Adding in support for passive CAS authentication. (ie: if you are already...

Adding in support for passive CAS authentication.  (ie: if you are already logged into CAS when you first visit this site, you will automatically be logged in.)

application/modules/auth/controllers/IndexController.php

@@ -21,7 +21,7 @@ class Auth_IndexController extends App_Controller_Action {
 		$session = new Zend_Session_Namespace(__CLASS__);
 		$baseUrl = Zend_Controller_Front::getInstance()->getBaseUrl();
 		try {
-		$referer = Zend_Uri_Http::factory($_SERVER['HTTP_REFERER']);
+            $referer = Zend_Uri_Http::factory($_SERVER['HTTP_REFERER']);
 		} catch (Exception $e) {
 		}
 		if ($referer && 
@@ -39,35 +39,20 @@ class Auth_IndexController extends App_Controller_Action {
 			$session->referer = '/';
 		}
 		
-        $this->_redirect('/auth/index/validate');
-        return;
+		$this->_redirect($this->_getCasAdapter()->getLoginUrl());
 	}
 	
 	public function logoutAction()
 	{
 		Zend_Auth::getInstance()->clearIdentity();
-		$this->_redirect('/');
+		$this->_getCasAdapter()->clearIdentity();
+		$this->_redirect($this->_getCasAdapter()->getLogoutUrl());
 	}
 	
 	public function validateAction()
 	{
-		$username = $this->getRequest()->getParam('username');
-		$password = $this->getRequest()->getParam('password');
-		
 		$auth = Unl_Auth::getInstance();
-		
-		//$ldap = new Unl_Ldap('ldap://localhost:10389');
-		//$ldapAdapter = new Unl_Auth_Adapter_Ldap($ldap, $username, $password);
-		//$auth->pushAdapter($ldapAdapter);
-		
-		if ($_SERVER['HTTPS'] == 'on') {
-		    $serviceUrl = 'https://';
-		} else {
-		    $serviceUrl = 'http://';
-		}
-		$serviceUrl .= $_SERVER['SERVER_NAME'] . Zend_Controller_Front::getInstance()->getBaseUrl() . '/auth/index/validate';
-		$casAdapter = new Unl_Auth_Adapter_Cas($serviceUrl, 'https://login.unl.edu/cas', $this->_getParam('ticket'));
-		$auth->pushAdapter($casAdapter);
+		$auth->pushAdapter($this->_getCasAdapter());
 		
 		try {
 			$result = $auth->authenticate();
@@ -75,18 +60,11 @@ class Auth_IndexController extends App_Controller_Action {
 			//
 		}
 		
-		if (!$result || !$result->isValid()) {
-			$session = new Zend_Session_Namespace(__CLASS__);
-			$session->errorMessage = 'Login Failed';
-			// Don't redirect, CAS is already doing it.
-			//$this->_redirect('/auth/index');
-            $this->_disableLayoutAndView();
-			return;
-		}
-		
-		$user = Auth_UserModel::findCurrentUser();
-		if (!$user) {
-			$user = Auth_UserModel::fetchNewFromLdap($auth->getIdentity());
+		if ($result && $result->isValid()) {
+	        $user = Auth_UserModel::findCurrentUser();
+	        if (!$user) {
+	            $user = Auth_UserModel::fetchNewFromLdap($auth->getIdentity());
+	        }
 		}
 		
 		$session = new Zend_Session_Namespace(__CLASS__);
@@ -96,5 +74,20 @@ class Auth_IndexController extends App_Controller_Action {
         	$this->_redirect('/');
 		}
 	}
+	
+	/**
+	 * Sets up the CAS adapter and returns it.
+	 * @return Unl_Auth_Adapter_Cas
+	 */
+	protected function _getCasAdapter()
+	{		
+        if ($_SERVER['HTTPS'] == 'on') {
+            $serviceUrl = 'https://';
+        } else {
+            $serviceUrl = 'http://';
+        }
+        $serviceUrl .= $_SERVER['SERVER_NAME'] . Zend_Controller_Front::getInstance()->getBaseUrl() . '/auth/index/validate';
+        return new Unl_Auth_Adapter_Cas($serviceUrl, 'https://login.unl.edu/cas', $this->_getParam('ticket'));
+	}
 
 }

application/modules/default/views/scripts/layout.phtml

 <?php
 
+$baseUrl = Zend_Controller_Front::getInstance()->getBaseUrl();
+
 $staticBaseUrl = '';
 if ($_SERVER['HTTPS']) {
     $staticBaseUrl = 'https://';
@@ -7,7 +9,7 @@ if ($_SERVER['HTTPS']) {
     $staticBaseUrl = 'http://';
 }
 $staticBaseUrl .= $_SERVER['HTTP_HOST']
-                . Zend_Controller_Front::getInstance()->getBaseUrl();
+                . $baseUrl;
 
 $this->headLink()->appendStylesheet($this->baseUrl() . '/css/index.css', 'all');
 $this->headLink()->appendStylesheet($this->baseUrl() . '/css/print.css', 'print');
@@ -99,6 +101,8 @@ try {
 	pageTracker._initData();
     pageTracker._trackPageview();
 } catch(err) {}
+
+WDN.idm.setLogoutURL('$baseUrl/auth/index/logout');
 </script>
 EOF;
 

library/App/Controller/Action.php

 <?php
 
+/**
+ * A custom base controller class that takes care of setting up custom View Helpers.
+ */
+
 class App_Controller_Action extends Unl_Controller_Action
 {
     public function init()
-    {
+    {	
         parent::init();
         $this->view->addHelperPath(dirname(__FILE__) . '/../View/Helper', 'App_View_Helper');
         $this->view->doctype()->setDoctype(Zend_View_Helper_Doctype::XHTML1_TRANSITIONAL);
         // Zend_Controller_Action_HelperBroker::addPrefix('App_Controller_Helper');
+        
+        $this->_transparentCasLogin();
+    }
+    
+    protected function _transparentCasLogin()
+    {
+        $session = new Zend_Session_Namespace(__CLASS__);
+        
+    	// The auth module is doing its thing (probably an active login or logout). Let it be.
+    	if (get_class($this) == 'Auth_IndexController') {
+    		return;
+    	}
+    	
+    	// Only passively check for a login once per hour (per user)
+    	if ($session->lastCasCheck > time() - 60*60) {
+            return;
+    	}
+    	
+        $session->lastCasCheck = time();
+    	
+    	
+    	// Do a passive authentication check
+    	$redirectUri = $_SERVER['REQUEST_URI'];
+        $baseUrl = Zend_Controller_Front::getInstance()->getBaseUrl();
+        $redirectUri = substr($redirectUri, strlen($baseUrl));
+        
+        $authSession = new Zend_Session_Namespace('Auth_IndexController');
+        $authSession->referer = $redirectUri;
+        
+        
+        if ($_SERVER['HTTPS'] == 'on') {
+            $serviceUrl = 'https://';
+        } else {
+            $serviceUrl = 'http://';
+        }
+        $serviceUrl .= $_SERVER['SERVER_NAME'] . Zend_Controller_Front::getInstance()->getBaseUrl() . '/auth/index/validate';
+        
+        $casAdapter = new Unl_Auth_Adapter_Cas($serviceUrl, 'https://login.unl.edu/cas', $this->_getParam('ticket'));
+        $casAdapter->setGateway();
+        $this->_redirect($casAdapter->getLoginUrl());
     }
 }