Hello <%=greeting%> (<%=uid%>)
The validation message contains:
<%=line0%> <%=line1%> <%=line2%> <%=line3%> <%=line4%>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - b. Here's a PHP script that counts the number of times a user visits the URL. The user's person info is also displayed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Welcome, !
Welcome back, !
We know this about you:
This is your time here.
">log off (no more single-signon)
Can't reuse service tickets!
Please ">login securely by clicking on the link.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - c. An alternative method of using the Web Login Service with PHP is available at: http://www.hawaii.edu/infotech/webservice/cas.html This is some information put together by DLUS for ITS hosted web sites and uses PHP's interface to the cURL library. d. Here's a JSP demo. It comes in two JSPs: cas-demo.jsp and the supporting cas-handler.jsp. You'll also need the Java CAS client jar which you can get from: http://www.ja-sig.org/products/cas/client/javaclient/index.html which has a link to casclient-2.1.1.jar. Install the casclient-2.1.1.jar file in your web app's WEB-INF/lib directory. Install the JSP files in your web app's main directory. Point your browser at cas-demo.jsp. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - <% // cas-demo.jsp - Demo of using the Web Login Service with JSPs // - 08/21/08, russ@hawaii.edu // - Copyright (c) University of Hawaii 2011 // All rights reserved. // - See the end of this file for the LICENSE %>Welcome!
Please login securely by clicking on the link.
<% } else { // logged in --> the inside protected page // show the number of times the user visited me Integer visits = (Integer) session.getAttribute("visits"); if (visits == null) { visits = new Integer(1); logIt("first visit"); } else { visits = new Integer(visits.intValue() + 1); logIt("bumped visits to " + visits); } session.setAttribute("visits", visits); %>Welcome, <%= netId %>
Number of visits = <%= visits.toString() %>
<% } // else { // logged in --> the inside protected page %><%= (new java.util.Date()).toLocaleString() %>
<% // University of Hawaii LICENSE //-------------------------------------------------------------------- // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions // are met: // // 1. Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright // notice, this list of conditions and the following disclaimer in // the documentation and/or other materials provided with the // distribution. // // 3. Redistributions of any form whatsoever must retain the following // acknowledgment: // "This product includes software developed by the University of // Hawaii (http://www.hawaii.edu/)." // // THIS SOFTWARE IS PROVIDED BY THE UNIVERSITY OF HAWAII "AS IS" AND ANY // EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR // PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE UNIVERSITY OF HAWAII // OR THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT // NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) // HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, // STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED // OF THE POSSIBILITY OF SUCH DAMAGE. //-------------------------------------------------------------------- %> <% // cas-handler.jsp - functions for using the CAS Client library to login // users via the Web Login Service. // - 08/21/08, russ@hawaii.edu // - Copyright (c) University of Hawaii 2008 // All rights reserved. // - See the end of this file for the LICENSE // //-------------------------------------------------------------------- // Usage: // 1. Include this file in your front page JSP. // 2. Set up these URLS: // a. Front page - the advertised to users and they bookmark. // b. Inside page - where the application does all the work. // c. Service URL - the URL-encode form of the inside page. // d. Web Login Service - the one that authenticates users; not us. // 3. Call the doWebLogin() method to get the netId (a.k.a., username) // of the user. The Web Login Service is the only one to handle // the user's credentials. We'll end with the netId if they // authenticate successfully with the Web Login Service. // // Example JSP code: // // String front = request.getRequestURL().toString(); // String inside = request.getRequestURL().toString(); // String service = URLEncoder.encode(insidePage); // String weblogin = "https://russ.mgt.hawaii.edu:8443/cas"; // // String netId = doWebLogin(request, response, weblogin, front, service); // //-------------------------------------------------------------------- %> <%@ page import="edu.yale.its.tp.cas.client.ServiceTicketValidator" %> <%@ page import="java.net.URLEncoder" %> <%@ page import="java.io.IOException" %> <%@ page import="org.xml.sax.SAXException" %> <%@ page import="javax.xml.parsers.ParserConfigurationException" %> <%! // A crude logging method - entry is sent to stderr. protected