Provided by: python3-django-cas-server-doc_2.1.0-2_all 
NAME
django-cas-server - django-cas-server Documentation
Contents:
CAS SERVER
CAS Server is a Django application implementing the CAS Protocol 3.0 Specification.
By default, the authentication process uses django internal users but you can easily use
any source (see the Authentication backend section and auth classes in the auth.py file)
Table of Contents
• CAS Server
• Features
• Dependencies
• Installation
• Quick start
• Settings
• Template settings
• Authentication settings
• Federation settings
• New version warnings settings
• Tickets validity settings
• Tickets miscellaneous settings
• Forms settings
• Mysql backend settings
• Sql backend settings
• Ldap backend settings
• Test backend settings
• Authentication backend
• Logs
• Service Patterns
• Federation mode
Features
• Support CAS version 1.0, 2.0, 3.0
• Support Single Sign Out
• Configuration of services via the Django Admin application
• Fine control on which user’s attributes are passed to which service
• Possibility to rename/rewrite attributes per service
• Possibility to require some attribute values per service
• Federated mode between multiple CAS
• Supports Django 1.11, 2.2, 3.2, 4.2
• Supports Python 3.6+
Dependencies
django-cas-server depends on the following python packages:
• Django >= 1.11 < 4.3
• requests >= 2.4
• requests_futures >= 0.9.5
• lxml >= 3.4
Minimal version of package dependencies are just indicative and means that
django-cas-server has been tested with it. Previous versions of dependencies may or may
not work.
Additionally, depending on the Authentication backend you plan to use, you may need the
following python packages:
• ldap3
• psycopg2
• mysql-python
Here is a table with the name of python packages and the corresponding packages providing
them on debian like systems and centos like systems. You should try as much as possible
to use system packages as they are automatically updated when you update your system. You
can then install Not Available (N/A) packages on your system using pip3 inside a
virtualenv as described in the Installation section.
┌─────────────────┬──────────────────────────┬─────────────────────┐
│python package │ debian like systems │ centos like systems │
├─────────────────┼──────────────────────────┼─────────────────────┤
│Django │ python3-django │ python36-django │
├─────────────────┼──────────────────────────┼─────────────────────┤
│requests │ python3-requests │ python36-requests │
├─────────────────┼──────────────────────────┼─────────────────────┤
│requests_futures │ python3-requests-futures │ N/A │
├─────────────────┼──────────────────────────┼─────────────────────┤
│lxml │ python3-lxml │ python36-lxml │
├─────────────────┼──────────────────────────┼─────────────────────┤
│ldap3 │ python3-ldap3 │ python36-ldap3 │
├─────────────────┼──────────────────────────┼─────────────────────┤
│psycopg2 │ python3-psycopg2 │ python36-psycopg2 │
├─────────────────┼──────────────────────────┼─────────────────────┤
│mysql-python │ python3-mysqldb │ python36-mysql │
└─────────────────┴──────────────────────────┴─────────────────────┘
Installation
The recommended installation mode is to use a virtualenv with --system-site-packages
1. Make sure that python virtualenv is installed
2. Install python packages available via the system package manager:
On debian like systems:
$ sudo apt-get install python3-django python3-requests python3-lxml python3-requests-futures
On debian jessie, you can use the version of python-django available in the backports.
On centos like systems with epel enabled:
$ sudo yum install python36-django python36-requests python36-lxml
3. Create a virtualenv:
$ virtualenv -p python3 --system-site-packages cas_venv
4. And activate it:
$ cd cas_venv/; . bin/activate
5. Create a django project:
$ django-admin startproject cas_project
$ cd cas_project
6. Install django-cas-server. To use the last published release, run:
$ pip install django-cas-server
Alternatively if you want to use the version of the git repository, you can clone it:
$ git clone https://github.com/nitmir/django-cas-server
$ cd django-cas-server
$ pip install -r requirements.txt
Then, either run make install to create a python package using the sources of the
repository and install it with pip, or place the cas_server directory into your ‐
PYTHONPATH (for instance by symlinking cas_server to the root of your django project).
7. Open cas_project/settings.py in your favourite editor and follow the quick start
section.
Quick start
1. Add “cas_server” to your INSTALLED_APPS setting like this:
INSTALLED_APPS = (
'django.contrib.admin',
...
'cas_server',
)
For internationalization support, add “django.middleware.locale.LocaleMiddleware” to
your MIDDLEWARE setting like this:
MIDDLEWARE = [
...
'django.middleware.locale.LocaleMiddleware',
...
]
2. Include the cas_server URLconf in your project urls.py like this:
from django.urls import path, include
urlpatterns = [
path('admin/', admin.site.urls),
...
path('cas/', include('cas_server.urls', namespace="cas_server")),
]
3. Run python manage.py migrate to create the cas_server models.
4. You should add some management commands to a crontab: clearsessions, cas_clean_tickets
and cas_clean_sessions.
• clearsessions: please see Clearing the session store.
• cas_clean_tickets: old tickets and timed-out tickets do not get purged from the
database automatically. They are just marked as invalid. cas_clean_tickets is a
clean-up management command for this purpose. It sends SingleLogOut requests to
services with timed out tickets and deletes them.
• cas_clean_sessions: Logout and purge users (sending SLO requests) that are inactive
more than SESSION_COOKIE_AGE. The default value is 1209600 seconds (2 weeks). You
probably should reduce it to something like 86400 seconds (1 day).
You could, for example, do as below:
0 0 * * * cas-user /path/to/project/manage.py clearsessions
*/5 * * * * cas-user /path/to/project/manage.py cas_clean_tickets
5 0 * * * cas-user /path/to/project/manage.py cas_clean_sessions
5. Run python manage.py createsuperuser to create an administrator user.
6. Start the development server and visit http://127.0.0.1:8000/admin/ to add a first
service allowed to authenticate user against the CAS (you’ll need the Admin app
enabled). See the Service Patterns section below.
7. Visit http://127.0.0.1:8000/cas/ to login with your django users.
Settings
All settings are optional. Add them to settings.py to customize django-cas-server:
Template settings
• CAS_LOGO_URL: URL to the logo shown in the upper left corner on the default template.
Set it to False to disable it.
• CAS_FAVICON_URL: URL to the favicon (shortcut icon) used by the default templates.
Default is a key icon. Set it to False to disable it.
• CAS_SHOW_POWERED: Set it to False to hide the powered by footer. The default is True.
• CAS_COMPONENT_URLS: URLs to css and javascript external components. It is a dictionary
having the five following keys: "bootstrap3_css", "bootstrap3_js", bootstrap4_css,
bootstrap4_js, "html5shiv", "respond", "jquery". The default is:
{
"bootstrap3_css": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css",
"bootstrap3_js": "//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js",
"html5shiv": "//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js",
"respond": "//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js",
"bootstrap4_css": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css",
"bootstrap4_js": "//stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js",
"jquery": "//code.jquery.com/jquery.min.js",
}
if you omit some keys of the dictionary, the default value for these keys is used.
• CAS_SHOW_SERVICE_MESSAGES: Messages displayed about the state of the service on the
login page. The default is True.
• CAS_INFO_MESSAGES: Messages displayed in info-boxes on the html pages of the default
templates. It is a dictionary mapping message name to a message dict. A message dict
has 3 keys:
• message: A unicode message to display, potentially wrapped around ugettex_lazy
• discardable: A boolean, specify if the users can close the message info-box
• type: One of info, success, warning, danger. The type of the info-box.
CAS_INFO_MESSAGES contains by default one message, cas_explained, which explains roughly
the purpose of a CAS. The default is:
{
"cas_explained": {
"message":_(
u"The Central Authentication Service grants you access to most of our websites by "
u"authenticating only once, so you don't need to type your credentials again unless "
u"your session expires or you logout."
),
"discardable": True,
"type": "info", # one of info, success, warning, danger
},
}
• CAS_INFO_MESSAGES_ORDER: A list of message names. Order in which info-box messages are
displayed. Use an empty list to disable messages display. The default is [].
• CAS_LOGIN_TEMPLATE: Path to the template shown on /login when the user is not
autenticated. The default is "cas_server/bs4/login.html".
• CAS_WARN_TEMPLATE: Path to the template shown on /login?service=... when the user is
authenticated and has asked to be warned before being connected to a service. The
default is "cas_server/bs4/warn.html".
• CAS_LOGGED_TEMPLATE: Path to the template shown on /login when the user is
authenticated. The default is "cas_server/bs4/logged.html".
• CAS_LOGOUT_TEMPLATE: Path to the template shown on /logout when the user is being
disconnected. The default is "cas_server/bs4/logout.html"
• CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT: Should we redirect users to /login after they logged
out instead of displaying CAS_LOGOUT_TEMPLATE. The default is False.
Note that the old bootstrap3 template is available in cas_server/bs3/
Authentication settings
• CAS_AUTH_CLASS: A dotted path to a class or a class implementing
cas_server.auth.AuthUser. The default is "cas_server.auth.DjangoAuthUser" Available
classes bundled with django-cas-server are listed below in the Authentication backend
section.
• SESSION_COOKIE_AGE: This is a django setting. Here, it controls the delay in seconds
after which inactive users are logged out. The default is 1209600 (2 weeks). You
probably should reduce it to something like 86400 seconds (1 day).
• CAS_TGT_VALIDITY: Max time after which the user MUST reauthenticate. Set it to None for
no max time. This can be used to force refreshing cached information only available upon
user authentication like the user attributes in federation mode or with the ldap auth in
bind mode. The default is None.
• CAS_PROXY_CA_CERTIFICATE_PATH: Path to certificate authorities file. Usually on linux
the local CAs are in /etc/ssl/certs/ca-certificates.crt. The default is True which tells
requests to use its internal certificate authorities. Setting it to False should disable
all x509 certificate validation and MUST not be done in production. x509 certificate
validation is performed upon PGT issuance.
• CAS_SLO_MAX_PARALLEL_REQUESTS: Maximum number of parallel single log out requests sent.
If more requests need to be sent, they are queued. The default is 10.
• CAS_SLO_TIMEOUT: Timeout for a single SLO request in seconds. The default is 5.
• CAS_REMOVE_DJANGO_SESSION_COOKIE_ON_LOGOUT: If True Django session cookie will be
removed on logout from CAS server (default False). Note that Django session middleware
will generate a new session cookie.
• CAS_REMOVE_DJANGO_CSRF_COOKIE_ON_LOGOUT: If True Django csrf cookie will be removed on
logout from CAS server (default False). Note that Django csrf middleware will generate a
new csrf token cookie.
• CAS_REMOVE_DJANGO_LANGUAGE_COOKIE_ON_LOGOUT: If True Django language cookie will be
removed on logout from CAS server (default False).
Federation settings
• CAS_FEDERATE: A boolean for activating the federated mode (see the Federation mode
section below). The default is False.
• CAS_FEDERATE_REMEMBER_TIMEOUT: Time after which the cookie used for “remember my
identity provider” expire. The default is 604800, one week. The cookie is called
_remember_provider.
New version warnings settings
• CAS_NEW_VERSION_HTML_WARNING: A boolean for diplaying a warning on html pages that a new
version of the application is avaible. Once closed by a user, it is not displayed to
this user until the next new version. The default is True.
• CAS_NEW_VERSION_EMAIL_WARNING: A boolean for sending a email to settings.ADMINS when a
new version is available. The default is True.
Tickets validity settings
• CAS_TICKET_VALIDITY: Number of seconds the service tickets and proxy tickets are valid.
This is the maximal time between ticket issuance by the CAS and ticket validation by an
application. The default is 60.
• CAS_PGT_VALIDITY: Number of seconds the proxy granting tickets are valid. The default
is 3600 (1 hour).
• CAS_TICKET_TIMEOUT: Number of seconds a ticket is kept in the database before sending
Single Log Out request and being cleared. The default is 86400 (24 hours).
Tickets miscellaneous settings
• CAS_TICKET_LEN: Default ticket length. All CAS implementations MUST support ST and PT up
to 32 chars, PGT and PGTIOU up to 64 chars and it is RECOMMENDED that all tickets up to
256 chars are supported. Here the default is 64.
• CAS_LT_LEN: Length of the login tickets. Login tickets are only processed by
django-cas-server thus there are no length restrictions on it. The default is
CAS_TICKET_LEN.
• CAS_ST_LEN: Length of the service tickets. The default is CAS_TICKET_LEN. You may need
to lower it to 32 if you use some old clients.
• CAS_PT_LEN: Length of the proxy tickets. The default is CAS_TICKET_LEN. This length
should be the same as CAS_ST_LEN. You may need to lower it to 32 if you use some old
clients.
• CAS_PGT_LEN: Length of the proxy granting tickets. The default is CAS_TICKET_LEN.
• CAS_PGTIOU_LEN: Length of the proxy granting tickets IOU. The default is CAS_TICKET_LEN.
• CAS_LOGIN_TICKET_PREFIX: Prefix of login tickets. The default is "LT".
• CAS_SERVICE_TICKET_PREFIX: Prefix of service tickets. The default is "ST". The CAS
specification mandates that service tickets MUST begin with the characters ST so you
should not change this.
• CAS_PROXY_TICKET_PREFIX: Prefix of proxy ticket. The default is "PT".
• CAS_PROXY_GRANTING_TICKET_PREFIX: Prefix of proxy granting ticket. The default is "PGT".
• CAS_PROXY_GRANTING_TICKET_IOU_PREFIX: Prefix of proxy granting ticket IOU. The default
is "PGTIOU".
Forms settings
• CAS_USER_CREDENTIAL_FORM: A dotted path to a form or a form used on the login page to
retrieve user credentials. The default is "cas_server.forms.UserCredential".
• CAS_WARN_FORM: A dotted path to a form or a form used on warn page before emitting a
ticket. The default is "cas_server.forms.WarnForm".
• CAS_FEDERATE_SELECT_FORM: A dotted path to a form or a form used on the login page to
select another CAS in federated mode. The default is "cas_server.forms.FederateSelect"
• CAS_FEDERATE_USER_CREDENTIAL_FORM: A dotted path to a form or a form used on the login
page in federated mode. The default is "cas_server.forms.FederateUserCredential"
• CAS_TICKET_FORM: A dotted path to a form or a form for Tickets in the admin interface.
