首页 > 代码库 > Discuz 3.X 整合 CAS 的方法
Discuz 3.X 整合 CAS 的方法
1，新建 CasClient.php
<?php
include_once (dirname ( __FILE__ ) . ‘/CasClientConfig.php‘); // 注意这个
include_once (dirname ( __FILE__ ) . ‘/CAS.php‘); // 注意这个
// 初始化 phpCAS::setDebug ();
// initialize phpCAS phpCAS::client ( CAS_VERSION_2_0, CAS_SERVER_HOSTNAME, CAS_SERVER_PORT, CAS_SERVER_APP_NAME );
// no SSL validation for the CAS server phpCAS::setNoCasServerValidation ();
2，新建 CasClientConfig.php
// define ( ‘CAS_SERVER_HOSTNAME‘, ‘caslocal.youxituan.com‘ ); // define ( ‘CAS_SERVER_PORT‘, 80 ); define ( ‘CAS_SERVER_HOSTNAME‘, ‘localhost‘ );
define ( ‘CAS_SERVER_PORT‘, 34382 ); define ( ‘CAS_SERVER_APP_NAME‘, "cas" );
define ( ‘LocalLoginPath‘, ‘/cas/localogin.php‘ );
define ( ‘LocalCheckPath‘, ‘/cas/logincheck.php‘ );
define ( ‘LocalLogOffPath‘, ‘/cas/logoff.php‘ );
3， 修改 class_core.php
error_reporting(E_ALL);
define(‘IN_DISCUZ‘, true);
define(‘DISCUZ_ROOT‘, substr(dirname(__FILE__), 0, -12)); define(‘DISCUZ_CORE_DEBUG‘, false);
define(‘DISCUZ_TABLE_EXTENDABLE‘, false);
require_once DISCUZ_ROOT."Cas/CasClient.php";
set_exception_handler(array(‘core‘, ‘handleException‘));
if(DISCUZ_CORE_DEBUG) {
3,修改 function_member.php 支持 CAS 登录
增加一个方法
// 新加的方法，用以支持CAS 登录 function userloginCas($username, $password, $email, $uid) { $return = array ();
$merge = 0;
$status = $uid;
$mockcallback = array($uid, $username, $password, $email, $merge); $return [‘ucresult‘] = $mockcallback;
// $return [‘ucresult‘] [‘status‘] = 0; // $return [‘ucresult‘] [‘username‘] = $username; // $return [‘ucresult‘] [‘password‘] = $password; // $return [‘ucresult‘] [‘email‘] = $email; // $return [‘ucresult‘] [‘uid‘] = $uid; // $return [‘ucresult‘] [‘merge‘] = $merge; // } $tmp = array (); $duplicate = ‘‘; list ( $tmp [‘uid‘], $tmp [‘username‘], $tmp [‘password‘], $tmp [‘email‘], $duplicate ) = $return [‘ucresult‘];
$return [‘ucresult‘] = $tmp;
if ($duplicate && $return [‘ucresult‘] [‘uid‘] > 0 || $return [‘ucresult‘] [‘uid‘] <= 0) {
$return [‘status‘] = 0;
return $return;
}
$member = getuserbyuid ( $return [‘ucresult‘] [‘uid‘], 1 );
if (! $member || empty ( $member [‘uid‘] )) {
$return [‘status‘] = - 1;
return $return;
}
$return [‘member‘] = $member;
$return [‘status‘] = 1;
if ($member [‘_inarchive‘]) {
C::t ( ‘common_member_archive‘ )->move_to_master ( $member [‘uid‘] );
}
if ($member [‘email‘] != $return [‘ucresult‘] [‘email‘]) {
C::t ( ‘common_member‘ )->update ( $return [‘ucresult‘] [‘uid‘], array (
‘email‘ => $return [‘ucresult‘] [‘email‘]
) );
}
return $return;
}
4，修改 class_member.php 添加支持 Cas登录支持
修改 OnLogin 方法
function on_login() { global $_G; if ($_G [‘uid‘]) {
