SugarCRM如何集成CAS
公司需要使用SugarCRM且与其他系统集成，但是又需要使用cas单点登录。所以必须修改SugarCRM源代码，经过多次尝试，找到相对比较靠谱的方法，记录如下：
- 修改config.php
在最后面加上如下这句
'authenticationClass' => 'CASAuthenticate',
这句话的意思应该是让自定义的CASAuthenticate类全面接管授权工作
- 修改index.php
增加如下语句:
因为我下载的是6.1.2所以无需增加
require_once('modules/Users/authentication/AuthenticationController.php');$authController = new AuthenticationController((!empty($GLOBALS['sugar_config']['authenticationClass'])? $GLOBALS['sugar_config']['authenticationClass'] : 'SugarAuthenticate'));
- 创建授权类文件
创建如下目录
SugarCE/modules/Users/authentication/CASAuthenticate
建立如下两个文件:
CASAuthenticate.php
<?php
if
(!defined(
'sugarEntry'
) || !sugarEntry)
die
(
'Not A Valid Entry Point'
);
require_once
(
'modules/Users/authentication/SugarAuthenticate/SugarAuthenticate.php'
);
require_once
(
'CAS.php'
);
/********************************************************************
* Module that allows Sugar to perform user authentication using
* CAS.
*********************************************************************/
class
CASAuthenticate
extends
SugarAuthenticate {
var
$userAuthenticateClass
=
'CASAuthenticateUser'
;
var
$authenticationDir
=
'CASAuthenticate'
;
function
CASAuthenticate(){
parent
::SugarAuthenticate();
// require_once('modules/Users/authentication/'. $this->authenticationDir . '/'. $this->userAuthenticateClass . '.php');
// $this->userAuthenticate = new $this->userAuthenticateClass();
$this->doCASAuth();
}
function
doCASAuth(){
@session_start();
// Don't try to login if the user is logging out
if
(
isset
($_REQUEST[
'action'
]) && $_REQUEST[
'action'
] ==
'Logout'
) {
echo
"logout xxxxxxx"
;
$this->logout();
}
// If the user is already authenticated, do this.
elseif
(
isset
($_SESSION[
'authenticated_user_id'
]) ) {
$this->sessionAuthenticate();
return
;
}
// Try to log the user in via SSO
else
{
if
($this->
userAuthenticate
->loadUserOnLogin() ==
true
) {
parent
::postLoginAuthenticate();
}
else
{
die
();
//I should redirect here. I'm not sure on the syntax -- sorry.
}
//end nested else.
}
// end top else.
}
//end doCASAuth()
function
sessionAuthenticate(){
global
$module, $action, $allowed_actions;
$authenticated =
false
;
$allowed_actions =
array
(
"Authenticate"
,
"Login"
);
// these are actions where the user/server keys aren't compared
if
(
isset
($_SESSION[
'authenticated_user_id'
])) {
$GLOBALS[
'log'
]->debug(
"We have an authenticated user id: "
.$_SESSION[
"authenticated_user_id"
]);
$authenticated = $this->postSessionAuthenticate();
}
else
if
(
isset
($action) &&
isset
($module) && $action ==
"Authenticate"
&& $module ==
"Users"
) {
$GLOBALS[
'log'
]->debug(
"We are NOT authenticating user now. CAS will redirect."
);
}
return
$authenticated;
}
//end sessionAuthenticate()
function
postSessionAuthenticate(){
global
$action, $allowed_actions, $sugar_config;
$_SESSION[
'userTime'
][
'last'
] = time();
$user_unique_key = (
isset
($_SESSION[
'unique_key'
])) ? $_SESSION[
'unique_key'
] :
''
;
$server_unique_key = (
isset
($sugar_config[
'unique_key'
])) ? $sugar_config[
'unique_key'
] :
''
;
//CHECK IF USER IS CROSSING SITES
if
(($user_unique_key != $server_unique_key) && (!in_array($action, $allowed_actions)) && (!
isset
($_SESSION[
'login_error'
]))) {
session_destroy();
$post_login_nav =
''
;
if
(!
empty
($record) && !
empty
($action) && !
empty
($module)) {
$post_login_nav =
"&login_module="
.$module.
"&login_action="
.$action.
