SugarCRM如何集成CAS

 

公司需要使用SugarCRM且与其他系统集成，但是又需要使用cas单点登录。所以必须修改SugarCRM源代码，经过多次尝试，找到相对比较靠谱的方法，记录如下：

• 修改config.php

在最后面加上如下这句

'authenticationClass' => 'CASAuthenticate',

这句话的意思应该是让自定义的CASAuthenticate类全面接管授权工作

• 修改index.php

增加如下语句:

因为我下载的是6.1.2所以无需增加

require_once('modules/Users/authentication/AuthenticationController.php');

$authController = new AuthenticationController((!empty($GLOBALS['sugar_config']['authenticationClass'])? $GLOBALS['sugar_config']['authenticationClass'] : 'SugarAuthenticate'));

• 创建授权类文件

创建如下目录

SugarCE/modules/Users/authentication/CASAuthenticate

建立如下两个文件:

CASAuthenticate.php

---

<?php

if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');

require_once('modules/Users/authentication/SugarAuthenticate/SugarAuthenticate.php');

require_once('CAS.php');

/********************************************************************

 * Module that allows Sugar to perform user authentication using

 *  CAS.

 *********************************************************************/

class CASAuthenticate extends SugarAuthenticate {

    var $userAuthenticateClass = 'CASAuthenticateUser';

    var $authenticationDir = 'CASAuthenticate';

      

      

      function CASAuthenticate(){

      parent::SugarAuthenticate();

//                  require_once('modules/Users/authentication/'. $this->authenticationDir . '/'. $this->userAuthenticateClass . '.php');

//        $this->userAuthenticate = new $this->userAuthenticateClass();

            $this->doCASAuth();           

          } 

      

        function doCASAuth(){

                

         @session_start();

                                 

        // Don't try to login if the user is logging out

        if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'Logout') {

            echo "logout xxxxxxx";

            $this->logout();

        }

        // If the user is already authenticated, do this.

        elseif (isset($_SESSION['authenticated_user_id']) ) {

            $this->sessionAuthenticate();   

            return;

        }

                   // Try to log the user in via SSO

        else {

            if ($this->userAuthenticate->loadUserOnLogin() == true) {

              parent::postLoginAuthenticate();

                 }

          else {

            die(); //I should redirect here.  I'm not sure on the syntax -- sorry.

                       } //end nested else.

        } // end top else.

        } //end doCASAuth()

 

     

        function sessionAuthenticate(){

        

        global $module, $action, $allowed_actions;

        $authenticated = false;

        $allowed_actions = array ("Authenticate", "Login"); // these are actions where the user/server keys aren't compared

        if (isset ($_SESSION['authenticated_user_id'])) {

            $GLOBALS['log']->debug("We have an authenticated user id: ".$_SESSION["authenticated_user_id"]); 

            $authenticated = $this->postSessionAuthenticate();

        } else

            if (isset ($action) && isset ($module) && $action == "Authenticate" && $module == "Users") {

            $GLOBALS['log']->debug("We are NOT authenticating user now.  CAS will redirect.");

        } 

        return $authenticated;

        } //end sessionAuthenticate()

       

      function postSessionAuthenticate(){

       

        global $action, $allowed_actions, $sugar_config;

        $_SESSION['userTime']['last'] = time();

        $user_unique_key = (isset ($_SESSION['unique_key'])) ? $_SESSION['unique_key'] : '';

        $server_unique_key = (isset ($sugar_config['unique_key'])) ? $sugar_config['unique_key'] : '';

        

        //CHECK IF USER IS CROSSING SITES

        if (($user_unique_key != $server_unique_key) && (!in_array($action, $allowed_actions)) && (!isset ($_SESSION['login_error']))) {

            

            session_destroy();

            $post_login_nav = '';

            if (!empty ($record) && !empty ($action) && !empty ($module)) {

                $post_login_nav = "&login_module=".$module."&login_action=".$action."&login_record=".$record;

            }

            $GLOBALS['log']->debug('Destroying Session User has crossed Sites');

            //header("Location: index.php?action=Login&module=Users".$post_login_nav);

            sugar_cleanup(true);