$referer = dreferer ();
$ucsynlogin = $this->setting [‘allowsynlogin‘] ? uc_user_synlogin ( $_G [‘uid‘] ) : ‘‘;
$param = array ( ‘username‘ => $_G [‘member‘] [‘username‘],
‘usergroup‘ => $_G [‘group‘] [‘grouptitle‘],
‘uid‘ => $_G [‘member‘] [‘uid‘]
);
showmessage ( ‘login_succeed‘, $referer ? $referer : ‘./‘, $param, array (
‘showdialog‘ => 1, ‘locationtime‘ => true,
‘extrajs‘ => $ucsynlogin ) );
}
list ( $seccodecheck ) = seccheck ( ‘login‘ );
if (! empty ( $_GET [‘auth‘] )) {
$dauth = authcode ( $_GET [‘auth‘], ‘DECODE‘, $_G [‘config‘] [‘security‘] [‘authkey‘] );
list ( , , , $secchecklogin2 ) = explode ( "\t", $dauth );
if ($secchecklogin2) { $seccodecheck = true; }
}
$seccodestatus = ! empty ( $_GET [‘lssubmit‘] ) ? false : $seccodecheck;
$invite = getinvite ();
// if(!submitcheck(‘loginsubmit‘, 1, $seccodestatus)) { if (1 == 2) { $auth = ‘‘; $username = ! empty ( $_G [‘cookie‘] [‘loginuser‘] ) ? dhtmlspecialchars ( $_G [‘cookie‘] [‘loginuser‘] ) : ‘‘;
if (! empty ( $_GET [‘auth‘] )) {
list ( $username, $password, $questionexist ) = explode ( "\t", authcode ( $_GET [‘auth‘], ‘DECODE‘, $_G [‘config‘] [‘security‘] [‘authkey‘] ) );
$username = dhtmlspecialchars ( $username );
$auth = dhtmlspecialchars ( $_GET [‘auth‘] ); }
$cookietimecheck = ! empty ( $_G [‘cookie‘] [‘cookietime‘] ) || ! empty ( $_GET [‘cookietime‘] ) ? ‘checked="checked"‘ : ‘‘;
if ($seccodecheck) { $seccode = random ( 6, 1 ) + $seccode {0} * 1000000; }
if ($this->extrafile && file_exists ( $this->extrafile )) { require_once $this->extrafile; }
$navtitle = lang ( ‘core‘, ‘title_login‘ );
include template ( $this->template ); } else { if (! empty ( $_GET [‘auth‘] )) {
list ( $_GET [‘username‘], $_GET [‘password‘] ) = daddslashes ( explode ( "\t", authcode ( $_GET [‘auth‘], ‘DECODE‘, $_G [‘config‘] [‘security‘] [‘authkey‘] ) ) );
}
$loginhash = ! empty ( $_GET [‘loginhash‘] ) && preg_match ( ‘/^\w+$/‘, $_GET [‘loginhash‘] ) ? $_GET [‘loginhash‘] : ‘‘;
if (! ($_G [‘member_loginperm‘] = logincheck ( $_GET [‘username‘] ))) {
captcha::report ( $_G [‘clientip‘] ); showmessage ( ‘login_strike‘ ); }
if ($_GET [‘fastloginfield‘]) {
$_GET [‘loginfield‘] = $_GET [‘fastloginfield‘];
}
$_G [‘uid‘] = $_G [‘member‘] [‘uid‘] = 0;
$_G [‘username‘] = $_G [‘member‘] [‘username‘] = $_G [‘member‘] [‘password‘] = ‘‘;
phpCAS::$_PHPCAS_CLIENT->setNoClearTicketsFromUrl ();
$auth1 = phpCAS::isAuthenticated ();
$username=‘‘; if ($auth1) { $username = phpCAS::getUser ();
} else { phpCAS::forceAuthentication ();
// showmessage ( ‘尚未登录,<a href=http://www.mamicode.com/"" onclick="return gocas();">前去登录‘ ); }
