devise_cas_authenticatable

devise_cas_authenticatable

Written by Nat Budin

Taking a lot of inspiration from devise_ldap_authenticatable

devise_cas_authenticatable is CAS single sign-on support for Devise applications. It acts as a replacement for database_authenticatable. It builds on rack-cas and should support just about any conformant CAS server (although I have personally tested it using rubycas-server).

Requirements

• Rails 5.0 or greater
• Devise 4.0 or greater

devise_cas_authenticatable version 2 is a major rewrite

devise_cas_authenticatable version 1 was based on rubycas-client. Now that rubycas-client is deprecated, devise_cas_authenticatable version 2 is based on rack-cas.

In order to upgrade, you'll need to:

• Make sure you're on a supported version of Devise (4.0 or above) and a supported version of Rails (5.0 or above)
• Add the rack-cas configuration to your application.rb (see below)
• Remove the cas_base_url, cas_login_url, cas_logout_url, cas_validate_url, and cas_client_config_options from your devise.rb initializer, if present
• If using single sign out: set up rack-cas's built-in single sign out support

Installation

Add to your Gemfile:

gem 'devise'
gem 'devise_cas_authenticatable'

Setup

Once devise_cas_authenticatable is installed, add the following to your user model:

devise :cas_authenticatable

You can also add other modules such as token_authenticatable, trackable, etc. Please do not add database_authenticatable as this module is intended to replace it.

You'll also need to set up the database schema for this:

create_table :users do |t|
  t.string :username, :null => false
end

We also recommend putting a unique index on the username column:

add_index :users, :username, :unique => true

(Note: previously, devise_cas_authenticatable recommended using a t.cas_authenticatable method call to update the schema. Devise 2.0 has deprecated this type of schema building method, so we now recommend just adding the username string column as above. As of this writing, t.cas_authenticatable still works, but throws a deprecation warning in Devise 2.0.)

You'll need to configure rack-cas so that it knows where your CAS server is. See the rack-cas README for full instructions, but here is the bare minimum:

config.rack_cas.server_url = "https://cas.myorganization.com" # replace with your server URL
config.rack_cas.service = "/users/service" # If your user model isn't called User, change this

Finally, you may need to add some configuration to your config/initializers/devise.rb in order to tell your app how to talk to your CAS server. This isn't always required. Here's an example:

…

Extra attributes

If your CAS server passes along extra attributes you'd like to save in your user records, using the CAS extra_attributes parameter, you can define a method in your user model called cas_extra_attributes= to accept these. For example:

class User < ActiveRecord::Base
  devise :cas_authenticatable

  def cas_extra_attributes=(extra_attributes)
    extra_attributes.each do |name, value|
      case name.to_sym
      when :fullname
        self.fullname = value
      when :email
        self.email = value
      end
    end
  end
end

Using without a database

You don't have to save your user model to the database - you can simply store it in the session as is. You can follow the following approach (inspired by this article):

…

See also

• CAS
• rack-cas
• Devise
• Warden

License

devise_cas_authenticatable is released under the terms and conditions of the MIT license. See the LICENSE file for more information.