Jasig/phpCAS — Issue #19: Proxy requires a seperate URL for the pgtUrl
Author: ravids
Created: 2012-01-12 16:59:14+00:00
State: open

We tried to use the following method in CAS-1.2.2 as well in the commit number in the latest github code (commit number : SHA: ec3e9358aec7679c8ab49b9f1e7a9505cebb99fb)

``` phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context)
```
In this case, we had the above code in ```client.example.com/proxy.php``` and the CAS server is ```cas.example.com```. By default phpCAS constructs ```client.example.com/proxy.php``` as the pgtUrl. The process failed when the CAS server tried to validate the pgtUrl.

We finally got it working by giving a different pgtUrl, ```client.example.com/proxycallback.php```, and using the ```phpCAS::setFixedCallbackURL``` method.

We also debugged why phpCAS default behavior does not work. Following is the apache log extract from the server that is serving ```client.example.com```, with the working solution using a different pgtUrl.

```
192.168.1.21 - - [11/Jan/2012:14:10:12 -0500] "GET /proxy.php HTTP/1.1" 302 476
"-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"
192.168.1.247 - - [11/Jan/2012:14:10:37 -0500] "GET /proxycallback.php HTTP/1.1" 200 581
"-" "Java/1.6.0_24"
192.168.1.247 - - [11/Jan/2012:14:10:37 -0500] "GET /proxycallback.php?pgtIou=PGTIOU-22-ndDLo0Zs4JIeeDFrXNK9-cas&pgtId=TGT-60-BOmnxU0OvQkcyexOMBvbXYdOcZwiapSERiAjvDMw4nwncOxP75-cas HTTP/1.1" 200 294 "-" "Java/1.6.0_24"
192.168.1.21 - - [11/Jan/2012:14:10:36 -0500] "GET /proxy.php?ticket=ST-56-zDai54pHmOoZN9IdDdZW-cas HTTP/1.1" 200 229 "https://cas.example.com:8443/cas/login?service=https%3A%2F%2Fclient.example.com%2Fproxy.php" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
```
The first call is where my browser tries to access the ```proxy.php```. It redirects me to the CAS server, where I provide my login credentials. Then CAS server tries to validate the pgtUrl. This is where the bug is. If CAS server calls back ```proxy.php``` as in the default behavior of phpCAS, phpCAS would redirect back to the CAS server to login. why? because phpCAS ```isAuthenticated()``` method return false. Since phpCAS has not received any service ticket back from the CAS server ```isAuthenticated()``` returning false is justifiable. As I see there are two solutions

1. Use a different fixed pgtUrl (proxycallback.php) as we did. The script at this URL retrieved the ```pgtId``` and ```pgtIou``` and saved to the pgt storage. Later when CAS calls the calling url (proxy.php) with the ```pgtIou``` , the ```pgtId``` is present in the pgt storage for the next steps.

2. Modify phpCAS to return a 200 response, bypassing every other code when the CAS server simply calls it to validate the pgtUrl.

May be there is a configuration we are missing. But we have phpCAS working using both the above two solutions. Please let us know if it is just a missing configuration or what we are reporting is a known issue.