search

modolabs / Kurogo-Mobile-Web

Kurogo is a PHP framework for delivering high quality, data driven customizable content to a wide range of mobile devices. Its strengths lie in the customizable system that allows you to adapt content from a variety of sources and easily present that to mobile devices from feature phones, to early generation smart phones, to modern devices and tablets
http://kurogo.org
GNU Lesser General Public License v2.1
198 stars 99 forks source link

CASAuthentication - Support for proxy-authenticated web-service requests #44

Closed adamfranco closed 12 years ago

adamfranco commented 12 years ago

The CAS 2.0 protocol supports proxy-authentication of web-service requests. Proxy authentication allows one web application to access resources (e.g. web services) of another web application on behalf of a user, but without the username or password transmitted between the applications. https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough

In a proxy-authentication configuration, phpCAS with Kurogo is given a proxy-granting-ticket (PGT) which it can use to obtain a proxy-ticket (PT) that it passes off to underlying web-services secured by CAS. The underlying web-service will validate the PT with the CAS server and obtain the user id and information about the user who logged in to Kurogo without ever seeing the user's password or having to trust that Kurogo authenticated the user correctly.

This patch set includes configuration additions to the CASAuthentication class that allow Kurogo to configure the phpCAS library in "proxy" mode. As well, it includes an abstract CASProxyAuthenticatedDataController that can be extended to provide access to webservices protected by CAS.

akinspe commented 12 years ago

This has been integrated into the master branch. We probably want to talk with you about creating a DataRetriever in addition to a DataController. Please let me know if you want to talk about it.

adamfranco commented 12 years ago

I'd be happy to work on adding a matching DataRetriever. Is this list post the only info outside of the source-code?

akinspe commented 12 years ago

Some of the documentation has been updated and thankfully github is pretty good at rendering RST

https://github.com/modolabs/Kurogo-Mobile-Web/blob/master/doc/mw/dataretriever.rst https://github.com/modolabs/Kurogo-Mobile-Web/blob/master/doc/mw/urldataretriever.rst

I would not consider it complete, but it should give you a good start. It will be flushed out closer to 1.4 release.