CAS
This page explains how to use a CAS server to authenticate user in eprints.
Contents
Install a secure host
The first thing you'll have to do is to install a secure host.
Apache::AuthCAS
This perl library allows you to easily communicate with a CAS sever.
Install the lib
This can be done with the command: perl -MCPAN -e 'install Apache::AuthCAS'
More infomartion are available on CPAN
Make few changes to AuthCAS.pm (if using mysql)
The Apache::AuthCAS module use a database to store cookies. You can use Postgres or MySQL, as you wish.
Most probably, you will use mysql, as eprints use it. Unfortunately AuthCAS.pm is coded with the "Pg" driver in hard, even if a variable ($DB_DRIVER) exists, it is not used. So you will have to edit your AuthCAS.pm file and change each "Pg" with "mysql".
Create the database to store cookies
You should find this mysql schema in /root/.cpan/build/Apache-AuthCAS-0.4/schema.sql
-- schema that has been used with PostgreSQL and may need to be altered for
-- another DBMS
CREATE TABLE cas_sessions (
id varchar(32) not null primary key,
last_accessed int8 not null,
uid varchar(32) not null,
pgtiou varchar(64) not null
);
CREATE TABLE cas_pgtiou_to_pgt (
pgtiou varchar(64) not null primary key,
pgt varchar(64) not null,
created int8 not null
);
--example PostgreSQL indeces
--CREATE INDEX cas_sessions_id_index ON cas_sessions(id);
--CREATE INDEX cas_pgtiou_to_pgt_pgtiou_index ON cas_pgtiou_to_pgt(pgtiou);
--CREATE INDEX cas_sessions_last_accessed_index ON cas_sessions(last_accessed);
Configure your secure host
You must provide some information like the CAS host. You can provide it in your virtual host, or in AuthCAS.pm. Read the module page on CPAN to know more about it.
Also edit $EPRINTS_ROOT/archives/$ARCHIVE_ID/cfg/auto-secure.conf and make the following changes:
Remove lines:
AuthType "Basic" PerlAuthenHandler EPrints::Auth::authen
and add:
AuthType Apache::AuthCAS AuthName "CAS" PerlAuthenHandler Apache::AuthCAS->authenticate PerlSetVar CASProduction "1"
Load the module
Finally, don't forget to load Apache::AuthCAS!
Eprints::Session edit
Now edit the $EPRINTS_PATH/perl_lib/EPrints/Session.pm. First add this line:
use CGI qw(:standard -nph);
Which enables you to use the raw_cookie fuction which returns variables stored in http cookie. Then go to the current_user function definition where you have to put the uid provided by AuthCAS module in $username. To do it, you just have to make a sql query which looks like that:
$sql="SELECT uid FROM cas_sessions WHERE id='$user_ticket'";
Where $user_ticket is the variable stored in the AuthCAS http cookie.
my $user_ticket=raw_cookie('APACHECAS');
Note that 'APACHECAS' is the default name for the AuthCAS cookie but you may have change it.
Here is a code that should work if you have installed your Apache::AuthCAS sql tables in the same database where you store your eprints tables:
sub current_user
{
my( $self ) = @_;
my $user = undef;
# If we've already done this once, no point
# in doing it again.
unless( defined $self->{currentuser} )
{
my $username ="";
my $user_ticket="";
if( defined $ENV{HTTP_CAS_FILTER_USER})#just connected with cas, no cookie set
{
$username = $ENV{HTTP_CAS_FILTER_USER};
}
elsif ( defined $self->{archive}->get_conf("cassessioncookiename") )#cas auth seems configured...
