L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth/cas: MDL-25062 CAS authentication plugin does not validate the CAS server certificate

Browse Source 
The CAS protocol security model requires that you verify the cas server
certificate before you trust the answer (valid authentication and username
etc.).

Credit goes to Joachim Fritschi for reporting it and providing a patch.
This commit is contained in:
Inaki
2010-11-18 00:12:23 +00:00
parent 80c2a742b6
commit 387d1dc0d5
3 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/cas/auth.php
+14 -2
View File
@@ -173,8 +173,12 @@ class auth_plugin_cas extends auth_plugin_ldap {
}
}
// Don't try to validate the server SSL credentials
phpCAS::setNoCasServerValidation();
if($this->config->certificate_check && $this->config->certificate_path){
phpCAS::setCasServerCACert($this->config->certificate_path);
}else{
// Don't try to validate the server SSL credentials
phpCAS::setNoCasServerValidation();
}
}
/**
@@ -245,6 +249,12 @@ class auth_plugin_cas extends auth_plugin_ldap {
if (!isset($config->multiauth)) {
$config->multiauth = '';
}
if (!isset($config->certificate_check)) {
$config->certificate_check = '';
}
if (!isset($config->certificate_path)) {
$config->certificate_path = '';
}
// LDAP settings
if (!isset($config->host_url)) {
@@ -306,6 +316,8 @@ class auth_plugin_cas extends auth_plugin_ldap {
set_config('proxycas', $config->proxycas, $this->pluginconfig);
set_config('logoutcas', $config->logoutcas, $this->pluginconfig);
set_config('multiauth', $config->multiauth, $this->pluginconfig);
set_config('certificate_check', $config->certificate_check, $this->pluginconfig);
set_config('certificate_path', $config->certificate_path, $this->pluginconfig);
// save LDAP settings
set_config('host_url', trim($config->host_url), $this->pluginconfig);
auth/cas/config.html
+25
View File
@@ -27,6 +27,12 @@ if (!isset ($config->logoutcas)) {
if (!isset ($config->multiauth)) {
$config->multiauth = '';
}
if (!isset ($config->certificate_check)) {
$config->certificate_check = '';
}
if (!isset ($config->certificate_path)) {
$config->certificate_path = '';
}
// set to defaults if undefined (LDAP)
if (!isset($config->host_url)) {
@@ -176,6 +182,25 @@ $yesno = array( get_string('no'), get_string('yes') );
<?php print_string('auth_cas_multiauth', 'auth_cas') ?>
</td>
</tr>
<tr valign="top" class="required">
<td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth_cas') ?>:</td>
<td>
<?php echo html_writer::select($yesno, 'certificate_check', $config->certificate_check, false); ?>
</td>
<td>
<?php print_string('auth_cas_certificate_check', 'auth_cas') ?>
</td>
</tr>
<tr valign="top" class="required">
<td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth_cas') ?>:</td>
<td>
<input name="certificate_path" id="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
<?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
</td>
<td>
<?php print_string('auth_cas_certificate_path', 'auth_cas') ?>
</td>
</tr>
<tr>
<td colspan="2">
<h4><?php print_string('auth_ldap_server_settings', 'auth_ldap') ?></h4>
auth/cas/lang/en/auth_cas.php
+4
View File
@@ -31,6 +31,10 @@ $string['auth_cas_baseuri_key'] = 'Base URI';
$string['auth_cas_broken_password'] = 'You cannot proceed without changing your password, however there is no available page for changing it. Please contact your Moodle Administrator.';
$string['auth_cas_cantconnect'] = 'LDAP part of CAS-module cannot connect to server: {$a}';
$string['auth_cas_casversion'] = 'Version';
$string['auth_cas_certificate_check'] = 'Turn this to \'yes\' if you want to validate the server certificate';
$string['auth_cas_certificate_check_key'] = 'Server validation';
$string['auth_cas_certificate_path'] = 'Path of the CA chain file (PEM Format) to validate the server certificate';
$string['auth_cas_certificate_path_key'] = 'Certificate path';
$string['auth_cas_create_user'] = 'Turn this on if you want to insert CAS-authenticated users in Moodle database. If not then only users who already exist in the Moodle database can log in.';
$string['auth_cas_create_user_key'] = 'Create user';
$string['auth_casdescription'] = 'This method uses a CAS server (Central Authentication Service) to authenticate users in a Single Sign On environment (SSO). You can also use a simple LDAP authentication. If the given username and password are valid according to CAS, Moodle creates a new user entry in its database, taking user attributes from LDAP if required. On following logins only the username and password are checked.';