The default is "cas_server.forms.TicketForm"
Mysql backend settings
Deprecated, see the Sql backend settings. Only useful if you are using the mysql
authentication backend:
• CAS_SQL_HOST: Host for the SQL server. The default is "localhost".
• CAS_SQL_USERNAME: Username for connecting to the SQL server.
• CAS_SQL_PASSWORD: Password for connecting to the SQL server.
• CAS_SQL_DBNAME: Database name.
• CAS_SQL_DBCHARSET: Database charset. The default is "utf8"
• CAS_SQL_USER_QUERY: The query performed upon user authentication. The username must be
in field username, the password in password, additional fields are used as the user
attributes. The default is "SELECT user AS username, pass AS password, users.* FROM
users WHERE user = %s"
• CAS_SQL_PASSWORD_CHECK: The method used to check the user password. Must be one of the
following:
• "crypt" (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
should begin with $. This method is deprecated and will stop to work in python 3.13.
• "ldap" (see ‐
https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the
password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA},
{SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. {CRYPT} is
deprecated and will stop to work in python 3.13.
• "hex_HASH_NAME" with HASH_NAME in md5, sha1, sha224, sha256, sha384, sha512. The
hashed password in the database is compared to the hexadecimal digest of the clear
password hashed with the corresponding algorithm.
• "plain", the password in the database must be in clear.
The default is "crypt". This default is deprecated and will stop to work in python 3.13.
Sql backend settings
Only useful if you are using the sql authentication backend. You must add a "cas_server"
database to settings.DATABASES as defined in the django documentation. It is then the
database used by the sql backend.
• CAS_SQL_USER_QUERY: The query performed upon user authentication. The username must be
in field username, the password in password, additional fields are used as the user
attributes. The default is "SELECT user AS username, pass AS password, users.* FROM
users WHERE user = %s"
• CAS_SQL_PASSWORD_CHECK: The method used to check the user password. Must be one of the
following:
• "crypt" (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
should begin with $. This method is deprecated and will stop to work in python 3.13.
• "ldap" (see ‐
https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the
password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA},
{SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. {CRYPT} is
deprecated and will stop to work in python 3.13.
• "hex_HASH_NAME" with HASH_NAME in md5, sha1, sha224, sha256, sha384, sha512. The
hashed password in the database is compared to the hexadecimal digest of the clear
password hashed with the corresponding algorithm.
• "plain", the password in the database must be in clear.
The default is "crypt". This default is deprecated and will stop to work in python 3.13.
• CAS_SQL_PASSWORD_CHARSET: Charset the SQL users passwords was hash with. This is needed
to encode the user submitted password before hashing it for comparison. The default is
"utf-8".
Ldap backend settings
Only useful if you are using the ldap authentication backend:
• CAS_LDAP_SERVER: Address of the LDAP server. The default is "localhost".
• CAS_LDAP_USER: User bind address, for example "cn=admin,dc=crans,dc=org" for connecting
to the LDAP server.
• CAS_LDAP_PASSWORD: Password for connecting to the LDAP server.
• CAS_LDAP_BASE_DN: LDAP search base DN, for example "ou=data,dc=crans,dc=org".
• CAS_LDAP_USER_QUERY: Search filter for searching user by username. User entered
usernames are escaped using ldap3.utils.conv.escape_bytes. The default is "(uid=%s)"
• CAS_LDAP_USERNAME_ATTR: Attribute used for user’s usernames. The default is "uid"
• CAS_LDAP_PASSWORD_ATTR: Attribute used for user’s passwords. The default is
"userPassword"
• CAS_LDAP_PASSWORD_CHECK: The method used to check the user password. Must be one of the
following:
• "crypt" (see <https://en.wikipedia.org/wiki/Crypt_(C)>), the password in the database
should begin with $. This method is deprecated and will stop to work in python 3.13.
• "ldap" (see ‐
https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html) the
password in the database must begin with one of {MD5}, {SMD5}, {SHA}, {SSHA},
{SHA256}, {SSHA256}, {SHA384}, {SSHA384}, {SHA512}, {SSHA512}, {CRYPT}. {CRYPT} is
deprecated and will stop to work in python 3.13.
• "hex_HASH_NAME" with HASH_NAME in md5, sha1, sha224, sha256, sha384, sha512. The
hashed password in the database is compared to the hexadecimal digest of the clear
password hashed with the corresponding algorithm.
• "plain", the password in the database must be in clear.
• "bind", the user credentials are used to bind to the ldap database and retreive the
user attribute. In this mode, the settings CAS_LDAP_PASSWORD_ATTR and
CAS_LDAP_PASSWORD_CHARSET are ignored, and it is the ldap server that performs the
password check.
The default is "ldap".
• CAS_LDAP_ATTRS_VIEW: This parameter is only used then CAS_LDAP_PASSWORD_CHECK is set to
"bind". If 0 the user attributes are retrieved by connecting to the ldap as
CAS_LDAP_USER. If 1 the user attributes are retrieve then the user authenticate using
the user credentials and are cached for later use. It means there can be some
differences between the attributes in database and the cached ones. See the parameter
CAS_TGT_VALIDITY to force user to reauthenticate periodically. The default is 0.
• CAS_LDAP_PASSWORD_CHARSET: Charset the LDAP users passwords was hashed with. This is
needed to encode the user submitted password before hashing it for comparison. The
default is "utf-8".
Test backend settings
Only useful if you are using the test authentication backend:
• CAS_TEST_USER: Username of the test user. The default is "test".
• CAS_TEST_PASSWORD: Password of the test user. The default is "test".
• CAS_TEST_ATTRIBUTES: Attributes of the test user. The default is {'nom': 'Nymous',
'prenom': 'Ano', 'email': 'anonymous@example.net', 'alias': ['demo1', 'demo2']}.
Authentication backend
django-cas-server comes with some authentication backends:
• dummy backend cas_server.auth.DummyAuthUser: all authentication attempts fail.
• test backend cas_server.auth.TestAuthUser: username, password and returned attributes
for the user are defined by the CAS_TEST_* settings.
• django backend cas_server.auth.DjangoAuthUser: Users are authenticated against django
users system. This is the default backend. The returned attributes are the fields
available on the user model.
• mysql backend cas_server.auth.MysqlAuthUser: Deprecated, use the sql backend instead.
see the Mysql backend settings section. The returned attributes are those returned by
sql query CAS_SQL_USER_QUERY.
• sql backend cas_server.auth.SqlAuthUser: see the Sql backend settings section. The
returned attributes are those returned by sql query CAS_SQL_USER_QUERY.
• ldap backend cas_server.auth.LdapAuthUser: see the Ldap backend settings section. The
returned attributes are those of the ldap node returned by the query filter
CAS_LDAP_USER_QUERY.
• federated backend cas_server.auth.CASFederateAuth: It is automatically used when
CAS_FEDERATE is True. You should not set it manually without setting CAS_FEDERATE to
True.
Logs
django-cas-server logs most of its actions. To enable login, you must set the LOGGING (‐
https://docs.djangoproject.com/en/stable/topics/logging) variable in settings.py.
Users successful actions (login, logout) are logged with the level INFO, failures are
logged with the level WARNING and user attributes transmitted to a service are logged with
the level DEBUG.
For example to log to syslog you can use :
LOGGING = {
'version': 1,
'disable_existing_loggers': False,
'formatters': {
'cas_syslog': {
'format': 'cas: %(levelname)s %(message)s'
},
},
'handlers': {
'cas_syslog': {
'level': 'INFO',
'class': 'logging.handlers.SysLogHandler',
'address': '/dev/log',
'formatter': 'cas_syslog',
},
},
'loggers': {
'cas_server': {
'handlers': ['cas_syslog'],
'level': 'INFO',
'propagate': True,
},
},
}
Or to log to a file:
LOGGING = {
'version': 1,
'disable_existing_loggers': False,
'formatters': {
'cas_file': {
'format': '%(asctime)s %(levelname)s %(message)s'
},
},
'handlers': {
'cas_file': {
'level': 'INFO',
'class': 'logging.FileHandler',
'filename': '/tmp/cas_server.log',
'formatter': 'cas_file',
},
},
'loggers': {
'cas_server': {
'handlers': ['cas_file'],
'level': 'INFO',
'propagate': True,
},
},
}
Service Patterns
In a CAS context, Service refers to the application the client is trying to access. By
extension we use service for the URL of such an application.
By default, django-cas-server does not allow any service to use the CAS to authenticate
users. In order to allow services, you need to connect to the django admin interface
using a django superuser, and add a first service pattern.
A service pattern comes with 9 fields:
• Position: an integer used to change the order in which services are matched against
service patterns.
• Name: the name of the service pattern. It will be displayed to the users asking for a
ticket for a service matching this service pattern on the login page.
• Pattern: a regular expression used to match services.
• User field: the user attribute to use as username for services matching this service
pattern. Leave it empty to use the login name.
• Restrict username: if checked, only login names defined below are allowed to get tickets
for services matching this service pattern.
• Proxy: if checked, allow the creation of Proxy Ticket for services matching this service
pattern. Otherwise, only Service Ticket will be created.
• Proxy callback: if checked, services matching this service pattern are allowed to
retrieve Proxy Granting Ticket. A service with a Proxy Granting Ticket can get Proxy
Ticket for other services. Hence you must only check this for trusted services that
need it. (For instance, a webmail needs Proxy Ticket to authenticate himself as the user
to the imap server).
• Single log out: Check it to send Single Log Out requests to authenticated services
matching this service pattern. SLO requests are sent to all services the user is
authenticated to when the user disconnects.
• Single log out callback: The http(s) URL to POST the SLO requests. If empty, the service
URL is used. This field is useful to allow non http services (imap, smtp, ftp) to handle
SLO requests.
A service pattern has 4 associated models:
• Usernames: a list of username associated with the Restrict username field
• Replace attribute names: a list of user attributes to send to the service. Choose the
name used for sending the attribute by setting Replacement or leave it empty to leave it
unchanged.
• Replace attribute values: a list of sent user attributes for which value needs to be
tweaked. Replace the attribute value by the string obtained by replacing the leftmost
non-overlapping occurrences of pattern in string by replace. In replace backslash
escapes are processed. Matched groups are captured by 1, 2, etc.
• Filter attribute values: a list of user attributes for which value needs to match a
regular expression. For instance, service A may need an email address, and you only want
user with an email address to connect to it. To do so, put email in Attribute and .* in
pattern.
When a user asks for a ticket for a service, the service URL is compared against each
service pattern sorted by position. The first service pattern that matches the service URL
is chosen. Hence, you should give low position to very specific patterns like
^https://www\.example\.com(/.*)?$ and higher position to generic patterns like
^https://.*. So the service URL https://www.examle.com will use the service pattern for
^https://www\.example\.com(/.*)?$ and not the one for ^https://.*.
Federation mode
django-cas-server comes with a federation mode. When CAS_FEDERATE is True, users are
invited to choose an identity provider on the login page, then, they are redirected to the
provider CAS to authenticate. This provider transmits to django-cas-server the user
username and attributes. The user is now logged in on django-cas-server and can use
services using django-cas-server as CAS.
In federation mode, the user attributes are cached upon user authentication. See the
settings CAS_TGT_VALIDITY to force users to reauthenticate periodically and allow
django-cas-server to refresh cached attributes.
The list of allowed identity providers is defined using the django admin application.
With the development server started, visit http://127.0.0.1:8000/admin/ to add identity
providers.
An identity provider comes with 5 fields:
• Position: an integer used to tweak the order in which identity providers are displayed
on the login page. Identity providers are sorted using position first, then, on equal
position, using verbose name and then, on equal verbose name, using suffix.
• Suffix: the suffix that will be append to the username returned by the identity
provider. It must be unique.
• Server url: the URL to the identity provider CAS. For instance, if you are using
https://cas.example.org/login to authenticate on the CAS, the server url is
https://cas.example.org
• CAS protocol version: the version of the CAS protocol to use to contact the identity
provider. The default is version 3.
• Verbose name: the name used on the login page to display the identity provider.
• Display: a boolean controlling the display of the identity provider on the login page.
Beware that this do not disable the identity provider, it just hide it on the login
page. User will always be able to log in using this provider by fetching
/federate/provider_suffix.
In federation mode, django-cas-server build user’s username as follow:
provider_returned_username@provider_suffix. Choose the provider returned username for
django-cas-server and the provider suffix in order to make sense, as this built username
is likely to be displayed to end users in applications.
Then using federate mode, you should add one command to a daily crontab:
cas_clean_federate. This command clean the local cache of federated user from old unused
users.
You could for example do as below:
10 0 * * * cas-user /path/to/project/manage.py cas_clean_federate
CAS_SERVER PACKAGE
Subpackages
cas_server.templatetags package
Submodules
cas_server.templatetags.cas_server module
template tags for the app
cas_server.templatetags.cas_server.is_checkbox(field)
check if a form bound field is a checkbox
Parameters
field (django.forms.BoundField) – A bound field
Returns
True if the field is a checkbox, False otherwise.
Return type
bool
cas_server.templatetags.cas_server.is_hidden(field)
check if a form bound field is hidden
Parameters
field (django.forms.BoundField) – A bound field
Returns
True if the field is hidden, False otherwise.
