Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Add configuration setting for CAS protocol version #15816

Merged
merged 12 commits into from
Aug 24, 2023
Merged

Add configuration setting for CAS protocol version #15816

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
9fa253b
Update cas.py
agrimpard Jun 21, 2023
e04ede7
Update cas.py
agrimpard Jun 21, 2023
f3d22cc
Create 15807.feature
agrimpard Jun 21, 2023
00553f6
Merge branch 'matrix-org:develop' into develop
agrimpard Jun 21, 2023
eb0a7ab
Update config_documentation.md
agrimpard Jun 21, 2023
62ab53a
Update 15807.feature
agrimpard Jun 21, 2023
8b51585
Rename 15807.feature to 15816.feature (issuer to PR)
agrimpard Jun 22, 2023
f079462
Handle CAS protocol version 1, 2 and 3 else it raise an error
agrimpard Aug 24, 2023
46821f8
Merge branch 'develop' into develop
clokep Aug 24, 2023
f806669
Handle default CAS protocol version "none"
agrimpard Aug 24, 2023
02acd2b
Import ConfigError since we eventually raise error
agrimpard Aug 24, 2023
d2f271b
lint !
agrimpard Aug 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/15816.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add configuration setting for CAS protocol version. Contributed by Aurélien Grimpard.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Helpful docs for anyone looking at this: https://github.com/matrix-org/synapse/blob/d53547352063c3e66302f7bdc40d7ac7270e605c/docs/development/cas.md

2 changes: 2 additions & 0 deletions docs/usage/configuration/config_documentation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3420,6 +3420,7 @@ Has the following sub-options:
to style the login flow according to the identity provider in question.
See the [spec](https://spec.matrix.org/latest/) for possible options here.
* `server_url`: The URL of the CAS authorization endpoint.
* `protocol_version`: The CAS protocol version, defaults to none (version 3 is required if you want to use "required_attributes").
* `displayname_attribute`: The attribute of the CAS response to use as the display name.
If no name is given here, no displayname will be set.
* `required_attributes`: It is possible to configure Synapse to only allow logins if CAS attributes
Expand All @@ -3433,6 +3434,7 @@ Example configuration:
cas_config:
enabled: true
server_url: "https://cas-server.com"
protocol_version: 3
displayname_attribute: name
required_attributes:
userGroup: "staff"
Expand Down
13 changes: 12 additions & 1 deletion synapse/config/cas.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
from synapse.config.sso import SsoAttributeRequirement
from synapse.types import JsonDict

from ._base import Config
from ._base import Config, ConfigError
from ._util import validate_config


Expand All @@ -41,6 +41,16 @@ def read_config(self, config: JsonDict, **kwargs: Any) -> None:
public_baseurl = self.root.server.public_baseurl
self.cas_service_url = public_baseurl + "_matrix/client/r0/login/cas/ticket"

self.cas_protocol_version = cas_config.get("protocol_version")
agrimpard marked this conversation as resolved.
Show resolved Hide resolved
if (
self.cas_protocol_version is not None
and self.cas_protocol_version not in [1, 2, 3]
):
raise ConfigError(
"Unsupported CAS protocol version %s (only versions 1, 2, 3 are supported)"
% (self.cas_protocol_version,),
("cas_config", "protocol_version"),
)
self.cas_displayname_attribute = cas_config.get("displayname_attribute")
required_attributes = cas_config.get("required_attributes") or {}
self.cas_required_attributes = _parsed_required_attributes_def(
Expand All @@ -54,6 +64,7 @@ def read_config(self, config: JsonDict, **kwargs: Any) -> None:
else:
self.cas_server_url = None
self.cas_service_url = None
self.cas_protocol_version = None
self.cas_displayname_attribute = None
self.cas_required_attributes = []

Expand Down
6 changes: 5 additions & 1 deletion synapse/handlers/cas.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ def __init__(self, hs: "HomeServer"):

self._cas_server_url = hs.config.cas.cas_server_url
self._cas_service_url = hs.config.cas.cas_service_url
self._cas_protocol_version = hs.config.cas.cas_protocol_version
self._cas_displayname_attribute = hs.config.cas.cas_displayname_attribute
self._cas_required_attributes = hs.config.cas.cas_required_attributes

Expand Down Expand Up @@ -121,7 +122,10 @@ async def _validate_ticket(
Returns:
The parsed CAS response.
"""
uri = self._cas_server_url + "/proxyValidate"
if self._cas_protocol_version == 3:
uri = self._cas_server_url + "/p3/proxyValidate"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems legit -> spec docs for CAS protocol version 3: https://apereo.github.io/cas/6.6.x/protocol/CAS-Protocol-Specification.html#29-p3proxyvalidate-cas-30

2.9. /p3/proxyValidate [CAS 3.0]

/p3/proxyValidate MUST perform the same validation tasks as /p3/serviceValidate and additionally validate proxy tickets. See Section 2.8.

2.8. /p3/serviceValidate [CAS 3.0]

/p3/serviceValidate MUST perform the same validation tasks as /serviceValidate and additionally return user attributes in the CAS response. See Section 2.5 and Section 2.5.7 for details.

2.5.7 Example response with custom attributes

<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
  <cas:authenticationSuccess>
    <cas:user>username</cas:user>
    <cas:attributes>
      <cas:firstname>John</cas:firstname>
      <cas:lastname>Doe</cas:lastname>
      <cas:title>Mr.</cas:title>
      <cas:email>jdoe@example.org</cas:email>
      <cas:affiliation>staff</cas:affiliation>
      <cas:affiliation>faculty</cas:affiliation>
    </cas:attributes>
    <cas:proxyGrantingTicket>PGTIOU-84678-8a9d...</cas:proxyGrantingTicket>
  </cas:authenticationSuccess>
</cas:serviceResponse>

else:
uri = self._cas_server_url + "/proxyValidate"
args = {
"ticket": ticket,
"service": self._build_service_param(service_args),
Expand Down
Loading