README.rst 15.6 KB
Newer Older
Valentin Samir's avatar
Valentin Samir committed
1
CAS Server
Valentin Samir's avatar
Valentin Samir committed
2
##########
Valentin Samir's avatar
Valentin Samir committed
3 4 5

.. image:: https://travis-ci.org/nitmir/django-cas-server.svg?branch=master
    :target: https://travis-ci.org/nitmir/django-cas-server
Valentin Samir's avatar
Valentin Samir committed
6

Valentin Samir's avatar
Valentin Samir committed
7 8 9 10
.. image:: https://img.shields.io/pypi/v/django-cas-server.svg
    :target: https://pypi.python.org/pypi/django-cas-server

.. image:: https://img.shields.io/pypi/l/django-cas-server.svg
Valentin Samir's avatar
Valentin Samir committed
11
    :target: https://www.gnu.org/licenses/gpl-3.0.html
Valentin Samir's avatar
Valentin Samir committed
12

13 14 15 16 17 18
.. image:: https://api.codacy.com/project/badge/Grade/255c21623d6946ef8802fa7995b61366
    :target: https://www.codacy.com/app/valentin-samir/django-cas-server

.. image:: https://api.codacy.com/project/badge/Coverage/255c21623d6946ef8802fa7995b61366
    :target: https://www.codacy.com/app/valentin-samir/django-cas-server

19
CAS Server is a Django application implementing the `CAS Protocol 3.0 Specification
20
<https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html>`_.
21

Valentin Samir's avatar
Valentin Samir committed
22 23 24
By defaut, the authentication process use django internal users but you can easily
use any sources (see auth classes in the auth.py file)

25
The defaut login/logout template use `django-bootstrap3 <https://github.com/dyve/django-bootstrap3>`__
26 27
but you can use your own templates using settings variables.

28
Note that for Django 1.7 compatibility, you need a version of
29
`django-bootstrap3 <https://github.com/dyve/django-bootstrap3>`__ < 7.0.0
30 31
like the 6.2.2 version.

Valentin Samir's avatar
Valentin Samir committed
32 33
.. contents:: Table of Contents

34
Features
Valentin Samir's avatar
Valentin Samir committed
35
========
36 37 38 39 40 41 42

* Support CAS version 1.0, 2.0, 3.0
* Support Single Sign Out
* Configuration of services via the django Admin application
* Fine control on which user's attributes are passed to which service
* Possibility to rename/rewrite attributes per service
* Possibility to require some attribute values per service
43
* Federated mode between multiple CAS
44 45
* Supports Django 1.7, 1.8 and 1.9
* Supports Python 2.7, 3.x
Valentin Samir's avatar
Valentin Samir committed
46 47

Quick start
Valentin Samir's avatar
Valentin Samir committed
48
===========
49
1. If you want to make a virtualenv for ``django-cas-server``, you will need the following
Valentin Samir's avatar
Valentin Samir committed
50 51 52 53 54 55 56 57
   dependencies on a bare debian like system::

    virtualenv build-essential python-dev libxml2-dev libxslt1-dev zlib1g-dev

   If you want to use python3 instead of python2, replace ``python-dev`` with ``python3-dev``.

   If you intend to run the tox tests you will also need ``python3.4-dev`` depending of the current
   version of python3 on your system.
Valentin Samir's avatar
Valentin Samir committed
58

59
2. Add "cas_server" to your INSTALLED_APPS setting like this::
Valentin Samir's avatar
Valentin Samir committed
60 61

    INSTALLED_APPS = (
62
        'django.contrib.admin',
Valentin Samir's avatar
Valentin Samir committed
63
        ...
64
        'bootstrap3',
Valentin Samir's avatar
Valentin Samir committed
65 66 67
        'cas_server',
    )

68 69 70 71 72 73 74 75 76
   For internatinalization support, add "django.middleware.locale.LocaleMiddleware"
   to your MIDDLEWARE_CLASSES setting like this::

