README.rst 7.13 KB
Newer Older
Valentin Samir's avatar
Valentin Samir committed
1
CAS Server
Valentin Samir's avatar
Valentin Samir committed
2 3 4 5 6 7 8
==========

.. image:: https://badge.fury.io/py/django-cas-server.svg
    :target: https://badge.fury.io/py/django-cas-server

.. image:: https://travis-ci.org/nitmir/django-cas-server.svg?branch=master
    :target: https://travis-ci.org/nitmir/django-cas-server
Valentin Samir's avatar
Valentin Samir committed
9

10 11 12
CAS Server is a Django app implementing the `CAS Protocol 3.0 Specification
<https://jasig.github.io/cas/development/protocol/CAS-Protocol-Specification.html>`_.

Valentin Samir's avatar
Valentin Samir committed
13 14 15 16 17 18
By defaut, the authentication process use django internal users but you can easily
use any sources (see auth classes in the auth.py file)

The differents parametters you can use in settings.py to tweak the application
are listed in default_settings.py

19
The defaut login/logout template use `django-bootstrap3 <https://github.com/dyve/django-bootstrap3>`_
Valentin Samir's avatar
Valentin Samir committed
20
but you can use your own templates using the CAS_LOGIN_TEMPLATE,
Valentin Samir's avatar
Valentin Samir committed
21
CAS_LOGGED_TEMPLATE, CAS_WARN_TEMPLATE and CAS_LOGOUT_TEMPLATE setting variables.
Valentin Samir's avatar
Valentin Samir committed
22 23 24 25 26 27 28 29

Quick start
-----------

1. Add "cas_server" to your INSTALLED_APPS setting like this::

    INSTALLED_APPS = (
        ...
30
        'bootstrap3',
Valentin Samir's avatar
Valentin Samir committed
31 32 33
        'cas_server',
    )

34 35 36 37 38 39 40 41 42
   For internatinalization support, add "django.middleware.locale.LocaleMiddleware"
   to your MIDDLEWARE_CLASSES setting like this::

    MIDDLEWARE_CLASSES = (
        ...
        'django.middleware.locale.LocaleMiddleware',
        ...
    )

Valentin Samir's avatar
Valentin Samir committed
43 44
2. Include the polls URLconf in your project urls.py like this::

45
    url(r'^cas/', include('cas_server.urls', namespace="cas_server")),
Valentin Samir's avatar
Valentin Samir committed
46 47 48 49 50 51 52 53

3. Run `python manage.py migrate` to create the cas_server models.

4. Start the development server and visit http://127.0.0.1:8000/admin/
   to add a first service allowed to authenticate user agains the CAS
   (you'll need the Admin app enabled).

5. Visit http://127.0.0.1:8000/cas/ to login with your django users.
Valentin Samir's avatar
Valentin Samir committed
54 55 56 57 58 59 60 61 62

Settings
--------

All settings are optional. Add them to ``settings.py`` to customize ``django-cas-server``:


Template settings:

Valentin Samir's avatar
Valentin Samir committed
63 64 65 66 67 68 69 70 71 72 73
* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user
  is not autenticated.  The default is ``"cas_server/login.html"``.
* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=…`` then
  the user is authenticated and has asked to be warned before beeing connected
  to a service. The default is ``"cas_server/warn.html"``.
* ``CAS_LOGGED_TEMPLATE``: Path to the template showed on ``/login`` then to user is
  authenticated. The default is ``"cas_server/logged.html"``.
* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user
  is being disconnected. The default is ``"cas_server/logout.html"``
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to `/login` after they
  logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``.
Valentin Samir's avatar
Valentin Samir committed
74 75 76 77


Authentication settings:

Valentin Samir's avatar
Valentin Samir committed
78 79
*  ``CAS_AUTH_CLASS``: A dotted paths to a class implementing ``cas_server.auth.AuthUser``.
   The default is ``"cas_server.auth.DjangoAuthUser"``
Valentin Samir's avatar
Valentin Samir committed
80

Valentin Samir's avatar
Valentin Samir committed
81 82 83 84 85
* ``CAS_PROXY_CA_CERTIFICATE_PATH``: Path to certificates authority file. Usually on linux
  the local CAs are in ``/etc/ssl/certs/ca-certificates.crt``. The default is ``True`` which
  tell requests to use its internal certificat authorities. Settings it to ``False`` should
  disable all x509 certificates validation and MUST not be done in production.
  x509 certificate validation is perform upon PGT issuance.
Valentin Samir's avatar
Valentin Samir committed
86

Valentin Samir's avatar
Valentin Samir committed
87 88
* ``CAS_SLO_MAX_PARALLEL_REQUESTS``: Maximum number of parallel single log out requests send.
  If more requests need to be send, there are queued. The default is ``10``.
Valentin Samir's avatar
Valentin Samir committed
89 90 91