Return type
bool
Module contents
Submodules
cas_server.admin module
module for the admin interface of the app
class cas_server.admin.BaseInlines(parent_model, admin_site)
Bases: django.contrib.admin.TabularInline
Base class for inlines in the admin interface.
extra = 0
This controls the number of extra forms the formset will display in addition
to the initial forms.
property media
class cas_server.admin.UserAdminInlines(parent_model, admin_site)
Bases: BaseInlines
Base class for inlines in UserAdmin interface
form The form TicketForm used to display tickets.
alias of TicketForm
readonly_fields = ('validate', 'service', 'service_pattern', 'creation', 'renew',
'single_log_out', 'value')
Fields to display on a object that are read only (not editable).
fields = ('validate', 'service', 'service_pattern', 'creation', 'renew',
'single_log_out')
Fields to display on a object.
property media
class cas_server.admin.ServiceTicketInline(parent_model, admin_site)
Bases: UserAdminInlines
ServiceTicket in admin interface
model The model which the inline is using.
alias of ServiceTicket
property media
class cas_server.admin.ProxyTicketInline(parent_model, admin_site)
Bases: UserAdminInlines
ProxyTicket in admin interface
model The model which the inline is using.
alias of ProxyTicket
property media
class cas_server.admin.ProxyGrantingInline(parent_model, admin_site)
Bases: UserAdminInlines
ProxyGrantingTicket in admin interface
model The model which the inline is using.
alias of ProxyGrantingTicket
property media
class cas_server.admin.UserAdmin(model, admin_site)
Bases: django.contrib.admin.ModelAdmin
User in admin interface
inlines = (<class 'cas_server.admin.ServiceTicketInline'>, <class
'cas_server.admin.ProxyTicketInline'>, <class
'cas_server.admin.ProxyGrantingInline'>)
See ServiceTicketInline, ProxyTicketInline, ProxyGrantingInline objects
below the UserAdmin fields.
readonly_fields = ('username', 'date', 'session_key')
Fields to display on a object that are read only (not editable).
fields = ('username', 'date', 'session_key')
Fields to display on a object.
list_display = ('username', 'date', 'session_key')
Fields to display on the list of class:UserAdmin objects.
property media
class cas_server.admin.UsernamesInline(parent_model, admin_site)
Bases: BaseInlines
Username in admin interface
model The model which the inline is using.
alias of Username
property media
class cas_server.admin.ReplaceAttributNameInline(parent_model, admin_site)
Bases: BaseInlines
ReplaceAttributName in admin interface
model The model which the inline is using.
alias of ReplaceAttributName
property media
class cas_server.admin.ReplaceAttributValueInline(parent_model, admin_site)
Bases: BaseInlines
ReplaceAttributValue in admin interface
model The model which the inline is using.
alias of ReplaceAttributValue
property media
class cas_server.admin.FilterAttributValueInline(parent_model, admin_site)
Bases: BaseInlines
FilterAttributValue in admin interface
model The model which the inline is using.
alias of FilterAttributValue
property media
class cas_server.admin.ServicePatternAdmin(model, admin_site)
Bases: django.contrib.admin.ModelAdmin
ServicePattern in admin interface
inlines = (<class 'cas_server.admin.UsernamesInline'>, <class
'cas_server.admin.ReplaceAttributNameInline'>, <class
'cas_server.admin.ReplaceAttributValueInline'>, <class
'cas_server.admin.FilterAttributValueInline'>)
See UsernamesInline, ReplaceAttributNameInline, ReplaceAttributValueInline,
FilterAttributValueInline objects below the ServicePatternAdmin fields.
list_display = ('pos', 'name', 'pattern', 'proxy', 'single_log_out',
'proxy_callback', 'restrict_users')
Fields to display on the list of class:ServicePatternAdmin objects.
property media
class cas_server.admin.FederatedIendityProviderAdmin(model, admin_site)
Bases: django.contrib.admin.ModelAdmin
FederatedIendityProvider in admin interface
fields = ('pos', 'suffix', 'server_url', 'cas_protocol_version', 'verbose_name',
'display')
Fields to display on a object.
list_display = ('verbose_name', 'suffix', 'display')
Fields to display on the list of class:FederatedIendityProviderAdmin
objects.
property media
class cas_server.admin.FederatedUserAdmin(model, admin_site)
Bases: django.contrib.admin.ModelAdmin
FederatedUser in admin interface
fields = ('username', 'provider', 'last_update')
Fields to display on a object.
list_display = ('username', 'provider', 'last_update')
Fields to display on the list of class:FederatedUserAdmin objects.
property media
class cas_server.admin.UserAttributesAdmin(model, admin_site)
Bases: django.contrib.admin.ModelAdmin
UserAttributes in admin interface
fields = ('username', '_attributs')
Fields to display on a object.
property media
cas_server.apps module
django config module
class cas_server.apps.CasAppConfig(app_name, app_module)
Bases: django.apps.AppConfig
django CAS application config class
name = 'cas_server'
Full Python path to the application. It must be unique across a Django
project.
verbose_name = 'Central Authentication Service'
Human-readable name for the application.
cas_server.auth module
Some authentication classes for the CAS
class cas_server.auth.AuthUser(username)
Bases: object
Authentication base class
Parameters
username (unicode) – A username, stored in the username class attribute.
username = None
username used to instanciate the current object
test_password(password)
Tests password against the user-supplied password.
Raises NotImplementedError – always. The method need to be implemented by
subclasses
attributs()
The user attributes.
raises NotImplementedError: always. The method need to be implemented by
subclasses
class cas_server.auth.DummyAuthUser(username)
Bases: AuthUser
A Dummy authentication class. Authentication always fails
Parameters
username (unicode) – A username, stored in the username class attribute.
There is no valid value for this attribute here.
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
always False
Return type
bool
attributs()
The user attributes.
Returns
en empty dict.
Return type
dict
class cas_server.auth.TestAuthUser(username)
Bases: AuthUser
A test authentication class only working for one unique user.
Parameters
username (unicode) – A username, stored in the username class attribute. The
uniq valid value is settings.CAS_TEST_USER.
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
True if username is valid and password is equal to
settings.CAS_TEST_PASSWORD, False otherwise.
Return type
bool
attributs()
The user attributes.
Returns
the settings.CAS_TEST_ATTRIBUTES dict if username is valid, an empty
dict otherwise.
Return type
dict
class cas_server.auth.DBAuthUser(username)
Bases: AuthUser
base class for databate based auth classes
user = None
DB user attributes as a dict if the username is found in the database.
attributs()
The user attributes.
Returns
a dict with the user attributes. Attributes may be unicode() or list
of unicode(). If the user do not exists, the returned dict is empty.
Return type
dict
class cas_server.auth.MysqlAuthUser(username)
Bases: DBAuthUser
DEPRECATED, use SqlAuthUser instead.
A mysql authentication class: authenticate user against a mysql database
Parameters
username (unicode) – A username, stored in the username class attribute.
Valid value are fetched from the MySQL database set with settings.CAS_SQL_*
settings parameters using the query settings.CAS_SQL_USER_QUERY.
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
True if username is valid and password is correct, False otherwise.
Return type
bool
class cas_server.auth.SqlAuthUser(username)
Bases: DBAuthUser
A SQL authentication class: authenticate user against a SQL database. The SQL
database must be configures in settings.py as settings.DATABASES['cas_server'].
Parameters
username (unicode) – A username, stored in the username class attribute.
Valid value are fetched from the MySQL database set with settings.CAS_SQL_*
settings parameters using the query settings.CAS_SQL_USER_QUERY.
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
True if username is valid and password is correct, False otherwise.
Return type
bool
class cas_server.auth.LdapAuthUser(username)
Bases: DBAuthUser
A ldap authentication class: authenticate user against a ldap database
Parameters
username (unicode) – A username, stored in the username class attribute.
Valid value are fetched from the ldap database set with settings.CAS_LDAP_*
settings parameters.
classmethod get_conn()
Return a connection object to the ldap database
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
True if username is valid and password is correct, False otherwise.
Return type
bool
attributs()
The user attributes.
Returns
a dict with the user attributes. Attributes may be unicode() or list
of unicode(). If the user do not exists, the returned dict is empty.
Return type
dict
class cas_server.auth.DjangoAuthUser(username)
Bases: AuthUser
A django auth class: authenticate user against django internal users
Parameters
username (unicode) – A username, stored in the username class attribute.
Valid value are usernames of django internal users.
user = None
a django user object if the username is found. The user model is retreived
using django.contrib.auth.get_user_model().
test_password(password)
Tests password against the user-supplied password.
Parameters
password (unicode) – a clear text password as submited by the user.
Returns
True if user is valid and password is correct, False otherwise.
Return type
bool
attributs()
The user attributes, defined as the fields on the user object.
Returns
a dict with the user object fields. Attributes may be If the user do
not exists, the returned dict is empty.
Return type
dict
class cas_server.auth.CASFederateAuth(username)
Bases: AuthUser
Authentication class used then CAS_FEDERATE is True
Parameters
username (unicode) – A username, stored in the username class attribute.
Valid value are usernames of FederatedUser object. FederatedUser object are
created on CAS backends successful ticket validation.
user = None
a :class`FederatedUser<cas_server.models.FederatedUser>` object if username
is found.
test_password(ticket)
Tests password against the user-supplied password.
Parameters
password (unicode) – The CAS tickets just used to validate the user
authentication against its CAS backend.
Returns
True if user is valid and password is a ticket validated less than
settings.CAS_TICKET_VALIDITY secondes and has not being previously
used for authenticated this FederatedUser. False otherwise.
Return type
bool
attributs()
The user attributes, as returned by the CAS backend.
Returns
FederatedUser.attributs. If the user do not exists, the returned
dict is empty.
Return type
dict
cas_server.cas module
exception cas_server.cas.CASError
Bases: ValueError
class cas_server.cas.ReturnUnicode
Bases: object
static u(string, charset)
class cas_server.cas.SingleLogoutMixin
Bases: object
classmethod get_saml_slos(logout_request)
returns saml logout ticket info
class cas_server.cas.CASClient(*args, **kwargs)
Bases: object
class cas_server.cas.CASClientBase(service_url=None, server_url=None,
extra_login_params=None, renew=False, username_attribute=None)
Bases: object
logout_redirect_param_name = 'service'
verify_ticket(ticket)
must return a triple
get_login_url()
Generates CAS login URL
get_logout_url(redirect_url=None)
Generates CAS logout URL
get_proxy_url(pgt)
Returns proxy url, given the proxy granting ticket
get_proxy_ticket(pgt)
Returns proxy ticket given the proxy granting ticket
static get_page_charset(page, default='utf-8')
class cas_server.cas.CASClientV1(service_url=None, server_url=None,
extra_login_params=None, renew=False, username_attribute=None)
Bases: CASClientBase, ReturnUnicode
CAS Client Version 1
logout_redirect_param_name = 'url'
verify_ticket(ticket)
Verifies CAS 1.0 authentication ticket.
Returns username on success and None on failure.
class cas_server.cas.CASClientV2(proxy_callback=None, *args, **kwargs)
Bases: CASClientBase, ReturnUnicode
CAS Client Version 2
url_suffix = 'serviceValidate'
logout_redirect_param_name = 'url'
verify_ticket(ticket)
Verifies CAS 2.0+/3.0+ XML-based authentication ticket and returns extended
attributes
get_verification_response(ticket)
classmethod parse_attributes_xml_element(element, charset)
classmethod verify_response(response, charset)
classmethod parse_response_xml(response, charset)
class cas_server.cas.CASClientV3(proxy_callback=None, *args, **kwargs)
Bases: CASClientV2, SingleLogoutMixin
CAS Client Version 3
url_suffix = 'serviceValidate'
logout_redirect_param_name = 'service'
classmethod parse_attributes_xml_element(element, charset)
classmethod verify_response(response, charset)
class cas_server.cas.CASClientWithSAMLV1(proxy_callback=None, *args, **kwargs)
Bases: CASClientV2, SingleLogoutMixin
CASClient 3.0+ with SAML
verify_ticket(ticket, **kwargs)
Verifies CAS 3.0+ XML-based authentication ticket and returns extended
attributes.
@date: 2011-11-30 @author: Carlos Gonzalez Vila <carlewis@gmail.com>
Returns username and attributes on success and None,None on failure.
fetch_saml_validation(ticket)
classmethod get_saml_assertion(ticket)
http://www.jasig.org/cas/protocol#samlvalidate-cas-3.0
SAML request values:
RequestID [REQUIRED]:
unique identifier for the request
IssueInstant [REQUIRED]:
timestamp of the request
samlp:AssertionArtifact [REQUIRED]:
the valid CAS Service Ticket obtained as a response parameter at
login.
cas_server.default_settings module
Default values for the app’s settings
cas_server.default_settings.CAS_LOGO_URL = '/static/cas_server/logo.png'
URL to the logo showed in the up left corner on the default templates.
cas_server.default_settings.CAS_FAVICON_URL = '/static/cas_server/favicon.ico'
URL to the favicon (shortcut icon) used by the default templates. Default is a key
icon.
cas_server.default_settings.CAS_SHOW_POWERED = True
Show the powered by footer if set to True
cas_server.default_settings.CAS_COMPONENT_URLS = {'bootstrap3_css':
'//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css', 'bootstrap3_js':
'//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js', 'bootstrap4_css':
'//stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css', 'bootstrap4_js':
'//stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js', 'html5shiv':
'//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js', 'jquery':
'//code.jquery.com/jquery.min.js', 'respond':
'//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js'}
URLs to css and javascript external components.
cas_server.default_settings.CAS_LOGIN_TEMPLATE = 'cas_server/bs4/login.html'
Path to the template showed on /login then the user is not autenticated.
cas_server.default_settings.CAS_WARN_TEMPLATE = 'cas_server/bs4/warn.html'
Path to the template showed on /login?service=… then the user is authenticated and
has asked to be warned before being connected to a service.
cas_server.default_settings.CAS_LOGGED_TEMPLATE = 'cas_server/bs4/logged.html'
Path to the template showed on /login then to user is authenticated.
cas_server.default_settings.CAS_LOGOUT_TEMPLATE = 'cas_server/bs4/logout.html'
Path to the template showed on /logout then to user is being disconnected.
cas_server.default_settings.CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT = False
Should we redirect users to /login after they logged out instead of displaying
CAS_LOGOUT_TEMPLATE.
cas_server.default_settings.CAS_AUTH_CLASS = 'cas_server.auth.DjangoAuthUser'
A dotted path to a class or a class implementing cas_server.auth.AuthUser.
cas_server.default_settings.CAS_PROXY_CA_CERTIFICATE_PATH = True
Path to certificate authorities file. Usually on linux the local CAs are in
/etc/ssl/certs/ca-certificates.crt. True tell requests to use its internal
certificat authorities.
cas_server.default_settings.CAS_SLO_MAX_PARALLEL_REQUESTS = 10
Maximum number of parallel single log out requests send if more requests need to be
send, there are queued
cas_server.default_settings.CAS_SLO_TIMEOUT = 5
Timeout for a single SLO request in seconds.
cas_server.default_settings.CAS_AUTH_SHARED_SECRET = ''
Shared to transmit then using the view cas_server.views.Auth
cas_server.default_settings.CAS_TGT_VALIDITY = None
Max time after with the user MUST reauthenticate. Let it to None for no max time.
