How to integrate CAS into Webauction

[cinto_qq]

Hi,

Our company is using CAS as the authentication system. How can we integrate CAS with Webauction?


Cheers,
Cinto

[cinto_qq]

Hi,

We have managed to add CAS to webauction.

However, how can we change the authorization from Webauction database to our own database? Do we add the check of getting the role inside function getRoles(Dataface_Record $record); under ApplicationDelegateClass.php?


Cheers,
Cinto

[shannah]

CAS is really only meant for authentication (determining that someone is who they say they are). Authorization/Permissions should still be handled in web auction. I.e. you'll generally still manage the user accounts inside web auction. The only difference with CAS is that the webauction password won't be used because they'll be using there CAS login.

If you want to start storing permissions info or group info centrally you'll be looking at something separate from cas.... Essentially you need to create a way for web auction to communicate with your role management system. In reality I don't think it's realistic to have centralized permissions management for multiple distinct applications because many of the permissions will be specific to that application. It is possible to tap into a more general role policy that you store centrally and use this as a guideline when initializing the permissions for a particular application.... once again, outside the scope of CAS though.

-Steve

[cinto_qq]

Hi Steve,

Thanks for the explanation.

I have another question on CAS. We need users to login before they can see webauction. How can we modify webauction or CAS to achieve that?


Cheers,
Cinto

[shannah]

You can either use the Apache CAS module to disable access to the directory altogether. (This works using .htaccess files).
or
You can modify the getPermissions() method to disable anonymous access. E.g. in the application delegate class, change:

Code: Select all

function getPermissions(&$record){
      if ( isAdmin() ) return Dataface_PermissionsTool::ALL();
      return Dataface_PermissionsTool::READ_ONLY();
   
   }


to

Code: Select all

function getPermissions(&$record){
      if ( isAdmin() ) return Dataface_PermissionsTool::ALL();
      return Dataface_PermissionsTool::NO_ACCESS();
   
   }


-Steve

[cinto_qq]

Hi Steve,

Thanks! We are able to cas the whole webaucation.

I have modified the getPermissions method further to allow users to login. This is the code I used:

Code: Select all

function getPermissions(&$record){
      if ( isAdmin() )
                       return Dataface_PermissionsTool::ALL();      
      else if ( isUser() )
                       return Dataface_PermissionsTool::READ_ONLY();
      else
                       return Dataface_PermissionsTool::NO_ACCESS();
   
}


I have written the function isUser() to check if the login belongs to userRole.


Cheers,
Cinto