Support agentOptions configuration for requests to CAS server

.travis.yml

@@ -1,3 +1,3 @@
 language: node_js
 node_js:
-  - "0.10"
+  - "8"

README.md

@@ -23,6 +23,7 @@ Many of these options are borrowed from node's [url documentation](http://nodejs
     - `proxyValidate` Path to validate PGT (not implemented)
     - `proxy` Path to obtain a proxy ticket
     - `login` Path to the CAS login
+  - `agentOptions` - Options used when making requests to the CAS server ([see request's docs here](https://www.npmjs.com/package/request#using-optionsagentoptions))
 
 ## Usage
 

lib/configure.js

@@ -12,7 +12,8 @@ var defaults = {
         proxy: '/cas/proxy',
         login: '/cas/login',
         logout: '/cas/logout'
-    }
+    },
+    agentOptions : {},
 };
 
 module.exports = function(options){

lib/proxy-ticket.js

@@ -21,7 +21,7 @@ module.exports = function(options){
         options.query.pgt = req.session.pgt;
         options.pathname = options.paths.proxy;
 
-        request.get(url.format(options), function(err, res, body){
+        request.get(url.format(options), { agentOptions : options.agentOptions }, function(err, res, body){
             if (err || res.statusCode !== HttpStatus.OK) return redirectToLogin(options, req, res);
             if (/<cas:proxySuccess/.exec(body)) {
                 if (/<cas:proxyTicket>(.*)<\/cas:proxyTicket>/.exec(body)){

lib/service-validate.js

@@ -50,26 +50,27 @@ module.exports = function (overrides) {
                 if (storedSession && storedSession.st && (storedSession.st === ticket)) {
                     return next();
                 } else {
-                    validateService(res, formatUrl(options), function (casBody) {
+                    validateService(res, formatUrl(options), options.agentOptions, function (casBody) {
                         validateCasResponse(req, res, ticket, casBody, options, next);
                     });
                 }
 
             });
         // cookie session
         } else {
-            validateService(res, formatUrl(options), function (casBody) {
+            validateService(res, formatUrl(options), options.agentOptions, function (casBody) {
                 validateCasResponse(req, res, ticket, casBody, options, next);
             });
         }
 
     };
 };
 
-function validateService(res, url, callback) {
-
-    request.get(url, function(casErr, casRes, casBody){
+function validateService(res, url, agentOptions, callback) {
+    request.get(url, { agentOptions : agentOptions }, function(casErr, casRes, casBody){
         if (casErr || casRes.statusCode !== HttpStatus.OK){
+            if (casErr)
+                console.error(casErr);
             res.send(HttpStatus.UNAUTHORIZED);
             return;
         }

package.json

@@ -31,7 +31,7 @@
     "mocha": "~1.9.0",
     "should": "~1.2.2",
     "connect": "~2.7.6",
-    "express": "~3.2.0",
+    "express": "^4.16.0",
     "connect-redis": "~1.4.5"
   },
   "bugs": {

test/certs/localhost.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDLDCCAhQCCQCn4Orv4Cb7tjANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJB
+VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRAwDgYDVQQDDAdSb290IENBMB4XDTE4MDczMTAzMzkwNloXDTM4
+MDcyNjAzMzkwNlowWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9j
+YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvKg72NImqq+9
+gXjfhRcjbI9YOLgt0ctpGilleu0A65A+m3gkNThdpqzbuQw2ur/LpS77d5Bb7ve+
+skDhXmKjpSpmqM9+HHT4TF3GsDSCsqK7u0i44kxmHiAxH3xlOhwC5StMsrGI84CL
+ZtVCIVe9InRLVKwbXtMdBkROEgjBd4q7sh0qDxOPqlt4+544wBax1vpuI/J6Apiq
++yb6hKKrJpDYW+9LQXBkyNKi3upvuWYOL8iMdV6QuxD/9zM7UnMYMQhM4WWV0cQu
+X9sctj6fsOClboYPmu0L2SXY7G9VJ9i4QgplbZ6CPd8bx4NshNtxoivldLQL6kGz
+TUjc/Wl+lwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDQJQdz09uFzU8E2Qo7gAyO
+P10ZvlV0hI/pIYFqYO58kQMv5uiAadeSrFXdecpmaGhC0R2UQ5mtrCrOq5dv1y3S
+ImiCZuVzstm3BNRB8MteYeumP6IQ+GFEfIdHkfoiWxRFG/YJu8m/4OiJtTzBR19a
+9kLiuHsM10xl1INOWb9FNXLiNTRndECeyX8wXzwGMia/QgaN76SRbYYvqMDqiMmP
+RadmyI4HA0xTykZ3Oq1ZzAhGw2hU19yyZsqU/FhpdsqnGS/zNGuHRJ3i7RXx3wN6
+zQLHk2OJoG6CNj6d6O4gr3cWjtLToEqF40MGE196miEZnB6C8Oh0drCV/XSMGJ7K
+-----END CERTIFICATE-----

