Single Sign Out about django-cas-ng

[nitmir]

The jasig CAS (the mainline implementation) send the logout request in a POST parameter called logoutRequest.
You can also see that phpCAS use this POST parameter to see if the request is a logout request https://github.com/Jasig/phpCAS/blob/master/source/CAS/Client.php#L1696.
Idem for rubycas-client-rails https://github.com/rubycas/rubycas-client-rails/blob/master/lib/rubycas-client-rails.rb#L290 or the omniauth-cas client https://docs.omniref.com/ruby/gems/eriko-omniauth-cas/1.0.5/symbols/OmniAuth::Strategies::CAS::LogoutRequest#line=34

I think it could be easier to have mama-cas to send the POST parameter than to modify all CAS clients.

We should not be checking for logout request if CAS_VERSION < 3 as it is only suported by CAS_VERSION == 3 and SAML 1.1.

I personally do not use django-mama-cas because I found its policy about who can get a ProxyGrantingTicket way too permissive. The mainline jasig CAS server require each registered application in the registry to be explicitly configured to allow for proxy authentication.
For your information (I do not know if you are familiar with the CAS protocol) once something get a ProxyGrantingTicket for a user, it can connect pretty much to every apps using the CAS as this user. At the current time, every services allowed to authenticate against the CAS (ie inside MAMA_CAS_VALID_SERVICES) are de-facto allowed to retrieve a PGT jbittel/django-mama-cas#26

[manelclos]

Hi,

Yes, I see your point. Let me ask django-mama-cas project about that.

Thanks for the prompt reply!

[jbittel]

I am planning to rework how services are validated in django-mama-cas to allow for per-service configuration, including allowing/disallowing proxy authentication. Thanks for the reminder!

[manelclos]

Hi, this has been fixed in django-mama-cas, thank you!

jbittel/django-mama-cas#27