README.rst 31.4 KB
Newer Older
Valentin Samir's avatar
Valentin Samir committed
1
CAS Server
Valentin Samir's avatar
Valentin Samir committed
2
##########
Valentin Samir's avatar
Valentin Samir committed
3

Valentin Samir's avatar
Valentin Samir committed
4
|travis| |coverage| |licence| |github_version| |pypi_version| |codacy| |doc|
5

6
CAS Server is a Django application implementing the `CAS Protocol 3.0 Specification
7
<https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html>`_.
8

Valentin Samir's avatar
Valentin Samir committed
9
By default, the authentication process use django internal users but you can easily
10
use any sources (see the `Authentication backend`_ section and auth classes in the auth.py file)
Valentin Samir's avatar
Valentin Samir committed
11

Valentin Samir's avatar
Valentin Samir committed
12 13
.. contents:: Table of Contents

14
Features
Valentin Samir's avatar
Valentin Samir committed
15
========
16 17 18 19 20 21 22

* Support CAS version 1.0, 2.0, 3.0
* Support Single Sign Out
* Configuration of services via the django Admin application
* Fine control on which user's attributes are passed to which service
* Possibility to rename/rewrite attributes per service
* Possibility to require some attribute values per service
23
* Federated mode between multiple CAS
24 25
* Supports Django 1.11 and 2.0
* Supports Python 2.7, 3.5+
Valentin Samir's avatar
Valentin Samir committed
26

Valentin Samir's avatar
Valentin Samir committed
27 28 29 30 31
Dependencies
============

``django-cas-server`` depends on the following python packages:

Valentin Samir's avatar
Valentin Samir committed
32
* Django >= 1.7.1 < 1.11
Valentin Samir's avatar
Valentin Samir committed
33 34 35
* requests >= 2.4
* requests_futures >= 0.9.5
* lxml >= 3.4
36 37 38 39 40
* six >= 1.8

Minimal version of packages dependancy are just indicative and meens that ``django-cas-server`` has
been tested with it. Previous versions of dependencies may or may not work.

41
Additionally, denpending of the `Authentication backend`_ you plan to use, you may need the following
42 43
python packages:

44 45 46
* ldap3
* psycopg2
* mysql-python
47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74


Here there is a table with the name of python packages and the corresponding packages providing
them on debian like systems and centos like systems.
You should try as much as possible to use system packages as there are automatically updated then
you update your system. You can then install Not Available (N/A)
packages on your system using pip inside a virtualenv as described in the `Installation`_ section.
For use with python3, just replace python(2) in the table by python3.

+------------------+-------------------------+---------------------+
| python package   | debian like systems     | centos like systems |
+==================+=========================+=====================+
| Django           | python-django           | python-django       |
+------------------+-------------------------+---------------------+
| requests         | python-requests         | python-requests     |
+------------------+-------------------------+---------------------+
| requests_futures | python-requests-futures | N/A                 |
+------------------+-------------------------+---------------------+
| lxml             | python-lxml             | python-lxml         |
+------------------+-------------------------+---------------------+
| six              | python-six              | python-six          |
+------------------+-------------------------+---------------------+
| ldap3            | python-ldap3            | python-ldap3        |
+------------------+-------------------------+---------------------+
| psycopg2         | python-psycopg2         | python-psycopg2     |
+------------------+-------------------------+---------------------+
| mysql-python     | python-mysqldb          | python2-mysql       |
+------------------+-------------------------+---------------------+
Valentin Samir's avatar
Valentin Samir committed
75 76 77 78 79 80 81 82 83 84 85 86

Installation
============

The recommended installation mode is to use a virtualenv with ``--system-site-packages``

1. Make sure that python virtualenv is installed

2. Install python packages available via the system package manager:

   On debian like systems::

87
    $ sudo apt-get install python-django python-requests python-six python-lxml python-requests-futures
Valentin Samir's avatar
Valentin Samir committed
88 89 90 91 92 93 94 95 96

   On debian jessie, you can use the version of python-django available in the
   `backports <https://backports.debian.org/Instructions/>`_.

