How thinkphp implements single sign-on

1. Prerequisite: CAS server construction is completed

This is not the focus of this article, so I won’t go into details. Portal: https://blog.csdn.net/u013825231/article/details/79132399

2. Download phpCAS client

php client download: https://github.com /apereo/phpCAS

php client configuration precautions and other content: https://apereo.atlassian.net/wiki/spaces/CASC/pages/103252517/phpCAS

php client Requirements: https://apereo.atlassian.net/wiki/spaces/CASC/pages/103252625/phpCAS requirements

Note: The php configuration file php.ini needs to enable php_curl, find;extension=php_curl.dll, Just remove the semicolon in front of the sentence and change it to extension=php_curl.dll

3. Thinkphp5 introduces the phpCAS class library

1. Download the phpCAS client file structure.

Related recommendations: "ThinkPHP Tutorial"

2. Copy the source folder to the extend folder under thinphp5, And rename it to: phpCAS

##3. Configuration of config.php file

<?php
 
// The purpose of this central config file is configuring all examples
// in one place with minimal work for your working environment
// Just configure all the items in this config according to your environment
// and rename the file to config.php
 
$phpcas_path = &#39;phpCAS/&#39;;
 
///////////////////////////////////////
// Basic Config of the phpCAS client //
///////////////////////////////////////
$client_domain = &#39;localhost&#39;; // 客户端 domain 
$client_path = &#39;afschool&#39;;
$client_secure = false;
$client_httpOnly = true;
$client_lifetime = 0;
 
// Full Hostname of your CAS Server 服务器主机
$cas_host = &#39;cas.example.com&#39;;
 
// Context of the CAS Server  
$cas_context = &#39;/cas&#39;;
 
// Port of your CAS server. Normally for a https server it&#39;s 443
$cas_port = 443;
 
// Path to the ca chain that issued the cas server certificate
$cas_server_ca_cert_path = &#39;/path/to/cachain.pem&#39;;
 
//////////////////////////////////////////
// Advanced Config for special purposes //
//////////////////////////////////////////
 
// The "real" hosts of clustered cas server that send SAML logout messages
// Assumes the cas server is load balanced across multiple hosts
$cas_real_hosts = array (
&#39;cas-real-1.example.com&#39;,
&#39;cas-real-2.example.com&#39;
);
 
// Database config for PGT Storage
$db = &#39;pgsql:host=localhost;dbname=phpcas&#39;;
//$db = &#39;mysql:host=localhost;dbname=phpcas&#39;;
$db_user = &#39;phpcasuser&#39;;
$db_password = &#39;mysupersecretpass&#39;;
$db_table = &#39;phpcastabel&#39;;
 
///////////////////////////////////////////
// End Configuration -- Don&#39;t edit below //
///////////////////////////////////////////
 
// Generating the URLS for the local cas example services for proxy testing
if ( isset($_SERVER[&#39;HTTPS&#39;]) && $_SERVER[&#39;HTTPS&#39;] == &#39;on&#39;){
$curbase = &#39;https://&#39;.$_SERVER[&#39;SERVER_NAME&#39;];
}else{
$curbase = &#39;http://&#39;.$_SERVER[&#39;SERVER_NAME&#39;];
}
if ($_SERVER[&#39;SERVER_PORT&#39;] != 80 && $_SERVER[&#39;SERVER_PORT&#39;] != 443)
$curbase .= &#39;:&#39;.$_SERVER[&#39;SERVER_PORT&#39;];
 
$curdir = dirname($_SERVER[&#39;REQUEST_URI&#39;])."/";
 
 
// CAS client nodes for rebroadcasting pgtIou/pgtId and logoutRequest
$rebroadcast_node_1 = &#39;http://cas-client-1.example.com&#39;;
$rebroadcast_node_2 = &#39;http://cas-client-2.example.com&#39;;
 
// access to a single service
$serviceUrl = $curbase.$curdir.&#39;example_service.php&#39;;
// access to a second service
$serviceUrl2 = $curbase.$curdir.&#39;example_service_that_proxies.php&#39;;
 
$pgtBase = preg_quote(preg_replace(&#39;/^http:/&#39;, &#39;https:&#39;, $curbase.$curdir),&#39;/&#39;);
$pgtUrlRegexp = &#39;/^&#39;.$pgtBase.&#39;.*$/&#39;;
 
$cas_url = &#39;https://&#39;.$cas_host;
if ($cas_port != &#39;443&#39;)
{
$cas_url = $cas_url.&#39;:&#39;.$cas_port;
}
$cas_url = $cas_url.$cas_context;
 
 
// Set the session-name to be unique to the current script so that the client script
// doesn&#39;t share its session with a proxied script.
// This is just useful when running the example code, but not normally.
session_name(&#39;session_for:&#39;.preg_replace(&#39;/[^a-z0-9-]/i&#39;, &#39;_&#39;, basename($_SERVER[&#39;SCRIPT_NAME&#39;])));
?>

4. Because the server I request single sign-on is http authenticated, not https, I need to modify CAS/client.php and change https to http (the client.php file was not modified at the beginning, and https authentication is always used. So the request failed)

5. Rename the sibling file CAS.php in the CAS class library folder to phpCAS.php

## and modify it to

6. The login controller method is:

<?php
namespace app\index\controller;
use think\Db;
use think\Loader;
 
class Index extends \think\Controller
{
    public function login()
    {
// Example for a simple client
        // Load the settings from the central config file
        require &#39;./extend/config.php&#39;;
        // Loader::import(&#39;config.php&#39;,EXTEND_PATH);
        // Load the CAS lib
        //直接引入phpCAS扩展库下的类文件phpCAS.php
        Loader::import(&#39;phpCAS\phpCAS&#39;,EXTEND_PATH);        
        //直接引入库文件需要实例化类
        $phpCAS = new \phpCAS();
        // Uncomment to enable debugging
        $phpCAS->setDebug();
        
        // Initialize phpCAS
        $phpCAS->client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
 
        // For quick testing you can disable SSL validation of the CAS server. 
        // THIS SETTING IS NOT RECOMMENDED FOR PRODUCTION. 
        // VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS PROTOCOL! 
        $phpCAS->setNoCasServerValidation();
 
        //这里会检测服务器端的退出的通知，就能实现php和其他语言平台间同步登出了
        $phpCAS->handleLogoutRequests();
 
        //访问CAS的验证通过后，跳转到网页
        if($phpCAS->forceAuthentication()){ 
 
        echo "<script language=\"javascript\">parent.location.href=&#39;http://www.baidu.com&#39;;</script>";
 
        };
        
     }
}

Finally access this login method to complete the single sign-on page jump!

The above is the detailed content of How thinkphp implements single sign-on. For more information, please follow other related articles on the PHP Chinese website!