CAS Login

auth.php

<?php

/* 
By Robert Moore
[email protected]
http://www.github.com/bobby5892
5/1/2018

Request Looks Like
POST /cas/v1/tickets HTTP/1.0

username=battags&password=password&additionalParam1=paramvalue

Response Looks Like
201 Created
Location: http://www.whatever.com/cas/v1/tickets/{TGT id}

https://cas.lanecc.edu/cas/v1/tickets/ST-270968-nHodQOnWLxaiIepYrIec-ds-prod-cas-01.lanecc.edu

Code	Result
200	Successful authentication. 
403	Produces a AccountDisabledException
404	Produces a AccountNotFoundException
423	Produces a AccountLockedException
412	Produces a AccountExpiredException
428	Produces a AccountPasswordMustChangeException
Other	Produces a FailedLoginException

Full Documentation @
https://apereo.github.io/cas/5.2.x/protocol/REST-Protocol.html

// This uses the REST API as documented above - to submit a username and password
to the CAS server and get a toke back

function getCasToken($username,$password)
		This will return a token if valid login
		Otherwise it returns false


function verifyCasToken()
		This returns a true / false
		This Look s for $_SESSION['CASTOKEN']
*/


// Debug Mode
function verifyCasToken(){
	
	$settings["debug"] = false;

	$url = 'https://cas.lanecc.edu/cas/v1/tickets/' + $_SESSION['CASTOKEN'];

	// what post fields?

	// build the urlencoded data
	$postvars = http_build_query($fields);

	// open connection
	$ch = curl_init();

	// set the url, number of POST vars, POST data
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_POST, count($fields));
	// This mutes header output
	curl_setopt($ch, CURLOPT_RETURNTRANSFER , 1);

	// This disables 301 redirects
	curl_setopt($ch, CURLOPT_AUTOREFERER, false);
	// Exclude the body from the output
	curl_setopt($ch, CURLOPT_NOBODY, false);

	// This does a POST style Request
	curl_setopt($ch, CURLOPT_POSTFIELDS, $postvars);
	if($settings["debug"]){
			curl_setopt($ch, CURLOPT_VERBOSE, 1);
	}
	// This enables the capture of HTTP Request/Response Headers
	curl_setopt($ch, CURLOPT_HEADER, 1);

	// This sets the user agent as Firefox (5.0)
	curl_setopt($ch, CURLOPT_USERAGENT,'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13');

	// execute post
	$response = curl_exec($ch);
	$http_status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
	$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
	$header = substr($response, 0, $header_size);
	$body = substr($response, $header_size);
	// close connection
	curl_close($ch);

	if($settings["debug"]){
			print_r($http_status);
			print_r($header);
			print_r($body);
	}
	if($http_status == 200){
		// We are good - the ticket is still valid
		return true;
	}
	else{
		// Log them out - they are no longer valid
		return false;
	}
}
function getCasToken($username,$password){

	$settings["debug"] = false;

	$url = 'https://cas.lanecc.edu/cas/v1/tickets';
	
	// what post fields?
	$fields = array(
	   'username' => $username,
	   'password' => $password
	);

	// build the urlencoded data
	$postvars = http_build_query($fields);

	// open connection
	$ch = curl_init();

	// set the url, number of POST vars, POST data
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_POST, count($fields));
	// This mutes header output
	curl_setopt($ch, CURLOPT_RETURNTRANSFER , 1);

	// This disables 301 redirects
	curl_setopt($ch, CURLOPT_AUTOREFERER, false);
	// Exclude the body from the output
	curl_setopt($ch, CURLOPT_NOBODY, false);

	// This does a POST style Request
	curl_setopt($ch, CURLOPT_POSTFIELDS, $postvars);
	if($settings["debug"]){
			curl_setopt($ch, CURLOPT_VERBOSE, 1);
	}
	// This enables the capture of HTTP Request/Response Headers
	curl_setopt($ch, CURLOPT_HEADER, 1);

	// This sets the user agent as Firefox (5.0)
	curl_setopt($ch, CURLOPT_USERAGENT,'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13');

	// execute post
	$response = curl_exec($ch);
	$http_status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
	$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
	$header = substr($response, 0, $header_size);
	$body = substr($response, $header_size);
	// close connection
	curl_close($ch);


	if($settings["debug"]){
			print_r($http_status);
			print_r($header);
			print_r($body);
	}
	if($http_status == 200){
		// We are good - the validation passed
		// This needs coded in production - to look at the HTTP BODY and see what CAS gives back
		return true;
	}
	else{
		// Failed Login
		return false;
	}
}