Skip to content
This repository

CAS authentication support for Devise

Releasing 1.3.6

latest commit 091ad5e523
Nat Budin authored
Octocat-spinner-32 app ALWAYS redirect back to CAS server in the event a user attemps to tar… January 30, 2014
Octocat-spinner-32 lib Fixing the Single Sign Out with Rails 4 and activerecord-session_store February 05, 2014
Octocat-spinner-32 rails Initial checkin. May 04, 2010
Octocat-spinner-32 spec ALWAYS redirect back to CAS server in the event a user attemps to tar… January 30, 2014
Octocat-spinner-32 .gitignore Don't check in Gemfile.lock January 23, 2013
Octocat-spinner-32 .project Initial checkin. May 04, 2010
Octocat-spinner-32 .travis.yml Dropping Ruby 1.8, adding Devise 3.0/Rails 4.0 August 16, 2013
Octocat-spinner-32 CHANGELOG.md Releasing 1.3.6 February 05, 2014
Octocat-spinner-32 Gemfile Get rid of old gemfile, symlink to latest devise one January 23, 2013
Octocat-spinner-32 Gemfile.devise12 Test with lots of Devises November 06, 2012
Octocat-spinner-32 Gemfile.devise13 Test with lots of Devises November 06, 2012
Octocat-spinner-32 Gemfile.devise14 Test with lots of Devises November 06, 2012
Octocat-spinner-32 Gemfile.devise15 Test with lots of Devises November 06, 2012
Octocat-spinner-32 Gemfile.devise20 Test with lots of Devises November 06, 2012
Octocat-spinner-32 Gemfile.devise21 ALWAYS redirect back to CAS server in the event a user attemps to tar… January 30, 2014
Octocat-spinner-32 Gemfile.devise30 Rails 4 needs activerecord-session_store gem to work with this test s… August 16, 2013
Octocat-spinner-32 LICENSE Add MIT license (closes #50) July 20, 2012
Octocat-spinner-32 README.md Fixing the Single Sign Out with Rails 4 and activerecord-session_store February 05, 2014
Octocat-spinner-32 Rakefile Get rdoc out of the rakefile, it's causing compatibility issues. May 08, 2013
Octocat-spinner-32 devise_cas_authenticatable.gemspec Releasing 1.3.6 February 05, 2014
README.md

devise_cas_authenticatable Build Status

Written by Nat Budin
Taking a lot of inspiration from devise_ldap_authenticatable

devise_cas_authenticatable is CAS single sign-on support for Devise applications. It acts as a replacement for database_authenticatable. It builds on rubycas-client and should support just about any conformant CAS server (although I have personally tested it using rubycas-server).

Requirements

  • Rails 2.3 or greater (works with 3.x versions as well)
  • Devise 1.0 or greater
  • rubycas-client

Installation

gem install --pre devise_cas_authenticatable

and in your config/environment.rb (on Rails 2.3):

config.gem 'devise', :version => '~> 1.0.6'
config.gem 'devise_cas_authenticatable'

or Gemfile (Rails 3.x):

gem 'devise'
gem 'devise_cas_authenticatable'

Setup

Once devise_cas_authenticatable is installed, add the following to your user model:

devise :cas_authenticatable

You can also add other modules such as token_authenticatable, trackable, etc. Please do not add database_authenticatable as this module is intended to replace it.

You'll also need to set up the database schema for this:

create_table :users do |t|
  t.string :username, :null => false
end

We also recommend putting a unique index on the username column:

add_index :users, :username, :unique => true

(Note: previously, devise_cas_authenticatable recommended using a t.cas_authenticatable method call to update the schema. Devise 2.0 has deprecated this type of schema building method, so we now recommend just adding the username string column as above. As of this writing, t.cas_authenticatable still works, but throws a deprecation warning in Devise 2.0.)

Finally, you'll need to add some configuration to your config/initializers/devise.rb in order to tell your app how to talk to your CAS server:

Devise.setup do |config|
  ...
  config.cas_base_url = "https://cas.myorganization.com"

  # you can override these if you need to, but cas_base_url is usually enough
  # config.cas_login_url = "https://cas.myorganization.com/login"
  # config.cas_logout_url = "https://cas.myorganization.com/logout"
  # config.cas_validate_url = "https://cas.myorganization.com/serviceValidate"

  # The CAS specification allows for the passing of a follow URL to be displayed when
  # a user logs out on the CAS server. RubyCAS-Server also supports redirecting to a
  # URL via the destination param. Set either of these urls and specify either nil,
  # 'destination' or 'follow' as the logout_url_param. If the urls are blank but
  # logout_url_param is set, a default will be detected for the service.
  # config.cas_destination_url = 'https://cas.myorganization.com'
  # config.cas_follow_url = 'https://cas.myorganization.com'
  # config.cas_logout_url_param = nil

  # You can specify the name of the destination argument with the following option.
  # e.g. the following option will change it from 'destination' to 'url'
  # config.cas_destination_logout_param_name = 'url'

  # By default, devise_cas_authenticatable will create users.  If you would rather
  # require user records to already exist locally before they can authenticate via
  # CAS, uncomment the following line.
  # config.cas_create_user = false

  # You can enable Single Sign Out, which by default is disabled.
  # config.cas_enable_single_sign_out = true

  # If you want to use the Devise Timeoutable module with single sign out, 
  # uncommenting this will redirect timeouts to the logout url, so that the CAS can
  # take care of signing out the other serviced applocations. Note that each
  # application manages timeouts independently, so one application timing out will 
  # kill the session on all applications serviced by the CAS.
  # config.warden do |manager|
  #   manager.failure_app = DeviseCasAuthenticatable::SingleSignOut::WardenFailureApp
  # end
end

Extra attributes

If your CAS server passes along extra attributes you'd like to save in your user records, using the CAS extra_attributes parameter, you can define a method in your user model called cas_extra_attributes= to accept these. For example:

class User < ActiveRecord::Base
  devise :cas_authenticatable

  def cas_extra_attributes=(extra_attributes)
    extra_attributes.each do |name, value|
      case name.to_sym
      when :fullname
        self.fullname = value
      when :email
        self.email = value
      end
    end
  end
end

See also

TODO

  • Test on non-ActiveRecord ORMs

License

devise_cas_authenticatable is released under the terms and conditions of the MIT license. See the LICENSE file for more information.

Something went wrong with that request. Please try again.