   On centos like systems::

    $ sudo yum install python-django python-requests python-six python-lxml

3. Create a virtualenv::
Valentin Samir's avatar
Valentin Samir committed
97

Valentin Samir's avatar
Valentin Samir committed
98 99 100 101 102 103
    $ virtualenv --system-site-packages cas_venv
    Running virtualenv with interpreter /var/www/html/cas-server/bin/python2
    Using real prefix '/usr'
    New python executable in cas/bin/python2
    Also creating executable in cas/bin/python
    Installing setuptools, pip...done.
104 105 106

4. And `activate it <https://virtualenv.pypa.io/en/stable/userguide/#activate-script>`__::

Valentin Samir's avatar
Valentin Samir committed
107
    $ cd cas_venv/; . bin/activate
Valentin Samir's avatar
Valentin Samir committed
108

109
5. Create a django project::
Valentin Samir's avatar
Valentin Samir committed
110

Valentin Samir's avatar
Valentin Samir committed
111 112
   $ django-admin startproject cas_project
   $ cd cas_project
Valentin Samir's avatar
Valentin Samir committed
113

114
6. Install `django-cas-server`. To use the last published release, run::
Valentin Samir's avatar
Valentin Samir committed
115 116 117 118 119 120 121 122 123 124

    $ pip install django-cas-server

   Alternatively if you want to use the version of the git repository, you can clone it::

    $ git clone https://github.com/nitmir/django-cas-server
    $ cd django-cas-server
    $ pip install -r requirements.txt

   Then, either run ``make install`` to create a python package using the sources of the repository
125
   and install it with pip, or place the ``cas_server`` directory into your
Valentin Samir's avatar
Valentin Samir committed
126
   `PYTHONPATH <https://docs.python.org/2/using/cmdline.html#envvar-PYTHONPATH>`_
127
   (for instance by symlinking ``cas_server`` to the root of your django project).
Valentin Samir's avatar
Valentin Samir committed
128

129
7. Open ``cas_project/settings.py`` in you favourite editor and follow the quick start section.
Valentin Samir's avatar
Valentin Samir committed
130 131 132 133 134 135


Quick start
===========

1. Add "cas_server" to your INSTALLED_APPS setting like this::
Valentin Samir's avatar
Valentin Samir committed
136 137

    INSTALLED_APPS = (
138
        'django.contrib.admin',
Valentin Samir's avatar
Valentin Samir committed
139 140 141 142
        ...
        'cas_server',
    )

Valentin Samir's avatar
Valentin Samir committed
143
   For internationalization support, add "django.middleware.locale.LocaleMiddleware"
144 145 146 147 148 149 150 151
   to your MIDDLEWARE_CLASSES setting like this::

    MIDDLEWARE_CLASSES = (
        ...
        'django.middleware.locale.LocaleMiddleware',
        ...
    )

Valentin Samir's avatar
Valentin Samir committed
152 153 154
2. Include the cas_server URLconf in your project urls.py like this::

    from django.conf.urls import url, include
Valentin Samir's avatar
Valentin Samir committed
155

156 157 158 159 160
    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        ...
        url(r'^cas/', include('cas_server.urls', namespace="cas_server")),
    ]
Valentin Samir's avatar
Valentin Samir committed
161

Valentin Samir's avatar
Valentin Samir committed
162
3. Run ``python manage.py migrate`` to create the cas_server models.
Valentin Samir's avatar
Valentin Samir committed
163

164

Valentin Samir's avatar
Valentin Samir committed
165
4. You should add some management commands to a crontab: ``clearsessions``,
166 167
   ``cas_clean_tickets`` and ``cas_clean_sessions``.

168 169 170 171 172 173 174 175
   * ``clearsessions``:  please see `Clearing the session store <https://docs.djangoproject.com/en/stable/topics/http/sessions/#clearing-the-session-store>`_.
   * ``cas_clean_tickets``: old tickets and timed-out tickets do not get purge from
     the database automatically. They are just marked as invalid. ``cas_clean_tickets``
     is a clean-up management command for this purpose. It send SingleLogOut request
     to services with timed out tickets and delete them.
   * ``cas_clean_sessions``: Logout and purge users (sending SLO requests) that are
     inactive since more than ``SESSION_COOKIE_AGE``. The default value for is ``1209600``
     seconds (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day).
176

177
   You could for example do as bellow::
178

179 180 181
     0   0  * * * cas-user /path/to/project/manage.py clearsessions
     */5 *  * * * cas-user /path/to/project/manage.py cas_clean_tickets
     5   0  * * * cas-user /path/to/project/manage.py cas_clean_sessions
182

Valentin Samir's avatar
Valentin Samir committed
183 184
5. Run ``python manage.py createsuperuser`` to create an administrator user.

