# loopback-component-cas

> Loopback CAS Authentification

Latest version **0.5.21** (published 2018-06-23) · MIT license · 0 weekly downloads

## Install

```sh
npm install loopback-component-cas
pnpm add loopback-component-cas
yarn add loopback-component-cas
bun add loopback-component-cas
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.5.21 |
| Published | 2018-06-23 |
| First published | 2017-09-13 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 4 |
| Unpacked size | 393.6 KB |
| Known vulnerabilities | 0 (+1 in 1 direct dependencies) |
| Install scripts | no |
| GitHub stars | 3 |
| Author | Sebastien Bechet |
| Maintainers | sbechet |
| Keywords | jasig, cas, saml, authentication, sso, loopback, component |

## Links

- npm: https://www.npmjs.com/package/loopback-component-cas
- Repository: https://github.com/sbechet/loopback-component-cas
- Homepage: https://github.com/sbechet/loopback-component-cas#readme
- Issues: https://github.com/sbechet/loopback-component-cas/issues
- npm.io page: https://npm.io/package/loopback-component-cas

## Dependencies (4)

- [debug](https://npm.io/package/debug.md) ^3.1.0
- [marko](https://npm.io/package/marko.md) ~4.4.28
- [moment](https://npm.io/package/moment.md) ^2.22.2
- [bluebird](https://npm.io/package/bluebird.md) ^3.5.1

## Alternatives

- [@mce/gif](https://npm.io/package/@mce/gif.md) — 2.6K weekly downloads
- [cleanse](https://npm.io/package/cleanse.md) — 173 weekly downloads
- [str](https://npm.io/package/str.md) — 127 weekly downloads
- [naming](https://npm.io/package/naming.md) — 95 weekly downloads
- [tap-telco-api](https://npm.io/package/tap-telco-api.md) — 19 weekly downloads

## Recent versions

- 0.5.21 (latest) — 2018-06-23
- 0.5.20 — 2018-01-26
- 0.5.19 — 2017-12-20
- 0.5.18 — 2017-12-13
- 0.5.17 — 2017-12-13
- 0.5.16 — 2017-12-13
- 0.5.15 — 2017-12-12
- 0.5.14 — 2017-11-29
- 0.5.13 — 2017-11-23
- 0.5.12 — 2017-11-23
- 0.5.11 — 2017-11-23
- 0.5.10 — 2017-11-23
- 0.5.9 — 2017-11-15
- 0.5.8 — 2017-11-15
- 0.5.7 — 2017-11-15
- … 14 more at https://npm.io/package/loopback-component-cas/versions

## README

# loopback-component-cas

This component provides a loopback native implementation of a [CAS Protocol Specification](https://apereo.github.io/cas/5.0.x/protocol/CAS-Protocol-Specification.html).

Use it with [loopback](https://github.com/strongloop/loopback)

* [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language)
* [SAML v1.1](https://en.wikipedia.org/wiki/SAML_1.1)

DONE : CASv1, CASv2, CASv3, SAMLv1.1

TODO : SLO logout, SAMLv2, Regression Test

## Installation

* `npm i loopback-component-cas`
* Don't forget to add `express-xml-bodyparser` to your project

## Configuration

### Application Model

You MUST use `application` model to store RegExp url field.

### User Model

User model MUST have a `profile` entry with user JSON profile AND `uuid` for each user.

Example in `common/models/account.json`:

```json
{
  "name": "Account",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {
    "uuid": {
      "type": "string",
      "required": true
    },
    "profile": {
      "type": "string"
    }
  },
  "validations": [],
  "relations": {},
  "acls": [],
  "methods": {}
}
```

### AccessToken model

In `model-config.json`, add appId field and modify belongsTo relation to use Account.

```json
"AccessToken": {
  ...
  "relations": {
    "application": {
      "type": "belongsTo",
      "model": "Application",
      "foreignKey": "appId"
    },
    "user": {
      "type": "belongsTo",
      "model": "Account",
      "foreignKey": "userId"
    }
  }
}
```

### login and logout WEB Pages

CAS redirect on theses pages if necessary.

#### login Page parameter

* `redirect` [OPTIONAL] - the full URL-encoded cas login service as described in section 2.2 of RFC 3986 (ex. ${accessUrl}/cas/login?service=serviceUrl)

#### logout Page parameter

* `redirect` [OPTIONAL] - the full URL-encoded service URL as described in section 2.2 of RFC 3986

### `token`, `cookie-parser` and `express-xml-bodyparser`

In `server/middleware.json`, add in request cookie-parser, token and express-xml-bodyparser

```json
"session:before": {
   "cookie-parser": {
     "params": "${cookieSecret}"
   }
},
"auth": {
  "loopback#token": {
    "params": {
      "model": "AccessToken"
   }
  }
},
"parse": {
  "express-xml-bodyparser": {
    "params": {
     "normalize": true,
     "normalizeTags": false,
     "explicitArray": false
    }
  }
}
```

Don't forget to add `config.json#cookieSecret`.

## Component configuration

In `server/component-config.json`

```json
"./components/loopback-component-cas": {
  "accessUrl": "https://my.access.Url"
  "serviceTicketTTL": 60000,
  "loginPage": "/account/signin",
  "logoutPage": "/account/signout",
  "userModel": "User",
  "attributes": [
    "authenticationDate",
    "longTermAuthenticationRequestTokenUsed",
    "isFromNewLogin",
    "memberOf",
    "email",
    "displayName",
    "firstname",
    "lastname",
    "languages",
    "userId",
    "uuid"
  ],
  "loginCallback": "loginCallback"
}
```

`${userModel}.uuid` is always injected

Attributes may comply with [contact schema](https://tools.ietf.org/html/draft-smarr-vcarddav-portable-contacts-00)
established by [Joseph Smarr][schema-author].

Attributes can be any key from `${userModel}.profile`.

If optional `loginCallback(req, service, user)` exist, `loopback-component-cas` call it when login occure.

### Specific case

* `email` come from model `${userModel}.email`
* `firstname` come from  `${userModel}.profile.name.givenName`
* `lastname`  come from  `${userModel}.profile.name.familyName`

---
_Source: https://npm.io/package/loopback-component-cas · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._