Skip to content

Commit 97c01a5

Browse files
javiereguiluzjaviereguiluz
committed
minor #19538 [Security] add CAS 2.0 AccessToken handler (alamirault)
This PR was merged into the 7.1 branch. Discussion ---------- [Security] add CAS 2.0 AccessToken handler Try fix #19490 Commits ------- c881eab [Security] add CAS 2.0 AccessToken handler
2 parents 227275a + c881eab commit 97c01a5

File tree

1 file changed

+185
-3
lines changed

1 file changed

+185
-3
lines changed

‎security/access_token.rst‎

Lines changed: 185 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -706,6 +706,187 @@ create your own User from the claims, you must
706706
}
707707
}
708708

709+
Using CAS 2.0
710+
-------------
711+
712+
`Central Authentication Service (CAS)`_ is an enterprise multilingual single
713+
sign-on solution and identity provider for the web and attempts to be a
714+
comprehensive platform for your authentication and authorization needs.
715+
716+
Configure the Cas2Handler
717+
~~~~~~~~~~~~~~~~~~~~~~~~~
718+
719+
Symfony provides a generic ``Cas2Handler`` to call your CAS server. It requires
720+
the ``symfony/http-client`` package to make the needed HTTP requests. If you
721+
haven't installed it yet, run this command:
722+
723+
.. code-block:: terminal
724+
725+
$ composer require symfony/http-client
726+
727+
You can configure a ``cas`` ``token_handler``:
728+
729+
.. configuration-block::
730+
731+
.. code-block:: yaml
732+
733+
# config/packages/security.yaml
734+
security:
735+
firewalls:
736+
main:
737+
access_token:
738+
token_handler:
739+
cas:
740+
validation_url: https://www.example.com/cas/validate
741+
742+
.. code-block:: xml
743+
744+
<!-- config/packages/security.xml -->
745+
<?xml version="1.0" encoding="UTF-8"?>
746+
<srv:container xmlns="http://symfony.com/schema/dic/security"
747+
xmlns:srv="http://symfony.com/schema/dic/services"
748+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
749+
xsi:schemaLocation="http://symfony.com/schema/dic/services
750+
https://symfony.com/schema/dic/services/services-1.0.xsd
751+
http://symfony.com/schema/dic/security
752+
https://symfony.com/schema/dic/security/security-1.0.xsd">
753+
754+
<config>
755+
<firewall name="main">
756+
<access-token>
757+
<token-handler>
758+
<cas validation-url="https://www.example.com/cas/validate"/>
759+
</token-handler>
760+
</access-token>
761+
</firewall>
762+
</config>
763+
</srv:container>
764+
765+
.. code-block:: php
766+
767+
// config/packages/security.php
768+
use Symfony\Config\SecurityConfig;
769+
770+
return static function (SecurityConfig $security) {
771+
$security->firewall('main')
772+
->accessToken()
773+
->tokenHandler()
774+
->cas()
775+
->validationUrl('https://www.example.com/cas/validate')
776+
;
777+
};
778+
779+
The ``cas`` token handler automatically creates an HTTP client to call
780+
the specified ``validation_url``. If you prefer using your own client, you can
781+
specify the service name via the ``http_client`` option:
782+
783+
.. configuration-block::
784+
785+
.. code-block:: yaml
786+
787+
# config/packages/security.yaml
788+
security:
789+
firewalls:
790+
main:
791+
access_token:
792+
token_handler:
793+
cas:
794+
validation_url: https://www.example.com/cas/validate
795+
http_client: cas.client
796+
797+
.. code-block:: xml
798+
799+
<!-- config/packages/security.xml -->
800+
<?xml version="1.0" encoding="UTF-8"?>
801+
<srv:container xmlns="http://symfony.com/schema/dic/security"
802+
xmlns:srv="http://symfony.com/schema/dic/services"
803+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
804+
xsi:schemaLocation="http://symfony.com/schema/dic/services
805+
https://symfony.com/schema/dic/services/services-1.0.xsd
806+
http://symfony.com/schema/dic/security
807+
https://symfony.com/schema/dic/security/security-1.0.xsd">
808+
809+
<config>
810+
<firewall name="main">
811+
<access-token>
812+
<token-handler>
813+
<cas validation-url="https://www.example.com/cas/validate" http-client="cas.client"/>
814+
</token-handler>
815+
</access-token>
816+
</firewall>
817+
</config>
818+
</srv:container>
819+
820+
.. code-block:: php
821+
822+
// config/packages/security.php
823+
use Symfony\Config\SecurityConfig;
824+
825+
return static function (SecurityConfig $security) {
826+
$security->firewall('main')
827+
->accessToken()
828+
->tokenHandler()
829+
->cas()
830+
->validationUrl('https://www.example.com/cas/validate')
831+
->httpClient('cas.client')
832+
;
833+
};
834+
835+
By default the token handler will read the validation URL XML response with
836+
``cas`` prefix but you can configure another prefix:
837+
838+
.. configuration-block::
839+
840+
.. code-block:: yaml
841+
842+
# config/packages/security.yaml
843+
security:
844+
firewalls:
845+
main:
846+
access_token:
847+
token_handler:
848+
cas:
849+
validation_url: https://www.example.com/cas/validate
850+
prefix: cas-example
851+
852+
.. code-block:: xml
853+
854+
<!-- config/packages/security.xml -->
855+
<?xml version="1.0" encoding="UTF-8"?>
856+
<srv:container xmlns="http://symfony.com/schema/dic/security"
857+
xmlns:srv="http://symfony.com/schema/dic/services"
858+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
859+
xsi:schemaLocation="http://symfony.com/schema/dic/services
860+
https://symfony.com/schema/dic/services/services-1.0.xsd
861+
http://symfony.com/schema/dic/security
862+
https://symfony.com/schema/dic/security/security-1.0.xsd">
863+
864+
<config>
865+
<firewall name="main">
866+
<access-token>
867+
<token-handler>
868+
<cas validation-url="https://www.example.com/cas/validate" prefix="cas-example"/>
869+
</token-handler>
870+
</access-token>
871+
</firewall>
872+
</config>
873+
</srv:container>
874+
875+
.. code-block:: php
876+
877+
// config/packages/security.php
878+
use Symfony\Config\SecurityConfig;
879+
880+
return static function (SecurityConfig $security) {
881+
$security->firewall('main')
882+
->accessToken()
883+
->tokenHandler()
884+
->cas()
885+
->validationUrl('https://www.example.com/cas/validate')
886+
->prefix('cas-example')
887+
;
888+
};
889+
709890
Creating Users from Token
710891
-------------------------
711892

@@ -736,8 +917,9 @@ need a user provider to create a user from the database::
736917
When using this strategy, you can omit the ``user_provider`` configuration
737918
for :ref:`stateless firewalls <reference-security-stateless>`.
738919

920+
.. _`Central Authentication Service (CAS)`: https://en.wikipedia.org/wiki/Central_Authentication_Service
739921
.. _`JSON Web Tokens (JWT)`: https://datatracker.ietf.org/doc/html/rfc7519
740-
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
741-
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
742-
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
743922
.. _`OpenID Connect (OIDC)`: https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)
923+
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
924+
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
925+
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html

0 commit comments

Comments
 (0)