    MIDDLEWARE_CLASSES = (
        ...
        'django.middleware.locale.LocaleMiddleware',
        ...
    )

77
3. Include the cas_server URLconf in your project urls.py like this::
Valentin Samir's avatar
Valentin Samir committed
78

79 80 81 82 83
    urlpatterns = [
        url(r'^admin/', admin.site.urls),
        ...
        url(r'^cas/', include('cas_server.urls', namespace="cas_server")),
    ]
Valentin Samir's avatar
Valentin Samir committed
84

85
4. Run `python manage.py migrate` to create the cas_server models.
Valentin Samir's avatar
Valentin Samir committed
86

87

88
5. You should add some management commands to a crontab: ``clearsessions``,
89 90
   ``cas_clean_tickets`` and ``cas_clean_sessions``.

91 92 93 94 95 96 97 98
   * ``clearsessions``:  please see `Clearing the session store <https://docs.djangoproject.com/en/stable/topics/http/sessions/#clearing-the-session-store>`_.
   * ``cas_clean_tickets``: old tickets and timed-out tickets do not get purge from
     the database automatically. They are just marked as invalid. ``cas_clean_tickets``
     is a clean-up management command for this purpose. It send SingleLogOut request
     to services with timed out tickets and delete them.
   * ``cas_clean_sessions``: Logout and purge users (sending SLO requests) that are
     inactive since more than ``SESSION_COOKIE_AGE``. The default value for is ``1209600``
     seconds (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day).
99

100
   You could for example do as bellow :
101 102 103 104 105 106 107

   .. code-block::

      0   0  * * * cas-user /path/to/project/manage.py clearsessions
      */5 *  * * * cas-user /path/to/project/manage.py cas_clean_tickets
      5   0  * * * cas-user /path/to/project/manage.py cas_clean_sessions

108
6. Start the development server and visit http://127.0.0.1:8000/admin/
Valentin Samir's avatar
Valentin Samir committed
109 110 111
   to add a first service allowed to authenticate user agains the CAS
   (you'll need the Admin app enabled).

112
7. Visit http://127.0.0.1:8000/cas/ to login with your django users.
113 114 115



Valentin Samir's avatar
Valentin Samir committed
116 117

Settings
Valentin Samir's avatar
Valentin Samir committed
118
========
Valentin Samir's avatar
Valentin Samir committed
119 120 121 122

All settings are optional. Add them to ``settings.py`` to customize ``django-cas-server``:


Valentin Samir's avatar
Valentin Samir committed
123 124
Template settings
-----------------
Valentin Samir's avatar
Valentin Samir committed
125

126 127 128
* ``CAS_LOGO_URL``: Url to the logo showed in the up left corner on the default
  templates. Set it to ``False`` to disable it.

Valentin Samir's avatar
Valentin Samir committed
129 130
* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user
  is not autenticated.  The default is ``"cas_server/login.html"``.
131
* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then
Valentin Samir's avatar
Valentin Samir committed
132 133 134 135 136 137 138 139
  the user is authenticated and has asked to be warned before beeing connected
  to a service. The default is ``"cas_server/warn.html"``.
* ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is
  authenticated. The default is ``"cas_server/logged.html"``.
* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user
  is being disconnected. The default is ``"cas_server/logout.html"``
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to `/login` after they
  logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``.
Valentin Samir's avatar
Valentin Samir committed
140 141


Valentin Samir's avatar
Valentin Samir committed
142 143
Authentication settings
-----------------------
Valentin Samir's avatar
Valentin Samir committed
144

Valentin Samir's avatar
Valentin Samir committed
145
*  ``CAS_AUTH_CLASS``: A dotted path to a class or a class implementing
146
   ``cas_server.auth.AuthUser``. The default is ``"cas_server.auth.DjangoAuthUser"``
Valentin Samir's avatar
Valentin Samir committed
147

148 149 150 151
*  ``SESSION_COOKIE_AGE``: This is a django settings. Here, it control the delay in seconds after
   which inactive users are logged out. The default is ``1209600`` (2 weeks). You probably should
   reduce it to something like ``86400`` seconds (1 day).

