{ "info": { "author": "James Macdonell", "author_email": "jmacdone@csusb.edu", "bugtrack_url": null, "classifiers": [], "description": "# cas-simulation\n\nA way to simulate a web browser visiting a service authenticated by\n[CAS](https://en.wikipedia.org/wiki/Central_Authentication_Service) and\nproceeding through the authentication.\n\nOriginally developed to facilitate authenticated service checks in Nagios.\n\n# `check_cas_sp`\n\n`cas_simulation` object instances are created using the included `check_cas_sp`\nscript, intended to be called from Nagios\n\nThe simulation will follow redirects from a starting URL (typically a service\nprovider like https://myportal.example.edu) until it reaches a form that it\nbelieves is a CAS authentication page (at least the one presented by the\nJASIG/Apereo implementation). It will then submit the form using the\ncredentials provided. It will follow redirects and submit forms (e.g. \"Click\nhere to continue\" javascript alternatives) until it receives a 200 OK page\nwithout a form, or the form contains an `id` or `action` attribute matching\nargument provided to the `--form`.\n\nThe final landing page is searched for an expected pattern using\n`--expression`. If it matches, the script returns 0 which corresponds to a OK\nin Nagios API. Otherwise it returns 2 for CRITICAL\n\nOptionally, the `check_cas_sp` will also fetch and check an expression against\na URL that is only expected to be available after authentication. This would\nsimulate clicking a link on a portal after logging in.\n\n## Gotchas\n\nNotably, the `--verbose` option stupidly assumes it can write to\n`/var/log/nagios`\n\n## Examples\n\n`check_cas_sp --help`\n\nList all current command line options\n\n\n```\ncheck_cas_sp \\\n --url https://fee-portal.csusb.edu/auth/shibboleth\" \\\n --expression \"Fines .{1,30}for Joe Coyote\" \\\n -w 5.0 \\\n --post-auth-check https://fee-portal.csusb.edu/fines/alma \"Balance [Dd]ue\" \\\n --credentials \"/etc/cas/joe-creds.json\" \\\n```\n\nAuthenticate fee-portal.csusb.edu using the credentials in\n/etc/cas/joe-creds.json. The post authentication redirect contains \"Fines and\nfees for Joe Coyote\" and should match the regular expression given.\n\nAfter that check, also check a url that requires an authenticated active\nsession. In this case, a check for the Alma library fees that should contain\nthe text \"Balance Due\". Return WARNING if the authentication takes more than 5\nseconds. (It probably *should* be `--post-auth-url` and\n`--post-auth-expression` instead of being combined like it is.)\n\n\n```\ncheck_cas_sp \\\n --url https://my.csusb.edu \\\n --expression 'Signed in as Joe Coyote