0

I'm developping a webapp linked to a CAS server with phpCAS. Up to now everything was going well, I was able to access my app after the CAS authentication. I'm now supposed to implement a logout feature : when someone logs out of the CAS server, it sends logout request to all apps opened for that session.

The problem is my app doesn't seem to receive that request. I contacted the adminstrator who told me that he can see the request leaving the server. He then asked me to confirm him that my server received that request.

And here is the problem : I have no idea how to see if the server received the logout request (a json file...apparently a POST Method is used to send the data to the address of my app...as you see, I have no idea what I'm talking about.). I've been searching for days now and I'm totally in the dark. I tried to use tcpdump. I see a TCP F Flag when I logout of the CAS server so it seemed first like a good thing. But I have no idea how to see if my server has received a logout request.

Hoping that someone can help me...

Thanking you in advance.

Lucas1283
  • 61
  • 1
  • 5

1 Answers1

1

And here is the problem : I have no idea how to see if the server received the logout request

You need to design some kind of filter/interceptor that sits in front of your application and intercepts all requests. This filter should examine the request body to see if the request is indeed a logout request. If it is, parse and consume the request body and begin to logout and remove the application session accordingly.

...with a little bit of searching and effort, it looks like phpCAS can handle logout requests on its own: https://github.com/apereo/phpCAS/blob/master/docs/examples/example_logout.php

apparently a POST Method is used to send the data to the address of my app

Not "apparently"; rather, exactly. According to the docs:

The CAS Server MAY support Single Logout (SLO). SLO means that the user gets logged out not only from the CAS Server, but also from all visited CAS client applications. If SLO is supported by the CAS Server, the CAS Server MUST send a HTTP POST request containing a logout XML document (see Appendix C) to all service URLs provided to CAS during this CAS session whenever a Ticket Granting Ticket is explicitly expired by the user (e.g. during logout). CAS Clients that do not support the SLO POST requests MUST ignore these requests. SLO requests MAY also be initiated by the CAS Server upon TGT idle timeout.

And then here is the actual payload.

Misagh Moayyed
  • 4,154
  • 2
  • 15
  • 25
  • Thank you very much. Indeed a POST request was sent by the CAS server but my phpCAS app wasn't receiving it because of a SSL issue (the certificate was incomplete). I edited the apache ssl.conf file to add the SSLCertificateChainFile option. Using if ($_SERVER['REQUEST_METHOD'] === 'POST') I could then verify if the POST request was intercepted by my page. Now, that the SSL issue was corrected I receive the POST request and the phpCAS::handlelogoutrequest() does indeed all the job. – Lucas1283 Mar 24 '21 at 18:20
  • Glad to hear it! – Misagh Moayyed Mar 24 '21 at 18:21