apereo / apereo/phpCAS

renewAuthentication doesn't force renew if user already authenticated

Open
#438 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
798
Forks
419
PR merge metrics
No merged PRs in 30d

Description

Hi,

This issue is quite related with this previous one: https://github.com/apereo/phpCAS/issues/93.

In this issue, this fixed has been made: https://github.com/apereo/phpCAS/commit/96a32a1183345c07b38da9ffe81f0699f2345d24#diff-fda8f069ddbab09f78110718008adf9bb2e330db9b2a2423c17a9bb4786e2990R1226

In my opinion the removal of $this->redirectToCas(false, true); is a mistake here (or the none use of $renew parameter in isAuthenticated, see below).

Because when you arrive to isAuthenticated first lines are:

    if ( $this->_wasPreviouslyAuthenticated() ) {
            if ($this->hasTicket()) {
                // User has a additional ticket but was already authenticated
                phpCAS::trace(
                    'ticket was present and will be discarded, use renewAuthenticate()'
                );

Which is a bit ironical (besides the fact it should read "use renewAuthentication()") since we are coming from it.
In the beginning of this function, if the user was previously authenticated (either he has a ticket or no), the function will return true, and won't be using the $renew parameter.
So renew is not renewing if user is already authenticated, unless I am mistaken.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading isAuthenticated, renewAuthentication, _wasPreviouslyAuthenticated, hasTicket, and redirectToCas, then compare the behavior with the linked prior change. Reproduce the case where a user is already authenticated and calls renewAuthentication; done means renewal is forced while ordinary isAuthenticated behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.