Zabbix是一个强大的服务器/交换机监控应用，有zabbix-server, zabbix-client, zabbix-web 三部分。zabbix-web管理端是用php写的。
前文参考：CAS客户端整合（一） Discuz!
登录流程
修改代码前例行先确定登录流程
原登录过程
Zabbix的登录流程跟 Discuz 类似。系统从 cookie/session 中读取用户会话id，如果用户为 guest ，只提供部分页面访问。需要访问受限资源，需要再登录
CAS登录过程
Zabbix通过cas登录也跟Discuz几乎一样，不过这次保留了zabbix的cookie判断
代码修改
引入cas-php-client
CAS客户端路径/local/cas，新建/local/cas/CasClient.php:
phpCAS::client ( CAS_VERSION_2_0, CAS_SERVER_HOST, CAS_SERVER_PORT, CAS_SERVER_PATH );
// no SSL validation for the CAS server
phpCAS::setNoCasServerValidation ();
phpCAS::handleLogoutRequests();
/**
* 关闭url携带ticket参数，防止重复认证导致 ticket not recognized
* @see [https://www.cnblogs.com/next-door-boy/p/3372522.html]
*/
phpCAS::$_PHPCAS_CLIENT->setNoClearTicketsFromUrl ();
/include/config.inc.php中导入
// cas client
require_once dirname(__FILE__).\'/../local/cas/CasClient.php\';
// zabbix 核心
require_once dirname(__FILE__).\'/classes/core/Z.php\';
Zabbix 登录
Zabbix的用户登录验证统一接口/include/class/user/CWebUser::checkAuthentication.这里是主要的登录逻辑。zabbix从cookie中获取zbxsessionid，然后比对是否有效sessionid。如果是有效用户我们直接允许。如果是guest用户或没有 sessionid 则检查cas是否已登录，如果已登录则初始化用户信息（代码在下一步介绍）。
public static function checkAuthentication($sessionId) {
try {
if ($sessionId !== null) {
self::$data = API::User()->checkAuthentication([$sessionId]);
/*
* login as guest
* cas authentication.
*/
if (self::$data[\'alias\'] == ZBX_GUEST_USER && phpCAS::isAuthenticated()) {
$sessionId = login_via_cas(phpCAS::getUser());
self::setSessionCookie($sessionId);
return $sessionId;
}
}
if ($sessionId === null || empty(self::$data)) {
/*
* cas authentication.
*/
if (phpCAS::isAuthenticated()) {
$sessionId = login_via_cas(phpCAS::getUser());
self::setSessionCookie($sessionId);
return $sessionId;
}
self::setDefault();
self::$data = API::User()->login([
\'user\' => ZBX_GUEST_USER,
\'password\' => \'\',
\'userData\' => true
]);
if (empty(self::$data)) {
clear_messages(1);
throw new Exception();
}
$sessionId = self::$data[\'sessionid\'];
}
if (self::$data[\'gui_access\'] == GROUP_GUI_ACCESS_DISABLED) {
throw new Exception();
}
self::setSessionCookie($sessionId);
return $sessionId;
}
catch (Exception $e) {
self::setDefault();
return false;
}
}
初始化用户信息
根据用户名初始化用户信息，代码从/include/class/api/services/CUser::login() 方法修改而来
/**
* Login from cas
* init user info.
* @param $name
* @author Carl
*/
function login_via_cas($name) {
$userInfo = DBfetch(DBselect(
\'SELECT u.userid,u.attempt_failed,u.attempt_clock,u.attempt_ip\'.
\' FROM users u\'.
\' WHERE u.alias=\'.zbx_dbstr($name)
));
if (!$userInfo) {
//CUser::exception(ZBX_API_ERROR_PARAMETERS, _(\'Login name or password is incorrect.\'));
}
// check if user is blocked
if ($userInfo[\'attempt_failed\'] >= ZBX_LOGIN_ATTEMPTS) {
if ((time() - $userInfo[\'attempt_clock\']) < ZBX_LOGIN_BLOCK) {
//CUser::exception(ZBX_API_ERROR_PARAMETERS, _s(\'Account is blocked for %s seconds\', (ZBX_LOGIN_BLOCK - (time() - $userInfo[\'attempt_clock\']))));
}
DBexecute(\'UPDATE users SET attempt_clock=\'.time().\' WHERE alias=\'.zbx_dbstr($name));
}
// check system permissions
if (!check_perm2system($userInfo[\'userid\'])) {
//CUser::exception(ZBX_API_ERROR_PARAMETERS, _(\'No permissions for system access.\'));
}
$dbAccess = DBfetch(DBselect(
\'SELECT MAX(g.gui_access) AS gui_access\'.
\' FROM usrgrp g,users_groups ug\'.
\' WHERE ug.userid=\'.zbx_dbstr($userInfo[\'userid\']).