This can be used to force refreshing cached informations only available upon user
authentication like the user attributes in federation mode or with the ldap auth in
bind mode.
cas_server.default_settings.CAS_TICKET_VALIDITY = 60
Number of seconds the service tickets and proxy tickets are valid. This is the
maximal time between ticket issuance by the CAS and ticket validation by an
application.
cas_server.default_settings.CAS_PGT_VALIDITY = 3600
Number of seconds the proxy granting tickets are valid.
cas_server.default_settings.CAS_TICKET_TIMEOUT = 86400
Number of seconds a ticket is kept in the database before sending Single Log Out
request and being cleared.
cas_server.default_settings.CAS_TICKET_LEN = 64
All CAS implementation MUST support ST and PT up to 32 chars, PGT and PGTIOU up to
64 chars and it is RECOMMENDED that all tickets up to 256 chars are supports so we
use 64 for the default len.
cas_server.default_settings.CAS_LT_LEN = 64
alias of settings.CAS_TICKET_LEN
cas_server.default_settings.CAS_ST_LEN = 64
alias of settings.CAS_TICKET_LEN Services MUST be able to accept service tickets of
up to 32 characters in length.
cas_server.default_settings.CAS_PT_LEN = 64
alias of settings.CAS_TICKET_LEN Back-end services MUST be able to accept proxy
tickets of up to 32 characters.
cas_server.default_settings.CAS_PGT_LEN = 64
alias of settings.CAS_TICKET_LEN Services MUST be able to handle proxy-granting
tickets of up to 64
cas_server.default_settings.CAS_PGTIOU_LEN = 64
alias of settings.CAS_TICKET_LEN Services MUST be able to handle PGTIOUs of up to
64 characters in length.
cas_server.default_settings.CAS_LOGIN_TICKET_PREFIX = 'LT'
Prefix of login tickets.
cas_server.default_settings.CAS_SERVICE_TICKET_PREFIX = 'ST'
Prefix of service tickets. Service tickets MUST begin with the characters ST so you
should not change this.
cas_server.default_settings.CAS_PROXY_TICKET_PREFIX = 'PT'
Prefix of proxy ticket. Proxy tickets SHOULD begin with the characters, PT.
cas_server.default_settings.CAS_PROXY_GRANTING_TICKET_PREFIX = 'PGT'
Prefix of proxy granting ticket. Proxy-granting tickets SHOULD begin with the
characters PGT.
cas_server.default_settings.CAS_PROXY_GRANTING_TICKET_IOU_PREFIX = 'PGTIOU'
Prefix of proxy granting ticket IOU. Proxy-granting ticket IOUs SHOULD begin with
the characters PGTIOU.
cas_server.default_settings.CAS_SQL_HOST = 'localhost'
Host for the SQL server.
cas_server.default_settings.CAS_SQL_USERNAME = ''
Username for connecting to the SQL server.
cas_server.default_settings.CAS_SQL_PASSWORD = ''
Password for connecting to the SQL server.
cas_server.default_settings.CAS_SQL_DBNAME = ''
Database name.
cas_server.default_settings.CAS_SQL_DBCHARSET = 'utf8'
Database charset.
cas_server.default_settings.CAS_SQL_USER_QUERY = 'SELECT user AS username, pass AS
password, users.* FROM users WHERE user = %s'
The query performed upon user authentication.
cas_server.default_settings.CAS_SQL_PASSWORD_CHECK = 'crypt'
The method used to check the user password. Must be one of "crypt", "ldap",
"hex_md5", "hex_sha1", "hex_sha224", "hex_sha256", "hex_sha384", "hex_sha512",
"plain".
cas_server.default_settings.CAS_SQL_PASSWORD_CHARSET = 'utf-8'
charset the SQL users passwords was hash with
cas_server.default_settings.CAS_LDAP_SERVER = 'localhost'
Address of the LDAP server
cas_server.default_settings.CAS_LDAP_USER = None
LDAP user bind address, for example "cn=admin,dc=crans,dc=org" for connecting to
the LDAP server.
cas_server.default_settings.CAS_LDAP_PASSWORD = None
LDAP connection password
cas_server.default_settings.CAS_LDAP_BASE_DN = None
LDAP seach base DN, for example "ou=data,dc=crans,dc=org".
cas_server.default_settings.CAS_LDAP_USER_QUERY = '(uid=%s)'
LDAP search filter for searching user by username. User inputed usernames are
escaped using ldap3.utils.conv.escape_bytes().
cas_server.default_settings.CAS_LDAP_USERNAME_ATTR = 'uid'
LDAP attribute used for users usernames
cas_server.default_settings.CAS_LDAP_PASSWORD_ATTR = 'userPassword'
LDAP attribute used for users passwords
cas_server.default_settings.CAS_LDAP_PASSWORD_CHECK = 'ldap'
The method used to check the user password. Must be one of "crypt", "ldap",
"hex_md5", "hex_sha1", "hex_sha224", "hex_sha256", "hex_sha384", "hex_sha512",
"plain", "bind".
cas_server.default_settings.CAS_LDAP_PASSWORD_CHARSET = 'utf-8'
charset the LDAP users passwords was hash with
cas_server.default_settings.CAS_LDAP_ATTRS_VIEW = 0
This parameter is only used then CAS_LDAP_PASSWORD_CHECK is set to "bind".
• if 0 the user attributes are retrieved by connecting to the ldap as
CAS_LDAP_USER.
• if 1 the user attributes are retrieve then the user authenticate using the
user credentials. These attributes are then cached for the session.
The default is 0.
cas_server.default_settings.CAS_TEST_USER = 'test'
Username of the test user.
cas_server.default_settings.CAS_TEST_PASSWORD = 'test'
Password of the test user.
cas_server.default_settings.CAS_TEST_ATTRIBUTES = {'alias': ['demo1', 'demo2'], 'email':
'anonymous@example.net', 'nom': 'Nymous', 'prenom': 'Ano'}
Attributes of the test user.
cas_server.default_settings.CAS_ENABLE_AJAX_AUTH = False
A bool for activatinc the hability to fetch tickets using javascript.
cas_server.default_settings.CAS_FEDERATE = False
A bool for activating the federated mode
cas_server.default_settings.CAS_FEDERATE_REMEMBER_TIMEOUT = 604800
Time after witch the cookie use for “remember my identity provider” expire (one
week).
cas_server.default_settings.CAS_NEW_VERSION_HTML_WARNING = True
A bool for diplaying a warning on html pages then a new version of the application
is avaible. Once closed by a user, it is not displayed to this user until the next
new version.
cas_server.default_settings.CAS_NEW_VERSION_EMAIL_WARNING = True
A bool for sending emails to settings.ADMINS when a new version is available.
cas_server.default_settings.CAS_NEW_VERSION_JSON_URL =
'https://pypi.org/pypi/django-cas-server/json'
URL to the pypi json of the application. Used to retreive the version number of the
last version. You should not change it.
cas_server.default_settings.CAS_SHOW_SERVICE_MESSAGES = True
If the service message should be displayed on the login page
cas_server.default_settings.CAS_INFO_MESSAGES = {'cas_explained': {'discardable': True,
'message': "The Central Authentication Service grants you access to most of our websites
by authenticating only once, so you don't need to type your credentials again unless your
session expires or you logout.", 'type': 'info'}}
Messages displayed in a info-box on the html pages of the default templates.
CAS_INFO_MESSAGES is a dict mapping message name to a message dict. A message dict
has 3 keys:
• message: A unicode, the message to display, potentially wrapped around
ugettex_lazy
• discardable: A bool, specify if the users can close the message info-box
• type: One of info, success, info, warning, danger. The type of the info-box.
CAS_INFO_MESSAGES contains by default one message, cas_explained, which explain
roughly the purpose of a CAS.
cas_server.default_settings.CAS_INFO_MESSAGES_ORDER = []
list of message names. Order in which info-box messages are displayed. Let the
list empty to disable messages display.
cas_server.default_settings.CAS_REMOVE_DJANGO_SESSION_COOKIE_ON_LOGOUT = False
bool If True Django session cookie will be removed on logout from CAS server
cas_server.default_settings.CAS_REMOVE_DJANGO_CSRF_COOKIE_ON_LOGOUT = False
bool If True Django csrf cookie will be removed on logout from CAS server
cas_server.default_settings.CAS_REMOVE_DJANGO_LANGUAGE_COOKIE_ON_LOGOUT = False
bool If True Django language cookie will be removed on logout from CAS server
cas_server.default_settings.CAS_USER_CREDENTIAL_FORM = 'cas_server.forms.UserCredential'
A dotted path to a form or a form used on the login page to retrieve user
credentials
cas_server.default_settings.CAS_WARN_FORM = 'cas_server.forms.WarnForm'
A dotted path to a form or a form used on warn page before emitting a ticket
cas_server.default_settings.CAS_FEDERATE_SELECT_FORM = 'cas_server.forms.FederateSelect'
A dotted path to a form or a form used on the login page to select another CAS in
federated mode
cas_server.default_settings.CAS_FEDERATE_USER_CREDENTIAL_FORM =
'cas_server.forms.FederateUserCredential'
A dotted path to a form or a form used on the login page in federated mode
cas_server.default_settings.CAS_TICKET_FORM = 'cas_server.forms.TicketForm'
A dotted path to a form or a form for Tickets in the admin interface
class cas_server.default_settings.SessionStore(session_key=None)
Bases: SessionBase
Implement database session store.
classmethod get_model_class()
model
load() Load the session data and return a dictionary.
exists(session_key)
Return True if the given session_key already exists.
create()
Create a new session instance. Guaranteed to create a new object with a
unique key and will have saved the result once (with empty data) before the
method returns.
create_model_instance(data)
Return a new instance of the session model object, which represents the
current session state. Intended to be used for saving the session data to
the database.
save(must_create=False)
Save the current session data to the database. If ‘must_create’ is True,
raise a database error if the saving operation doesn’t create a new entry
(as opposed to possibly updating an existing entry).
delete(session_key=None)
Delete the session data under this key. If the key is None, use the current
session key value.
classmethod clear_expired()
Remove expired sessions from the session store.
If this operation isn’t possible on a given backend, it should raise
NotImplementedError. If it isn’t necessary, because the backend has a
built-in expiration mechanism, it should be a no-op.
cas_server.federate module
federated mode helper classes
cas_server.federate.logger = <Logger cas_server.federate (INFO)>
logger facility
class cas_server.federate.CASFederateValidateUser(provider, service_url, renew=False)
Bases: object
Class CAS client used to authenticate the user again a CAS provider
Parameters
• provider (cas_server.models.FederatedIendityProvider) – The provider to
use for authenticate the user.
• service_url (unicode) – The service url to transmit to the provider.
username = None
the provider returned username
attributs = {}
the provider returned attributes
federated_username = None
the provider returned username this the provider suffix appended
provider = None
the identity provider
client = None
the CAS client instance
get_login_url()
Returns
the CAS provider login url
Return type
unicode
get_logout_url(redirect_url=None)
Parameters
redirect_url (unicode or NoneType) – The url to redirect to after
logout from the provider, if provided.
Returns
the CAS provider logout url
Return type
unicode
verify_ticket(ticket)
test ticket against the CAS provider, if valid, create a FederatedUser
matching provider returned username and attributes.
Parameters
ticket (unicode) – The ticket to validate against the provider CAS
Returns
True if the validation succeed, else False.
Return type
bool
static register_slo(username, session_key, ticket)
association a ticket with a (username, session_key) for processing later SLO
request by creating a cas_server.models.FederateSLO object.
Parameters
• username (unicode) – A logged user username, with the @ component.
• session_key (unicode) – A logged user session_key matching
username.
• ticket (unicode) – A ticket used to authentication username for the
session session_key.
clean_sessions(logout_request)
process a SLO request: Search for ticket values in logout_request. For each
ticket value matching a cas_server.models.FederateSLO, disconnect the
corresponding user.
Parameters
logout_request (unicode) – An XML document contening one or more
Single Log Out requests.
cas_server.forms module
forms for the app
class cas_server.forms.BootsrapForm(*args, **kwargs)
Bases: django.forms.Form
Form base class to use boostrap then rendering the form fields
property media
Return all media required to render the widgets on this form.
class cas_server.forms.BaseLogin(*args, **kwargs)
Bases: BootsrapForm
Base form with all field possibly hidden on the login pages
service
The service url for which the user want a ticket
lt A valid LoginTicket to prevent POST replay
renew Is the service asking the authentication renewal ?
gateway
Url to redirect to if the authentication fail (user not authenticated or bad
service)
property media
Return all media required to render the widgets on this form.
class cas_server.forms.WarnForm(*args, **kwargs)
Bases: BaseLogin
Form used on warn page before emiting a ticket
warned True if the user has been warned of the ticket emission
property media
Return all media required to render the widgets on this form.
class cas_server.forms.FederateSelect(*args, **kwargs)
Bases: BaseLogin
Form used on the login page when settings.CAS_FEDERATE is True allowing the user to
choose an identity provider.
provider
The providers the user can choose to be used as authentication backend
warn A checkbox to ask to be warn before emiting a ticket for another service
remember
A checkbox to remember the user choices of provider
property media
Return all media required to render the widgets on this form.
class cas_server.forms.UserCredential(*args, **kwargs)
Bases: BaseLogin
Form used on the login page to retrive user credentials
username
The user username
password
The user password
warn A checkbox to ask to be warn before emiting a ticket for another service
clean()
Validate that the submited username and password are valid
Raises django.forms.ValidationError – if the username and password are not
valid.