Valentin Samir's avatar
Valentin Samir committed
152
* ``CAS_PROXY_CA_CERTIFICATE_PATH``: Path to certificate authorities file. Usually on linux
Valentin Samir's avatar
Valentin Samir committed
153 154 155 156
  the local CAs are in ``/etc/ssl/certs/ca-certificates.crt``. The default is ``True`` which
  tell requests to use its internal certificat authorities. Settings it to ``False`` should
  disable all x509 certificates validation and MUST not be done in production.
  x509 certificate validation is perform upon PGT issuance.
Valentin Samir's avatar
Valentin Samir committed
157

Valentin Samir's avatar
Valentin Samir committed
158 159
* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests send.
  If more requests need to be send, there are queued. The default is ``10``.
160
* ``CAS_SLO_TIMEOUT``: Timeout for a single SLO request in seconds. The default is ``5``.
Valentin Samir's avatar
Valentin Samir committed
161

162

163 164
Federation settings
-------------------
165 166 167

* ``CAS_FEDERATE``: A boolean for activating the federated mode (see the federate section below).
  The default is ``False``.
168
* ``CAS_FEDERATE_PROVIDERS``: A dictionnary for the allowed identity providers (see the federate
169
  section below). The default is ``{}``.
170 171 172 173
* ``CAS_FEDERATE_PROVIDERS_LIST``: A list in with the keys of ``CAS_FEDERATE_PROVIDERS`` are ordened
  for beeing displayed on the login page. The default is the list of all the keys of
  ``CAS_FEDERATE_PROVIDERS`` sorted in natural order (0 < 2 < 10 < 20 < a = A < … < z = Z and
  lexicographical)
174 175 176
* ``CAS_FEDERATE_REMEMBER_TIMEOUT``: Time after witch the cookie use for "remember my identity
  provider" expire. The default is ``604800``, one week. The cookie is called
  ``_remember_provider``.
177 178


Valentin Samir's avatar
Valentin Samir committed
179 180
Tickets validity settings
-------------------------
Valentin Samir's avatar
Valentin Samir committed
181

Valentin Samir's avatar
Valentin Samir committed
182 183 184 185 186
* ``CAS_TICKET_VALIDITY``: Number of seconds the service tickets and proxy tickets are valid.
  This is the maximal time between ticket issuance by the CAS and ticket validation by an
  application. The default is ``60``.
* ``CAS_PGT_VALIDITY``: Number of seconds the proxy granting tickets are valid.
  The default is ``3600`` (1 hour).
Valentin Samir's avatar
Valentin Samir committed
187
* ``CAS_TICKET_TIMEOUT``: Number of seconds a ticket is kept in the database before sending
Valentin Samir's avatar
Valentin Samir committed
188
  Single Log Out request and being cleared. The default is ``86400`` (24 hours).
Valentin Samir's avatar
Valentin Samir committed
189

Valentin Samir's avatar
Valentin Samir committed
190 191
Tickets miscellaneous settings
------------------------------
Valentin Samir's avatar
Valentin Samir committed
192

Valentin Samir's avatar
Valentin Samir committed
193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209
* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementation MUST support ST and PT
  up to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up
  to 256 chars are supports. Here the default is ``64``.
* ``CAS_LT_LEN``: Length of the login tickets. Login tickets are only processed by ``django-cas-server``
  thus there is no length restriction on it. The default is ``CAS_TICKET_LEN``.
* ``CAS_ST_LEN``: Length of the service tickets. The default is ``CAS_TICKET_LEN``.
  You may need to lower is to ``32`` if you use some old clients.
* ``CAS_PT_LEN``: Length of the proxy tickets. The default is ``CAS_TICKET_LEN``.
  This length should be the same as ``CAS_ST_LEN``. You may need to lower is to ``32``
  if you use some old clients.
* ``CAS_PGT_LEN``: Length of the proxy granting tickets. The default is ``CAS_TICKET_LEN``.
* ``CAS_PGTIOU_LEN``: Length of the proxy granting tickets IOU. The default is ``CAS_TICKET_LEN``.

