Re: [PEAR] LiveUser with CAS / LDAP

Hi Brett,

I am trying to test CAS_example.php in UNL_Auth

I am getting the following error upon redirection from CAS back to
CAS_example.php.

Please help!

Regards,
Stephanas

(URL corresponding to this screen is
http://192.168.1.50/cas/CAS_example.php?login=true&ticket=ST-6-5cedd1NsbEN3QzsDsOxy-cas01.example.org
)

*Warning*: DOMDocument::loadXML() [domdocument.loadxml
<http://192.168.1.50/cas/domdocument.loadxml>]: Empty string supplied as
input in */usr/share/pear/CAS/Client.php* on line *2778*
CAS Authentication failed!

You were not authenticated.

You may submit your request again by clicking here
<http://192.168.1.50/cas/CAS_example.php?login=true>.

If the problem persists, you may contact the administrator of this site
<root@localhost>.
------------------------------
phpCAS 1.3.2 using server https://192.168.1.50:8443/cas/ (CAS 2.0)
*Fatal error*: Uncaught exception 'CAS_AuthenticationException' in
/usr/share/pear/CAS/Client.php:2780 Stack trace: #0
/usr/share/pear/CAS/Client.php(1224): CAS_Client->validateCAS20('
https://192.168...', '', NULL) #1 /usr/share/pear/CAS/Client.php(1131):
CAS_Client->isAuthenticated() #2 /usr/share/pear/CAS.php(1078):
CAS_Client->checkAuthentication() #3 /usr/share/pear/UNL/Auth/CAS.php(84):
phpCAS::checkAuthentication() #4 /usr/share/pear/UNL/Auth/CAS.php(100):
UNL_Auth_CAS->__construct(Array) #5 [internal function]:
UNL_Auth_CAS::getInstance(NULL) #6 /usr/share/pear/UNL/Auth.php(109):
call_user_func(Array, NULL) #7 /usr/share/pear/UNL/Auth.php(58):
UNL_Auth::discoverAndReturn('UNL_Auth_CAS', '/usr/share/pear...', NULL) #8
/var/www/html/cas/CAS_example.php(7): UNL_Auth::factory('CAS') #9 {main}
thrown in */usr/share/pear/CAS/Client.php* on line *2780*







On Thu, Jan 29, 2015 at 6:25 PM, Brett Bieber <[email protected]>
wrote:

> Hi,
>
> On Thu Jan 29 2015 at 1:15:30 PM Stephanas Francis <[email protected]>
> wrote:
>
>> Dear all,
>>
>> In my organization, we have been using two locally developed PHP / MySQL
>> applications beside Moodle, Koha and Bugzilla: all of them having their
>> own
>> local authentication. Where possible, we have our custom scripts to sync
>> up
>> the authentication information among these applications.
>>
>> The two locally developed applications I referred above make use of
>> LiveUser package to implement authentication as well as permission
>> framework.
>>
>> At this point, we need to implement Single Sign-On. We are considering CAS
>> and LDAP. I understand from google search that Moodle, Koha and Bugzilla
>> will work with CAS as well as LDAP. But I request your advice and guidance
>> on how to go about migrating our PHP / PEAR based applications to SSO.
>> Specifically, following questions are in our mind:
>>
>> 1. What will be a good architecture / combination to use - CAS / LDAP /
>> LiveUser based customized permission management.
>>
>
> CAS is a very simple protocol for outsourcing SSO AuthN. AuthZ is quite a
> different beast.
>
> LDAP is typically great for "common login," but not true SSO.
>
> We have a mixture of apps using direct LDAP, AD, as well as federated SSO
> using ADFS, WS-FED, CAS & SAML 2.0 protocols, but are requiring all new
> software to use SAML 2.0 or CAS.
>
>
>> 2. Can LiveUser's authentication framework be used with CAS and / or LDAP?
>>
>
> It sounds like your AuthZ is all contained in LiveUser already?
>
> If that's the case, LiveUser can use PEAR's Auth containers, adding an
> authentication handler that supports the CAS protocol is pretty easy. I did
> the same thing for some of our custom applications that were using
> PEAR::Auth.
>
> Here's that code:
> https://github.com/unlpear/UNL_Auth
>
> If you're looking to the future, and you're in education or higher-ed
> (with Moodle, I assume you are) — I would strongly encourage you to look at
> SAML, and a SAML IdP. In particular, Shibboleth. Higher Ed is pretty set on
> using SAML for federated SSO, and it would make sense to explore that
> option if you're interested in future collaboration or agile adoption of
> SaaS in the Education market.
>
> Hopefully some of that helps,
>
> -Brett
>
>