Skip to content

Commit d3349b2

Browse files
javiereguiluzjaviereguiluz
committed
Merge branch '7.1' into 7.2
* 7.1: [Security] add CAS 2.0 AccessToken handler
2 parents 09e0519 + fd7b8ea commit d3349b2

File tree

1 file changed

+189
-3
lines changed

1 file changed

+189
-3
lines changed

‎security/access_token.rst‎

Lines changed: 189 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -706,6 +706,191 @@ create your own User from the claims, you must
706706
}
707707
}
708708

709+
Using CAS 2.0
710+
-------------
711+
712+
.. versionadded:: 7.1
713+
714+
The support for CAS token handlers was introduced in Symfony 7.1.
715+
716+
`Central Authentication Service (CAS)`_ is an enterprise multilingual single
717+
sign-on solution and identity provider for the web and attempts to be a
718+
comprehensive platform for your authentication and authorization needs.
719+
720+
Configure the Cas2Handler
721+
~~~~~~~~~~~~~~~~~~~~~~~~~
722+
723+
Symfony provides a generic ``Cas2Handler`` to call your CAS server. It requires
724+
the ``symfony/http-client`` package to make the needed HTTP requests. If you
725+
haven't installed it yet, run this command:
726+
727+
.. code-block:: terminal
728+
729+
$ composer require symfony/http-client
730+
731+
You can configure a ``cas`` token handler as follows:
732+
733+
.. configuration-block::
734+
735+
.. code-block:: yaml
736+
737+
# config/packages/security.yaml
738+
security:
739+
firewalls:
740+
main:
741+
access_token:
742+
token_handler:
743+
cas:
744+
validation_url: https://www.example.com/cas/validate
745+
746+
.. code-block:: xml
747+
748+
<!-- config/packages/security.xml -->
749+
<?xml version="1.0" encoding="UTF-8"?>
750+
<srv:container xmlns="http://symfony.com/schema/dic/security"
751+
xmlns:srv="http://symfony.com/schema/dic/services"
752+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
753+
xsi:schemaLocation="http://symfony.com/schema/dic/services
754+
https://symfony.com/schema/dic/services/services-1.0.xsd
755+
http://symfony.com/schema/dic/security
756+
https://symfony.com/schema/dic/security/security-1.0.xsd">
757+
758+
<config>
759+
<firewall name="main">
760+
<access-token>
761+
<token-handler>
762+
<cas validation-url="https://www.example.com/cas/validate"/>
763+
</token-handler>
764+
</access-token>
765+
</firewall>
766+
</config>
767+
</srv:container>
768+
769+
.. code-block:: php
770+
771+
// config/packages/security.php
772+
use Symfony\Config\SecurityConfig;
773+
774+
return static function (SecurityConfig $security) {
775+
$security->firewall('main')
776+
->accessToken()
777+
->tokenHandler()
778+
->cas()
779+
->validationUrl('https://www.example.com/cas/validate')
780+
;
781+
};
782+
783+
The ``cas`` token handler automatically creates an HTTP client to call
784+
the specified ``validation_url``. If you prefer using your own client, you can
785+
specify the service name via the ``http_client`` option:
786+
787+
.. configuration-block::
788+
789+
.. code-block:: yaml
790+
791+
# config/packages/security.yaml
792+
security:
793+
firewalls:
794+
main:
795+
access_token:
796+
token_handler:
797+
cas:
798+
validation_url: https://www.example.com/cas/validate
799+
http_client: cas.client
800+
801+
.. code-block:: xml
802+
803+
<!-- config/packages/security.xml -->
804+
<?xml version="1.0" encoding="UTF-8"?>
805+
<srv:container xmlns="http://symfony.com/schema/dic/security"
806+
xmlns:srv="http://symfony.com/schema/dic/services"
807+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
808+
xsi:schemaLocation="http://symfony.com/schema/dic/services
809+
https://symfony.com/schema/dic/services/services-1.0.xsd
810+
http://symfony.com/schema/dic/security
811+
https://symfony.com/schema/dic/security/security-1.0.xsd">
812+
813+
<config>
814+
<firewall name="main">
815+
<access-token>
816+
<token-handler>
817+
<cas validation-url="https://www.example.com/cas/validate" http-client="cas.client"/>
818+
</token-handler>
819+
</access-token>
820+
</firewall>
821+
</config>
822+
</srv:container>
823+
824+
.. code-block:: php
825+
826+
// config/packages/security.php
827+
use Symfony\Config\SecurityConfig;
828+
829+
return static function (SecurityConfig $security) {
830+
$security->firewall('main')
831+
->accessToken()
832+
->tokenHandler()
833+
->cas()
834+
->validationUrl('https://www.example.com/cas/validate')
835+
->httpClient('cas.client')
836+
;
837+
};
838+
839+
By default the token handler will read the validation URL XML response with
840+
``cas`` prefix but you can configure another prefix:
841+
842+
.. configuration-block::
843+
844+
.. code-block:: yaml
845+
846+
# config/packages/security.yaml
847+
security:
848+
firewalls:
849+
main:
850+
access_token:
851+
token_handler:
852+
cas:
853+
validation_url: https://www.example.com/cas/validate
854+
prefix: cas-example
855+
856+
.. code-block:: xml
857+
858+
<!-- config/packages/security.xml -->
859+
<?xml version="1.0" encoding="UTF-8"?>
860+
<srv:container xmlns="http://symfony.com/schema/dic/security"
861+
xmlns:srv="http://symfony.com/schema/dic/services"
862+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
863+
xsi:schemaLocation="http://symfony.com/schema/dic/services
864+
https://symfony.com/schema/dic/services/services-1.0.xsd
865+
http://symfony.com/schema/dic/security
866+
https://symfony.com/schema/dic/security/security-1.0.xsd">
867+
868+
<config>
869+
<firewall name="main">
870+
<access-token>
871+
<token-handler>
872+
<cas validation-url="https://www.example.com/cas/validate" prefix="cas-example"/>
873+
</token-handler>
874+
</access-token>
875+
</firewall>
876+
</config>
877+
</srv:container>
878+
879+
.. code-block:: php
880+
881+
// config/packages/security.php
882+
use Symfony\Config\SecurityConfig;
883+
884+
return static function (SecurityConfig $security) {
885+
$security->firewall('main')
886+
->accessToken()
887+
->tokenHandler()
888+
->cas()
889+
->validationUrl('https://www.example.com/cas/validate')
890+
->prefix('cas-example')
891+
;
892+
};
893+
709894
Creating Users from Token
710895
-------------------------
711896

@@ -736,8 +921,9 @@ need a user provider to create a user from the database::
736921
When using this strategy, you can omit the ``user_provider`` configuration
737922
for :ref:`stateless firewalls <reference-security-stateless>`.
738923

924+
.. _`Central Authentication Service (CAS)`: https://en.wikipedia.org/wiki/Central_Authentication_Service
739925
.. _`JSON Web Tokens (JWT)`: https://datatracker.ietf.org/doc/html/rfc7519
740-
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
741-
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
742-
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
743926
.. _`OpenID Connect (OIDC)`: https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)
927+
.. _`OpenID Connect Specification`: https://openid.net/specs/openid-connect-core-1_0.html
928+
.. _`RFC6750`: https://datatracker.ietf.org/doc/html/rfc6750
929+
.. _`SAML2 (XML structures)`: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html

0 commit comments

Comments
 (0)