* ``CAS_LOGIN_TICKET_PREFIX``: Prefix of login tickets. The default is ``"LT"``.
* ``CAS_SERVICE_TICKET_PREFIX``: Prefix of service tickets. The default is ``"ST"``.
  The CAS specification mandate that service tickets MUST begin with the characters ST
  so you should not change this.
Valentin Samir's avatar
Valentin Samir committed
210
* ``CAS_PROXY_TICKET_PREFIX``: Prefix of proxy ticket. The default is ``"PT"``.
Valentin Samir's avatar
Valentin Samir committed
211 212
* ``CAS_PROXY_GRANTING_TICKET_PREFIX``: Prefix of proxy granting ticket. The default is ``"PGT"``.
* ``CAS_PROXY_GRANTING_TICKET_IOU_PREFIX``: Prefix of proxy granting ticket IOU. The default is ``"PGTIOU"``.
Valentin Samir's avatar
Valentin Samir committed
213 214


Valentin Samir's avatar
Valentin Samir committed
215 216 217
Mysql backend settings
----------------------
Only usefull if you are using the mysql authentication backend:
Valentin Samir's avatar
Valentin Samir committed
218

Valentin Samir's avatar
Valentin Samir committed
219 220 221 222 223 224 225
* ``CAS_SQL_HOST``: Host for the SQL server. The default is ``"localhost"``.
* ``CAS_SQL_USERNAME``: Username for connecting to the SQL server.
* ``CAS_SQL_PASSWORD``: Password for connecting to the SQL server.
* ``CAS_SQL_DBNAME``: Database name.
* ``CAS_SQL_DBCHARSET``: Database charset. The default is ``"utf8"``
* ``CAS_SQL_USER_QUERY``: The query performed upon user authentication.
  The username must be in field ``username``, the password in ``password``,
226
  additional fields are used as the user attributes.
Valentin Samir's avatar
Valentin Samir committed
227
  The default is ``"SELECT user AS usersame, pass AS password, users.* FROM users WHERE user = %s"``
228
* ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be one of the following:
Valentin Samir's avatar
Valentin Samir committed
229

230 231 232 233 234 235 236 237 238
  * ``"crypt"`` (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
    should begin this $
  * ``"ldap"`` (see https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html)
    the password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA}, {SHA256},
    {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}.
  * ``"hex_HASH_NAME"`` with ``HASH_NAME`` in md5, sha1, sha224, sha256, sha384, sha512.
    The hashed password in the database is compare to the hexadecimal digest of the clear
    password hashed with the corresponding algorithm.
  * ``"plain"``, the password in the database must be in clear.
239 240

  The default is ``"crypt"``.
Valentin Samir's avatar
Valentin Samir committed
241

Valentin Samir's avatar
Valentin Samir committed
242

Valentin Samir's avatar
Valentin Samir committed
243 244 245
Test backend settings
---------------------
Only usefull if you are using the test authentication backend:
Valentin Samir's avatar
Valentin Samir committed
246 247 248 249

* ``CAS_TEST_USER``: Username of the test user. The default is ``"test"``.
* ``CAS_TEST_PASSWORD``: Password of the test user. The default is ``"test"``.
* ``CAS_TEST_ATTRIBUTES``: Attributes of the test user. The default is
250 251
  ``{'nom': 'Nymous', 'prenom': 'Ano', 'email': 'anonymous@example.net',
  'alias': ['demo1', 'demo2']}``.
Valentin Samir's avatar
Valentin Samir committed
252

Valentin Samir's avatar
Valentin Samir committed
253 254

Authentication backend
Valentin Samir's avatar
Valentin Samir committed
255
======================
Valentin Samir's avatar
Valentin Samir committed
256 257 258

``django-cas-server`` comes with some authentication backends:

