This is a quick test to see if my new plug-in for WordPress that uses CAS for browser based authentication and LDAP for api based authentication works.

I’m now editing this post with a different api-based tool.

Ja-sig’s Central Authentication Service (CAS) supports multiple authentication sources, including using 3 database authentication types. They are:

• BindModeSearchDatabaseAuthenticationHandler which uses the RDBMS’s user security to authenticate users. If CAS can connect to the database with the user’s username and password the credentials are considered legitimate.
• QueryDatabaseAuthenticationHandler which passes the username into a specified query that returns the password. If the returned password matches that which was specified by the user the credentials are considered legitimate.
• SearchModeSearchDatabaseAuthenticationHandler which queries a given table for a given username column and a given password column with the username and password provided by the user. If a record is return the user is considered legitimage.

I have a fourth scenerio which doesn’t lend itself to any of these solutions. I’d like to pass the username and password into a stored procedure and allow it to determine if the credentials are legitimate. This has some advantages like being able to directly record when the last successful or failed authentication was. I also have a future project of developing a solution to allow CAS to use one-time passwords (OTP), where the user could print out a list of 5 or 10 passwords that can be used to log in exactly one time. After being used, the user scratches that password off the list. This becomes very easy if a stored procedure is being used to provide the validation logic.

The solution I’ve developed is the StoredProcedureDatabaseAuthenticationHandler. It’s design has been mirrored after the other database handlers, and it’s derived from the same base class. It has 5 parameters:

• dataSource (inherited) – review the CAS JDBC Authnetication page for details (required).
• procedureName – the name of the stored procedure being called (required).
• usernameParameterName – the name of the SP’s username parameter (required).
• passwordParameterName – the name of the SP’s password parameter (required).
• successReturnValue – the value that is returned in the SP’s resultset (1st column/1st row) upon successful validation (required).

After extracting the files and adding them to your build, you’ll want to add the following code to the authenticationHandler list in the the deployerConfigContext.xml file. Something similar to:

<bean class="org.jasig.cas.adaptors.jdbc.StoredProcedureDatabaseAuthenticationHandler">
  <property name="dataSource" ref="dataSource" />
  <property name="procedureName" value="p_validatePassword" />
  <property name="usernameParameterName" value="Username" />
  <property name="passwordParameterName" value="Password" />
  <property name="successReturnValue" value="yes" />
</bean>

You’ll also want to add the following snippet to your Maven POM file so that appropriate dependencies exist for building and running the unit test:

  <dependency>
          <groupId>org.jasig.cas</groupId>
          <artifactId>cas-server-support-jdbc</artifactId>
          <version>${cas.version}</version>
          <scope>compile</scope>
  </dependency>
  <dependency>
          <groupId>junit</groupId>
          <artifactId>junit</artifactId>
          <version>4.8.1</version>
          <scope>test</scope>
  </dependency>
  <dependency>
          <groupId>org.hsqldb</groupId>
          <artifactId>hsqldb</artifactId>
          <version>2.2.4</version>
          <scope>test</scope>
  </dependency>

You will likely need to add additional dependencies to get database connectivity working, but the CAS User’s Manual/Wiki has all of the necessary information.

StoredProcedureDatabaseAuthenticationHandler has been tested against Microsoft SQL Server and HyperSQL (hsqldb). In fact, the unit test that I developed are against HyperSQL 2.2.4. Please let me know if you have success with other database platforms.

My long term plan for this project is to submit it to Ja-sig for inclusion in the core/jdbc CAS framework. That way others get to benefit from it, and I don’t have to be solely responsible to maintain it.

…

In the same bundle, I’ve included the StoredFunctionDatabaseAuthenticationHandler class. Using Spring to connect to a Stored Procedure is nearly identical to connecting to a User-Defined Function/Stored Function. However I could never get it to work with hsqldb for unit testing as HyperSQL reports that only one parameter is being passed. My guess is that there is a bad interaction between Spring and HyperSQL as HyperSQL isn’t natively support by the Spring Framework. It does, however, work when connecting to Microsoft SQL Server, so I’m publishing the StoredFunctionDatabaseAuthenticationHandler code as well. The only real difference in use is the class name and one of the parameter name of procedureName becomes functionName:

<bean class="org.jasig.cas.adaptors.jdbc.StoredFunctionDatabaseAuthenticationHandler">
  <property name="dataSource" ref="dataSource"/>
  <property name="functionName" value="f_validatePassword" />
  <property name="usernameParameterName" value="Username" />
  <property name="passwordParameterName" value="Password" />
  <property name="successReturnValue" value="yes" />
</bean>

Attachment: ExtraCasJdbcAuthHandlers.zip