$password = ‘‘; $email = phpCAS::getAttribute(‘Email‘); $uid = phpCAS::getAttribute(‘Uid‘); // $result = userlogin($_GET[‘username‘], $_GET[‘password‘], $_GET[‘questionid‘], $_GET[‘answer‘], $this->setting[‘autoidselect‘] ? ‘auto‘ : $_GET[‘loginfield‘], $_G[‘clientip‘]); $result = userloginCas ( $username, $password, $email, $uid );
$uid = $result [‘ucresult‘] [‘uid‘];
if (! empty ( $_GET [‘lssubmit‘] ) && ($result [‘ucresult‘] [‘uid‘] == - 3 || $seccodecheck)) {
$_GET [‘username‘] = $result [‘ucresult‘] [‘username‘];
$this->logging_more ( $result [‘ucresult‘] [‘uid‘] == - 3 );
}
if ($result [‘status‘] == - 1) {
if (! $this->setting [‘fastactivation‘]) {
$auth = authcode ( $result [‘ucresult‘] [‘username‘] . "\t" . FORMHASH, ‘ENCODE‘ );
showmessage ( ‘location_activation‘, ‘member.php?mod=‘ . $this->setting [‘regname‘] . ‘&action=activation&auth=‘ . rawurlencode ( $auth ) . ‘&referer=‘ . rawurlencode ( dreferer () ), array (), array (
‘location‘ => true
) );
} else { $init_arr = explode ( ‘,‘, $this->setting [‘initcredits‘] );
$groupid = $this->setting [‘regverify‘] ? 8 : $this->setting [‘newusergroupid‘];
C::t ( ‘common_member‘ )->insert ( $uid, $result [‘ucresult‘] [‘username‘], md5 ( random ( 10 ) ), $result [‘ucresult‘] [‘email‘], $_G [‘clientip‘], $groupid, $init_arr );
$result [‘member‘] = getuserbyuid ( $uid ); $result [‘status‘] = 1; }
}
if ($result [‘status‘] > 0) {
if ($this->extrafile && file_exists ( $this->extrafile )) { require_once $this->extrafile; }
setloginstatus ( $result [‘member‘], $_GET [‘cookietime‘] ? 2592000 : 0 );
checkfollowfeed ();
if ($_G [‘group‘] [‘forcelogin‘]) {
if ($_G [‘group‘] [‘forcelogin‘] == 1) {
clearcookies ();
showmessage ( ‘location_login_force_qq‘ ); } elseif ($_G [‘group‘] [‘forcelogin‘] == 2 && $_GET [‘loginfield‘] != ‘email‘) {
clearcookies ();
showmessage ( ‘location_login_force_mail‘ ); }
}
if ($_G [‘member‘] [‘lastip‘] && $_G [‘member‘] [‘lastvisit‘]) {
dsetcookie ( ‘lip‘, $_G [‘member‘] [‘lastip‘] . ‘,‘ . $_G [‘member‘] [‘lastvisit‘] );
}
C::t ( ‘common_member_status‘ )->update ( $_G [‘uid‘], array (
‘lastip‘ => $_G [‘clientip‘],
‘port‘ => $_G [‘remoteport‘],
‘lastvisit‘ => TIMESTAMP, ‘lastactivity‘ => TIMESTAMP ) );
$ucsynlogin = $this->setting [‘allowsynlogin‘] ? uc_user_synlogin ( $_G [‘uid‘] ) : ‘‘;
$pwold = false; if ($this->setting [‘strongpw‘] && ! $this->setting [‘pwdsafety‘]) {
if (in_array ( 1, $this->setting [‘strongpw‘] ) && ! preg_match ( "/\d+/", $_GET [‘password‘] )) {
$pwold = true; }
if (in_array ( 2, $this->setting [‘strongpw‘] ) && ! preg_match ( "/[a-z]+/", $_GET [‘password‘] )) {
$pwold = true; }
if (in_array ( 3, $this->setting [‘strongpw‘] ) && ! preg_match ( "/[A-Z]+/", $_GET [‘password‘] )) {