test/certs/localhost.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICnjCCAYYCAQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9j
+YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvKg72NImqq+9
+gXjfhRcjbI9YOLgt0ctpGilleu0A65A+m3gkNThdpqzbuQw2ur/LpS77d5Bb7ve+
+skDhXmKjpSpmqM9+HHT4TF3GsDSCsqK7u0i44kxmHiAxH3xlOhwC5StMsrGI84CL
+ZtVCIVe9InRLVKwbXtMdBkROEgjBd4q7sh0qDxOPqlt4+544wBax1vpuI/J6Apiq
++yb6hKKrJpDYW+9LQXBkyNKi3upvuWYOL8iMdV6QuxD/9zM7UnMYMQhM4WWV0cQu
+X9sctj6fsOClboYPmu0L2SXY7G9VJ9i4QgplbZ6CPd8bx4NshNtxoivldLQL6kGz
+TUjc/Wl+lwIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBACjehq4B6n7kPXO6LqOH
+wGcOm1rY9SL3O07SEgZINYovAV744OuoTYz5TyL1rnPgTT59hFBBPUJngYUImaVG
++tIoy+E0IFfDNTpXRfaxJBBijYfPailLSSrGrILbXRCNbHJw1Lq7TXdZ49KLgHY8
+iFKbuauhfalkjHIKbBGSp5GMXASzxhgzn407xY9jOJUpbAtxE1AvmhxFoPFE9Mdn
+LBAH8viNNcc5Xul9dSVoH69Axu6haKeHCFvybRqbmDEoA8tE6fGQahe5M4fFVCPl
+Sxoc3U+Q2N1i/wEkphuo7WCdsWKFgr0wAeZxkur8NXfMKAhbk/Mr7o+AoS6L5sQt
+Fps=
+-----END CERTIFICATE REQUEST-----

test/certs/localhost.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAvKg72NImqq+9gXjfhRcjbI9YOLgt0ctpGilleu0A65A+m3gk
+NThdpqzbuQw2ur/LpS77d5Bb7ve+skDhXmKjpSpmqM9+HHT4TF3GsDSCsqK7u0i4
+4kxmHiAxH3xlOhwC5StMsrGI84CLZtVCIVe9InRLVKwbXtMdBkROEgjBd4q7sh0q
+DxOPqlt4+544wBax1vpuI/J6Apiq+yb6hKKrJpDYW+9LQXBkyNKi3upvuWYOL8iM
+dV6QuxD/9zM7UnMYMQhM4WWV0cQuX9sctj6fsOClboYPmu0L2SXY7G9VJ9i4Qgpl
+bZ6CPd8bx4NshNtxoivldLQL6kGzTUjc/Wl+lwIDAQABAoIBAG1Uobo5r6bjSdOq
+lP6wNhtHxzy3n/YhB7vdma3vg8UARwgaTAF7tOpO6tcGuQDo/b+wxpK32k9Wy/DJ
+oNHuICArvmq+NLuRHgRDpE2hYMzdeiZDMsISvGthBJbWpGNUsGjW+w/jyxYyvJbP
+qA9ipX0+IBnl08bUWdGz6/qPkG8RvBBs1T1nB86ZTuGcz3gqiBOjMsvUvLY8eiO8
+KTZDqrdNzWjKyRBElI15F+S5VhGcqWLlEMtwUwwmpzvk+8GHpW4ZTsV9L8vTVKwN
+YdvHzGP+BqgObVTYWALZk38Z7FgQYMhBi4l68wLiqTRChIVcOCIILqMire/4L5Yu
+1Mco2gECgYEA6jU5JFyN3qsRFgCEPJqDQ4uRuVc4xazUn1KWoosD79R6v1eQfYTw
+ZvcAIilNZ1FyI5x1K7X6M48hbWcqrWHhkbNRBH+iyJTRN/KA2VeoHBQ1x9dVjPGq
+G5GvnV0rm6OZ6HE98Jqn1mSdrVgh4vj7zMtfqwSIJshaSeQtajaajNcCgYEAzjYA
+sri4uLJ/HQzDbllvu2q+RA2SM7w9GbQ5Aj94tZWz0WqpQkwqwq3YLrUDEEJLynC3
+rVCnRApNpUG8Tzy2QQa+O6MdtRnFJszj+Ez4i5EqYDt1fuQ3EdoKiEmj5nmeHXzT
+HgOxfA92yac/SnUIPOn+BZI3DMZouO5jjPFepEECgYEAr6vOOZTmoN8FSNCIX4Cx
+9ocIfdGLdtIFBaAH9tF42Xoxu7WtXkjJnSGlyvnZ4iY4C7f+NxQfIG86bnoUi8pA
+TG4I1ev6qKLfLyzJMrzKDo2mLUg6FibqJhWneMx6uhoDhlLyV7dZLrl3f578g+en
+ztu43Wjfyt86wfPRkLp2QC8CgYAUZtti00vTWjWhViXvwQGA9WqlqQISBEm3RVFu
+m4EB1jHYQklEuexxHmoJFPecoDKHcOd7SkOCQ9KyyvIqlMMjY9tmYxkJVedfk13q
+rxLYHCCpLLjPOR0JsxzfpwmEP/wYxsTMb2kb8Ru7j8R/RVzvSedL/c9cgDTUNyG6
+TBclAQKBgQCLSesmfnICP5H4ivBr0R9OXFP9FdoPvb8rgmvi7cexZslHxLLSfa5G
+Sz7JjEk0avIuICN1kRN5qRhSmmKYJVd7dsgSX+7npyjLNOheR5ac4hbd19tCa0Gu
+lvWHlHadePGuhGKRjTJyn3hPdiDEqZ7RuizWC9jKLN7h9084Q+N6rw==
+-----END RSA PRIVATE KEY-----

