README.rst 10.8 KB
Newer Older
Valentin Samir's avatar
Valentin Samir committed
1
CAS Server
Valentin Samir's avatar
Valentin Samir committed
2 3 4 5
==========

.. image:: https://travis-ci.org/nitmir/django-cas-server.svg?branch=master
    :target: https://travis-ci.org/nitmir/django-cas-server
Valentin Samir's avatar
Valentin Samir committed
6

Valentin Samir's avatar
Valentin Samir committed
7 8 9 10
.. image:: https://img.shields.io/pypi/v/django-cas-server.svg
    :target: https://pypi.python.org/pypi/django-cas-server

.. image:: https://img.shields.io/pypi/l/django-cas-server.svg
Valentin Samir's avatar
Valentin Samir committed
11
    :target: https://www.gnu.org/licenses/gpl-3.0.html
Valentin Samir's avatar
Valentin Samir committed
12

Valentin Samir's avatar
Valentin Samir committed
13
CAS Server is a Django application implementing the `CAS Protocol 3.0 Specification
14 15
<https://jasig.github.io/cas/development/protocol/CAS-Protocol-Specification.html>`_.

Valentin Samir's avatar
Valentin Samir committed
16 17 18
By defaut, the authentication process use django internal users but you can easily
use any sources (see auth classes in the auth.py file)

19
The defaut login/logout template use `django-bootstrap3 <https://github.com/dyve/django-bootstrap3>`_
Valentin Samir's avatar
Valentin Samir committed
20 21 22 23 24 25 26 27 28 29 30 31 32
but you can use your own templates using settings variables.

Features
--------

* Support CAS version 1.0, 2.0, 3.0
* Support Single Sign Out
* Configuration of services via the django Admin application
* Fine control on which user's attributes are passed to which service
* Possibility to rename/rewrite attributes per service
* Possibility to require some attribute values per service
* Supports Django 1.7, 1.8 and 1.9
* Supports Python 2.7, 3.x
Valentin Samir's avatar
Valentin Samir committed
33 34 35 36 37 38 39

Quick start
-----------

1. Add "cas_server" to your INSTALLED_APPS setting like this::

    INSTALLED_APPS = (
Valentin Samir's avatar
Valentin Samir committed
40
        'django.contrib.admin',
Valentin Samir's avatar
Valentin Samir committed
41
        ...
Valentin Samir's avatar
Valentin Samir committed
42
        'bootstrap3',
Valentin Samir's avatar
Valentin Samir committed
43 44 45
        'cas_server',
    )

46 47 48 49 50 51 52 53 54
   For internatinalization support, add "django.middleware.locale.LocaleMiddleware"
   to your MIDDLEWARE_CLASSES setting like this::

    MIDDLEWARE_CLASSES = (
        ...
        'django.middleware.locale.LocaleMiddleware',
        ...
    )

Valentin Samir's avatar
Valentin Samir committed
55
2. Include the cas_server URLconf in your project urls.py like this::
Valentin Samir's avatar
Valentin Samir committed
56

Valentin Samir's avatar
Valentin Samir committed
57 58 59 60 61
    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        ...
        url(r'^cas/', include('cas_server.urls', namespace="cas_server")),
    ]
Valentin Samir's avatar
Valentin Samir committed
62 63 64

3. Run `python manage.py migrate` to create the cas_server models.

65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86

4. You should add some management commands to a crontab: ``clearsessions``,
   ``cas_clean_tickets`` and ``cas_clean_sessions``.

 * ``clearsessions``:  please see `Clearing the session store <https://docs.djangoproject.com/en/1.9/topics/http/sessions/#clearing-the-session-store>`_.
 * ``cas_clean_tickets``: old tickets and timed-out tickets do not get purge from
   the database automatically. They are just marked as invalid. ``cas_clean_tickets``
   is a clean-up management command for this purpose. It send SingleLogOut request
   to services with timed out tickets and delete them.
 * ``cas_clean_sessions``: Logout and purge users (sending SLO requests) that are
   inactive since more than ``SESSION_COOKIE_AGE``. The default value for is ``1209600``
   seconds (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day).

