Hi All,
I've been trying to tackle a rather difficult problem (for a new DNN developer anyway). I work for a university where we have a single sign on system called JA-SIG Central Authentication Service (CAS).
www.ja-sig.org/products/cas/
I am trying to develop a module for DotNetNuke to handle some of our departmental needs. However, all systems on campus use CAS for authentication. After spending a couple weeks trying to figure out how to do this, I've resorted to asking for help here.
CAS Operations
To utilize CAS, a web site redirects the user to the CAS login URL like: https://sso.university.edu/cas/login?service=http://return.to.url.edu/default.aspx
The user is redirected to the page and signs in with their username and password. When they get the u/p correct, CAS redirects the user to http://return.to.url.edu/Default.aspx?ticket=<session ticket>
The web application then sends a call to https://sso.university.edu/cas/validate?service=http://return.to.url.edu/default.aspx?ticket=<session ticket>
The response that comes back - if the ticket is valid - looks like:
<cas:response>
<cas:netid>myusername</cas:netid>
<cas:userid>1234567890</cas:userid>
</cas:response>
DotNetNuke Operations
From what I can tell, DNN uses the signin.ascx control to handle authentication. It calls the AuthenticationController, and UserController to validate the username and password locally.
From here I'm confused about what to modify to make CAS work with DNN. I was thinking that all I needed to do was write a replacement for signin.ascx and add the user to the local database if they did not already exist. But since I do not get back a password I cannot sync DNN with CAS.
Now it looks like I have to code a concrete class for MembershipProvider, AuthenticationProvider, and signin.ascx. What am I missing here? This seems more complicated than it should be. I realize that at some point I should get the username back from CAS, validate the session, and add the user to the DNN Membership tables if it does not exist. But how do I do this without a password?
Conclusion
At this point any help would be greatly appreciated. My other option is to write an LDAP provider, although this is pretty frowned on and LDAP is going away at our institution. Shibboleth is being brought up soon and all LDAP authentication will be phased out.
Thank You,
Ben Floyd