search

IUCrimson / AspNet.Security.CAS

ASP.NET Core authentication provider for CAS
MIT License
92 stars 47 forks source link

readme

AspNetCore.Security.CAS

A CAS 2.0 authentication provider for ASP.NET Core 2, based on Microsoft's providers for OAuth and Twitter.

Usage

  1. Install the NuGet package

    PM> Install-Package AspNetCore.Security.CAS

  2. Open Startup.cs

  3. In your startup's ConfigureServices method:

    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = new PathString("/login");
    })
    .AddCAS(options =>
    {
        options.CasServerUrlBase = Configuration["CasBaseUrl"];   // Set in `appsettings.json` file.
        options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    });

  4. In your startup's Configure method before UseMvc:

    app.UseAuthentication();

  5. Create a login endpoint. It doesn't have to automatically challenge but this example does:

    [AllowAnonymous]
[Route("login")]
public async Task Login(string returnUrl)
{
    var props = new AuthenticationProperties { RedirectUri = returnUrl };
    await HttpContext.ChallengeAsync("CAS", props);
}

CasOptions

At a minmum, the CasOptions object needs to have the CasServerUrlBase property set to the URL to your CAS server.

These options extend the RemoteAuthenticationOptions class.

Properties

Property Description Default
CasServerUrlBase The base url of the CAS server. Required. null
CasValidationUrl Used in cases where ticket validation occurs on a separate server than user login. Optional. null
TicketValidator Gets or sets the ICasTicketValidator used to validate tickets from CAS. Cas2TicketValidator
StateDataFormat Gets or sets the type used to secure data handled by the middleware. PropertiesDataFormat
NameIdentifierAttribute If set, and using the CAS 2 payload, the ticket validator use the specified CAS attribute as the NameIdentifier claim, which is used to associate external logins. null
Renew If this parameter is set, single sign-on will be bypassed. In this case, CAS will require the client to present credentials regardless of the existence of a single sign-on session with CAS. false
Gateway If this parameter is set, CAS will not ask the client for credentials. If the client has a pre-existing single sign-on session with CAS, or if a single sign-on session can be established through non-interactive means (i.e. trust authentication), CAS MAY redirect the client to the URL specified by the service parameter, appending a valid service ticket. false
ServiceHost Specify the domain name used in the service parameter. null
ServiceForceHTTPS Specify that exchanges with the CAS endpoint use https false
EscapeServiceString Escape the the service parameter string when sending requests to the CAS server. The default behavior to build the service uri is to escape, however, not all CAS server implementations will decode this value on receiving it. true

See the documentation for optional properties for more information if using Renew or Gateway.

Other .NET CAS Providers

MVC 5: Owin.Security.CAS

MVC 4 and below: Jasig's .NET CAS Client

MIT license