sojweb

<p><strong>THIS IS FOR DEVELOPMENT PURPOSES, NOT FOR USE ON PRODUCTION SITES</strong></p>
<p>This plugin is meant to be a reference; I’ve talked to several people who have similar setups, and thought it would beneficial to share some code.</p>
<p>This plugin allows users to be authenticated via CAS, and logins to be controlled via LDAP. Default user roles can be assigned based on LDAP group membership, and accounts can be auto-created for users that exist in LDAP, but not yet in WordPress.</p>
<p>It assumes that, for CAS authentication, the user is redirected to an outside address, then back to the referring address; that’s how it works where I’m at :-). You can also specify a group in LDAP that will always have admin privileges; useful for tech staff.</p>
<p>Before the plugin is used, the constants in <code>soj-ldap_constants.inc.php</code> must be filled out. The CAS default password is the one the user is registered with in WordPress; so all WP users will have this password. Be aware of that. There is obviously more that could be done there, and I’m happy to work with others who have ideas.</p>
<p>I’ve adapted this from an in-house plugin I made, so there might be leftover code bits or things that look strange… feel free to harass me about that, I did this in a bit of a rush.</p>
<p>I’ve only ever used this plugin on one environment, so it might not work out-of-the-box for you. I’m interested in making this plugin more robust, however, so please let me know of any issues.</p>
<p>Contact me: jj56@indiana.edu</p>


SoJ CAS/LDAP Login

This plugin allows users to be authenticated via CAS, and logins to be controlled via LDAP.

