Question

我目前正在尝试让PHP登录并使用CAS单点登录服务器进行身份验证，这很难实现。

官方网站有一些基本的source code here，它应该处理身份验证并登录用户。据我所知，在我的测试中，它完成了流程中的步骤1和2（基本流程的see this diagram）。登录测试服务器后，我可以完成步骤3并从发送回我页面的URL中检索服务票证。似乎没有任何例子可以完成该过程的第4步和第5步。我需要编写自己的代码来做到这一点是否正确？

我试图将故障单拿回来，然后使用我自己的代码使用cURL或fsockopen将其发送到验证服务，但没有运气。

if (isset($_GET['ticket']))
{
    $currentProtocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') ? 'https://' : 'http://';
    $requestUri = explode('?', $_SERVER['REQUEST_URI']);
    $requestUri = $requestUri[0];
    $ticket = $_GET['ticket'];
    $port = ($_SERVER['SERVER_PORT'] != 80) ? ':8080' : '';
    $currentUrl = urlencode($currentProtocol . $_SERVER['SERVER_NAME'] . $port . $requestUri);
    $validateUrl = 'ssl://server.com/cas/serviceValidate?service=' . $currentUrl . '&ticket=' . $ticket;

    $errno = 0;
    $errstr = '';   
    $fp = fsockopen($validateUrl, 443, $errno, $errstr, 30);

    if (!$fp) {
        echo "$errstr ($errno)<br />\n";
    }
    else {
        var_dump($fp);

        $out = "GET / HTTP/1.1\r\n";
        $out .= "Host: www.example.com\r\n";
        $out .= "Connection: Close\r\n\r\n";
        fwrite($fp, $out);
        while (!feof($fp)) {
            echo fgets($fp, 128);
        }
        fclose($fp);
    }
}

如果我直接通过浏览器访问它，我可以从该服务获得合法的响应，例如：

https://server.com/cas/serviceValidate?service=http%3A%2F%2Flocalhost%3A8080%2Ftestcas%2Fcas-client.php&ticket=ST-35717-XLiWQ2ucCCuks2wsVNMJ-cas

返回包含Active Directory用户ID的XML响应：

<cas:serviceResponse xmlns:cas='http://www.server.com/cas'>
    <cas:authenticationSuccess>
        <cas:user>c314317</cas:user>
    </cas:authenticationSuccess>
</cas:serviceResponse>

但我真的认为我需要能够使用PHP直接从服务器端访问该URL，然后一旦我拥有了用户ID，我就可以将其链接到我们的系统并将其登录到站点中。

我的问题是似乎没有任何代码来处理故障单和验证方面的事情。有人能指出我正确的方向吗？

非常感谢。

Answer 1

好吧我想我用cURL解决了这个问题。我没有将CURLOPT_SSL_VERIFYPEER设置为false，这就是它失败的原因。我现在可以使用PHP获取XML响应，处理XML响应并检索用户ID。这是代码：

// Get the current server address we are executing the PHP from
$currentProtocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') ? 'https://' : 'http://';
$requestUri = explode('?', $_SERVER['REQUEST_URI']);
$requestUri = $requestUri[0];
$ticket = $_GET['ticket'];
$port = ($_SERVER['SERVER_PORT'] != 80) ? ':' . $_SERVER['SERVER_PORT'] : '';   # Don't need the port if it's 80, but needed if for example test server is running port 8080 
$currentUrl = $currentProtocol . $_SERVER['SERVER_NAME'] . $port . $requestUri;

// Setup the validation URL
$validateUrl = 'https://sso.server.com/cas/serviceValidate?service=' . strtolower(urlencode($currentUrl)) . '&ticket=' . $ticket;

// Send request to validate the URL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $validateUrl);        # The URL to get the data from
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);     # Return the value of curl_exec() instead of outputting it out directly.
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 120);      # The number of seconds to wait while trying to connect
curl_setopt($ch, CURLOPT_TIMEOUT, 120);             # The maximum number of seconds to allow cURL functions to execute
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);        # Check the existence of a common name and also verify that it matches the hostname provided
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);    # Stop cURL from verifying the peer's certificate
curl_setopt($ch, CURLOPT_HEADER, false);            # Don't include the header in the output

// Execute the request and close the handle
$xml = curl_exec($ch);
curl_close($ch);

// Get the user ID from the XML using XPath
$xml = new SimpleXMLElement($xml);
$result = $xml->xpath('cas:authenticationSuccess/cas:user');
$userId = null;

while(list( , $node) = each($result))
{
    $userId = (string) $node;
}

echo 'user: ' . $userId . "<br>";

使用PHP进行CAS身份验证的困难

1 个答案: