Add configuration setting for CAS protocol version

[agrimpard]

Add configuration setting for CAS protocol version

I made a new pull request, taking into account Clokep's comment. I've added the possibility of configuring the CAS protocol version and, in the case of version 3, the CAS ticket validation url is modified to allow CAS attributes to be retrieved, which is not possible with version 2.

Fix #15807

Old PR : #15811

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Pull request includes a sign off
• Code style is correct
  (run the linters)

Signed-off-by: Aurélien Grimpard aurelien@grimpard.net

[agrimpard]

I made a new pull request, taking into account Clokep's comment. I've added the possibility of configuring the CAS protocol version and, in the case of version 3, the CAS ticket validation url is modified to allow CAS attributes to be retrieved, which is not possible with version 2.

It solve this issue : #15807

Old PR : #15811

[MadLittleMods]

Helpful docs for anyone looking at this: https://github.com/matrix-org/synapse/blob/d53547352063c3e66302f7bdc40d7ac7270e605c/docs/development/cas.md

[MadLittleMods]

Seems legit -> spec docs for CAS protocol version 3: https://apereo.github.io/cas/6.6.x/protocol/CAS-Protocol-Specification.html#29-p3proxyvalidate-cas-30

2.9. /p3/proxyValidate [CAS 3.0]

/p3/proxyValidate MUST perform the same validation tasks as /p3/serviceValidate and additionally validate proxy tickets. See Section 2.8.

2.8. /p3/serviceValidate [CAS 3.0]

/p3/serviceValidate MUST perform the same validation tasks as /serviceValidate and additionally return user attributes in the CAS response. See Section 2.5 and Section 2.5.7 for details.

2.5.7 Example response with custom attributes

<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
  <cas:authenticationSuccess>
    <cas:user>username</cas:user>
    <cas:attributes>
      <cas:firstname>John</cas:firstname>
      <cas:lastname>Doe</cas:lastname>
      <cas:title>Mr.</cas:title>
      <cas:email>jdoe@example.org</cas:email>
      <cas:affiliation>staff</cas:affiliation>
      <cas:affiliation>faculty</cas:affiliation>
    </cas:attributes>
    <cas:proxyGrantingTicket>PGTIOU-84678-8a9d...</cas:proxyGrantingTicket>
  </cas:authenticationSuccess>
</cas:serviceResponse>

[clokep]

@agrimpard Are you interested in finishing this up?

[agrimpard]

@agrimpard Are you interested in finishing this up?

I'm sorry i'm a bit new there, what should be done ?

I'm interested to have this PR in prod :)

[clokep]

I'm interested to have this PR in prod :)

There's a comment left above which needs to be handled: #15816 (comment)

You should be able to just push additional commits to this branch (or perhaps just commit what was suggested via the GitHub UI, if you agree with it).

[clokep]

Looks good if CI is happy! 👍 Thanks for sticking w/ this.

[clokep]

Thanks for your contribution! 🎉 It should be part of Synapse 1.92.0.