185
6. Start the development server and visit http://127.0.0.1:8000/admin/
Valentin Samir's avatar
Valentin Samir committed
186
   to add a first service allowed to authenticate user against the CAS
187
   (you'll need the Admin app enabled). See the `Service Patterns`_ section bellow.
Valentin Samir's avatar
Valentin Samir committed
188

189
7. Visit http://127.0.0.1:8000/cas/ to login with your django users.
190 191 192



Valentin Samir's avatar
Valentin Samir committed
193 194

Settings
Valentin Samir's avatar
Valentin Samir committed
195
========
Valentin Samir's avatar
Valentin Samir committed
196 197 198 199

All settings are optional. Add them to ``settings.py`` to customize ``django-cas-server``:


Valentin Samir's avatar
Valentin Samir committed
200 201
Template settings
-----------------
Valentin Samir's avatar
Valentin Samir committed
202

Valentin Samir's avatar
Valentin Samir committed
203
* ``CAS_LOGO_URL``: URL to the logo showed in the up left corner on the default
204
  templates. Set it to ``False`` to disable it.
205 206
* ``CAS_FAVICON_URL``: URL to the favicon (shortcut icon) used by the default templates.
  Default is a key icon. Set it to ``False`` to disable it.
207
* ``CAS_SHOW_POWERED``: Set it to ``False`` to hide the powered by footer. The default is ``True``.
208
* ``CAS_COMPONENT_URLS``: URLs to css and javascript external components. It is a dictionnary
209
  having the five following keys: ``"bootstrap3_css"``, ``"bootstrap3_js"``,
210 211 212 213 214 215 216 217 218
  ``"html5shiv"``, ``"respond"``, ``"jquery"``. The default is::

        {
            "bootstrap3_css": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css",
            "bootstrap3_js": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js",
            "html5shiv": "//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js",
            "respond": "//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js",
            "jquery": "//code.jquery.com/jquery.min.js",
        }
Valentin Samir's avatar
Valentin Samir committed
219

220
  if you omit some keys of the dictionnary, the default value for these keys is used.
Jorik Kraaikamp's avatar
Jorik Kraaikamp committed
221 222
* ``CAS_SHOW_SERVICE_MESSAGES``: Messages displayed about the state of the service on the login page.
  The default is ``True``.
223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246
* ``CAS_INFO_MESSAGES``: Messages displayed in info-boxes on the html pages of the default templates.
  It is a dictionnary mapping message name to a message dict. A message dict has 3 keys:

  * ``message``: A unicode message to display, potentially wrapped around ugettex_lazy
  * ``discardable``: A boolean, specify if the users can close the message info-box
  * ``type``: One of info, success, info, warning, danger. The type of the info-box.

  ``CAS_INFO_MESSAGES`` contains by default one message, ``cas_explained``, which explain
  roughly the purpose of a CAS. The default is::

    {
        "cas_explained": {
            "message":_(
                u"The Central Authentication Service grants you access to most of our websites by "
                u"authenticating only once, so you don't need to type your credentials again unless "
                u"your session expires or you logout."
            ),
            "discardable": True,
            "type": "info",  # one of info, success, info, warning, danger
        },
    }

* ``CAS_INFO_MESSAGES_ORDER``: A list of message names. Order in which info-box messages are
  displayed. Use an empty list to disable messages display. The default is ``[]``.
Valentin Samir's avatar
Valentin Samir committed
247 248
* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user
  is not autenticated.  The default is ``"cas_server/login.html"``.
249
* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then
Valentin Samir's avatar
Valentin Samir committed
250
  the user is authenticated and has asked to be warned before being connected
Valentin Samir's avatar
Valentin Samir committed
251 252 253 254 255
  to a service. The default is ``"cas_server/warn.html"``.
* ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is
  authenticated. The default is ``"cas_server/logged.html"``.
* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user
  is being disconnected. The default is ``"cas_server/logout.html"``
256
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to ``/login`` after they
Valentin Samir's avatar
Valentin Samir committed
257
  logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``.
Valentin Samir's avatar
Valentin Samir committed
258 259


Valentin Samir's avatar
Valentin Samir committed
260 261
Authentication settings
-----------------------
Valentin Samir's avatar
Valentin Samir committed
262

