Skip to content

Commit c881eab

Browse files
alamiraultalamirault
committed
[Security] add CAS 2.0 AccessToken handler
1 parent 7a6096e commit c881eab

File tree

1 file changed

+185
-3
lines changed

1 file changed

+185
-3
lines changed

‎security/access_token.rst‎

Lines changed: 185 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -697,6 +697,187 @@ create your own User from the claims, you must
697697
}
698698
}
699699

700+
Using CAS 2.0
701+
-------------
702+
703+
`Central Authentication Service (CAS)`_ is an enterprise multilingual single
704+
sign-on solution and identity provider for the web and attempts to be a
705+
comprehensive platform for your authentication and authorization needs.
706+
707+
Configure the Cas2Handler
708+
~~~~~~~~~~~~~~~~~~~~~~~~~
709+
710+
Symfony provides a generic ``Cas2Handler`` to call your CAS server. It requires
711+
the ``symfony/http-client`` package to make the needed HTTP requests. If you
712+
haven't installed it yet, run this command:
713+
714+
.. code-block:: terminal
715+
716+
$ composer require symfony/http-client
717+
718+
You can configure a ``cas`` ``token_handler``:
719+
720+
.. configuration-block::
721+
722+
.. code-block:: yaml
723+
724+
# config/packages/security.yaml
725+
security:
726+
firewalls:
727+
main:
728+
access_token:
729+
token_handler:
730+
cas:
731+
validation_url: https://www.example.com/cas/validate
732+
733+
.. code-block:: xml
734+
735+
<!-- config/packages/security.xml -->
736+
<?xml version="1.0" encoding="UTF-8"?>
737+
<srv:container xmlns="http://symfony.com/schema/dic/security"
738+
xmlns:srv="http://symfony.com/schema/dic/services"
739+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
740+
xsi:schemaLocation="http://symfony.com/schema/dic/services
741+
https://symfony.com/schema/dic/services/services-1.0.xsd
742+
http://symfony.com/schema/dic/security
743+
https://symfony.com/schema/dic/security/security-1.0.xsd">
744+
745+
<config>
746+
<firewall name="main">
747+
<access-token>
748+
<token-handler>
749+
<cas validation-url="https://www.example.com/cas/validate"/>
750+
</token-handler>
751+
</access-token>
752+
</firewall>
753+
</config>
754+
</srv:container>
755+
756+
.. code-block:: php
757+
758+
// config/packages/security.php
759+
use Symfony\Config\SecurityConfig;
760+
761+
return static function (SecurityConfig $security) {
762+
$security->firewall('main')
763+
->accessToken()
764+
->tokenHandler()
765+
->cas()
766+
->validationUrl('https://www.example.com/cas/validate')
767+
;
768+
};
769+
770+
The ``cas`` token handler automatically creates an HTTP client to call
771+
the specified ``validation_url``. If you prefer using your own client, you can
772+
specify the service name via the ``http_client`` option:
773+
774+
.. configuration-block::
775+
776+
.. code-block:: yaml
777+
778+
# config/packages/security.yaml
779+
security:
780+
firewalls:
781+
main:
782+
access_token:
783+
token_handler:
784+
cas:
785+
validation_url: https://www.example.com/cas/validate
786+
http_client: cas.client
787+
788+
.. code-block:: xml
789+
790+
<!-- config/packages/security.xml -->
791+
<?xml version="1.0" encoding="UTF-8"?>
792+
<srv:container xmlns="http://symfony.com/schema/dic/security"
793+
xmlns:srv="http://symfony.com/schema/dic/services"
794+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
795+
xsi:schemaLocation="http://symfony.com/schema/dic/services
796+
https://symfony.com/schema/dic/services/services-1.0.xsd
797+
http://symfony.com/schema/dic/security
798+
https://symfony.com/schema/dic/security/security-1.0.xsd">
799+
800+
<config>
801+
<firewall name="main">
802+
<access-token>
803+
<token-handler>
804+
<cas validation-url="https://www.example.com/cas/validate" http-client="cas.client"/>
805+
</token-handler>
806+
</access-token>
807+
</firewall>
808+
</config>
809+
</srv:container>
810+
811+
.. code-block:: php
812+
813+
// config/packages/security.php
814+
use Symfony\Config\SecurityConfig;
815+
816+
return static function (SecurityConfig $security) {
817+
$security->firewall('main')
818+
->accessToken()
819+
->tokenHandler()
820+
->cas()
821+
->validationUrl('https://www.example.com/cas/validate')
822+
->httpClient('cas.client')
823+
;
824+
};
825+
826+
By default the token handler will read the validation URL XML response with
827+
``cas`` prefix but you can configure another prefix:
828+
829+
.. configuration-block::
830+
831+
.. code-block:: yaml
832+
833+
# config/packages/security.yaml
834+
security:
835+
firewalls:
836+
main:
837+
access_token:
838+
token_handler:
839+
cas:
840+
validation_url: https://www.example.com/cas/validate
841+
prefix: cas-example
842+
843+
.. code-block:: xml
844+
845+
<!-- config/packages/security.xml -->
846+
<?xml version="1.0" encoding="UTF-8"?>
847+
<srv:container xmlns="http://symfony.com/schema/dic/security"
848+
xmlns:srv="http://symfony.com/schema/dic/services"
849+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
850+
xsi:schemaLocation="http://symfony.com/schema/dic/services
851+
https://symfony.com/schema/dic/services/services-1.0.xsd
852+
http://symfony.com/schema/dic/security
853+
https://symfony.com/schema/dic/security/security-1.0.xsd">
854+
855+
<config>
856+
<firewall name="main">
857+
<access-token>
858+
<token-handler>
859+
<cas validation-url="https://www.example.com/cas/validate" prefix="cas-example"/>
860+
</token-handler>
861+
</access-token>
862+
</firewall>
863+
</config>
864+
</srv:container>
865+
866+
.. code-block:: php
867+
868+
// config/packages/security.php
869+
use Symfony\Config\SecurityConfig;
870+
871+
return static function (SecurityConfig $security) {
872+
$security->firewall('main')
873+
->accessToken()
874+
->tokenHandler()
875+
->cas()
876+
->validationUrl('https://www.example.com/cas/validate')
877+
->prefix('cas-example')
878+
;
879+
};
880+
700881
Creating Users from Token
701882
-------------------------
702883

@@ -727,8 +908,9 @@ need a user provider to create a user from the database::
727908
When using this strategy, you can omit the ``user_provider`` configuration
728909
for :ref:`stateless firewalls <reference-security-stateless>`.
729910

911+
.. _`Central Authentication Service (CAS)`: https://en.wikipedia.org/wiki/Central_Authentication_Service
730912
.. _`JSON Web Tokens (JWT)`: https://datatracker.ietf.org/doc/html/rfc7519
731-
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
732-
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
733-
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
734913
.. _`OpenID Connect (OIDC)`: https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)
914+
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
915+
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
916+
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html

0 commit comments

Comments
 (0)