 You could for example do as bellow :

   .. code-block::

      0   0  * * * cas-user /path/to/project/manage.py clearsessions
      */5 *  * * * cas-user /path/to/project/manage.py cas_clean_tickets
      5   0  * * * cas-user /path/to/project/manage.py cas_clean_sessions

5. Start the development server and visit http://127.0.0.1:8000/admin/
Valentin Samir's avatar
Valentin Samir committed
87 88 89
   to add a first service allowed to authenticate user agains the CAS
   (you'll need the Admin app enabled).

90 91 92 93
6. Visit http://127.0.0.1:8000/cas/ to login with your django users.



Valentin Samir's avatar
Valentin Samir committed
94 95 96 97 98 99 100 101 102

Settings
--------

All settings are optional. Add them to ``settings.py`` to customize ``django-cas-server``:


Template settings:

Valentin Samir's avatar
Valentin Samir committed
103 104
* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user
  is not autenticated.  The default is ``"cas_server/login.html"``.
105
* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then
Valentin Samir's avatar
Valentin Samir committed
106 107 108 109 110 111 112 113
  the user is authenticated and has asked to be warned before beeing connected
  to a service. The default is ``"cas_server/warn.html"``.
* ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is
  authenticated. The default is ``"cas_server/logged.html"``.
* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user
  is being disconnected. The default is ``"cas_server/logout.html"``
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to `/login` after they
  logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``.
Valentin Samir's avatar
Valentin Samir committed
114 115 116 117


Authentication settings:

Valentin Samir's avatar
Valentin Samir committed
118 119
*  ``CAS_AUTH_CLASS``: A dotted paths to a class implementing ``cas_server.auth.AuthUser``.
   The default is ``"cas_server.auth.DjangoAuthUser"``
Valentin Samir's avatar
Valentin Samir committed
120

121 122 123 124
*  ``SESSION_COOKIE_AGE``: This is a django settings. Here, it control the delay in seconds after
   which inactive users are logged out. The default is ``1209600`` (2 weeks). You probably should
   reduce it to something like ``86400`` seconds (1 day).

Valentin Samir's avatar
Valentin Samir committed
125 126 127 128 129
* ``CAS_PROXY_CA_CERTIFICATE_PATH``: Path to certificates authority file. Usually on linux
  the local CAs are in ``/etc/ssl/certs/ca-certificates.crt``. The default is ``True`` which
  tell requests to use its internal certificat authorities. Settings it to ``False`` should
  disable all x509 certificates validation and MUST not be done in production.
  x509 certificate validation is perform upon PGT issuance.
Valentin Samir's avatar
Valentin Samir committed
130

Valentin Samir's avatar
Valentin Samir committed
131 132
* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests send.
  If more requests need to be send, there are queued. The default is ``10``.
Valentin Samir's avatar
Valentin Samir committed
133
* ``CAS_SLO_TIMEOUT``: Timeout for a single SLO request in seconds. The default is ``5``.
Valentin Samir's avatar
Valentin Samir committed
134 135 136

Tickets validity settings:

Valentin Samir's avatar
Valentin Samir committed
137 138 139 140 141 142 143
* ``CAS_TICKET_VALIDITY``: Number of seconds the service tickets and proxy tickets are valid.
  This is the maximal time between ticket issuance by the CAS and ticket validation by an
  application. The default is ``60``.
* ``CAS_PGT_VALIDITY``: Number of seconds the proxy granting tickets are valid.
  The default is ``3600`` (1 hour).
* ``CAS_TICKET_TIMEOUT``: Number of seconds a ticket is kept is the database before sending
  Single Log Out request and being cleared. The default is ``86400`` (24 hours).
Valentin Samir's avatar
Valentin Samir committed
144 145 146

Tickets miscellaneous settings:

Valentin Samir's avatar
Valentin Samir committed
147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166
* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementation MUST support ST and PT
  up to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up
  to 256 chars are supports. Here the default is ``64``.
* ``CAS_LT_LEN``: Length of the login tickets. Login tickets are only processed by ``django-cas-server``
  thus there is no length restriction on it. The default is ``CAS_TICKET_LEN``.
* ``CAS_ST_LEN``: Length of the service tickets. The default is ``CAS_TICKET_LEN``.
  You may need to lower is to ``32`` if you use some old clients.
* ``CAS_PT_LEN``: Length of the proxy tickets. The default is ``CAS_TICKET_LEN``.
  This length should be the same as ``CAS_ST_LEN``. You may need to lower is to ``32``
  if you use some old clients.
* ``CAS_PGT_LEN``: Length of the proxy granting tickets. The default is ``CAS_TICKET_LEN``.
* ``CAS_PGTIOU_LEN``: Length of the proxy granting tickets IOU. The default is ``CAS_TICKET_LEN``.