Luis Rodrigues

<p>Cassava allows WordPress to act as a single sign-on authenticator using the Central Authentication Service (CAS) protocol.</p>
<p>That way, users on your WordPress install may be able to access different applications that support the CAS protocol by providing a single set of credentials and without exposing the user’s password.</p>
<p>By default, CAS method URIs are provided under the <code>wp-cas</code> endpoint:</p>
<ul>
<li><code>/wp-cas/login</code>: Allows a remote service to request that a user authenticate on the CAS server. Will redirect back to the remote service along with a service ticket.</li>
<li><code>/wp-cas/logout</code>: Terminates the single sign-on session. May optionally redirect the user back to the remote service.</li>
<li><code>/wp-cas/validate</code> [CAS 1.0]: Allows a remote service to validate a service ticket forwarded by the user on redirect. Returns a plaintext response.</li>
<li><code>/wp-cas/proxy</code> [CAS 2.0]: Provides access to remote services with proxy tickets in exchange for proxy-granting tickets. Returns an XML response.</li>
<li><code>/wp-cas/proxyValidate</code> [CAS 2.0]: Allows a remote service to validate a service or proxy ticket forwarded by the user on redirect. Returns an XML response.</li>
<li><code>/wp-cas/serviceValidate</code> [CAS 2.0]: Allows a remote service to validate a service ticket forwarded by the user on redirect. Returns an XML response.</li>
<li><code>/wp-cas/p3/proxyValidate</code> [CAS 3.0]: Allows a remote service to validate a service or proxy ticket forwarded by the user on redirect. Returns an XML response.</li>
<li><code>/wp-cas/p3/serviceValidate</code> [CAS 3.0]: Allows a remote service to validate a service ticket forwarded by the user on redirect. Returns an XML response.</li>
</ul>
<p>There are a few <a href="http://www.jasig.org/cas/client-integration" rel="nofollow ugc">client integration</a> libraries available for CAS, as well as a handy guide for <a href="https://wiki.jasig.org/display/CASC/CASifying+Applications" rel="nofollow ugc">CASifying several existing applications</a>. Independent WordPress installations may integrate with Cassava using a client plugin such as <a href="https://wordpress.org/plugins/cas-maestro/" rel="ugc">CAS Maestro</a>.</p>
<p>Please follow and contribute to Cassava’s development on <a href="https://github.com/goblindegook/wp-cas-server" rel="nofollow ugc">Github</a>.</p>
<h3>Hooks</h3>
<h4>Action: cas_server_before_request</h4>
<p>Fires before a CAS request is processed.</p>
<p>Parameters:</p>
<ul>
<li><em>string</em> <code>$path</code>: Requested URI path.</li>
</ul>
<h4>Action: cas_server_after_request</h4>
<p>Fires after a CAS request is processed.</p>
<p>Parameters:</p>
<ul>
<li><em>string</em> <code>$path</code>: Requested URI path.</li>
</ul>
<h4>Action: cas_server_error</h4>
<p>Fires if the CAS server has to return an XML error.</p>
<p>Parameters:</p>
<ul>
<li><em>WP_Error</em> <code>$error</code>: WordPress error to return as XML.</li>
</ul>
<h4>Action: cas_server_validation_success</h4>
<p>Fires on successful ticket validation.</p>
<p>Parameters:</p>
<ul>
<li><em>WP_User</em> <code>$user</code>: WordPress user validated by ticket.</li>
<li><em>string</em> <code>$ticket</code>: Valid ticket string.</li>
</ul>
<h4>Filter: cas_enabled</h4>
<p>Allows developers to disable CAS.</p>
<p>Parameters:</p>
<ul>
<li><em>boolean</em> <code>$cas_enabled</code>: Whether the server should respond to single sign-on requests.</li>
</ul>
<h4>Filter: cas_server_routes</h4>
<p>Allows developers to override the default controller mapping, define additional endpoints and provide alternative implementations to the provided controllers.</p>
<p>Controllers provided in this fashion should extend the <code>\Cassava\CAS\Controller\BaseController</code> class.</p>
<p>Parameters:</p>
<ul>
<li><em>array</em> <code>$cas_routes</code>: CAS endpoint to controller mapping.</li>
</ul>
<h4>Filter: cas_server_response</h4>
<p>Lets developers change the CAS server response string.</p>
<p>Parameters:</p>
<ul>
<li><em>string</em> <code>$output</code>: Response output string.</li>
<li><em>string</em> <code>$path</code>: Requested URI path.</li>
</ul>
<h4>Filter: cas_server_dispatch_args</h4>
<p>Filters the callback arguments to be dispatched for the request. Plugin developers may return a <code>WP_Error</code> object here to abort the request.</p>
<p>Parameters:</p>
<ul>
<li><em>array</em> <code>$args</code>: Arguments to pass the callback.</li>
<li><em>(string|array)</em> <code>$callback</code>: Callback function or method.</li>
<li><em>string</em> <code>$path</code>: Requested URI path.</li>
</ul>
<h4>Filter: cas_server_login_args</h4>
<p>Allows developers to change the request parameters passed to a <code>/login</code> request.</p>
<p>Parameters:</p>
<ul>
<li><em>array</em> <code>$args</code>: HTTP request (GET, POST) parameters.</li>
</ul>
<h4>Filter: cas_server_redirect_service</h4>
<p>Filters the redirect URI for the service requesting user authentication.</p>
<p>Parameters:</p>
<ul>
<li><em>string</em> <code>$service</code>: Service URI requesting user authentication.</li>
<li><em>WP_User</em> <code>$user</code>: Logged in WordPress user.</li>
</ul>
<h4>Filter: cas_server_custom_auth_uri</h4>
<p>Allows developers to redirect the user to a custom login form.</p>
<p>Parameters:</p>
<ul>
<li><em>string</em> <code>$custom_login_url</code>: URI for the custom login page.</li>
<li><em>array</em> <code>$args</code>: Login request parameters.</li>
</ul>
<h4>Filter: cas_server_ticket_expiration</h4>
<p>This filter allows developers to override the default ticket expiration period.</p>
<p>Parameters:</p>
<ul>
<li><em>int</em> <code>$expiration</code>: Ticket expiration period (in seconds).</li>
<li><em>string</em> <code>$type</code>: Type of ticket to set.</li>
<li><em>WP_User</em> <code>$user</code>: Authenticated user associated with the ticket.</li>
</ul>
<h4>Filter: cas_server_validation_user_attributes</h4>
<p>Allows developers to change the list of (key, value) pairs before they’re included in a <code>/serviceValidate</code> response.</p>
<p>Parameters:</p>
<ul>
<li><em>array</em> <code>$attributes</code>: List of attributes to output.</li>
<li><em>WP_User</em> <code>$user</code>: Authenticated user.</li>
</ul>
<h4>Filter: cas_server_settings_user_attribute_options</h4>
<p>Allows developers to change the list of user attributes that appear in the dashboard for an administrator to set to return on successful validation requests.</p>
<p>Options are stored in an associative array, with user attribute slugs as array keys and option labels as array values.</p>
<p>These settings are valid only for CAS 2.0 validation requests.</p>
<p>Parameters:</p>
<ul>
<li><em>array</em> <code>$attributeOptions</code> Attribute options an administrator can set on the dashboard.</li>
</ul>


Cassava CAS Server

Cassava provides authentication services based on the Jasig CAS protocol.

SoJ CAS/LDAP Login vs Cassava CAS Server