263 264 265 266
* ``CAS_AUTH_CLASS``: A dotted path to a class or a class implementing
  ``cas_server.auth.AuthUser``. The default is ``"cas_server.auth.DjangoAuthUser"``
  Available classes bundled with ``django-cas-server`` are listed below in the
  `Authentication backend`_ section.
Valentin Samir's avatar
Valentin Samir committed
267

268 269 270
* ``SESSION_COOKIE_AGE``: This is a django settings. Here, it control the delay in seconds after
  which inactive users are logged out. The default is ``1209600`` (2 weeks). You probably should
  reduce it to something like ``86400`` seconds (1 day).
271

272 273 274 275 276
* ``CAS_TGT_VALIDITY``: Max time after with the user MUST reauthenticate. Let it to `None` for no
  max time.This can be used to force refreshing cached informations only available upon user
  authentication like the user attributes in federation mode or with the ldap auth in bind mode.
  The default is ``None``.

Valentin Samir's avatar
Valentin Samir committed
277
* ``CAS_PROXY_CA_CERTIFICATE_PATH``: Path to certificate authorities file. Usually on linux
Valentin Samir's avatar
Valentin Samir committed
278 279 280 281
  the local CAs are in ``/etc/ssl/certs/ca-certificates.crt``. The default is ``True`` which
  tell requests to use its internal certificat authorities. Settings it to ``False`` should
  disable all x509 certificates validation and MUST not be done in production.
  x509 certificate validation is perform upon PGT issuance.
Valentin Samir's avatar
Valentin Samir committed
282

Valentin Samir's avatar
Valentin Samir committed
283 284
* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests send.
  If more requests need to be send, there are queued. The default is ``10``.
285
* ``CAS_SLO_TIMEOUT``: Timeout for a single SLO request in seconds. The default is ``5``.
Valentin Samir's avatar
Valentin Samir committed
286

287

288 289
Federation settings
-------------------
290

291 292
* ``CAS_FEDERATE``: A boolean for activating the federated mode (see the `Federation mode`_
  section below). The default is ``False``.
293 294 295
* ``CAS_FEDERATE_REMEMBER_TIMEOUT``: Time after witch the cookie use for "remember my identity
  provider" expire. The default is ``604800``, one week. The cookie is called
  ``_remember_provider``.
296 297


298 299 300 301 302 303
New version warnings settings
-----------------------------

* ``CAS_NEW_VERSION_HTML_WARNING``: A boolean for diplaying a warning on html pages then a new
  version of the application is avaible. Once closed by a user, it is not displayed to this user
  until the next new version. The default is ``True``.
Valentin Samir's avatar
Valentin Samir committed
304
* ``CAS_NEW_VERSION_EMAIL_WARNING``: A boolean for sending a email to ``settings.ADMINS`` when a new
305 306 307
  version is available. The default is ``True``.


Valentin Samir's avatar
Valentin Samir committed
308 309
Tickets validity settings
-------------------------
Valentin Samir's avatar
Valentin Samir committed
310

Valentin Samir's avatar
Valentin Samir committed
311 312 313 314 315
* ``CAS_TICKET_VALIDITY``: Number of seconds the service tickets and proxy tickets are valid.
  This is the maximal time between ticket issuance by the CAS and ticket validation by an
  application. The default is ``60``.
* ``CAS_PGT_VALIDITY``: Number of seconds the proxy granting tickets are valid.
  The default is ``3600`` (1 hour).
Valentin Samir's avatar
Valentin Samir committed
316
* ``CAS_TICKET_TIMEOUT``: Number of seconds a ticket is kept in the database before sending
Valentin Samir's avatar
Valentin Samir committed
317
  Single Log Out request and being cleared. The default is ``86400`` (24 hours).
Valentin Samir's avatar
Valentin Samir committed
318

Valentin Samir's avatar
Valentin Samir committed
319 320
Tickets miscellaneous settings
------------------------------
Valentin Samir's avatar
Valentin Samir committed
321

Valentin Samir's avatar
Valentin Samir committed
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementation MUST support ST and PT
  up to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up
  to 256 chars are supports. Here the default is ``64``.
* ``CAS_LT_LEN``: Length of the login tickets. Login tickets are only processed by ``django-cas-server``
  thus there is no length restriction on it. The default is ``CAS_TICKET_LEN``.
* ``CAS_ST_LEN``: Length of the service tickets. The default is ``CAS_TICKET_LEN``.
  You may need to lower is to ``32`` if you use some old clients.
* ``CAS_PT_LEN``: Length of the proxy tickets. The default is ``CAS_TICKET_LEN``.
  This length should be the same as ``CAS_ST_LEN``. You may need to lower is to ``32``
  if you use some old clients.
* ``CAS_PGT_LEN``: Length of the proxy granting tickets. The default is ``CAS_TICKET_LEN``.
* ``CAS_PGTIOU_LEN``: Length of the proxy granting tickets IOU. The default is ``CAS_TICKET_LEN``.