* ``CAS_LOGIN_TICKET_PREFIX``: Prefix of login tickets. The default is ``"LT"``.
* ``CAS_SERVICE_TICKET_PREFIX``: Prefix of service tickets. The default is ``"ST"``.
  The CAS specification mandate that service tickets MUST begin with the characters ST
  so you should not change this.
* ``CAS_PROXY_TICKET_PREFIX``: Prefix of proxy ticket. The default is ``"ST"``.
* ``CAS_PROXY_GRANTING_TICKET_PREFIX``: Prefix of proxy granting ticket. The default is ``"PGT"``.
* ``CAS_PROXY_GRANTING_TICKET_IOU_PREFIX``: Prefix of proxy granting ticket IOU. The default is ``"PGTIOU"``.
Valentin Samir's avatar
Valentin Samir committed
167 168 169 170


Mysql backend settings. Only usefull is you use the mysql authentication backend:

Valentin Samir's avatar
Valentin Samir committed
171 172 173 174 175 176 177
* ``CAS_SQL_HOST``: Host for the SQL server. The default is ``"localhost"``.
* ``CAS_SQL_USERNAME``: Username for connecting to the SQL server.
* ``CAS_SQL_PASSWORD``: Password for connecting to the SQL server.
* ``CAS_SQL_DBNAME``: Database name.
* ``CAS_SQL_DBCHARSET``: Database charset. The default is ``"utf8"``
* ``CAS_SQL_USER_QUERY``: The query performed upon user authentication.
  The username must be in field ``username``, the password in ``password``,
Valentin Samir's avatar
Valentin Samir committed
178
  additional fields are used as the user attributes.
Valentin Samir's avatar
Valentin Samir committed
179 180 181
  The default is ``"SELECT user AS usersame, pass AS password, users.* FROM users WHERE user = %s"``
* ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be
  ``"crypt"`` or ``"plain``". The default is ``"crypt"``.
Valentin Samir's avatar
Valentin Samir committed
182 183 184 185 186 187

Authentication backend
----------------------

``django-cas-server`` comes with some authentication backends:

Valentin Samir's avatar
Valentin Samir committed
188 189
* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempt fails.
* test backend ``cas_server.auth.TestAuthUser``: username is ``test`` and password is ``test``
Valentin Samir's avatar
Valentin Samir committed
190
  the returned attributes for the user are: ``{'nom': 'Nymous', 'prenom': 'Ano', 'email': 'anonymous@example.net'}``
Valentin Samir's avatar
Valentin Samir committed
191
* django backend ``cas_server.auth.DjangoAuthUser``: Users are anthenticated agains django users system.
Valentin Samir's avatar
Valentin Samir committed
192
  This is the default backend. The returned attributes are the fields available on the user model.
Valentin Samir's avatar
Valentin Samir committed
193
* mysql backend ``cas_server.auth.MysqlAuthUser``: see the 'Mysql backend settings' section.
Valentin Samir's avatar
Valentin Samir committed
194
  The returned attributes are those return by sql query ``CAS_SQL_USER_QUERY``.
Valentin Samir's avatar
Valentin Samir committed
195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262

Logs
----

``django-cas-server`` logs most of its actions. To enable login, you must set the ``LOGGING``
(https://docs.djangoproject.com/en/dev/topics/logging) variable is ``settings.py``.

Users successful actions (login, logout) are logged with the level ``INFO``, failures are logged
with the level ``WARNING`` and user attributes transmitted to a service are logged with the level ``DEBUG``.

For exemple to log to syslog you can use :

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_syslog': {
                'format': 'cas: %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_syslog': {
                'level': 'INFO',
                'class': 'logging.handlers.SysLogHandler',
                'address': '/dev/log',
                'formatter': 'cas_syslog',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_syslog'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }


Or to log to a file:

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_file': {
                'format': '%(asctime)s %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_file': {
                'level': 'INFO',
                'class': 'logging.FileHandler',
                'filename': '/tmp/cas_server.log',
                'formatter': 'cas_file',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_file'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }