From 387d1dc0d506d6a41c578976a2bf6bfb06be47a0 Mon Sep 17 00:00:00 2001
From: Inaki <iarenuno@eteo.mondragon.edu>
Date: Thu, 18 Nov 2010 00:12:23 +0000
Subject: [PATCH] auth/cas: MDL-25062 CAS authentication plugin does not
 validate the CAS server certificate

The CAS protocol security model requires that you verify the cas server
certificate before you trust the answer (valid authentication and username
etc.).

Credit goes to Joachim Fritschi for reporting it and providing a patch.
---
 auth/cas/auth.php             | 16 ++++++++++++++--
 auth/cas/config.html          | 25 +++++++++++++++++++++++++
 auth/cas/lang/en/auth_cas.php |  4 ++++
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/auth/cas/auth.php b/auth/cas/auth.php
index 33fee98fd44..d8204b8a576 100644
--- a/auth/cas/auth.php
+++ b/auth/cas/auth.php
@@ -173,8 +173,12 @@ class auth_plugin_cas extends auth_plugin_ldap {
             }
         }
 
-        // Don't try to validate the server SSL credentials
-        phpCAS::setNoCasServerValidation();
+        if($this->config->certificate_check && $this->config->certificate_path){
+            phpCAS::setCasServerCACert($this->config->certificate_path);
+        }else{
+            // Don't try to validate the server SSL credentials
+            phpCAS::setNoCasServerValidation();
+        }
     }
 
     /**
@@ -245,6 +249,12 @@ class auth_plugin_cas extends auth_plugin_ldap {
         if (!isset($config->multiauth)) {
             $config->multiauth = '';
         }
+        if (!isset($config->certificate_check)) {
+            $config->certificate_check = '';
+        }
+        if (!isset($config->certificate_path)) {
+            $config->certificate_path = '';
+        }
 
         // LDAP settings
         if (!isset($config->host_url)) {
@@ -306,6 +316,8 @@ class auth_plugin_cas extends auth_plugin_ldap {
         set_config('proxycas', $config->proxycas, $this->pluginconfig);
         set_config('logoutcas', $config->logoutcas, $this->pluginconfig);
         set_config('multiauth', $config->multiauth, $this->pluginconfig);
+        set_config('certificate_check', $config->certificate_check, $this->pluginconfig);
+        set_config('certificate_path', $config->certificate_path, $this->pluginconfig);
 
         // save LDAP settings
         set_config('host_url', trim($config->host_url), $this->pluginconfig);
diff --git a/auth/cas/config.html b/auth/cas/config.html
index de6595b66ca..b1aaa6d354f 100644
--- a/auth/cas/config.html
+++ b/auth/cas/config.html
@@ -27,6 +27,12 @@ if (!isset ($config->logoutcas)) {
 if (!isset ($config->multiauth)) {
     $config->multiauth = '';
 }
+if (!isset ($config->certificate_check)) {
+    $config->certificate_check = '';
+}
+if (!isset ($config->certificate_path)) {
+    $config->certificate_path = '';
+}
 
 // set to defaults if undefined (LDAP)
 if (!isset($config->host_url)) {
@@ -176,6 +182,25 @@ $yesno = array( get_string('no'), get_string('yes') );
         <?php print_string('auth_cas_multiauth', 'auth_cas') ?>
     </td>
 </tr>
+<tr valign="top"  class="required">
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth_cas') ?>:</td>
+    <td>
+        <?php echo html_writer::select($yesno, 'certificate_check', $config->certificate_check, false); ?>
+    </td>
+    <td>
+        <?php print_string('auth_cas_certificate_check', 'auth_cas') ?>
+    </td>
+</tr>
+<tr valign="top" class="required">
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth_cas') ?>:</td>
+    <td>
+        <input name="certificate_path" id="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+    </td>
+    <td>
+        <?php print_string('auth_cas_certificate_path', 'auth_cas') ?>
+    </td>
+</tr>
 <tr>
    <td colspan="2">
         <h4><?php print_string('auth_ldap_server_settings', 'auth_ldap') ?></h4>
diff --git a/auth/cas/lang/en/auth_cas.php b/auth/cas/lang/en/auth_cas.php
index 0bb83784c33..9770ccc29e5 100644
--- a/auth/cas/lang/en/auth_cas.php
+++ b/auth/cas/lang/en/auth_cas.php
@@ -31,6 +31,10 @@ $string['auth_cas_baseuri_key'] = 'Base URI';
 $string['auth_cas_broken_password'] = 'You cannot proceed without changing your password, however there is no available page for changing it. Please contact your Moodle Administrator.';
 $string['auth_cas_cantconnect'] = 'LDAP part of CAS-module cannot connect to server: {$a}';
 $string['auth_cas_casversion'] = 'Version';
+$string['auth_cas_certificate_check'] = 'Turn this to \'yes\' if you want to validate the server certificate';
+$string['auth_cas_certificate_check_key'] = 'Server validation';
+$string['auth_cas_certificate_path'] = 'Path of the CA chain file (PEM Format) to validate the server certificate';
+$string['auth_cas_certificate_path_key'] = 'Certificate path';
 $string['auth_cas_create_user'] = 'Turn this on if you want to insert CAS-authenticated users in Moodle database. If not then only users who already exist in the Moodle database can log in.';
 $string['auth_cas_create_user_key'] = 'Create user';
 $string['auth_casdescription'] = 'This method uses a CAS server (Central Authentication Service) to authenticate users in a Single Sign On environment (SSO). You can also use a simple LDAP authentication. If the given username and password are valid according to CAS, Moodle creates a new user entry in its database, taking user attributes from LDAP if required. On following logins only the username and password are checked.';