rubycas/rubycas-server — Issue #70: Rubycas-Server doesn't have a list of allowed services
Author: brodock
Created: 2011-11-10 22:01:48+00:00
State: open

I was reading the documentation on JaSIG implementation, and saw that they enabled service registration to control what service (websites) are allowed to authenticate with their CAS server.

This is a major security concern if you pass any personal information as an extra attribute, for example. This would let any other website use your own cas server to authenticate there and steel sensitive information.

For reference, this is the documentation: https://wiki.jasig.org/display/CASUM/Adding+a+New+Service

So i propose to create a new configuration option on config.yml to list allowed services, like the example bellow:

trusted_services_only: true # enable this feature
trusted_services:
- http://mywebsite.com/*
- https://mysecurewebsite.com/subsite/*
...

The idea is to accept some sort of wildmark or instead use standard ruby regexp patterns:

trusted_services_only: true # enable this feature
trusted_services:
- http://(www).mywebsite.com/.*
- https://mysecurewebsite.com/subsite/.*