phpCAS/api/example__hardening_8php_source.html

 <?php

 // Load the settings from the central config file
 require_once 'config.php';
 // Load the CAS lib
 require_once $phpcas_path . '/CAS.php';

 // Enable debugging
 phpCAS::setLogger();
 // Enable verbose error messages. Disable in production!
 phpCAS::setVerbose(false);

 // Harden session cookie to prevent some attacks on the cookie (e.g. XSS)
 session_set_cookie_params($client_lifetime, $client_path, $client_domain, $client_secure, $client_httpOnly);

 // Initialize phpCAS
 phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);

 // For production use set the CA certificate that is the issuer of the cert
 // on the CAS server and uncomment the line below
 phpCAS::setCasServerCACert($cas_server_ca_cert_path);

 // For quick testing you can disable SSL validation of the CAS server.
 // THIS SETTING IS NOT RECOMMENDED FOR PRODUCTION.
 // VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS PROTOCOL!
 // phpCAS::setNoCasServerValidation();

 // Handle SAML logout requests that emanate from the CAS host exclusively.
 // Failure to restrict SAML logout requests to authorized hosts could
 // allow denial of service attacks where at the least the server is
 // tied up parsing bogus XML messages.
 phpCAS::handleLogoutRequests(true, $cas_real_hosts);

 // Force CAS authentication on any page that includes this file
 phpCAS::forceAuthentication();

 // Some small code triggered by the logout button
 if (isset($_REQUEST['logout'])) {
     phpCAS::logout();
 }
 ?>
 <html>
   <head>
     <title>Advanced SAML 1.1 example</title>
   </head>
   <body>
 <h2>Advanced SAML 1.1 example</h2>
 <?php require 'script_info.php' ?>

 Authentication succeeded for user
 <strong><?php echo phpCAS::getUser(); ?></strong>.

 <h3>User Attributes</h3>
 <ul>
 <?php
 foreach (phpCAS::getAttributes() as $key => $value) {
     if (is_array($value)) {
         echo '<li>', $key, ':<ol>';
         foreach ($value as $item) {
             echo '<li><strong>', $item, '</strong></li>';
         }
         echo '</ol></li>';
     } else {
         echo '<li>', $key, ': <strong>', $value, '</strong></li>' . PHP_EOL;
     }
 }
     ?>
 </ul>
 <p><a href="?logout=">Logout</a></p>
 </body>
 </html>
$client_domain
$client_domain
Definition: config.example.php:47

$client_path
$client_path
Definition: config.example.php:48

phpCAS\forceAuthentication
static forceAuthentication()
Definition: CAS.php:1146

phpCAS\getUser
static getUser()
Definition: CAS.php:1227

SAML_VERSION_1_1
const SAML_VERSION_1_1
Definition: CAS.php:91

$client_httpOnly
$client_httpOnly
Definition: config.example.php:50

phpCAS\handleLogoutRequests
static handleLogoutRequests($check_client=true, $allowed_clients=array())
Definition: CAS.php:1324

$cas_server_ca_cert_path
$cas_server_ca_cert_path
Definition: config.example.php:36

$cas_real_hosts
$cas_real_hosts
Definition: config.example.php:44

phpCAS\getAttributes
static getAttributes()
Definition: CAS.php:1246

$client_secure
$client_secure
Definition: config.example.php:49

phpCAS\client
static client($server_version, $server_hostname, $server_port, $server_uri, $changeSessionID=true, \SessionHandlerInterface $sessionHandler=null)
Definition: CAS.php:345

$phpcas_path
$phpcas_path
Definition: config.example.php:20

phpCAS\setLogger
static setLogger($logger=null)
Definition: CAS.php:448

$client_lifetime
$client_lifetime
Definition: config.example.php:51

phpCAS\logout
static logout($params="")
Definition: CAS.php:1480

phpCAS\setCasServerCACert
static setCasServerCACert($cert, $validate_cn=true)
Definition: CAS.php:1670

phpCAS\setVerbose
static setVerbose($verbose)
Definition: CAS.php:512

$cas_host
$cas_host
Definition: config.example.php:27

$cas_context
$cas_context
Definition: config.example.php:30

$cas_port
$cas_port
Definition: config.example.php:33