Returns
The cleaned POST data
Return type
dict
property media
Return all media required to render the widgets on this form.
class cas_server.forms.FederateUserCredential(*args, **kwargs)
Bases: UserCredential
Form used on a auto submited page for linking the views FederateAuth and LoginView.
On successful authentication on a provider, in the view FederateAuth a
FederatedUser is created by
cas_server.federate.CASFederateValidateUser.verify_ticket() and the user is
redirected to LoginView. This form is then automatically filled with infos matching
the created FederatedUser using the ticket as one time password and submited using
javascript. If javascript is not enabled, a connect button is displayed.
This stub authentication form, allow to implement the federated mode with very few
modificatons to the LoginView view.
clean()
Validate that the submited username and password are valid using the
CASFederateAuth auth class.
Raises django.forms.ValidationError – if the username and password do not
correspond to a FederatedUser.
Returns
The cleaned POST data
Return type
dict
property media
Return all media required to render the widgets on this form.
class cas_server.forms.TicketForm(data=None, files=None, auto_id='id_%s', prefix=None,
initial=None, error_class=<class 'django.forms.utils.ErrorList'>, label_suffix=None,
empty_permitted=False, instance=None, use_required_attribute=None, renderer=None)
Bases: django.forms.ModelForm
Form for Tickets in the admin interface
property media
Return all media required to render the widgets on this form.
cas_server.models module
models for the app
cas_server.models.python_2_unicode_compatible(func)
We use Django >= 3.0 with Python >= 3.4, we don’t need Python 2 compatibility.
cas_server.models.logger = <Logger cas_server.models (INFO)>
logger facility
class cas_server.models.JsonAttributes(*args, **kwargs)
Bases: django.db.models.Model
A base class for models storing attributes as a json
class Meta
abstract = False
property attributs
The attributes
class cas_server.models.FederatedIendityProvider(*args, **kwargs)
Bases: django.db.models.Model
An identity provider for the federated mode
suffix Suffix append to backend CAS returned username: returned_username @ suffix.
it must be unique.
server_url
URL to the root of the CAS server application. If login page is ‐
https://cas.example.net/cas/login then server_url should be ‐
https://cas.example.net/cas/
cas_protocol_version
Version of the CAS protocol to use when sending requests the the backend
CAS.
verbose_name
Name for this identity provider displayed on the login page.
pos Position of the identity provider on the login page. Identity provider are
sorted using the (pos, verbose_name, suffix) attributes.
display
Display the provider on the login page. Beware that this do not disable the
identity provider, it just hide it on the login page. User will always be
able to log in using this provider by fetching /federate/suffix.
static build_username_from_suffix(username, suffix)
Transform backend username into federated username using suffix
Parameters
• username (unicode) – A CAS backend returned username
• suffix (unicode) – A suffix identifying the CAS backend
Returns
The federated username: username @ suffix.
Return type
unicode
build_username(username)
Transform backend username into federated username
Parameters
username (unicode) – A CAS backend returned username
Returns
The federated username: username @ suffix.
Return type
unicode
exception DoesNotExist
exception MultipleObjectsReturned
federateduser_set
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
get_cas_protocol_version_display(*, field=<django.db.models.fields.CharField:
cas_protocol_version>)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
class cas_server.models.FederatedUser(*args, **kwargs)
Bases: JsonAttributes
A federated user as returner by a CAS provider (username and attributes)
username
The user username returned by the CAS backend on successful ticket
validation
provider
A foreign key to FederatedIendityProvider
ticket The last ticket used to authenticate username against provider
last_update
Last update timespampt. Usually, the last time ticket has been set.
property federated_username
The federated username with a suffix for the current FederatedUser.
classmethod get_from_federated_username(username)
Returns
A FederatedUser object from a federated username
Return type
FederatedUser
classmethod clean_old_entries()
remove old unused FederatedUser
exception DoesNotExist
exception MultipleObjectsReturned
get_next_by_last_update(*, field=<django.db.models.fields.DateTimeField:
last_update>, is_next=True, **kwargs)
get_previous_by_last_update(*, field=<django.db.models.fields.DateTimeField:
last_update>, is_next=False, **kwargs)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
provider_id
class cas_server.models.FederateSLO(*args, **kwargs)
Bases: django.db.models.Model
An association between a CAS provider ticket and a (username, session) for
processing SLO
username
the federated username with the @ component
session_key
the session key for the session username has been authenticated using ticket
ticket The ticket used to authenticate username
classmethod clean_deleted_sessions()
remove old FederateSLO object for which the session do not exists anymore
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
class cas_server.models.UserAttributes(*args, **kwargs)
Bases: JsonAttributes
Local cache of the user attributes, used then needed
username
The username of the user for which we cache attributes
classmethod clean_old_entries()
Remove UserAttributes for which no more User exists.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
class cas_server.models.User(*args, **kwargs)
Bases: django.db.models.Model
A user logged into the CAS
session_key
The session key of the current authenticated user
username
The username of the current authenticated user
date Last time the authenticated user has do something (auth, fetch ticket, etc…)
last_login
last time the user logged
delete(*args, **kwargs)
Remove the current User. If settings.CAS_FEDERATE is True, also delete the
corresponding FederateSLO object.
classmethod clean_old_entries()
Remove User objects inactive since more that SESSION_COOKIE_AGE and send
corresponding SingleLogOut requests.
classmethod clean_deleted_sessions()
Remove User objects where the corresponding session do not exists anymore.
property attributs
Property. A fresh dict for the user attributes, using
settings.CAS_AUTH_CLASS if possible, and if not, try to fallback to cached
attributes (actually only used for ldap auth class with bind password check
mthode).
logout(request=None)
Send SLO requests to all services the user is logged in.
Parameters
request (django.http.HttpRequest or NoneType) – The current django
HttpRequest to display possible failure to the user.
get_ticket(ticket_class, service, service_pattern, renew)
Generate a ticket using ticket_class for the service service matching
service_pattern and asking or not for authentication renewal with renew
Parameters
• ticket_class (type) – ServiceTicket or ProxyTicket or
ProxyGrantingTicket.
• service (unicode) – The service url for which we want a ticket.
• service_pattern (ServicePattern) – The service pattern matching
service. Beware that service must match ServicePattern.pattern and
the current User must pass ServicePattern.check_user(). These
checks are not done here and you must perform them before calling
this method.
• renew (bool) – Should be True if authentication has been renewed.
Must be False otherwise.
Returns
A Ticket object.
Return type
ServiceTicket or ProxyTicket or ProxyGrantingTicket.
get_service_url(service, service_pattern, renew)
Return the url to which the user must be redirected to after a Service
Ticket has been generated
Parameters
• service (unicode) – The service url for which we want a ticket.
• service_pattern (ServicePattern) – The service pattern matching
service. Beware that service must match ServicePattern.pattern and
the current User must pass ServicePattern.check_user(). These
checks are not done here and you must perform them before calling
this method.
• renew (bool) – Should be True if authentication has been renewed.
Must be False otherwise.
Return unicode
The service url with the ticket GET param added.
Return type
unicode
exception DoesNotExist
exception MultipleObjectsReturned
get_next_by_date(*, field=<django.db.models.fields.DateTimeField: date>,
is_next=True, **kwargs)
get_next_by_last_login(*, field=<django.db.models.fields.DateTimeField:
last_login>, is_next=True, **kwargs)
get_previous_by_date(*, field=<django.db.models.fields.DateTimeField: date>,
is_next=False, **kwargs)
get_previous_by_last_login(*, field=<django.db.models.fields.DateTimeField:
last_login>, is_next=False, **kwargs)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
proxygrantingticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
proxyticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
serviceticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
exception cas_server.models.ServicePatternException
Bases: exceptions.Exception
Base exception of exceptions raised in the ServicePattern model
exception cas_server.models.BadUsername
Bases: ServicePatternException
Exception raised then an non allowed username try to get a ticket for a service
exception cas_server.models.BadFilter
Bases: ServicePatternException
Exception raised then a user try to get a ticket for a service and do not reach a
condition
exception cas_server.models.UserFieldNotDefined
Bases: ServicePatternException
Exception raised then a user try to get a ticket for a service using as username an
attribut not present on this user
class cas_server.models.ServicePattern(*args, **kwargs)
Bases: django.db.models.Model
Allowed services pattern against services are tested to
pos service patterns are sorted using the pos attribute
name A name for the service (this can bedisplayed to the user on the login page)
pattern
A regular expression matching services. “Will usually looks like
‘^https://some\.server\.com/path/.*$’. As it is a regular expression,
special character must be escaped with a ‘\’.
user_field
Name of the attribute to transmit as username, if empty the user login is
used
restrict_users
A boolean allowing to limit username allowed to connect to usernames.
proxy A boolean allowing to deliver ProxyTicket to the service.
proxy_callback
A boolean allowing the service to be used as a proxy callback (via the
pgtUrl GET param) to deliver ProxyGrantingTicket.
single_log_out
Enable SingleLogOut for the service. Old validaed tickets for the service
will be kept until settings.CAS_TICKET_TIMEOUT after what a SLO request is
send to the service and the ticket is purged from database. A SLO can be
send earlier if the user log-out.
single_log_out_callback
An URL where the SLO request will be POST. If empty the service url will be
used. This is usefull for non HTTP proxied services like smtp or imap.
check_user(user)
Check if user if allowed to use theses services. If user is not allowed,
raises one of BadFilter, UserFieldNotDefined, BadUsername
Parameters
user (User) – a User object
Raises
• BadUsername – if restrict_users if True and User.username is not
within usernames.
• BadFilter – if a FilterAttributValue condition of filters connot be
verified.
• UserFieldNotDefined – if user_field is defined and its value is not
within User.attributs.
Returns
True
Return type
bool
classmethod validate(service)
Get a ServicePattern intance from a service url.
Parameters
service (unicode) – A service url
Returns
A ServicePattern instance matching service.
Return type
ServicePattern
Raises ServicePattern.DoesNotExist – if no ServicePattern is matching
service.
exception DoesNotExist
exception MultipleObjectsReturned
attributs
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
filters
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
proxygrantingticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
proxyticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
replacements
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
serviceticket
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
usernames
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
class cas_server.models.Username(*args, **kwargs)
Bases: django.db.models.Model
A list of allowed usernames on a ServicePattern
value username allowed to connect to the service
service_pattern
ForeignKey to a ServicePattern. Username instances for a ServicePattern are
accessible thought its ServicePattern.usernames attribute.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
service_pattern_id
class cas_server.models.ReplaceAttributName(*args, **kwargs)
Bases: django.db.models.Model
A replacement of an attribute name for a ServicePattern. It also tell to transmit
an attribute of User.attributs to the service. An empty replace mean to use the
original attribute name.
name Name the attribute: a key of User.attributs
replace
The name of the attribute to transmit to the service. If empty, the value of
name is used.
service_pattern
ForeignKey to a ServicePattern. ReplaceAttributName instances for a
ServicePattern are accessible thought its ServicePattern.attributs
attribute.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
service_pattern_id
class cas_server.models.FilterAttributValue(*args, **kwargs)
Bases: django.db.models.Model
A filter on User.attributs for a ServicePattern. If a User do not have an attribute
attribut or its value do not match pattern, then ServicePattern.check_user() will
raises BadFilter if called with that user.
attribut
The name of a user attribute
pattern
A regular expression the attribute attribut value must verify. If attribut
if a list, only one of the list values needs to match.
service_pattern
ForeignKey to a ServicePattern. FilterAttributValue instances for a
ServicePattern are accessible thought its ServicePattern.filters attribute.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
service_pattern_id
class cas_server.models.ReplaceAttributValue(*args, **kwargs)
Bases: django.db.models.Model
A replacement (using a regular expression) of an attribute value for a
ServicePattern.
attribut
Name the attribute: a key of User.attributs
pattern
A regular expression matching the part of the attribute value that need to
be changed
replace
The replacement to what is mached by pattern. groups are capture by \1, \2 …
service_pattern
ForeignKey to a ServicePattern. ReplaceAttributValue instances for a
ServicePattern are accessible thought its ServicePattern.replacements
attribute.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
service_pattern_id
class cas_server.models.Ticket(*args, **kwargs)
Bases: JsonAttributes
Generic class for a Ticket
class Meta
abstract = False
user ForeignKey to a User.
validate
A boolean. True if the ticket has been validated
service
The service url for the ticket
service_pattern
ForeignKey to a ServicePattern. The ServicePattern corresponding to service.
Use ServicePattern.validate() to find it.
creation
Date of the ticket creation
renew A boolean. True if the user has just renew his authentication
single_log_out
A boolean. Set to service_pattern attribute ServicePattern.single_log_out
value.
VALIDITY = 60
Max duration between ticket creation and its validation. Any validation
attempt for the ticket after creation + VALIDITY will fail as if the ticket
do not exists.
TIMEOUT = 86400
Time we keep ticket with single_log_out set to True before sending
SingleLogOut requests.
exception DoesNotExist
raised in Ticket.get() then ticket prefix and ticket classes mismatch
static send_slos(queryset_list)
Send SLO requests to each ticket of each queryset of queryset_list
Parameters
queryset_list (list) – A list a Ticket queryset
Returns
A list of possibly encoutered Exception
Return type
list
classmethod clean_old_entries()
Remove old ticket and send SLO to timed-out services
logout(session, async_list=None)
Send a SLO request to the ticket service
static get_class(ticket, classes=None)
Return the ticket class of ticket
Parameters
• ticket (unicode) – A ticket
• classes (list) – Optinal arguement. A list of possible Ticket
subclasses
Returns
The class corresponding to ticket (ServiceTicket or ProxyTicket or
ProxyGrantingTicket) if found among classes, ``None otherwise.