void logIt(String msg) { String ts = (new java.util.Date()).toLocaleString(); System.err.println(ts + " " + msg); } // Return a netId (a.k.a., username); null if not logged in or // can't validate the service ticket from the Web Login Service. protected String doWebLogin(HttpServletRequest req, HttpServletResponse res, String weblogin, String frontPage, String serviceURL) throws IOException, SAXException, ParserConfigurationException { String validateURL = weblogin + "/serviceValidate"; HttpSession sess = req.getSession(); String sessionId = sess.getId(); logIt("sessionId = " + sessionId); String netId = (String) sess.getAttribute("netId"); logIt("netId from session = " + netId); // if there's a service ticket, try to validate it String ticket = req.getParameter("ticket"); logIt("got a ticket: " + ticket); if (ticket != null) { ServiceTicketValidator validator = new ServiceTicketValidator(); validator.setCasValidateUrl(validateURL); validator.setService(serviceURL); validator.setServiceTicket(ticket); validator.validate(); logIt("validation returned: " + validator.getResponse()); if (validator.isAuthenticationSuccesful()) { netId = validator.getUser(); logIt("authN successful for " + netId); // remember the user's username sess.setAttribute("netId", netId); // redirect back to me to get rid of the ticket in URL logIt("redirecting back to " + frontPage); res.sendRedirect(frontPage); return null; } } return netId; } %> <% // University of Hawaii LICENSE //-------------------------------------------------------------------- // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions // are met: // // 1. Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright // notice, this list of conditions and the following disclaimer in // the documentation and/or other materials provided with the // distribution. // // 3. Redistributions of any form whatsoever must retain the following // acknowledgment: // "This product includes software developed by the University of // Hawaii (http://www.hawaii.edu/)." // // THIS SOFTWARE IS PROVIDED BY THE UNIVERSITY OF HAWAII "AS IS" AND ANY // EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR // PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE UNIVERSITY OF HAWAII // OR THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT // NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) // HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, // STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED // OF THE POSSIBILITY OF SUCH DAMAGE. //-------------------------------------------------------------------- %> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 10. FREQUENTLY ASKED QUESTIONS (FAQ) Q: Why does my site automatically login a returning user after they logout of their session with my site? A: The Web Login Service provides a single sign-on mechanism by default. This is a convenience for the user visiting sites that use the Web Login Service. If you want you make sure your users always authenticate themselves to the Web Login Service before entering your site, you need to add the renew parameter to your login redirect URL. Q: Is there a preferred method for logging out users? A: Which to use is a judgement call for Web apps. When in doubt, use the Logout URL. It will always force a user to re-authenticate to the Web Login Service. Not having single sign-on is not necessarily a bad thing. The general user finds it difficult to understand the security implications of the various shades (actually, only two) of logging out. If an app might be used from a kiosk (public use PC and browser) it is safer to set things up to logout completely using the Logout URL. A future enhancement could make single sign-on an option for the user so the default will be no single sign-on. If the user chooses to enable single sign-on when authenticating to the Web Login Service, only those apps that don't use the renew parameter will permit single sign-on if the user doesn't logout via the Logout URL from a previously visited app. Q: Can anyone use my Web site? A: Anyone that is in the UH Core LDAP Directory Service. In other words, current people in the UH System (ten campuses, system offices, some RCUH employees) and visitors (temporary guest accounts) managed by VIA (www.hawaii.edu/via/). See section 8 above. 11. RESOURCES a. If you have questions, contact the ITS IAM Group at its-iam-help@lists.hawaii.edu. Be sure to provide details. Assistance is only provided to the UH community. b. Yale University's Central Authentication Service (CAS) URL: http://www.yale.edu/tp/cas/ NOTE: DO NOT contact Yale University's about Technology and Planning department about this installation as the CAS software has been modified for UH-specific requirements. More recently, CAS became a part of JA-SIG. URL: http://www.ja-sig.org/products/cas/ ---------------------------------------------------------------------- vim:ai expandtab tw=72