Sso Auth Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation Add the bundle to your composer.json:

   composer require berduj/sso-auth-bundle
   

   Enable it in config/bundles.php:

   return [
       // ...
       Berduj\SsoAuthBundle\BerdujSsoAuthBundle::class => ['all' => true],
   ];
   

2. Configuration Update config/packages/berduj_sso_auth.yaml (or create it):

   berduj_sso_auth:
       trusted:
           cas:
               server_url: "https://your-cas-server.example.com/cas"
               service_url: "https://your-app.example.com/login/cas"
               validate_url: "https://your-cas-server.example.com/cas/serviceValidate"
   

3. First Use Case: CAS Login Add a route to trigger CAS authentication in config/routes.yaml:

   berduj_sso_auth_cas_login:
       path: /login/cas
       controller: Berduj\SsoAuthBundle\Controller\CasController::login
   

   Redirect users to /login/cas to initiate SSO.

Implementation Patterns

Workflows

1. Trusted CAS Authentication

   • User Flow:
     1. User visits /login/cas.
     2. Bundle redirects to CAS server for login.
     3. CAS redirects back to service_url with a ticket.
     4. Bundle validates the ticket via validate_url and creates a Symfony User object.
   • Customization: Override Berduj\SsoAuthBundle\Security\CasUserProvider to map CAS attributes to your User entity.

2. Open SSO (Future) Extend the bundle by implementing Berduj\SsoAuthBundle\Provider\OpenSsoProviderInterface for protocols like OpenID.

3. Security Integration Configure Symfony’s security firewall in config/packages/security.yaml:

   firewalls:
       main:
           form_login:
               provider: your_user_provider
           cas:
               provider: berduj_sso_auth.cas_user_provider
               login_path: /login/cas
               check_path: /login/cas/check
   

Integration Tips

• User Entity Mapping: Use Doctrine listeners or the CasUserProvider to hydrate your User entity from CAS attributes:

  // src/EventListener/CasUserListener.php
  public function loadUserByCasAttributes(array $attributes)
  {
      return UserRepository::findOneBy(['email' => $attributes['email']]);
  }
  

  Register the listener in services.yaml:

  services:
      App\EventListener\CasUserListener:
          tags:
              - { name: kernel.event_listener, event: berduj_sso_auth.cas_user_load, method: loadUserByCasAttributes }
  

• Attribute Handling: Extract custom attributes from CAS responses using CasAuthenticationHandler:

  $attributes = $event->getAuthenticationToken()->getCredentials();
  $user->setFirstName($attributes['givenName'] ?? null);
  

Gotchas and Tips

Pitfalls

1. CORS/Redirect Issues:

   • Ensure service_url in config matches the exact callback URL registered with your CAS server.
   • Debug redirect loops by checking browser dev tools (Network tab) for malformed URLs.

2. User Provider Mismatch:

   • If users aren’t persisted, verify CasUserProvider is correctly wired to your User entity.
   • Clear cache (php bin/console cache:clear) after changing provider configurations.

3. Deprecated Symfony2:

   • The bundle targets Symfony 2/3/4 but lacks modern features (e.g., Symfony Flex support).
   • Test thoroughly in your target Symfony version (e.g., 4.x may need adjustments).

4. Attribute Parsing:

   • CAS responses may return nested arrays. Use json_decode($attributes, true) if attributes are JSON-encoded.

Debugging

• Enable Debug Mode: Set APP_DEBUG=1 in .env to log CAS validation errors in var/log/dev.log.
• Validate Ticket Manually: Test the validate_url endpoint directly with a ticket:

  curl "https://your-cas-server.example.com/cas/serviceValidate?ticket=TGT-123&service=https://your-app.example.com/login/cas"
  

  Expected response: XML with <authenticationSuccess> or <authenticationFailure>.

Extension Points

1. Custom Providers: Implement Berduj\SsoAuthBundle\Provider\SsoProviderInterface for unsupported protocols (e.g., SAML):

   class SamlProvider implements SsoProviderInterface {
       public function authenticate(array $attributes) { ... }
   }
   

   Register in services.yaml:

   services:
       App\Provider\SamlProvider:
           tags:
               - { name: berduj_sso_auth.provider, alias: saml }
   

2. Event Dispatching: Listen for berduj_sso_auth.cas_authenticated to post-process authenticated users:

   services:
       App\EventListener\PostAuthListener:
           tags:
               - { name: kernel.event_listener, event: berduj_sso_auth.cas_authenticated, method: onCasAuth }
   

3. Configuration Overrides: Dynamically override CAS URLs via dependency injection:

   // config/services.yaml
   Berduj\SsoAuthBundle\Security\CasUserProvider:
       arguments:
           $casServerUrl: '%env(CAS_SERVER_URL)%'