Return type
type or NoneType
username()
The username to send on ticket validation
Returns
The value of the corresponding user attribute if
service_pattern.user_field is set, the user username otherwise.
attributs_flat()
generate attributes list for template rendering
Returns
An list of (attribute name, attribute value) of all user attributes
flatened (no nested list)
Return type
list of tuple of unicode
classmethod get(ticket, renew=False, service=None)
Search the database for a valid ticket with provided arguments
Parameters
• ticket (unicode) – A ticket value
• renew (bool) – Is authentication renewal needed
• service (unicode) – Optional argument. The ticket service
Raises
• Ticket.DoesNotExist – if no class is found for the ticket prefix
• cls.DoesNotExist – if ticket value is not found in th database
Returns
a Ticket instance
Return type
Ticket
get_next_by_creation(*, field=<django.db.models.fields.DateTimeField: creation>,
is_next=True, **kwargs)
get_previous_by_creation(*, field=<django.db.models.fields.DateTimeField:
creation>, is_next=False, **kwargs)
service_pattern_id
user_id
class cas_server.models.ServiceTicket(*args, **kwargs)
Bases: Ticket
A Service Ticket
PREFIX = 'ST'
The ticket prefix used to differentiate it from other tickets types
value The ticket value
exception DoesNotExist
exception MultipleObjectsReturned
creation
Date of the ticket creation
get_next_by_creation(*, field=<django.db.models.fields.DateTimeField: creation>,
is_next=True, **kwargs)
get_previous_by_creation(*, field=<django.db.models.fields.DateTimeField:
creation>, is_next=False, **kwargs)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
renew A boolean. True if the user has just renew his authentication
service
The service url for the ticket
service_pattern
ForeignKey to a ServicePattern. The ServicePattern corresponding to service.
Use ServicePattern.validate() to find it.
service_pattern_id
single_log_out
A boolean. Set to service_pattern attribute ServicePattern.single_log_out
value.
user ForeignKey to a User.
user_id
validate
A boolean. True if the ticket has been validated
class cas_server.models.ProxyTicket(*args, **kwargs)
Bases: Ticket
A Proxy Ticket
PREFIX = 'PT'
The ticket prefix used to differentiate it from other tickets types
value The ticket value
exception DoesNotExist
exception MultipleObjectsReturned
creation
Date of the ticket creation
get_next_by_creation(*, field=<django.db.models.fields.DateTimeField: creation>,
is_next=True, **kwargs)
get_previous_by_creation(*, field=<django.db.models.fields.DateTimeField:
creation>, is_next=False, **kwargs)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
proxies
Accessor to the related objects manager on the reverse side of a many-to-one
relation.
In the example:
class Child(Model):
parent = ForeignKey(Parent, related_name='children')
Parent.children is a ReverseManyToOneDescriptor instance.
Most of the implementation is delegated to a dynamically defined manager
class built by create_forward_many_to_many_manager() defined below.
renew A boolean. True if the user has just renew his authentication
service
The service url for the ticket
service_pattern
ForeignKey to a ServicePattern. The ServicePattern corresponding to service.
Use ServicePattern.validate() to find it.
service_pattern_id
single_log_out
A boolean. Set to service_pattern attribute ServicePattern.single_log_out
value.
user ForeignKey to a User.
user_id
validate
A boolean. True if the ticket has been validated
class cas_server.models.ProxyGrantingTicket(*args, **kwargs)
Bases: Ticket
A Proxy Granting Ticket
PREFIX = 'PGT'
The ticket prefix used to differentiate it from other tickets types
VALIDITY = 3600
ProxyGranting ticket are never validated. However, they can be used during
VALIDITY to get ProxyTicket for user
value The ticket value
exception DoesNotExist
exception MultipleObjectsReturned
creation
Date of the ticket creation
get_next_by_creation(*, field=<django.db.models.fields.DateTimeField: creation>,
is_next=True, **kwargs)
get_previous_by_creation(*, field=<django.db.models.fields.DateTimeField:
creation>, is_next=False, **kwargs)
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
renew A boolean. True if the user has just renew his authentication
service
The service url for the ticket
service_pattern
ForeignKey to a ServicePattern. The ServicePattern corresponding to service.
Use ServicePattern.validate() to find it.
service_pattern_id
single_log_out
A boolean. Set to service_pattern attribute ServicePattern.single_log_out
value.
user ForeignKey to a User.
user_id
validate
A boolean. True if the ticket has been validated
class cas_server.models.Proxy(*args, **kwargs)
Bases: django.db.models.Model
A list of proxies on ProxyTicket
url Service url of the PGT used for getting the associated ProxyTicket
proxy_ticket
ForeignKey to a ProxyTicket. Proxy instances for a ProxyTicket are
accessible thought its ProxyTicket.proxies attribute.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
proxy_ticket_id
class cas_server.models.NewVersionWarning(*args, **kwargs)
Bases: django.db.models.Model
The last new version available version sent
version
A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
exception DoesNotExist
exception MultipleObjectsReturned
id A wrapper for a deferred-loading field. When the value is read from this
object the first time, the query is executed.
objects = <django.db.models.manager.Manager object>
classmethod send_mails()
For each new django-cas-server version, if the current instance is not up to
date send one mail to settings.ADMINS.
cas_server.urls module
urls for the app
cas_server.utils module
Some util function for the app
cas_server.utils.logger = <Logger cas_server.utils (INFO)>
logger facility
cas_server.utils.json_encode(obj)
Encode a python object to json
cas_server.utils.context(params)
Function that add somes variable to the context before template rendering
Parameters
params (dict) – The context dictionary used to render templates.
Returns
The params dictionary with the key settings set to django.conf.settings.
Return type
dict
cas_server.utils.json_response(request, data)
Wrapper dumping data to a json and sending it to the user with an HttpResponse
Parameters
• request (django.http.HttpRequest) – The request object used to generate
this response.
• data (dict) – The python dictionnary to return as a json
Returns
The content of data serialized in json
Return type
django.http.HttpResponse
cas_server.utils.import_attr(path)
transform a python dotted path to the attr
Parameters
path (unicode or str or anything) – A dotted path to a python object or a
python object
Returns
The python object pointed by the dotted path or the python object unchanged
cas_server.utils.redirect_params(url_name, params=None)
Redirect to url_name with params as querystring
Parameters
• url_name (unicode) – a URL pattern name
• params (dict or NoneType) – Some parameter to append to the reversed URL
Returns
A redirection to the URL with name url_name with params as querystring.
Return type
django.http.HttpResponseRedirect
cas_server.utils.reverse_params(url_name, params=None, **kwargs)
compute the reverse url of url_name and add to it parameters from params as
querystring
Parameters
• url_name (unicode) – a URL pattern name
• params (dict or NoneType) – Some parameter to append to the reversed URL
• **kwargs –
additional parameters needed to compure the reverse URL
Returns
The computed reverse URL of url_name with possible querystring from params
Return type
unicode
cas_server.utils.copy_params(get_or_post_params, ignore=None)
copy a django.http.QueryDict in a dict ignoring keys in the set ignore
Parameters
• get_or_post_params (django.http.QueryDict) – A GET or POST QueryDict
• ignore (set) – An optinal set of keys to ignore during the copy
Returns
A copy of get_or_post_params
Return type
dict
cas_server.utils.set_cookie(response, key, value, max_age)
Set the cookie key on response with value value valid for max_age secondes
Parameters
• response (django.http.HttpResponse) – a django response where to set the
cookie
• key (unicode) – the cookie key
• value (unicode) – the cookie value
• max_age (int) – the maximum validity age of the cookie
cas_server.utils.get_current_url(request, ignore_params=None)
Giving a django request, return the current http url, possibly ignoring some GET
parameters
Parameters
• request (django.http.HttpRequest) – The current request object.
• ignore_params (set) – An optional set of GET parameters to ignore
Returns
The URL of the current page, possibly omitting some parameters from
ignore_params in the querystring.
Return type
unicode
cas_server.utils.update_url(url, params)
update parameters using params in the url query string
Parameters
• url (unicode or str) – An URL possibily with a querystring
• params (dict) – A dictionary of parameters for updating the url
querystring
Returns
The URL with an updated querystring
Return type
unicode
cas_server.utils.unpack_nested_exception(error)
If exception are stacked, return the first one
Parameters
error – A python exception with possible exception embeded within
Returns
A python exception with no exception embeded within
cas_server.utils.gen_lt()
Generate a Login Ticket
Returns
A ticket with prefix settings.CAS_LOGIN_TICKET_PREFIX and length
settings.CAS_LT_LEN
Return type
unicode
cas_server.utils.gen_st()
Generate a Service Ticket
Returns
A ticket with prefix settings.CAS_SERVICE_TICKET_PREFIX and length
settings.CAS_ST_LEN
Return type
unicode
cas_server.utils.gen_pt()
Generate a Proxy Ticket
Returns
A ticket with prefix settings.CAS_PROXY_TICKET_PREFIX and length
settings.CAS_PT_LEN
Return type
unicode
cas_server.utils.gen_pgt()
Generate a Proxy Granting Ticket
Returns
A ticket with prefix settings.CAS_PROXY_GRANTING_TICKET_PREFIX and length
settings.CAS_PGT_LEN
Return type
unicode
cas_server.utils.gen_pgtiou()
Generate a Proxy Granting Ticket IOU
Returns
A ticket with prefix settings.CAS_PROXY_GRANTING_TICKET_IOU_PREFIX and
length settings.CAS_PGTIOU_LEN
Return type
unicode
cas_server.utils.gen_saml_id()
Generate an saml id
Returns
A random id of length settings.CAS_TICKET_LEN
Return type
unicode
cas_server.utils.get_tuple(nuplet, index, default=None)
Parameters
• nuplet (tuple) – A tuple
• index (int) – An index
• default – An optional default value
Returns
nuplet[index] if defined, else default (possibly None)
cas_server.utils.crypt_salt_is_valid(salt)
Validate a salt as crypt salt
Parameters
salt (str) – a password salt
Returns
True if salt is a valid crypt salt on this system, False otherwise
Return type
bool
class cas_server.utils.LdapHashUserPassword
Bases: object
Class to deal with hashed password as defined at ‐
https://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html
schemes_salt = {b'{CRYPT}', b'{SMD5}', b'{SSHA256}', b'{SSHA384}', b'{SSHA512}',
b'{SSHA}'}
valide schemes that require a salt
schemes_nosalt = {b'{MD5}', b'{SHA256}', b'{SHA384}', b'{SHA512}', b'{SHA}'}
valide sschemes that require no slat
exception BadScheme
Bases: ValueError
Error raised then the hash scheme is not in
LdapHashUserPassword.schemes_salt + LdapHashUserPassword.schemes_nosalt
exception BadHash
Bases: ValueError
Error raised then the hash is too short
exception BadSalt
Bases: ValueError
Error raised then, with the scheme {CRYPT}, the salt is invalid
classmethod hash(scheme, password, salt=None, charset='utf8')
Hash password with scheme using salt. This three variable beeing encoded in
charset.
Parameters
• scheme (bytes) – A valid scheme
• password (bytes) – A byte string to hash using scheme
• salt (bytes) – An optional salt to use if scheme requires any
• charset (str) – The encoding of scheme, password and salt
Returns
The hashed password encoded with charset
Return type
bytes
classmethod get_scheme(hashed_passord)
Return the scheme of hashed_passord or raise BadHash
Parameters
hashed_passord (bytes) – A hashed password
Returns
The scheme used by the hashed password
Return type
bytes
Raises BadHash – if no valid scheme is found within hashed_passord
classmethod get_salt(hashed_passord)
Return the salt of hashed_passord possibly empty
Parameters
hashed_passord (bytes) – A hashed password
Returns
The salt used by the hashed password (empty if no salt is used)
Return type
bytes
Raises BadHash – if no valid scheme is found within hashed_passord or if the
hashed password is too short for the scheme found.
cas_server.utils.check_password(method, password, hashed_password, charset)
Check that password match hashed_password using method, assuming the encoding is
charset.
Parameters
• method (str) – on of "crypt", "ldap", "hex_md5", "hex_sha1", "hex_sha224",
"hex_sha256", "hex_sha384", "hex_sha512", "plain"
• password (str or unicode) – The user inputed password
• hashed_password (str or unicode) – The hashed password as stored in the
database
• charset (str) – The used char encoding (also used internally, so it must
be valid for the charset used by password when it was initially )
Returns
True if password match hashed_password using method, False otherwise
Return type
bool
cas_server.utils.decode_version(version)
decode a version string following version semantic http://semver.org/ input a tuple
of int. It will work as long as we do not use pre release versions.
Parameters
version (unicode) – A dotted version
Returns
A tuple a int
Return type
tuple
cas_server.utils.last_version()
Fetch the last version from pypi and return it. On successful fetch from pypi, the
response is cached 24h, on error, it is cached 10 min.
Returns
the last django-cas-server version
Return type
unicode
cas_server.utils.dictfetchall(cursor)
Return all rows from a django cursor as a dict
cas_server.utils.logout_request(ticket)
Forge a SLO logout request
Parameters
ticket (unicode) – A ticket value
Returns
A SLO XML body request
Return type
unicode
cas_server.utils.regexpr_validator(value)
Test that value is a valid regular expression
Parameters
value (unicode) – A regular expression to test
Raises ValidationError – if value is not a valid regular expression
cas_server.views module
views for the app
cas_server.views.python_2_unicode_compatible(func)
We use Django >= 3.0 with Python >= 3.4, we don’t need Python 2 compatibility.
class cas_server.views.LogoutMixin
Bases: object
destroy CAS session utils
logout(all_session=False)
effectively destroy a CAS session
Parameters
all_session (boolean) – If True destroy all the user sessions,
otherwise destroy the current user session.
