search

nitmir / django-cas-server

A Django Central Authentication Service server implementing the CAS Protocol 3.0 Specification
GNU General Public License v3.0
132 stars 44 forks source link

Application's user sessions are independent from CAS Server sessions? #70

Closed sumpfralle closed 3 years ago

sumpfralle commented 3 years ago

I have an existing Django application (grouprise), which I would like to extend with an authentication provider, in order to let our users work with an external application (in this case: an element/matrix instance).

Thus I added cas_server to INSTALLED_APPS in my existing Django application. I was happy to get to a working login via /cas/login quickly. Now it is possible to use the external application based on the account storage of my existing application.

But I was surprised (surely due to my lack of understanding), that the session of my existing Django application is not connected to the session of the CAS Server application:

I assume, that this result is quite obvious for you, dear reader. But I am a bit at loss, what to do now.

I could imagine, that I could solve this, by adding a CAS client application to the setup, in order to redirect the authentication of existing application towards the CAS server.

Or maybe CAS server is just not meant to be combined with other applications? Or maybe I misunderstand something trivial?

Thank you for your time!

(sorry for using this issue tracker for a support request - I am not aware of other communication channels for CAS Server)

nitmir commented 3 years ago

Hi

You're indeed right, django-cas-server does not cohabit well with other app using django session. It does not use django auth framework at all and will completely erase user session upon login/logout, messing up with the auth framework if used. Django-cas-server can use a lots of different auth backends (I think most people use the ldap backend), most of them not matching exactly the Django user models. This is why the auth framework is not used.

The classic setup will be to use django-cas-server on a different django project than your main project with its own domain like https://cas.example.org. And then, on your main project, to use a CAS client like https://github.com/django-cas-ng/django-cas-ng.

I think (but I'm not sure) it is enough to have different cookie domain for django-cas-server and the rest of your project + a CAS client. Users will have different cookies and different session depending on from which url they access the service. With this, you could manage to keep a single project with 2 different (sub)domains.

Note it is possible to have 2 different django project use the same database as long as the django version is in sync between the 2 project. This would allow you to share the django users between 2 different Django projects.

(no problem for using the issue tracker for support requests, there indeed no other communication channels)

sumpfralle commented 3 years ago

Thank you a lot for your quick response and your comprehensive description of the available options. This will help me to decide how to move on. Thanks!