$pwold = true; }
if (in_array ( 4, $this->setting [‘strongpw‘] ) && ! preg_match ( "/[^a-zA-z0-9]+/", $_GET [‘password‘] )) {
$pwold = true; }
}
if ($_G [‘member‘] [‘adminid‘] != 1) {
if ($this->setting [‘accountguard‘] [‘loginoutofdate‘] && $_G [‘member‘] [‘lastvisit‘] && TIMESTAMP - $_G [‘member‘] [‘lastvisit‘] > 90 * 86400) {
C::t ( ‘common_member‘ )->update ( $_G [‘uid‘], array (
‘freeze‘ => 2 ) );
C::t ( ‘common_member_validate‘ )->insert ( array (
‘uid‘ => $_G [‘uid‘],
‘submitdate‘ => TIMESTAMP, ‘moddate‘ => 0, ‘admin‘ => ‘‘,
‘submittimes‘ => 1, ‘status‘ => 0, ‘message‘ => ‘‘,
‘remark‘ => ‘‘
), false, true );
manage_addnotify ( ‘verifyuser‘ ); showmessage ( ‘location_login_outofdate‘, ‘home.php?mod=spacecp&ac=profile&op=password&resend=1‘, array (
‘type‘ => 1 ), array ( ‘showdialog‘ => true,
‘striptags‘ => false,
‘locationtime‘ => true
) );
}
if ($this->setting [‘accountguard‘] [‘loginpwcheck‘] && $pwold) {
$freeze = $pwold;
if ($this->setting [‘accountguard‘] [‘loginpwcheck‘] == 2 && $freeze) {
C::t ( ‘common_member‘ )->update ( $_G [‘uid‘], array (
‘freeze‘ => 1 ) );
}
}
}
$seccheckrule = & $_G [‘setting‘] [‘seccodedata‘] [‘rule‘] [‘login‘];
if ($seccheckrule [‘allow‘] == 2) {
if ($seccheckrule [‘nolocal‘]) {
require_once libfile ( ‘function/misc‘ );
$lastipConvert = process_ipnotice ( convertip ( $_G [‘member‘] [‘lastip‘] ) );
$nowipConvert = process_ipnotice ( convertip ( $_G [‘clientip‘] ) ); if ($lastipConvert != $nowipConvert && stripos ( $lastipConvert, $nowipConvert ) == false && stripos ( $nowipConvert, $lastipConvert ) == false) {
$seccodecheck = true; }
}
if (! $seccodecheck && $seccheckrule [‘pwsimple‘] && $pwold) {
$seccodecheck = true; }
if (! $seccodecheck && $seccheckrule [‘outofday‘] && $_G [‘member‘] [‘lastvisit‘] && TIMESTAMP - $_G [‘member‘] [‘lastvisit‘] > $seccheckrule [‘outofday‘] * 86400) {
$seccodecheck = true; }
if (! $seccodecheck && $_G [‘member_loginperm‘] < 4) {
$seccodecheck = true; }
if (! $seccodecheck && $seccheckrule [‘numiptry‘]) {
$seccodecheck = failedipcheck ( $seccheckrule [‘numiptry‘], $seccheckrule [‘timeiptry‘] );
}
if ($seccodecheck && ! $secchecklogin2) { clearcookies ();
$auth = authcode ( $_GET [‘username‘] . "\t" . $_GET [‘password‘] . "\t" . ($_GET [‘questionid‘] ? 1 : 0) . "\t1", ‘ENCODE‘, $_G [‘config‘] [‘security‘] [‘authkey‘] );
$location = ‘member.php?mod=logging&action=login&auth=‘ . rawurlencode ( $auth ) . ‘&referer=‘ . rawurlencode ( dreferer () ) . (! empty ( $_GET [‘cookietime‘] ) ? ‘&cookietime=1‘ : ‘‘);
if (defined ( ‘IN_MOBILE‘ )) {