Returns
The number of destroyed sessions
Return type
int
class cas_server.views.CsrfExemptView(**kwargs)
Bases: View
base class for csrf exempt class views
dispatch(request, *args, **kwargs)
dispatch different http request to the methods of the same name
Parameters
request (django.http.HttpRequest) – The current request object
class cas_server.views.LogoutView(**kwargs)
Bases: View, LogoutMixin
destroy CAS session (logout) view
request = None
current django.http.HttpRequest object
service = None
service GET parameter
url = None
url GET paramet
ajax = None
True if the HTTP_X_AJAX http header is sent and
settings.CAS_ENABLE_AJAX_AUTH is True, False otherwise.
init_get(request)
Initialize the LogoutView attributes on GET request
Parameters
request (django.http.HttpRequest) – The current request object
static delete_cookies(response)
get(request, *args, **kwargs)
method called on GET request on this view
Parameters
request (django.http.HttpRequest) – The current request object
class cas_server.views.FederateAuth(**kwargs)
Bases: CsrfExemptView
view to authenticated user against a backend CAS then CAS_FEDERATE is True
csrf is disabled for allowing SLO requests reception.
service_url = None
current URL used as service URL by the CAS client
get_cas_client(request, provider, renew=False)
return a CAS client object matching provider
Parameters
• request (django.http.HttpRequest) – The current request object
• provider (cas_server.models.FederatedIendityProvider) – the user
identity provider
Returns
The user CAS client object
Return type
federate.CASFederateValidateUser
post(request, provider=None, *args, **kwargs)
method called on POST request
Parameters
• request (django.http.HttpRequest) – The current request object
• provider (unicode) – Optional parameter. The user provider suffix.
get(request, provider=None)
method called on GET request
Parameters
• request (django.http.HttpRequestself.) – The current request object
• provider (unicode) – Optional parameter. The user provider suffix.
class cas_server.views.LoginView(**kwargs)
Bases: View, LogoutMixin
credential requestor / acceptor
user = None
The current models.User object
form = None
The form to display to the user
request = None
current django.http.HttpRequest object
service = None
service GET/POST parameter
renew = None
True if renew GET/POST parameter is present and not “False”
warn = None
the warn GET/POST parameter
gateway = None
the gateway GET/POST parameter
method = None
the method GET/POST parameter
ajax = None
True if the HTTP_X_AJAX http header is sent and
settings.CAS_ENABLE_AJAX_AUTH is True, False otherwise.
renewed = False
True if the user has just authenticated
warned = False
True if renew GET/POST parameter is present and not “False”
username = None
The FederateAuth transmited username (only used if settings.CAS_FEDERATE is
True)
ticket = None
The FederateAuth transmited ticket (only used if settings.CAS_FEDERATE is
True)
INVALID_LOGIN_TICKET = 1
USER_LOGIN_OK = 2
USER_LOGIN_FAILURE = 3
USER_ALREADY_LOGGED = 4
USER_AUTHENTICATED = 5
USER_NOT_AUTHENTICATED = 6
init_post(request)
Initialize POST received parameters
Parameters
request (django.http.HttpRequest) – The current request object
gen_lt()
Generate a new LoginTicket and add it to the list of valid LT for the user
check_lt()
Check is the POSTed LoginTicket is valid, if yes invalide it
Returns
True if the LoginTicket is valid, False otherwise
Return type
bool
post(request, *args, **kwargs)
method called on POST request on this view
Parameters
request (django.http.HttpRequest) – The current request object
process_post()
Analyse the POST request:
• check that the LoginTicket is valid
• check that the user sumited credentials are valid
Returns
• INVALID_LOGIN_TICKET if the POSTed LoginTicket is not valid
• USER_ALREADY_LOGGED if the user is already logged and do no request
reauthentication.
• USER_LOGIN_FAILURE if the user is not logged or request for
reauthentication and his credentials are not valid
• USER_LOGIN_OK if the user is not logged or request for
reauthentication and his credentials are valid
Return type
int
init_get(request)
Initialize GET received parameters
Parameters
request (django.http.HttpRequest) – The current request object
get(request, *args, **kwargs)
method called on GET request on this view
Parameters
request (django.http.HttpRequest) – The current request object
process_get()
Analyse the GET request
Returns
• USER_NOT_AUTHENTICATED if the user is not authenticated or is
requesting for authentication renewal
• USER_AUTHENTICATED if the user is authenticated and is not
requesting for authentication renewal
Return type
int
init_form(values=None)
Initialization of the good form depending of POST and GET parameters
Parameters
values (django.http.QueryDict) – A POST or GET QueryDict
service_login()
Perform login against a service
Returns
• The rendering of the settings.CAS_WARN_TEMPLATE if the user asked
to be warned before ticket emission and has not yep been warned.
• The redirection to the service URL with a ticket GET parameter
• The redirection to the service URL without a ticket if ticket
generation failed and the gateway attribute is set
• The rendering of the settings.CAS_LOGGED_TEMPLATE template with
some error messages if the ticket generation failed (e.g: user not
allowed).
Return type
django.http.HttpResponse
authenticated()
Processing authenticated users
Returns
• The returned value of service_login() if service is defined
• The rendering of settings.CAS_LOGGED_TEMPLATE otherwise
Return type
django.http.HttpResponse
not_authenticated()
Processing non authenticated users
Returns
• The rendering of settings.CAS_LOGIN_TEMPLATE with various messages
depending of GET/POST parameters
• The redirection to FederateAuth if settings.CAS_FEDERATE is True
and the “remember my identity provider” cookie is found
Return type
django.http.HttpResponse
common()
Common part execute uppon GET and POST request
Returns
• The returned value of authenticated() if the user is authenticated
and not requesting for authentication or if the authentication has
just been renewed
• The returned value of not_authenticated() otherwise
Return type
django.http.HttpResponse
class cas_server.views.Auth(**kwargs)
Bases: CsrfExemptView
A simple view to validate username/password/service tuple
csrf is disable as it is intended to be used by programs. Security is assured by a
shared secret between the programs dans django-cas-server.
static post(request)
method called on POST request on this view
Parameters
request (django.http.HttpRequest) – The current request object
Returns
HttpResponse(u"yes\n") if the POSTed tuple (username, password,
service) if valid (i.e. (username, password) is valid dans username
is allowed on service). HttpResponse(u"no\n…") otherwise, with
possibly an error message on the second line.
Return type
django.http.HttpResponse
class cas_server.views.Validate(**kwargs)
Bases: View
service ticket validation
static get(request)
method called on GET request on this view
Parameters
request (django.http.HttpRequest) – The current request object
Returns
• HttpResponse("yes\nusername") if submited (service, ticket) is
valid
• else HttpResponse("no\n")
Return type
django.http.HttpResponse
exception cas_server.views.ValidationBaseError(code, msg='')
Bases: Exception
Base class for both saml and cas validation error
code = None
The error code
msg = None
The error message
render(request)
render the error template for the exception
Parameters
request (django.http.HttpRequest) – The current request object:
Returns
the rendered cas_server/serviceValidateError.xml template
Return type
django.http.HttpResponse
exception cas_server.views.ValidateError(code, msg='')
Bases: ValidationBaseError
handle service validation error
template = 'cas_server/serviceValidateError.xml'
template to be render for the error
context()
content to use to render template
Returns
A dictionary to contextualize template
Return type
dict
class cas_server.views.ValidateService(**kwargs)
Bases: View
service ticket validation [CAS 2.0] and [CAS 3.0]
request = None
Current django.http.HttpRequest object
service = None
The service GET parameter
ticket = None
the ticket GET parameter
pgt_url = None
the pgtUrl GET parameter
renew = None
the renew GET parameter
allow_proxy_ticket = False
specify if ProxyTicket are allowed by the view. Hence we user the same view
for /serviceValidate and /proxyValidate juste changing the parameter.
get(request)
method called on GET request on this view
Parameters
request (django.http.HttpRequest) – The current request object:
Returns
The rendering of cas_server/serviceValidate.xml if no errors is
raised, the rendering or cas_server/serviceValidateError.xml
otherwise.
Return type
django.http.HttpResponse
process_ticket()
fetch the ticket against the database and check its validity
Raises ValidateError – if the ticket is not found or not valid, potentially
for that service
Returns
A couple (ticket, proxies list)
Return type
tuple
process_pgturl(params)
Handle PGT request
Parameters
params (dict) – A template context dict
Raises ValidateError – if pgtUrl is invalid or if TLS validation of the
pgtUrl fails
Returns
The rendering of cas_server/serviceValidate.xml, using params
Return type
django.http.HttpResponse
class cas_server.views.Proxy(**kwargs)
Bases: View
proxy ticket service
request = None
Current django.http.HttpRequest object
pgt = None
A ProxyGrantingTicket from the pgt GET parameter
target_service = None
the targetService GET parameter
get(request)
method called on GET request on this view
Parameters
request (django.http.HttpRequest) – The current request object:
Returns
The returned value of process_proxy() if no error is raised, else the
rendering of cas_server/serviceValidateError.xml.
Return type
django.http.HttpResponse
process_proxy()
handle PT request
Raises ValidateError – if the PGT is not found, or the target service not
allowed or the user not allowed on the tardet service.
Returns
The rendering of cas_server/proxy.xml
Return type
django.http.HttpResponse
exception cas_server.views.SamlValidateError(code, msg='')
Bases: ValidationBaseError
handle saml validation error
template = 'cas_server/samlValidateError.xml'
template to be render for the error
context()
Returns
A dictionary to contextualize template
Return type
dict
class cas_server.views.SamlValidate(**kwargs)
Bases: CsrfExemptView
SAML ticket validation
request = None
target = None
ticket = None
root = None
post(request, *args, **kwargs)
method called on POST request on this view
Parameters
request (django.http.HttpRequest) – The current request object
Returns
the rendering of cas_server/samlValidate.xml if no error is raised,
else the rendering of cas_server/samlValidateError.xml.
Return type
django.http.HttpResponse
process_ticket()
validate ticket from SAML XML body
Raises SamlValidateError: if the ticket is not found or not valid, or if we
fail to parse the posted XML.
Returns
a ticket object
Return type
models.Ticket
Module contents
A django CAS server application
cas_server.VERSION = '2.1.0'
version of the application
CHANGE LOG
All notable changes to this project will be documented in this file.
Table of Contents
• Change Log
• v2.1.0 - 2024-08-18
• v2.0.0 - 2022-10-17
• v1.3.1 - 2021-07-03
• v1.3.0 - 2021-06-19
• v1.2.0 - 2020-07-05
• v1.1.0 - 2019-03-02
• v1.0.0 - 2019-01-12
• v0.9.0 - 2017-11-17
• v0.8.0 - 2017-03-08
• v0.7.4 - 2016-09-07
• v0.7.3 - 2016-09-07
• v0.7.2 - 2016-08-31
• v0.7.1 - 2016-08-24
• v0.7.0 - 2016-08-24
• v0.6.4 - 2016-08-14
• v0.6.3 - 2016-08-14
• v0.6.2 - 2016-08-02
• v0.6.1 - 2016-07-27
• v0.6.0 - 2016-07-06
• v0.5.0 - 2016-07-01
• v0.4.4 - 2016-04-30
• v0.4.3 - 2016-03-18
• v0.4.2 - 2016-03-18
• v0.4.1 - 2015-12-23
• v0.4.0 - 2015-12-15
• v0.3.5 - 2015-12-12
• v0.3.4 - 2015-12-12
• v0.3.3 - 2015-12-12
• v0.3.2 - 2015-12-12 [YANKED]
• v0.3.1 - 2015-12-12
• v0.3.0 - 2015-12-12
• v0.2.1 - 2015-12-12
• v0.2.0 - 2015-12-12 [YANKED]
• v0.1.0 - 2015-05-22 [YANKED]
v2.1.0 - 2024-08-18
Added
• Support for Django 4.2
• Allow forms to be overridden from settings
Deprecated
• Make the crypt module optional and deprecate it’s usage. The python stdlid crypt module
is deprecated since version 3.11 and will be removed in version 3.13. Check for the
availability of the crypt module. All password checks using the crypt module will stop
to work on python 3.13.
v2.0.0 - 2022-10-17
Added
• Support for Django 4.0 and 4.1
• Add locale for zh_Hans
• Add a unit test with a non ascii char in service url
• Add settings to allow deletings Django cookies upon logout
Changed
• Update CI: require pytest >= 7 and remove pytest-pythonpath dependancy
Fixes
• Fix unicode sandwich issue in cas_server.utils.update_url
• Fix DeprecationWarning about default_app_config in Django 3.2
• Fix DeprecationWarning about USE_L10N in Django 4.0
Removed
• Drop support for python 2.7 (now deprecated for more than 2 years, expect it to break
now or in a near future)
• Drop support for python 3.5 (but it should keep working for a while. pytest >= 7 do not
support python 3.5 and Debian Stretch support ended)
v1.3.1 - 2021-07-03
Fixes
• Documentation generation to works with latest Django and sphinx version
• Update classifier and dependencies versions in setup.py
v1.3.0 - 2021-06-19
Added
• Support for Dango 3.1 and 3.2
• Implement CAS_LDAP_ATTRS_VIEW set to 0: then using ldap bind mode, user attributes can
be retreive either using CAS_LDAP_USER or using the binded user credentials.
• Added ppc64le architecture support on travis-ci (django-cas-server is included in the
ppc64le versions of RHEL and Ubuntu)
• Python 3.9 support
Fixes
• Allow to use user attributes if auth by ldap bind
• Fix spelling mistakes in french translation
• Fix bug model datefield Form (Federated User Admin)
• django.conf.urls is deprecated and will be removed in Django 4.0. Use
django.urls.re_path instead
Removed
• Drop support for Django 3.0 as it reached end of life.
v1.2.0 - 2020-07-05
Added
• Bootstrap 4 templates
• Support for Django 2.2 and 3.0
Fixes
• Replace calls to add_description_unit. As of Sphinx 2.4, the deprecated
add_description_unit function has been removed.