"&login_record="
.$record;
}
$GLOBALS[
'log'
]->debug(
'Destroying Session User has crossed Sites'
);
//header("Location: index.php?action=Login&module=Users".$post_login_nav);
sugar_cleanup(
true
);
die
();
}
if
(!$this->
userAuthenticate
->loadUserOnSession($_SESSION[
'authenticated_user_id'
])) {
session_destroy();
//header("Location: index.php?action=Login&module=Users");
$GLOBALS[
'log'
]->debug(
'Current user session does not exist redirecting to login'
);
sugar_cleanup(
true
);
die
();
}
$GLOBALS[
'log'
]->debug(
'Current user is: '
.$GLOBALS[
'current_user'
]->
user_name
);
return true
;
}
//end postSessionAuthenticate()
function
logout() {
phpCAS::setDebug();
phpCAS::client(SAML_VERSION_1_1,
'xxx.xxx.xxx'
,xxx,
'Context'
,
false
);/
/CAS服务端的地址，端口号，与上下文
phpCAS::setNoCasServerValidation();
phpCAS::logout();
}
}
//end CASAuthenticate class
CASAuthenticateUser.php
<?php
if
(!defined(
'sugarEntry'
) || !sugarEntry)
die
(
'Not A Valid Entry Point'
);
require_once
(
'modules/Users/authentication/SugarAuthenticate/SugarAuthenticateUser.php'
);
require_once
(
'CAS.php'
);
class
CASAuthenticateUser
extends
SugarAuthenticateUser {
/********************************************************************************
* This is called when a user logs in
*
* @param STRING $name
* @param STRING $password
* @return boolean
********************************************************************************/
function
loadUserOnLogin() {
$name=$this->authUser();
if
(
empty
($name)){
return false
;
}
else
{
$GLOBALS[
'log'
]->debug(
"Starting user load for "
. $name);
$this->loadUserOnSession($user_id);
return true
;
}
}
//end loadUserOnlogin()
/**********************************************************************************************************************
* Attempt to authenticate the user via CAS SSO
***********************************************************************************************************************/
function
authUser() {
phpCAS::setDebug();
phpCAS::client(SAML_VERSION_1_1,
'xxx.xxx.xxx'
,xxx,
'Context'
,
false
);/
/CAS服务端的地址，端口号，与上下文
phpCAS::setNoCasServerValidation();
phpCAS::forceAuthentication();
$authenticated = phpCAS::isAuthenticated();
if
($authenticated)
{
$user_name = phpCAS::getUser();
$query =
"SELECT * from users where user_name='
$user_name
' and deleted=0"
;
$result =$GLOBALS[
'db'
]->limitQuery($query,0,1,
false
);
$row = $GLOBALS[
'db'
]->fetchByAssoc($result);
if
(!
empty
($row))
{
$_SESSION[
'authenticated_user_id'
] = $row[
'id'
];
}
else
// row in Sugar DB was empty, even though user is in CAS.
{ $user_id=$this->createSugarUser($name);
$_SESSION[
'authenticated_user_id'
] = $userid;
return
;
}
$_SESSION[
'login_user_name'
] = $user_name;
$_REQUEST[
'user_password'
] =
'foobar'
;
$action =
'Authenticate'
;
$module =
'Users'
;
$_REQUEST[
'action'
] =
'Authenticate'
;
$_REQUEST[
'module'
] =
'Users'
;
$_REQUEST[
'return_module'
] =
'Users'
;
$_REQUEST[
'action_module'
] =
'Login'
;
return
$user_name;
// SSO authentication was successful
}
else
// not authenticated in CAS.
{
return
;
}
}
//end authenticateSSO();
function
createSugarUser($name) {
$user =
new
User();
$user->
user_name
= $name;
$user->
employee_status
=
'Active'
;
$user->
status
=
'Active'
;
$user->
is_admin
= 0;
if
($name ==
'admin'
){
$user->
is_admin
= 1;
}
$user->save();
// Force the user to go to the home screen
$_REQUEST[
'action'
] =
'index'
;
$_REQUEST[
'module'
] =
'Home'
;
// Return the user's GUID
return
$user->
id
;
}
//createSugarUser
/************************************************************************************************************/
/************************************************************************************************************/
}
//End CASAuthenticateUSer class.
?>
修改login.php
将原来的
$sugar_smarty->display('modules/Users/login.tpl');
为
if
($sugar_config[
"authenticationClass"
] ==
"CASAuthenticate"
){
header(
'Location: index.php?module=Home&action=index'
);
}
else
{
$sugar_smarty->display(
'modules/Users/login.tpl'
);
}