showmessage ( ‘login_seccheck2‘, $location ); } else { $js = ‘<script type="text/javascript">location.href=http://www.mamicode.com/‘‘ . $location . ‘\‘</script>‘;
showmessage ( ‘login_seccheck2‘, ‘‘, array (
‘type‘ => 1 ), array ( ‘extrajs‘ => $js ) );
}
}
}
if ($invite [‘id‘]) {
$result = C::t ( ‘common_invite‘ )->count_by_uid_fuid ( $invite [‘uid‘], $uid );
if (! $result) { C::t ( ‘common_invite‘ )->update ( $invite [‘id‘], array (
‘fuid‘ => $uid, ‘fusername‘ => $_G [‘username‘]
) );
updatestat ( ‘invite‘ ); } else { $invite = array (); }
}
if ($invite [‘uid‘]) {
require_once libfile ( ‘function/friend‘ );
friend_make ( $invite [‘uid‘], $invite [‘username‘], false );
dsetcookie ( ‘invite_auth‘, ‘‘ );
if ($invite [‘appid‘]) {
updatestat ( ‘appinvite‘ ); }
}
$param = array ( ‘username‘ => $result [‘ucresult‘] [‘username‘],
‘usergroup‘ => $_G [‘group‘] [‘grouptitle‘],
‘uid‘ => $_G [‘member‘] [‘uid‘],
‘groupid‘ => $_G [‘groupid‘],
‘syn‘ => $ucsynlogin ? 1 : 0 );
$extra = array ( ‘showdialog‘ => true,
‘locationtime‘ => true,
‘extrajs‘ => $ucsynlogin );
if (! $freeze || ! $this->setting [‘accountguard‘] [‘loginpwcheck‘]) {
$loginmessage = $_G [‘groupid‘] == 8 ? ‘login_succeed_inactive_member‘ : ‘login_succeed‘;
$location = $invite || $_G [‘groupid‘] == 8 ? ‘home.php?mod=space&do=home‘ : dreferer ();
} else { $loginmessage = ‘login_succeed_password_change‘; $location = ‘home.php?mod=spacecp&ac=profile&op=password‘; $_GET [‘lssubmit‘] = 0; }
if (empty ( $_GET [‘handlekey‘] ) || ! empty ( $_GET [‘lssubmit‘] )) {
if (defined ( ‘IN_MOBILE‘ )) {
showmessage ( $loginmessage, $location, $param, array ( ‘location‘ => true
) );
} else { if (! empty ( $_GET [‘lssubmit‘] )) {
if (! $ucsynlogin) { $extra [‘location‘] = true;
}
showmessage ( $loginmessage, $location, $param, $extra );
} else { $href = http://www.mamicode.com/str_replace ( "‘", "\‘", $location );
showmessage ( ‘location_login_succeed‘, $location, array (), array (
‘showid‘ => ‘succeedmessage‘,
‘extrajs‘ => ‘<script type="text/javascript">‘ . ‘setTimeout("window.location.href =http://www.mamicode.com/‘‘ . $href . ‘\‘;", 3000);‘ . ‘$(\‘succeedmessage_href\‘).href = http://www.mamicode.com/‘‘ . $href . ‘\‘;‘ . ‘$(\‘main_message\‘).style.display = \‘none\‘;‘ . ‘$(\‘main_succeed\‘).style.display = \‘\‘;‘ . ‘$(\‘succeedlocation\‘).innerHTML = \‘‘ . lang ( ‘message‘, $loginmessage, $param ) . ‘\‘;</script>‘ . $ucsynlogin,
‘striptags‘ => false,
‘showdialog‘ => true
) );
}
}
} else { showmessage ( $loginmessage, $location, $param, $extra );
}
} else { $password = preg_replace ( "/^(.{" . round ( strlen ( $_GET [‘password‘] ) / 4 ) . "})(.+?)(.{" . round ( strlen ( $_GET [‘password‘] ) / 6 ) . "})$/s", "\\1***\\3", $_GET [‘password‘] );
