Ñò
ô†³Kc @ sà d Z d d k Z d d k l Z d d k l Z l Z d e f d „ ƒ YZ d e f d „ ƒ YZ d „ Z e Z
d d d
g Z d e j oM d Z
d d
k l Z d d k l Z d d k Te e e e e
ƒ ƒ ƒ n d S( ss
CAS 1.0 Authentication
The Central Authentication System is a straight-forward single sign-on
mechanism developed by Yale University's ITS department. It has since
enjoyed widespread success and is deployed at many major universities
and some corporations.
https://clearinghouse.ja-sig.org/wiki/display/CAS/Home
http://www.yale.edu/tp/auth/usingcasatyale.html
This implementation has the goal of maintaining current path arguments
passed to the system so that it can be used as middleware at any stage
of processing. It has the secondary goal of allowing for other
authentication methods to be used concurrently.
iÿÿÿÿN( t
construct_url( t HTTPSeeOthert
HTTPForbiddent CASLoginFailurec B s e Z d Z RS( s4 The exception raised if the authority returns 'no' ( t __name__t
__module__t __doc__( ( ( s2 /usr/lib/python2.6/site-packages/paste/auth/cas.pyR s t CASAuthenticatec B s e Z d Z RS( s/ The exception raised to authenticate the user ( R R R ( ( ( s2 /usr/lib/python2.6/site-packages/paste/auth/cas.pyR s c s= ˆ i d ƒ o ˆ i d ƒ p t ‚ ‡ ‡ f d † } | S( s8
middleware to implement CAS 1.0 authentication
There are several possible outcomes:
0. If the REMOTE_USER environment variable is already populated;
then this middleware is a no-op, and the request is passed along
to the application.
1. If a query argument 'ticket' is found, then an attempt to
validate said ticket /w the authentication service done. If the
ticket is not validated; an 403 'Forbidden' exception is raised.
Otherwise, the REMOTE_USER variable is set with the NetID that
was validated and AUTH_TYPE is set to "cas".
2. Otherwise, a 303 'See Other' is returned to the client directing
them to login using the CAS service. After logon, the service
will send them back to this same URL, only with a 'ticket' query
argument.
Parameters:
``authority``
This is a fully-qualified URL to a CAS 1.0 service. The URL
should end with a '/' and have the 'login' and 'validate'
sub-paths as described in the CAS 1.0 documentation.
t /t httpc sq | i d d ƒ } | o ˆ | | ƒ S| i d d ƒ i d ƒ } | oÜ | d i d ƒ oÈ | i ƒ i d d ƒ d } d i | ƒ | d s,
( t endswithR t AssertionError( R' R( R) ( ( R' R( s2 /usr/lib/python2.6/site-packages/paste/auth/cas.pyt AuthCASHandler s 'R, t __main__s( https://secure.its.yale.edu/cas/servlet/( t dump_environ( t serve( t *( R R t
paste.requestR t paste.httpexceptionsR R R R R, t
middlewaret __all__R R( t
paste.wsgilibR. t paste.httpserverR/ t HTTPExceptionHandler( ( ( s2 /usr/lib/python2.6/site-packages/paste/auth/cas.pyt s :