* ``CAS_LOGIN_TICKET_PREFIX``: Prefix of login tickets. The default is ``"LT"``.
* ``CAS_SERVICE_TICKET_PREFIX``: Prefix of service tickets. The default is ``"ST"``.
  The CAS specification mandate that service tickets MUST begin with the characters ST
  so you should not change this.
Valentin Samir's avatar
Valentin Samir committed
339
* ``CAS_PROXY_TICKET_PREFIX``: Prefix of proxy ticket. The default is ``"PT"``.
Valentin Samir's avatar
Valentin Samir committed
340 341
* ``CAS_PROXY_GRANTING_TICKET_PREFIX``: Prefix of proxy granting ticket. The default is ``"PGT"``.
* ``CAS_PROXY_GRANTING_TICKET_IOU_PREFIX``: Prefix of proxy granting ticket IOU. The default is ``"PGTIOU"``.
Valentin Samir's avatar
Valentin Samir committed
342 343


Valentin Samir's avatar
Valentin Samir committed
344 345
Mysql backend settings
----------------------
346
Deprecated, see the `Sql backend settings`_.
Valentin Samir's avatar
Valentin Samir committed
347
Only usefull if you are using the mysql authentication backend:
Valentin Samir's avatar
Valentin Samir committed
348

Valentin Samir's avatar
Valentin Samir committed
349 350 351 352 353 354 355
* ``CAS_SQL_HOST``: Host for the SQL server. The default is ``"localhost"``.
* ``CAS_SQL_USERNAME``: Username for connecting to the SQL server.
* ``CAS_SQL_PASSWORD``: Password for connecting to the SQL server.
* ``CAS_SQL_DBNAME``: Database name.
* ``CAS_SQL_DBCHARSET``: Database charset. The default is ``"utf8"``
* ``CAS_SQL_USER_QUERY``: The query performed upon user authentication.
  The username must be in field ``username``, the password in ``password``,
356
  additional fields are used as the user attributes.
Valentin Samir's avatar
Valentin Samir committed
357
  The default is ``"SELECT user AS username, pass AS password, users.* FROM users WHERE user = %s"``
358
* ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following:
Valentin Samir's avatar
Valentin Samir committed
359

360 361 362 363 364 365 366 367 368
  * ``"crypt"`` (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
    should begin this $
  * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html)
    the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256},
    {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}.
  * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512.
    The hashed password in the database is compare to the hexadecimal digest of the clear
    password hashed with the corresponding algorithm.
  * ``"plain"``, the password in the database must be in clear.
369 370

  The default is ``"crypt"``.
Valentin Samir's avatar
Valentin Samir committed
371

Valentin Samir's avatar
Valentin Samir committed
372

373 374 375
Sql backend settings
--------------------
Only usefull if you are using the sql authentication backend. You must add a ``"cas_server"``
376
database to `settings.DATABASES <https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-DATABASES>`__
377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
as defined in the django documentation. It is then the database
use by the sql backend.

* ``CAS_SQL_USER_QUERY``: The query performed upon user authentication.
  The username must be in field ``username``, the password in ``password``,
  additional fields are used as the user attributes.
  The default is ``"SELECT user AS username, pass AS password, users.* FROM users WHERE user = %s"``
* ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following:

  * ``"crypt"`` (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
    should begin this $
  * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html)
    the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256},
    {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}.
  * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512.
    The hashed password in the database is compare to the hexadecimal digest of the clear
    password hashed with the corresponding algorithm.
  * ``"plain"``, the password in the database must be in clear.

  The default is ``"crypt"``.
* ``CAS_SQL_PASSWORD_CHARSET``: Charset the SQL users passwords was hash with. This is needed to
  encode the user sended password before hashing it for comparison. The default is ``"utf-8"``.