{
$user_ticket=raw_cookie($self->{archive}->get_conf("cassessioncookiename"));
if( $user_ticket ne "" )#Indeed we've get a cookie :)
{
my $sql = "SELECT uid FROM cas_sessions where id='$user_ticket'";
my $sth = $self->{database}->prepare( $sql );
$self->{database}->execute( $sth, $sql );
while( my @info = $sth->fetchrow_array ) {
my @list = split(":",$info[0]);
foreach( @list ) {$username=$_;}
}
$sth->finish;
}
}
else#using default eprints authentication
{
$username = $ENV{'REMOTE_USER'};
}
if( $username ne "" )
{
$self->{currentuser} =
EPrints::User::user_with_username( $self, $username );
}
}
return $self->{currentuser};
}
This code assumes CASAuth SQL tables are stored with the rest of the Eprints server. It won't work if you use a Postgres database or even if you stored your CASauth tables on an other MySQL database. If you have any good reason to use a seperated database, you will have to change some lines in order to make it work.
I'm a busy man, give me a patch!
Okay, here is a patch which includes changes to files:
- Config.pm
- configure_archive
- generate_apacheconf
- Session.pm
It was made with Eprints version 2.3.13. CAS Authentication patch for Gnu eprints
Once your eprints gets patched, you have to:
- install Apache::AuthCAS module and create associated tables in your eprints database (see above)
- run configure_archive (answer yes to «configure secure host» and «use CAS authentication»)
- run generate_apacheconf
- restart your webserver
You should now be able to login through your CAS server.
Once CAS is working, you may need to copy the user entry from an LDAP server. This can be done as describe ine the Integrating_EPrints_with_LDAP article of this wiki or like this :
our LDAP Configuration
in the file perl_lib/EPrints/User.pm, go to the user_with_username function and replace it with the following function:
sub user_with_username
{
my( $session, $username ) = @_;
my $user_ds = $session->get_archive()->get_dataset( "user" );
my $searchexp = new EPrints::SearchExpression(
session=>$session,
dataset=>$user_ds );
$searchexp->add_field(
$user_ds->get_field( "username" ),
$username,
"EX" );
my $searchid = $searchexp->perform_search;
my $user;
#if no record was found and that there is an ldap host set, try to add a new record
if ( $records[0] eq "" and $session->{archive}->get_conf("ldaphost") ne ""){
#bring back data from ldap server
my $ldap = Net::LDAP->new ( $session->{archive}->get_conf("ldaphost") ) or die "$@";
my $userToAuthenticate=$session->{archive}->get_conf("ldapuser");
my $passwd= $session->{archive}->get_conf("ldappass");
my $base=$session->{archive}->get_conf("ldapbase");
my $additionalCriteria=$session->{archive}->get_conf("ldapsearchstring");
my $searchString="uid=$username";
if ($additionalCriteria ne ""){
$searchString="& ($additionalCriteria) ($searchString)";
}
my @Attrs = ( );
my $mesg = $ldap->bind ( "$userToAuthenticate",
password => "$passwd",
version => 3 );
my $result = $ldap->search ( base => "$base",
scope => "sub",
filter => "$searchString",
attrs => @Attrs
);
my @entries = $result->entries;
if (defined (my $entr = $entries[0])) {
my $usertype = "user";
$user = EPrints::User::create_user( $session, $usertype);
$user->set_value( "username" , $username );
my $name = {};
$name->{family} = $entr->get_value( "sn" );
$name->{given} = $entr->get_value( "givenName" );
$user->set_value("name", $name );
$user->set_value("email", $entr->get_value("mail") );
$user->set_value("org", $entr->get_value("supannEtablissement"));
$user->set_value("address", $entr->get_value("postalAddress")."\n".$entr->get_value("postalCode")." ".$entr->get_value("l"));
$user->set_value("country", "FRANCE");
$user->set_value("url", $entr->get_value("labeledURI"));
$user->commit();
}
} else {
$user = $records[0];
}
$searchexp->dispose();
return $user;
}
Remove authentication informations in the user area
This can be done changing the $c->{userauth}{'user'}{priv} value in the ArchiveConfig.pm
try something like this:
$c->{userauth} = {
user => {
auth => $CRYPTED_DBI,
priv => [ "subscription", "deposit", "change-email" ] },
] },
instead of
$c->{userauth} = {
user => {
auth => $CRYPTED_DBI,
priv => [ "subscription", "set-password", "deposit", "change-email", "change-user" ] },
and then I remove <field name="password" /> from the metadata-types.xml file.