                        die(); 

        }

        if (!$this->userAuthenticate->loadUserOnSession($_SESSION['authenticated_user_id'])) {

            session_destroy();

            //header("Location: index.php?action=Login&module=Users");

            $GLOBALS['log']->debug('Current user session does not exist redirecting to login');

            sugar_cleanup(true);

                        die(); 

               }

        $GLOBALS['log']->debug('Current user is: '.$GLOBALS['current_user']->user_name);

        return true;

          }//end postSessionAuthenticate()

  

        function logout() {

        phpCAS::setDebug();

        phpCAS::client(SAML_VERSION_1_1,'xxx.xxx.xxx',xxx,'Context',false);//CAS服务端的地址，端口号，与上下文

        phpCAS::setNoCasServerValidation();

        phpCAS::logout(); 

      }

}//end CASAuthenticate class

---

CASAuthenticateUser.php

---

<?php

if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');

require_once('modules/Users/authentication/SugarAuthenticate/SugarAuthenticateUser.php');

require_once('CAS.php');

class CASAuthenticateUser extends SugarAuthenticateUser {

    /********************************************************************************

     * This is called when a user logs in 

     *

     * @param STRING $name

     * @param STRING $password

     * @return boolean

     ********************************************************************************/

     

     function loadUserOnLogin() {

     

      $name=$this->authUser();

        if(empty($name)){

           return false;              

        }

     else{

            $GLOBALS['log']->debug("Starting user load for ". $name);

            $this->loadUserOnSession($user_id);

        return true; 

        }

      }//end loadUserOnlogin()

  

   /**********************************************************************************************************************

    * Attempt to authenticate the user via CAS SSO

    ***********************************************************************************************************************/

    

      function authUser() {

         phpCAS::setDebug();

         phpCAS::client(SAML_VERSION_1_1,'xxx.xxx.xxx',xxx,'Context',false);//CAS服务端的地址，端口号，与上下文

         phpCAS::setNoCasServerValidation();

         phpCAS::forceAuthentication();

         $authenticated = phpCAS::isAuthenticated();

        if ($authenticated)

        {   

            $user_name = phpCAS::getUser();

            $query = "SELECT * from users where user_name='$user_name' and deleted=0";

            $result =$GLOBALS['db']->limitQuery($query,0,1,false);

            $row = $GLOBALS['db']->fetchByAssoc($result);

            if (!empty ($row))

            {

                $_SESSION['authenticated_user_id'] = $row['id'];

            }

            else // row in Sugar DB was empty, even though user is in CAS.

            {  $user_id=$this->createSugarUser($name);

                  $_SESSION['authenticated_user_id'] = $userid;

              return;

            }            

            $_SESSION['login_user_name'] = $user_name;

            $_REQUEST['user_password'] = 'foobar';

           

            $action = 'Authenticate';

            $module = 'Users';

            $_REQUEST['action'] = 'Authenticate';

            $_REQUEST['module'] = 'Users';

            $_REQUEST['return_module'] = 'Users';

            $_REQUEST['action_module'] = 'Login';

                        

            return $user_name; // SSO authentication was successful

            

        }

        else // not authenticated in CAS.

        {            

          return;

        }

           

      }//end authenticateSSO();

        

   

     function createSugarUser($name) {

            $user = new User();

            $user->user_name = $name;

            $user->employee_status = 'Active';

            $user->status = 'Active';

            $user->is_admin = 0;

            

            if ($name =='admin'){

            $user->is_admin = 1;

            }

           

            $user->save();

            // Force the user to go to the home screen

            $_REQUEST['action'] = 'index';

            $_REQUEST['module'] = 'Home';

           // Return the user's GUID

           return $user->id;

    }//createSugarUser

      

/************************************************************************************************************/

/************************************************************************************************************/

}//End CASAuthenticateUSer class.

?>

---

修改login.php

将原来的

$sugar_smarty->display('modules/Users/login.tpl');

为

if($sugar_config["authenticationClass"] == "CASAuthenticate"){

      header('Location: index.php?module=Home&action=index');

}

else {

      $sugar_smarty->display('modules/Users/login.tpl');

}