Ldap backend settings
---------------------
Only usefull if you are using the ldap authentication backend:

* ``CAS_LDAP_SERVER``: Address of the LDAP server. The default is ``"localhost"``.
* ``CAS_LDAP_USER``: User bind address, for example ``"cn=admin,dc=crans,dc=org"`` for
  connecting to the LDAP server.
* ``CAS_LDAP_PASSWORD``: Password for connecting to the LDAP server.
* ``CAS_LDAP_BASE_DN``: LDAP search base DN, for example ``"ou=data,dc=crans,dc=org"``.
* ``CAS_LDAP_USER_QUERY``: Search filter for searching user by username. User inputed usernames are
  escaped using ``ldap3.utils.conv.escape_bytes``. The default is ``"(uid=%s)"``
* ``CAS_LDAP_USERNAME_ATTR``: Attribute used for users usernames. The default is ``"uid"``
* ``CAS_LDAP_PASSWORD_ATTR``: Attribute used for users passwords. The default is ``"userPassword"``
* ``CAS_LDAP_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following:

  * ``"crypt"`` (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
    should begin this $
  * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html)
    the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256},
    {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}.
  * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512.
    The hashed password in the database is compare to the hexadecimal digest of the clear
    password hashed with the corresponding algorithm.
  * ``"plain"``, the password in the database must be in clear.
425 426 427 428 429 430 431 432
  * ``"bind``, the user credentials are used to bind to the ldap database and retreive the user
    attribute. In this mode, the settings ``CAS_LDAP_PASSWORD_ATTR`` and ``CAS_LDAP_PASSWORD_CHARSET``
    are ignored, and it is the ldap server that perform password check. The counterpart is that
    the user attributes are only available upon user password check and so are cached for later
    use. All the other modes directly fetch the user attributes from the database whenever there
    are needed. This mean that is you use this mode, they can be some difference between the
    attributes in database and the cached ones if changes happend in the database after the user
    authentiate. See the parameter ``CAS_TGT_VALIDITY`` to force user to reauthenticate periodically.
433 434 435 436 437 438

  The default is ``"ldap"``.
* ``CAS_LDAP_PASSWORD_CHARSET``: Charset the LDAP users passwords was hash with. This is needed to
  encode the user sended password before hashing it for comparison. The default is ``"utf-8"``.


Valentin Samir's avatar
Valentin Samir committed
439 440 441
Test backend settings
---------------------
Only usefull if you are using the test authentication backend:
Valentin Samir's avatar
Valentin Samir committed
442 443 444 445

* ``CAS_TEST_USER``: Username of the test user. The default is ``"test"``.
* ``CAS_TEST_PASSWORD``: Password of the test user. The default is ``"test"``.
* ``CAS_TEST_ATTRIBUTES``: Attributes of the test user. The default is
446 447
  ``{'nom': 'Nymous', 'prenom': 'Ano', 'email': 'anonymous@example.net',
  'alias': ['demo1', 'demo2']}``.
Valentin Samir's avatar
Valentin Samir committed
448

Valentin Samir's avatar
Valentin Samir committed
449 450

Authentication backend
Valentin Samir's avatar
Valentin Samir committed
451
======================
Valentin Samir's avatar
Valentin Samir committed
452 453 454

``django-cas-server`` comes with some authentication backends:

Valentin Samir's avatar
Valentin Samir committed
455
* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempt fails.
Valentin Samir's avatar
Valentin Samir committed
456 457
* test backend ``cas_server.auth.TestAuthUser``: username, password and returned attributes
  for the user are defined by the ``CAS_TEST_*`` settings.
Valentin Samir's avatar
Valentin Samir committed
458
* django backend ``cas_server.auth.DjangoAuthUser``: Users are authenticated against django users system.
459
  This is the default backend. The returned attributes are the fields available on the user model.
460 461 462 463
* mysql backend ``cas_server.auth.MysqlAuthUser``: Deprecated, use the sql backend instead.
  see the `Mysql backend settings`_ section. The returned attributes are those return by sql query
  ``CAS_SQL_USER_QUERY``.
* sql backend ``cas_server.auth.SqlAuthUser``: see the `Sql backend settings`_ section.
464
  The returned attributes are those return by sql query ``CAS_SQL_USER_QUERY``.
465 466
* ldap backend ``cas_server.auth.LdapAuthUser``: see the `Ldap backend settings`_ section.
  The returned attributes are those of the ldap node returned by the query filter ``CAS_LDAP_USER_QUERY``.
467 468
* federated backend ``cas_server.auth.CASFederateAuth``: It is automatically used then ``CAS_FEDERATE`` is ``True``.
  You should not set it manually without setting ``CAS_FEDERATE`` to ``True``.
469

