CAS Support for Evergreen

CAS Support for Evergreen

This branch contains one approach to supporting CAS within Evergreen, I
had originally thought of CAS as an "all or nothing" option but I have
tried to make it possible to support standard authentication at the same
time since we will have a transition period where some accounts won't be
CAS-enabled and I suspect this is typical. As well, it is possible that
a library will need to have the ability to add accounts outside of the
campus directory.

In /openils/conf/opensrf.xml, you would add CAS-specific values,for
example

 <app_settings>
    <!-- 'enabled' is the master switch; set to 'true' to enable proxied logins -->
    <enabled>true</enabled>
    <authenticators>
        <authenticator>
           <name>cas</name>
           <module>OpenILS::Application::AuthProxy::CAS_Auth_Conifer</module>
           <cas_validate_url>https://uwinid.uwindsor.ca/cas/proxyValidate</cas_validate_url>
           <cas_service>https://localhost/eg/opac/login</cas_service>
           <cas_suffix>@uwindsor.ca</cas_suffix>
        </authenticator>
        <!-- 'native' is a proxied version of Evergreen's standard authentication -->

        <authenticator>
            <name>native</name>
            <!-- you can add 'login_types' and 'org_units' limits to this authenticator as well, if needed -->
        </authenticator>
    </authenticators>
 </app_settings>

The entry point for CAS is in topnav.tt2, I have added a "cas_intro"
option in order to give an introduction screen before passing a user to
the CAS service:

 <div id="your-acct-login-uwin">
    <a href="[% mkurl(ctx.opac_root _ '/cas_intro') %]"
       class="opac-button opac-button-header" id="home_myopac_link_uwin">
       [% l('Log in to Your Account (UWind ID)') %]
    </a>
 </div>

but you could just go directly to cas at this point:

 <div id="your-acct-login-uwin">
    <a href="[% ctx.cas.url %]"
       class="opac-button opac-button-header" id="home_myopac_link_uwin">
       [% l('Log in to Your Account (UWind ID)') %]
    </a>
 </div>

where ctx.cas.url is set in the config.tt2 file, for example:

 ctx.cas.url = 'https://uwinid.uwindsor.ca/cas/login?service=https://localhost/eg/opac/login';

I use a cookie to indicate that CAS has been used to authenticate, since
it requires a slightly different logout sequence. This also gets
reflected in topnav.tt2 if you are using both CAS and standard
authentication:

[% IF CGI.cookie('eg_CAS') %]
   <a href="[% mkurl(ctx.opac_root _ '/logout?redirect_to=' _ ctx.cas.logout, {}, 1) %]"
      class="opac-button" id="logout_link">[% l('Logout') %]</a>
[% ELSE %]
   <a href="[% mkurl(ctx.opac_root _ '/logout', {}, 1) %]"
      class="opac-button" id="logout_link">[% l('Logout') %]</a>
[% END %]

Note the "redirect_to", you will want to clear the session for logging
out of tpac so that another user on a public station won't stumble into
someone else's account. Again, if authentication is strictly CAS, then
you can just use the CAS form of the logout.

Signed-off-by: Art Rhyno <art632000@yahoo.ca>