\' AND g.usrgrpid=ug.usrgrpid\'
));
if (zbx_empty($dbAccess[\'gui_access\'])) {
$guiAccess = GROUP_GUI_ACCESS_SYSTEM;
}
else {
$guiAccess = $dbAccess[\'gui_access\'];
}
// start session
$sessionid = md5(time().$name.rand(0, 10000000));
DBexecute(\'INSERT INTO sessions (sessionid,userid,lastaccess,status)\'.
\' VALUES (\'.zbx_dbstr($sessionid).\',\'.zbx_dbstr($userInfo[\'userid\']).\',\'.time().\',\'.ZBX_SESSION_ACTIVE.\')\'
);
$userid = $userInfo[\'userid\'];
$userData = DBfetch(DBselect(
\'SELECT u.userid,u.alias,u.name,u.surname,u.url,u.autologin,u.autologout,u.lang,u.refresh,u.type,\'.
\' u.theme,u.attempt_failed,u.attempt_ip,u.attempt_clock,u.rows_per_page\'.
\' FROM users u\'.
\' WHERE u.userid=\'.zbx_dbstr($userid)
));
$userData[\'debug_mode\'] = (bool) DBfetch(DBselect(
\'SELECT ug.userid\'.
\' FROM usrgrp g,users_groups ug\'.
\' WHERE ug.userid=\'.zbx_dbstr($userid).
\' AND g.usrgrpid=ug.usrgrpid\'.
\' AND g.debug_mode=\'.GROUP_DEBUG_MODE_ENABLED
));
$userData[\'userip\'] = (isset($_SERVER[\'HTTP_X_FORWARDED_FOR\']) && $_SERVER[\'HTTP_X_FORWARDED_FOR\'])
? $_SERVER[\'HTTP_X_FORWARDED_FOR\']
: $_SERVER[\'REMOTE_ADDR\'];
$userData[\'sessionid\'] = $sessionid;
$userData[\'gui_access\'] = $guiAccess;
if ($userInfo[\'attempt_failed\']) {
DBexecute(\'UPDATE users SET attempt_failed=0 WHERE userid=\'.zbx_dbstr($userInfo[\'userid\']));
}
CWebUser::$data = CUser::$userData = $userData;
return $sessionid;
}
登出
分析代码发现zabbix的登出全部转到 index.php 中处理。修改logout这一段
// VAR TYPE OPTIONAL FLAGS VALIDATION EXCEPTION
$fields = [
\'name\' => [T_ZBX_STR, O_NO, null, null, \'isset({enter})\', _(\'Username\')],
\'password\' => [T_ZBX_STR, O_OPT, null, null, \'isset({enter})\'],
\'sessionid\' => [T_ZBX_STR, O_OPT, null, null, null],
\'reconnect\' => [T_ZBX_INT, O_OPT, P_SYS|P_ACT, BETWEEN(0, 65535), null],
\'enter\' => [T_ZBX_STR, O_OPT, P_SYS, null, null],
\'autologin\' => [T_ZBX_INT, O_OPT, null, null, null],
\'request\' => [T_ZBX_STR, O_OPT, null, null, null],
// zabbix 独特的检查机制，如果不指定无法从 $_REQUEST 变量获取获取请求参数
\'logoutRequest\' => [T_ZBX_STR, O_OPT, null, null, null],
];
check_fields($fields);
// logout
if (isset($_REQUEST[\'reconnect\']) || !empty($_REQUEST[\'logoutRequest\'])) {
DBstart();
add_audit_details(AUDIT_ACTION_LOGOUT, AUDIT_RESOURCE_USER, CWebUser::$data[\'userid\'], \'\', _(\'Manual Logout\'),
CWebUser::$data[\'userid\']
);
DBend(true);
CWebUser::logout();
//$ref = empty($_SERVER[\'HTTP_REFERER\']) ? (\'http://\'.$_SERVER[\'SERVER_NAME\'].substr($_SERVER[\'PHP_SELF\'], 0, strrpos($_SERVER[\'PHP_SELF\'], \'/\')+1).\'index.php\') : $_SERVER[\'HTTP_REFERER\'];
// cas 退出后返回的地址
$ref = \'http://\'.$_SERVER[\'SERVER_NAME\'].substr($_SERVER[\'PHP_SELF\'], 0, strrpos($_SERVER[\'PHP_SELF\'], \'/\')+1).\'index.php\';
phpCAS::logoutWithRedirectService($ref);
redirect(\'index.php\');
}
小结
代码看起来很少，但是要仔细查看源码分析登录过程，然后在什么地方做修改还是比较费心思的。
这个流程同步登录已经没问题了，但是不能同步登出。
因为zabbix的session是以cookie的形式存储。而cas-server无法清除客户端本地的cookie，这里我们又直接根据cookie验证用户，所以跳过了cas的状态复查。
这么看来，如果换成cas认证，那么必须抛弃cookie认证？