470

471
Logs
Valentin Samir's avatar
Valentin Samir committed
472
====
473 474

``django-cas-server`` logs most of its actions. To enable login, you must set the ``LOGGING``
Valentin Samir's avatar
Valentin Samir committed
475
(https://docs.djangoproject.com/en/stable/topics/logging) variable in ``settings.py``.
476 477 478 479

Users successful actions (login, logout) are logged with the level ``INFO``, failures are logged
with the level ``WARNING`` and user attributes transmitted to a service are logged with the level ``DEBUG``.

Valentin Samir's avatar
Valentin Samir committed
480
For example to log to syslog you can use :
481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_syslog': {
                'format': 'cas: %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_syslog': {
                'level': 'INFO',
                'class': 'logging.handlers.SysLogHandler',
                'address': '/dev/log',
                'formatter': 'cas_syslog',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_syslog'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }


Or to log to a file:

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_file': {
                'format': '%(asctime)s %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_file': {
                'level': 'INFO',
                'class': 'logging.FileHandler',
                'filename': '/tmp/cas_server.log',
                'formatter': 'cas_file',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_file'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }
538

Valentin Samir's avatar
Valentin Samir committed
539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585
Service Patterns
================

In a CAS context, ``Service`` refers to the application the client is trying to access.
By extension we use ``service`` for the URL of such an application.

By default, ``django-cas-server`` do not allow any service to use the CAS to authenticate users.
In order to allow services, you need to connect to the django admin interface using a django
superuser, and add a first service pattern.

A service pattern comes with 9 fields:

* ``Position``: an integer used to change the order in which services are matched against
  service patterns.
* ``Name``: the name of the service pattern. It will be displayed to the users asking for a ticket
  for a service matching this service pattern on the login page.
* ``Pattern``: a regular expression used to match services.
* ``User field``: the user attribute to use as username for services matching this service pattern.
  Leave it empty to use the login name.
* ``Restrict username``: if checked, only login name defined below are allowed to get tickets
  for services matching this service pattern.
* ``Proxy``: if checked, allow the creation of Proxy Ticket for services matching this
  service pattern. Otherwise, only Service Ticket will be created.
* ``Proxy callback``: if checked, services matching this service pattern are allowed to retrieve Proxy
  Granting Ticket. A service with a Proxy Granting Ticket can get Proxy Ticket for other services.
  Hence you must only check this for trusted services that need it. (For instance, a webmail needs
  Proxy Ticket to authenticate himself as the user to the imap server).
* ``Single log out``: Check it to send Single Log Out requests to authenticated services matching
  this service pattern. SLO requests are send to all services the user is authenticated to then
  the user disconnect.
* ``Single log out callback``: The http(s) URL to POST the SLO requests. If empty, the service URL
  is used. This field is useful to allow non http services (imap, smtp, ftp) to handle SLO requests.

A service pattern has 4 associated models:

* ``Usernames``: a list of username associated with the ``Restrict username`` field
* ``Replace attribut names``: a list of user attributes to send to the service. Choose the name
  used for sending the attribute by setting ``Remplacement`` or leave it empty to leave it unchanged.
* ``Replace attribut values``: a list of sent user attributes for which value needs to be tweak.
  Replace the attribute value by the string obtained by replacing the leftmost non-overlapping
  occurrences of ``pattern`` in string by ``replace``. In ``replace`` backslash escapes are processed.
  Matched groups are captures by \1, \2, etc.
* ``Filter attribut values``: a list of user attributes for which value needs to match a regular
  expression. For instance, service A may need an email address, and you only want user with
  an email address to connect to it. To do so, put ``email`` in ``Attribute`` and ``.*`` in ``pattern``.

Then a user ask a ticket for a service, the service URL is compare against each service patterns
586 587 588 589
sorted by ``position``. The first service pattern that matches the service URL is chosen.
Hence, you should give low ``position`` to very specific patterns like
``^https://www\.example\.com(/.*)?$`` and higher ``position`` to generic patterns like ``^https://.*``.
So the service URL ``https://www.examle.com`` will use the service pattern for
Valentin Samir's avatar
Valentin Samir committed
590 591
``^https://www\.example\.com(/.*)?$`` and not the one for ``^https://.*``.

