttpFoundation\Response(
      $this->app['twig']->render('logout.html.twig',array(
       'error'   => $data, 
      )); 
}

非常感謝！

來源

2017-04-13 15:42:30 raphr

CAS SSO與Silex後衛身份驗證處理程序

回答

相關問題