Add url to force authentication check

Would like to know more about what you're trying to accomplish rather than how you're trying to accomplish it. In the Redirection settings under the cas settings page you can require authentication for specific pages and list any number of wild card masks for pages that you need people to go through cas to get to. Is this functionality not sufficient? If notwhat's the delta here?

Abstracting from your request a bit, it seems that this issue (and the similar requests in the past) could be better dealt with by creating a more robust API for custom modules to interact with. As you describe, cas_login_check() should take some parameters, including "force authentication". I agree.

I've added a $force_authentication parameter to cas_login_check() and refactored cas_init():

@@ -27,152 +27,154 @@ function cas_init() {
-  cas_login_check();
+
+  $force_authentication = _cas_force_login();
+  $check_authentication = _cas_allow_check_for_login();
+  if ($force_authentication || $check_authentication) {
+    cas_login_check($force_authentication);
+  }

Attached patch is for 7.x-1.x. Backport to 6.x-3.x should be obvious. Thoughts?

Hmm, the patch in #3 is very hard to review. Instead please review this attached patch which is smaller because it does not dedent a large region of code.

And for 6.x-3.x, also with an easy-to-review patch leaving indenting broken. (We'll just clean up the indenting immediately prior to commit).

I reviewed and tested the 7.x version of this patch and it seems to perform as advertised. I was able to invoke cas_check_login from a helper module and get the desired behavior.

Committed to 7.x-1.x and 6.x-3.x. Thanks for the review Dave.

Marc: Can you put a patch together for what you are thinking?

I agree that we should probably check if $user exists before calling those other two functions.

Follow-up fix:

Now you check always "force login" and "check login" even if user is connected.

Committed to 6.x-3.x and 7.x-1.x.

Hi Marc:

I certainly agree with the spirit but I think that making cas_login_check even more monolithic would be going in the wrong direction.

Instead you'll now be able to implement the check_cas path yourself in a custom module. Over time this will give other developers additional flexibility and we can include the most popular and versatile configurations back into the main CAS module.

For example:

/**
 * Check with the CAS server to see if the user is already logged in.
 */
function check_cas_init() {
  if (arg(0) == 'check_cas') {
    cas_login_check(FALSE);
  }
}