Valentin Samir's avatar
Valentin Samir committed
259
* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempt fails.
Valentin Samir's avatar
Valentin Samir committed
260 261
* test backend ``cas_server.auth.TestAuthUser``: username, password and returned attributes
  for the user are defined by the ``CAS_TEST_*`` settings.
262
* django backend ``cas_server.auth.DjangoAuthUser``: Users are authenticated agains django users system.
263
  This is the default backend. The returned attributes are the fields available on the user model.
Valentin Samir's avatar
Valentin Samir committed
264
* mysql backend ``cas_server.auth.MysqlAuthUser``: see the 'Mysql backend settings' section.
265
  The returned attributes are those return by sql query ``CAS_SQL_USER_QUERY``.
266 267
* federated backend ``cas_server.auth.CASFederateAuth``: It is automatically used then ``CAS_FEDERATE`` is ``True``.
  You should not set it manually without setting ``CAS_FEDERATE`` to ``True``.
268 269

Logs
Valentin Samir's avatar
Valentin Samir committed
270
====
271 272

``django-cas-server`` logs most of its actions. To enable login, you must set the ``LOGGING``
Valentin Samir's avatar
Valentin Samir committed
273
(https://docs.djangoproject.com/en/stable/topics/logging) variable in ``settings.py``.
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335

Users successful actions (login, logout) are logged with the level ``INFO``, failures are logged
with the level ``WARNING`` and user attributes transmitted to a service are logged with the level ``DEBUG``.

For exemple to log to syslog you can use :

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_syslog': {
                'format': 'cas: %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_syslog': {
                'level': 'INFO',
                'class': 'logging.handlers.SysLogHandler',
                'address': '/dev/log',
                'formatter': 'cas_syslog',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_syslog'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }


Or to log to a file:

.. code-block:: python

    LOGGING = {
        'version': 1,
        'disable_existing_loggers': False,
        'formatters': {
            'cas_file': {
                'format': '%(asctime)s %(levelname)s %(message)s'
            },
        },
        'handlers': {
            'cas_file': {
                'level': 'INFO',
                'class': 'logging.FileHandler',
                'filename': '/tmp/cas_server.log',
                'formatter': 'cas_file',
            },
        },
        'loggers': {
            'cas_server': {
                'handlers': ['cas_file'],
                'level': 'INFO',
                'propagate': True,
            },
        },
    }
336 337 338


Federation mode
339
===============
340 341 342 343

``django-cas-server`` comes with a federation mode. Then ``CAS_FEDERATE`` is ``True``,
user are invited to choose an identity provider on the login page, then, they are redirected
to the provider CAS to authenticate. This provider transmit to ``django-cas-server`` the user
344
username and attributes. The user is now logged in on ``django-cas-server`` and can use
345 346 347 348 349 350 351 352
services using ``django-cas-server`` as CAS.

The list of allowed identity providers is defined using the ``CAS_FEDERATE_PROVIDERS`` parameter.
For instance:

.. code-block:: python

    CAS_FEDERATE_PROVIDERS = {
353 354
        "example.com": ("https://cas.example.com", 3, "Example dot com"),
        "exemple.fr": ("https://cas.exemple.fr", 3, "Exemple point fr"),
355 356 357 358
    }


``CAS_FEDERATE_PROVIDERS`` is a dictionnary using provider names as key and a tuple
359
(cas address, cas version protocol, provider verbose name) as value.
360 361 362 363

In federation mode, ``django-cas-server`` build user's username as follow:
``provider_returned_username@provider_name``.
You can choose the provider returned username for ``django-cas-server`` and the provider name
364 365
in order to make sense.

366 367
The "provider verbose name" is showed on the select menu of the login page.

368 369 370 371 372

Then using federate mode, you should add one command to a daily crontab: ``cas_clean_federate``.
This command clean the local cache of federated user from old unused users.


Valentin Samir's avatar
Valentin Samir committed
373 374 375 376 377
You could for example do as bellow :

.. code-block::

    10   0  * * * cas-user /path/to/project/manage.py cas_clean_federate