Tickets validity settings:

Valentin Samir's avatar
Valentin Samir committed
92 93 94 95 96 97 98
* ``CAS_TICKET_VALIDITY``: Number of seconds the service tickets and proxy tickets are valid.
  This is the maximal time between ticket issuance by the CAS and ticket validation by an
  application. The default is ``60``.
* ``CAS_PGT_VALIDITY``: Number of seconds the proxy granting tickets are valid.
  The default is ``3600`` (1 hour).
* ``CAS_TICKET_TIMEOUT``: Number of seconds a ticket is kept is the database before sending
  Single Log Out request and being cleared. The default is ``86400`` (24 hours).
Valentin Samir's avatar
Valentin Samir committed
99 100 101

Tickets miscellaneous settings:

Valentin Samir's avatar
Valentin Samir committed
102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121
* ``CAS_TICKET_LEN``: Default ticket length. All CAS implementation MUST support ST and PT
  up to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up
  to 256 chars are supports. Here the default is ``64``.
* ``CAS_LT_LEN``: Length of the login tickets. Login tickets are only processed by ``django-cas-server``
  thus there is no length restriction on it. The default is ``CAS_TICKET_LEN``.
* ``CAS_ST_LEN``: Length of the service tickets. The default is ``CAS_TICKET_LEN``.
  You may need to lower is to ``32`` if you use some old clients.
* ``CAS_PT_LEN``: Length of the proxy tickets. The default is ``CAS_TICKET_LEN``.
  This length should be the same as ``CAS_ST_LEN``. You may need to lower is to ``32``
  if you use some old clients.
* ``CAS_PGT_LEN``: Length of the proxy granting tickets. The default is ``CAS_TICKET_LEN``.
* ``CAS_PGTIOU_LEN``: Length of the proxy granting tickets IOU. The default is ``CAS_TICKET_LEN``.

* ``CAS_LOGIN_TICKET_PREFIX``: Prefix of login tickets. The default is ``"LT"``.
* ``CAS_SERVICE_TICKET_PREFIX``: Prefix of service tickets. The default is ``"ST"``.
  The CAS specification mandate that service tickets MUST begin with the characters ST
  so you should not change this.
* ``CAS_PROXY_TICKET_PREFIX``: Prefix of proxy ticket. The default is ``"ST"``.
* ``CAS_PROXY_GRANTING_TICKET_PREFIX``: Prefix of proxy granting ticket. The default is ``"PGT"``.
* ``CAS_PROXY_GRANTING_TICKET_IOU_PREFIX``: Prefix of proxy granting ticket IOU. The default is ``"PGTIOU"``.
Valentin Samir's avatar
Valentin Samir committed
122 123 124 125


Mysql backend settings. Only usefull is you use the mysql authentication backend:

Valentin Samir's avatar
Valentin Samir committed
126 127 128 129 130 131 132 133 134 135 136
* ``CAS_SQL_HOST``: Host for the SQL server. The default is ``"localhost"``.
* ``CAS_SQL_USERNAME``: Username for connecting to the SQL server.
* ``CAS_SQL_PASSWORD``: Password for connecting to the SQL server.
* ``CAS_SQL_DBNAME``: Database name.
* ``CAS_SQL_DBCHARSET``: Database charset. The default is ``"utf8"``
* ``CAS_SQL_USER_QUERY``: The query performed upon user authentication.
  The username must be in field ``username``, the password in ``password``,
  additional fields are used as the user attributs.
  The default is ``"SELECT user AS usersame, pass AS password, users.* FROM users WHERE user = %s"``
* ``CAS_SQL_PASSWORD_CHECK``: The method used to check the user password. Must be
  ``"crypt"`` or ``"plain``". The default is ``"crypt"``.
Valentin Samir's avatar
Valentin Samir committed
137 138 139 140 141 142

Authentication backend
----------------------

``django-cas-server`` comes with some authentication backends:

Valentin Samir's avatar
Valentin Samir committed
143 144 145 146 147 148 149
* dummy backend ``cas_server.auth.DummyAuthUser``: all authentication attempt fails.
* test backend ``cas_server.auth.TestAuthUser``: username is ``test`` and password is ``test``
  the returned attributs for the user are: ``{'nom': 'Nymous', 'prenom': 'Ano', 'email': 'anonymous@example.net'}``
* django backend ``cas_server.auth.DjangoAuthUser``: Users are anthenticated agains django users system.
  This is the default backend. The returned attributs are the fields available on the user model.
* mysql backend ``cas_server.auth.MysqlAuthUser``: see the 'Mysql backend settings' section.
  The returned attributs are those return by sql query ``CAS_SQL_USER_QUERY``.