592 593

Federation mode
594
===============
595 596 597 598

``django-cas-server`` comes with a federation mode. Then ``CAS_FEDERATE`` is ``True``,
user are invited to choose an identity provider on the login page, then, they are redirected
to the provider CAS to authenticate. This provider transmit to ``django-cas-server`` the user
599
username and attributes. The user is now logged in on ``django-cas-server`` and can use
600 601
services using ``django-cas-server`` as CAS.

602 603 604 605
In federation mode, the user attributes are cached upon user authentication. See the settings
``CAS_TGT_VALIDITY`` to force users to reauthenticate periodically and allow ``django-cas-server``
to refresh cached attributes.

606 607
The list of allowed identity providers is defined using the django admin application.
With the development server started, visit http://127.0.0.1:8000/admin/ to add identity providers.
608

609
An identity provider comes with 5 fields:
610

Valentin Samir's avatar
Valentin Samir committed
611
* ``Position``: an integer used to tweak the order in which identity providers are displayed on
612
  the login page. Identity providers are sorted using position first, then, on equal position,
Valentin Samir's avatar
Valentin Samir committed
613 614
  using ``verbose name`` and then, on equal ``verbose name``, using ``suffix``.
* ``Suffix``: the suffix that will be append to the username returned by the identity provider.
615
  It must be unique.
Valentin Samir's avatar
Valentin Samir committed
616
* ``Server url``: the URL to the identity provider CAS. For instance, if you are using
617
  ``https://cas.example.org/login`` to authenticate on the CAS, the ``server url`` is
Valentin Samir's avatar
Valentin Samir committed
618 619
  ``https://cas.example.org``
* ``CAS protocol version``: the version of the CAS protocol to use to contact the identity provider.
620
  The default is version 3.
Valentin Samir's avatar
Valentin Samir committed
621 622
* ``Verbose name``: the name used on the login page to display the identity provider.
* ``Display``: a boolean controlling the display of the identity provider on the login page.
623
  Beware that this do not disable the identity provider, it just hide it on the login page.
Valentin Samir's avatar
Valentin Samir committed
624
  User will always be able to log in using this provider by fetching ``/federate/provider_suffix``.
625 626 627


In federation mode, ``django-cas-server`` build user's username as follow:
628 629 630 631
``provider_returned_username@provider_suffix``.
Choose the provider returned username for ``django-cas-server`` and the provider suffix
in order to make sense, as this built username is likely to be displayed to end users in
applications.
632

633 634 635 636 637

Then using federate mode, you should add one command to a daily crontab: ``cas_clean_federate``.
This command clean the local cache of federated user from old unused users.


638
You could for example do as bellow::
Valentin Samir's avatar
Valentin Samir committed
639

640
  10   0  * * * cas-user /path/to/project/manage.py cas_clean_federate
641 642 643 644 645 646



.. |travis| image:: https://badges.genua.fr/travis/nitmir/django-cas-server/master.svg
    :target: https://travis-ci.org/nitmir/django-cas-server

647
.. |pypi_version| image:: https://badges.genua.fr/pypi/v/django-cas-server.svg
648 649
    :target: https://pypi.python.org/pypi/django-cas-server

650 651 652
.. |github_version| image:: https://badges.genua.fr/github/tag/nitmir/django-cas-server.svg?label=github
    :target: https://github.com/nitmir/django-cas-server/releases/latest

Valentin Samir's avatar
Valentin Samir committed
653
.. |licence| image:: https://badges.genua.fr/pypi/l/django-cas-server.svg
654 655 656 657 658
    :target: https://www.gnu.org/licenses/gpl-3.0.html

.. |codacy| image:: https://badges.genua.fr/codacy/grade/255c21623d6946ef8802fa7995b61366/master.svg
    :target: https://www.codacy.com/app/valentin-samir/django-cas-server

Valentin Samir's avatar
Valentin Samir committed
659 660
.. |coverage| image:: https://intranet.genua.fr/coverage/badge/django-cas-server/master.svg
    :target: https://badges.genua.fr/coverage/django-cas-server/master
Valentin Samir's avatar
Valentin Samir committed
661 662 663

.. |doc| image:: https://badges.genua.fr/local/readthedocs/?version=latest
    :target: http://django-cas-server.readthedocs.io