• Fix CRYPT-DES hash method for LDAP
• Fix various spelling miskate in README.rst
• Service URL: keep blank GET arguments
Changed
• Use python3 for flake8, check_rst and coverage
• Update README.rst quickstart for using python3 by default
Removed
• Drop support for Django 2.0 and 2.1 as it reached end of life. We still keep Django
1.11 as it is the last supported release by python2 AND the currently packaged version
of Django in Debian Buster (current stable).
v1.1.0 - 2019-03-02
Added
• Support for Django 2.1
Fixes
• Checkbox position on the login page
• Set ldap3 client_strategy from sync to sync-restartable
• Deprecation warning for {% load staticfiles %} and django.contrib.staticfiles
v1.0.0 - 2019-01-12
Added
• Support for python 3.6 and Django 1.11
• Support for Django 2.0
• Keep query string then redirecting from / to /login
Fixes
• Add missing attributes authenticationDate, longTermAuthenticationRequestTokenUsed and
isFromNewLogin from service validation response
• Catch error from calling django.contrib.staticfiles.templatetags.staticfiles.static in
non-debug mode before collectstatic in cas_server.default_settings.py
• Invalid escape sequence in regular expression
Deprecated
• Support for Django <1.11 is dropped, it should still works for this version. Next
versions will most probably be not compatible with Django <1.11
• Support for python 3.4 is dropped, it should still works for this version. Next
versions may or may not works with python 3.4.
Other
• Migrations have been squashed for Django 2.0 support. Be sur to apply all migration
before updating to this version
• Update PyPi url from https://pypi.python.org to https://pypi.org
v0.9.0 - 2017-11-17
Added
• Dutch translation
• Protuguese translation (brazilian variant)
• Support for ldap3 version 2 or more (changes in the API) All exception are now in
ldap3.core.exceptions, methodes for fetching attritutes and dn are renamed.
• Possibility to disable service message boxes on the login pages
Fixed
• Then using the LDAP auth backend with bind method for password check, do not try to bind
if the user dn was not found. This was causing the exception 'NoneType' object has no
attribute 'getitem' describe in #21
• Increase the max size of usernames (30 chars to 250)
• Fix XSS js injection
v0.8.0 - 2017-03-08
Added
• Add a test for login with missing parameter (username or password or both)
• Add ldap auth using bind method (use the user credentials to bind the the ldap server
and let the server check the credentials)
• Add CAS_TGT_VALIDITY parameter: Max time after with the user MUST reauthenticate.
Fixed
• Allow both unicode and bytes dotted string in utils.import_attr
• Fix some spelling and grammar on log messages. (thanks to Allie Micka)
• Fix froms css class error on success/error due to a scpaless block
• Disable pip cache then installing with make install
Changed
• Update french translation
v0.7.4 - 2016-09-07
Fixed
• Add templatetags to Pypi package
v0.7.3 - 2016-09-07
Added
• Add autofocus to the username input on the login page
Fixed
• Really pick the last version on Pypi for new version checking. We were only sorting
version string lexicographically and it would have break when we reach version 0.10.N or
0.N.10
• Only check for valid username/password if username and password POST fields are posted.
This fix a bug where posting without it raise a exception are None where passed for
username/password verification.
v0.7.2 - 2016-08-31
Added
• Add Django 1.10 support
• Add support of gitlab continuous integration
Fixed
• Fix BootsrapForm: placeholder on Input and Textarea only, use class form-control on
Input, Select and Textarea.
• Fix lang attribute in django 1.7. On html pages, the lang attribute of the <html> was
not present in django 1.7. We use now a methode to display it that is also available in
django 1.7
v0.7.1 - 2016-08-24
Added
• Add a forgotten migration (only change help_text and validators)
v0.7.0 - 2016-08-24
Added
• Add a CHANGELOG.rst file.
• Add a validator to models CharField that should be regular expressions checking that
user input are valids regular expressions.
• Add a CAS_INFO_MESSAGES and CAS_INFO_MESSAGES_ORDER settings allowing to display
messages in info-boxes on the html pages of the default templates.
Changed
• Allow the user defined CAS_COMPONENT_URLS to omit not changed values.
• replace code-block without language indication by literal blocks.
• Update french translation
Fixed
• Some README.rst typos.
• some english typos
v0.6.4 - 2016-08-14
commit: 282e3a831b3c0b0818881c2f16d056850d572b89
Added
• Add a forgotten migration (only change help_text)
v0.6.3 - 2016-08-14
commit: 07a537b403c5c5e39a4ddd084f90e3a4de88a54e
Added
• Add powered by footer
• Add a github version badge
• documents templatetags
Changed
• Usage of the documented API for models _meta in auth.DjangoAuthUser
• set warn cookie using javascript if possible
• Unfold many to many attributes in auth.DjangoAuthUser attributes
Fixed
• typos in README.rst
• w3c validation
Cleaned
• Code factorisation (models.py, views.py)
v0.6.2 - 2016-08-02
commit: 773707e6c3c3fa20f697c946e31cafc591e8fee8
Added
• Support authentication renewal in federate mode
• Add new version email and info box then new version is available
• Add SqlAuthUser and LdapAuthUser auth classes. Deprecate the usage of MysqlAuthUser in
favor of SqlAuthUser.
• Add pytest-warning to tests
• Add a checkbox to forget the identity provider if we checked “remember the identity
provider”
• Add dependancies correspondance between python pypi, debian and centos packages in
README
Changed
• Move coverage computation last in travis
• Enable logging to stderr then running tests
• Remember “warn me before…” using a cookie
• Put favicon (shortcut icon) URL in settings
Deprecated
• The auth class MysqlAuthUser is deprecated in favor of the SqlAuthUser class.
Fixed
• Use custom templatetags instead settings custom attributes to Boundfields (As it do not
work with django 1.7)
• Display an error message on bad response from identity provider in federate mode instead
of crashing. (e.g. Bad XML document)
• Catch base64 decode error on b64decode to raise our custom exception BadHash
• Add secret as sensitive variables/post parameter for /auth
• Only set “remember my provider” in federated mode upon successful authentication
• Since we drop django-boostrap3 dependancies, Django default minimal version is 1.7.1
• [cas.py] Append renew=true when validating tickets
Cleaned
• code factorization (cas.py, forms.py)
v0.6.1 - 2016-07-27
commit: b168e0a6423c53de31aae6c444fa1d1c5083afa6
Added
• Add sphinx docs + autodoc
• Add the possibility to run tests with “setup.py test”
• Include docs, Makefile, coverage config and tests config to source package
• Add serviceValidate ProxyTicket tests
• Add python 3.5 tox/travis tests
Changed
• Use https://badges.genua.fr for badges
Fixed
• Keep LoginTicket list upon fail authentication (It prevent the next login attemps to
fail because of bad LT)
Cleaned
• Compact federated mode migration
• Reformat default_settings.py for documentation using sphinx autodoc
• Factorize some code (from views.py to Ticket models class methods)
• Update urlpattern for django 1.10
• Drop dependancies django-picklefield and django-bootstrap3
v0.6.0 - 2016-07-06
commit: 4ad4d13baa4236c5cd72cc5216d7ff08dd361476
Added
• Add a section describing service patterns options to README.rst
• Add a federation mode: When the settings CAS_FEDERATE is True, django-cas-server will
offer to the user to choose its CAS backend to authenticate. Hence the login page do not
display anymore a username/password form but a select form with configured CASs backend.
This allow to give access to CAS supported applications to users from multiple
organization seamlessly.
It was originally developped to mach the need of https://ares.fr (Federated CAS at ‐
https://cas.ares.fr, example of an application using it as https://chat.myares.fr)
Fixed
• Then a ticket was marked as obtained with the user entering its credentials (aka not by
SSO), and the service did not require it, ticket validation was failing. Now, if the
service do not require authentication to be renewed, both ticket with renewed
authentication and non renewed authentication validate successfully.
v0.5.0 - 2016-07-01
commit: e3ab64271b718a17e4cbbbabda0a2453107a83df
Added
• Add more password scheme support to the mysql authentication backend: ldap user
attribute scheme encoding and simple password hash in hexa for md5, sha1, sha224,
sha256, sha384, sha512.
• Add a main heading to template “Central Authentication Service” with a logo controled by
CAS_LOGO_URL
• Add logos to the project (svg, png)
• Add coverage computation
• link project to codacy
• Update doc: add debian requirement, correct typos, correct links
Changed
• Use settings to set tests username password and attributes
• Tweak the css and html for small screens
• Update travis cache for faster build
• clean Makefile, use pip to install, add target for tests
Fixed
• Fix “warn me”: we generate the ticket after the user agree to be connected to the
service. we were generating first and the connect button was a link to the service url
with the ?ticket= this could lead to situation where the ticket validity expire if the
user is slow to click the connect button.
•
Fix authentication renewal: the renew parameter were not transmited when POST the login
request
and self.renew (aks for auth renewal) was use instead of self.renewed (auth was
renewd) when generating a ticket.
• Fix attribute value replacement when generating a ticket: we were using the ‘name’
attribute instead of the ‘attribut’ attribut on ReplaceAttributValue
• Fix attribute value replacement when generating a ticket then the value is a list:
iterate over each element of the list.
• Fix a NameError in utils.import_attr
• Fix serviceValidate and samlValidate when user_field is an attribute that is a list: we
use the first element of the list as username. we were serializing the list before that.
• Correct typos
Cleaned
• Clean some useless conditional branches found with coverage
• Clean cas.js: use compact object declararion
• Use six for python{2|3} compatibility
• Move all unit tests to cas_server.tests and use django primitive. We also have a 100%
tests coverage now. Using the django classes for tests, we do not need to use our own
dirty mock.
• Move mysql backend password check to a function in utils
v0.4.4 - 2016-04-30
commit: 77d1607b0beefe8b171adcd8e2dcd974e3cdc72a
Added
• Add sensitive_post_parameters and sensitive_variables for passwords, so passwords are
anonymised before django send an error report.
Fixed
• Before commit 77fc5b5 the User model had a foreign key to the Session model. After the
commit, Only the session_key is store, allowing to use different backend than the
Session SQL backend. So the first migration (which is 21 migrations combined) was
creating the User model with the foreign key, then delete it and add the field
session_key. Somehow, MySQL did not like it. Now the first migration directly create
the User model with the session_key and without the foreign key to the Session SQL
backend.
• Evaluate attributes variables in the template samlValidate.xml. the {{ }} was missing
causing the variable name to be displyed instead of the variable content.
• Return username in CAS 1.0 on the second ligne of the CAS response as specified.
Changed
• Update tests
v0.4.3 - 2016-03-18
commit: f6d436acb49f8d32b5457c316c18c4892accfd3b
Fixed
• Currently, one of our dependancy, django-boostrap3, do not support django 1.7 in its
last version. So there is some detection of the current django installed version in
setup.py to pin django-boostrap3 to a version supported by django 1.7 if django 1.7 is
installed, or to require at least django 1.8. The detection did not handle the case
where django was not installed.
• [PEP8] Put line breaks after binary operator and not before.
v0.4.2 - 2016-03-18
commit: d1cd17d6103281b03a8c57013671057eab80d21c
Added
• On logout, display the number of sessions we are logged out from.
Fixed
• One of our dependancy, django-boostrap3, do not support django 1.7 in its last version.
Some django version detection is added to setup.py to handle that.
• Some typos
• Make errors returned by utils.import_attr clearer (as they are likely to be displayed to
the django admin)
v0.4.1 - 2015-12-23
commit: 5e63f39f9b7c678a300ad2f8132166be34d1d35b
Added
• Add a run_test_server target to make file. Running make run_test_server will build a
virtualenv, create a django projet with django-cas-server and lauch ./management.py
runserver. It is quite handy to test developement version.
• Add verbose name for cas_server app and models
• Add Makefile clean targets for tox tests and test virtualenv.
• Add link on license badge to the GPLv3
Changed
• Make Makefile clean targets modular
• Use img.shields.io for PyPi badges
• Get django-cas-server version in Makefile directly from setup.py (so now, the version is
only written in one place)
Fixed
• Fix MysqlAuthUser when number of results != 1: In that case, call super anyway this the
provided username.
v0.4.0 - 2015-12-15
commit: 7b4fac575449e50c2caff07f5798dba7f4e4857c
Added
• Add a help_text to pattern of ServicePattern
• Add a timeout to SLO requests
• Add logging capabilities (see README.rst for instruction)
• Add management commands that should be called on a regular basis to README.rst
v0.3.5 - 2015-12-12
commit: 51fa0861f550723171e52d58025fa789dccb8cde
Added
• Add badges to README.rst
• Document settings parameter in README.rst
• Add a “Features” section in README.rst
Changed
• Add a AuthUser auth class and use it as auth classes base class instead of DummyAuthUser
Fixed
• Fix minor errors and typos in README.rst
v0.3.4 - 2015-12-12
commit: 9fbfe19c550b147e8d0377108cdac8231cf0fb27
Added
• Add static files, templates and locales to the PyPi release by adding them to
MANIFEST.in
• Add a Makefile with the build/install/clean/dist targets
v0.3.3 - 2015-12-12
commit: 16b700d0127abe33a1eabf5d5fe890aeb5167e5a
Added
• Add management commands and migrations to the package by adding there packages to
setup.py packages list.
v0.3.2 - 2015-12-12 [YANKED]
commit: eef9490885bf665a53349573ddb9cbe844319b3e
Added
• Add migrations to setup.py package_data
v0.3.1 - 2015-12-12
commit: d0f6ed9ea3a4b3e2bf715fd218c460892c32e39f
Added
• Add a forgotten migration (remove auto_now_add=True from the User model)
v0.3.0 - 2015-12-12
commit: b69769d71a99806a69e300eca0d7c6744a2b327e
Added
• Django 1.9 compatibility (add tox and travis tests and fix some decrecated)
v0.2.1 - 2015-12-12
commit: 90e077dedb991d651822e9bb283470de8bddd7dd
First github and PyPi release
Fixed
• Prune .tox in MANIFEST.in
• add dist/ to .gitignore
• typo in setup.cfg
v0.2.0 - 2015-12-12 [YANKED]
commit: a071ad46d7cd76fc97eb86f2f538d330457c6767
v0.1.0 - 2015-05-22 [YANKED]
commit: 6981433bdf8a406992ba0c5e844a47d06ccc08fb
• Index
AUTHOR
Valentin Samir
COPYRIGHT
2024, Valentin Samir