$errorlog = dhtmlspecialchars ( TIMESTAMP . "\t" . ($result [‘ucresult‘] [‘username‘] ? $result [‘ucresult‘] [‘username‘] : $_GET [‘username‘]) . "\t" . $password . "\t" . "Ques #" . intval ( $_GET [‘questionid‘] ) . "\t" . $_G [‘clientip‘] );
writelog ( ‘illegallog‘, $errorlog ); loginfailed ( $_GET [‘username‘] ); failedip ();
$fmsg = $result [‘ucresult‘] [‘uid‘] == ‘-3‘ ? (empty ( $_GET [‘questionid‘] ) || $answer == ‘‘ ? ‘login_question_empty‘ : ‘login_question_invalid‘) : ‘login_invalid‘;
if ($_G [‘member_loginperm‘] > 1) {
showmessage ( $fmsg, ‘‘, array (
‘loginperm‘ => $_G [‘member_loginperm‘] - 1
) );
} elseif ($_G [‘member_loginperm‘] == - 1) {
showmessage ( ‘login_password_invalid‘ ); } else { showmessage ( ‘login_strike‘ ); }
}
}
}
修改 on_logout 支持同步退出
function on_logout() { global $_G; $ucsynlogout = $this->setting [‘allowsynlogin‘] ? uc_user_synlogout () : ‘‘;
if ($_GET [‘formhash‘] != $_G [‘formhash‘]) {
showmessage ( ‘logout_succeed‘, dreferer (), array (
‘formhash‘ => FORMHASH, ‘ucsynlogout‘ => $ucsynlogout, ‘referer‘ => rawurlencode ( dreferer () ) ) );
}
clearcookies ();
$_G [‘groupid‘] = $_G [‘member‘] [‘groupid‘] = 7;
$_G [‘uid‘] = $_G [‘member‘] [‘uid‘] = 0;
$_G [‘username‘] = $_G [‘member‘] [‘username‘] = $_G [‘member‘] [‘password‘] = ‘‘;
$_G [‘setting‘] [‘styleid‘] = $this->setting [‘styleid‘];
if (defined ( ‘IN_MOBILE‘ )) {
showmessage ( ‘location_logout_succeed_mobile‘, dreferer (), array (
‘formhash‘ => FORMHASH, ‘referer‘ => rawurlencode ( dreferer () ) ) );
} else { // 退出 $service = dreferer () ;
phpCAS::logoutWithRedirectService ( $service );
// 后面这个showmessage提示实际上已经不会执行了 // showmessage ( ‘logout_succeed‘, dreferer (), array ( // ‘formhash‘ => FORMHASH, // ‘ucsynlogout‘ => $ucsynlogout, // ‘referer‘ => rawurlencode ( dreferer () ) // ) ); }
}
}
当然，最后把登录改成 到登录界面去登录的方式，这样才会生效，这其实是最简单的方法了。
如下图进行设置
CAS 结构 如下：
其中CAS 包我也做了小小的修改，但这个与主要业务无关，就不传了。
最后，我的版本是 Discuz! X3.1 Release 20131011 。
从 其它系统跳转到要检测是否已经登录，可以作用JS的方法判断CAS Server是否已经登录，如果已经登录，跳转到登录然后再返回
或使得JS方式从后台调用 CAS的方法进行登录，然后使用Ajax的方式，更新界面。
我的CASServer C# 版本 是自己的写的，但我基本上遵循的 CAS 2.0 的协议，所以对于Java版本CAS也差不多。相应代码可参见的GitHub上的代码。
**************************************************** 2014-8-27补充**********************************************************
其实还有一个问题没有说清楚的，
这个CAS Server的模式如下：
这个CAS Server 完全兼容了Discuz的UcCenter，也就是在支持标准CAS 协议的同时，也支持康盛的Uc接口，Discuz完全不再依赖于UC了。
其实在 DZ接入CasServer的时候，首先要关掉UC的同步登录功能。
接下来，由于DZ依赖于UC，要么改造一下CASServer适配为Uccenter，要么，改一下UcCenter来适应CASServer。
我上面的提到的代码中，应该算是一个思路，具体的实现，还是要根据实际情况进行修正。
Discuz 3.X 整合 CAS 的方法
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。