Example Configuration for Apache

The example below is valid provided that:

• it concerns a service provided by an Apache web server
• the part of the service to be protected is located in a subdirectory/sub-URL of the website
• you have the Apache module mod_auth_cas installed.

Configuration

Loading the Module

Usually handled by the file /etc/httpd/conf.modules.d/10-auth_cas.conf that comes with mod_auth_cas (RPM package mod_auth_cas).
Otherwise you have to manually add it:

<IfModule !auth_cas_module>
LoadModule auth_cas_module modules/mod_auth_cas.so
</IfModule>

General Configuration

CASCookiePath /var/cache/httpd/mod_auth_cas/

# NOTE: Choose Joint Web Login production or testing environment by activating the relevant lines!
CASLoginURL https://weblogin.uu.se/idp/profile/cas/login
CASValidateURL https://weblogin.uu.se/idp/profile/cas/serviceValidate

CASVersion 2
CASDebug On

# use Red Hat's CA certificate bundle (should continue to work as long as Joint Web Login is using a well-known, commercial certificate issuer)
CASCertificatePath /etc/pki/tls/certs/ca-bundle.crt

CASTimeout 28800
CASIdleTimeout 28800

The Protection Itself

# protect a single directory; any valid user is let in
<Directory "/var/www/html/wordpress">
Require valid-user
AuthType CAS
</Directory>

# protect a single directory; only certain users will be let in
<Directory "/var/www/html/phpmyadmin">
Require user abcd1234 efgh5678
AuthType CAS
</Directory>

# protect a certain URL; any valid user is let in
<Location "/secure">
Require valid-user
AuthType CAS
</Location>

# protect the entire site; any valid user is let in
<Location "/">
Require valid-user
AuthType CAS
</Location>

See /usr/share/doc/mod_auth_cas-*/README on your server for information on more directives to mod_auth_cas.

Logout

To log the user out of a protected resource but not out of the Joint Web Login service as a whole, you need to delete the cookies that mod_auth_cas set in the visitor's browser for the protected resource. You can do this by making sure the user selects a logout link on the form http[s]://myservice.uu.se/wordpress/?ServiceLogout=true. The request is captured by mod_rewrite and results in a Set-Cookie-header from mod_headers that deletes the cookies and redirects to the home page of the website:

RewriteEngine On

# detect HTTPS
RewriteCond %{HTTPS} =on [NC]
RewriteRule .* - [E=PROTOCOL:https]

# detect HTTP
RewriteCond %{HTTPS} !=on [NC]
RewriteRule .* - [E=PROTOCOL:http]

# catch logout requests for CAS-protected resources
RewriteCond %{QUERY_STRING} (^|[;&])ServiceLogout($|[;&=])

# where to redirect on CAS logouts (here: to the front page of the current website -- adjust as needed)
# this also captures the path of the protected resource (needed for unsetting CAS cookies)
RewriteRule ^((/[^/]*)*/)([^/]*)$ %{ENV:PROTOCOL}://%{SERVER_NAME}/? [R,L,E=COOKIE_PATH:$1]

# unset MOD_AUTH_CAS/MOD_AUTH_CAS_S cookie for a certain path (COOKIE_PATH environment variable set by mod_rewrite)
Header always set Set-Cookie "MOD_AUTH_CAS=;Path=%{COOKIE_PATH}e; HttpOnly; expires=Thu, 01 Jan 1970 00:00:00 GMT" "expr=%{HTTPS} != 'on' && -n reqenv('COOKIE_PATH')"
Header always set Set-Cookie "MOD_AUTH_CAS_S=;Secure;Path=%{COOKIE_PATH}e; HttpOnly; expires=Thu, 01 Jan 1970 00:00:00 GMT" "expr=%{HTTPS} == 'on' && -n reqenv('COOKIE_PATH')"

Where the user is redirected after logging out is up to you. If the entire website is protected by CAS, you must redirect the user to a completely different website. If not, the user will automatically be logged in again when landing on the home page.
Remember that the user is still logged in to Joint Web Login, and therefore automatically logged in to everything that requires a login – including the home page.