test/certs/rootCA.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA16YCcR0guWgb8t7WFXF8JBPjmwBhKpL8dD+MSrbKXvFTEzH+
+lHT/Dl+p9Dc4sKjc5cXA6c92xjJPj8Iqw8ky1f5IOR50B2bPcIbmTF4nc2sBkbAx
+9nejowWdKM9IQlxf4oEFCstVt55fNdYajJDxQQA2fXikN8O9CKS14kLz0RsQBQBp
+Xt87OA1Xd60Fhl1ROYAeB5DDNA26qGM4IaUd7iZJ7VsLb8ySPYSG2ou1QcCVOZLT
+2S2K6JGajcc4o1Qtqim9eIe2qXsWJbQO8CI6MB6Jq6D4jZGyNBijOm+3yjD150SL
+QCU+DLHQn8u2oHvJpREhSGIb/93b/mhVKzlkJQIDAQABAoIBACT0lxCJXFVJqRh6
+5ZcxJoQMQIIMk5o3LDpDtagMISwaERGGDMmmLxtoe3iVigqENa7Or9uhqQoYDxhk
+vu1kamjPtdLMDDhEfyIajBbkP8CAwvkTh8xj/k/uo1seApUUvX3UfGe4Js1bv5c7
+RLt4D1ADWFMyPHot+hQkHeNTc/MObn277Brtq8H57h6Jnu6gk1ol6RNJS7EfgFa/
+GeeYUyUCJGn4cjVUWxTML6l/xzLKonHpeKWMObOj4ey2f1d2QVGDPDrsu5hXY07K
+Fx1vpXNX9fDOHVgYfnnW0u61Iwd5KeWQEBpvNm6FB5JNYAES9yyc13CFIwrKe6LV
+c255hPUCgYEA+4Gw4dDh/XpM+6KsAG8ur5ORtTUVjYGx847EAG5wgex1CjnONwl0
+DGiwWxC+KFir5vFnL4S0AW84VNaQdJJGbMmmC1NaCCyFQciDq8CzqTAUz7dOCkhR
+ofGkGGPuEYRD04Cb15RzF1yRGodqF4zPzWhZV0Dq8LYq2YoEtWsjfAsCgYEA24BQ
+shd88Mvp4yZQ+ICpVREDApvzD7ZX0ubZfLRc3qBDmY2OPSTBI1uJGYmVAVowTUIK
+cOf6XQGBz2DQmgkKFq3aeowA1XbaEwsqvJgnOT5HeA/nSzhIvCosONXphysMN49k
+k/nCIf+fd4pxqVLtDoE8imFCzGAGhGtK10Frjo8CgYA8ggQjH9Tu3bidpZJJ/HW3
+6gHZHa9Uvwon9YX0MJ3CtDeoQSX6mbygq6MaFZoaLNMWmadgiEWiPrbHumNAmFx3
+GcBn4yK66rMYk3wSGydeIeIv4wLUeHejRXZcI9aHwlFrFfroT5+s1ClYv5Fnnwnz
+ehJcapLbXIhMk+b0GpWL5wKBgQDG78uzLRCCmP1YbtCx+MH/pBRrV/X6BpQgRDNX
+D4ygBPZfg+knR1l4dyyRpZ0Tha8DRlh6LfU+N/BziFZnVMv89AJwUNUsorRQ0C0i
+km/yNJzHlvpUtSVOzJYZyN4HMJ+490/7wUAOWkQoLqSHBu5s1/qLnEzTODCP8UH6
+R4N4xwKBgQCcGpRDy4k4o78PXksfPOU0CBTwR9d9P3NBSxMmCBV8Cu73SRldQFt2
+mdGzmQROz/9TiKSCXj4iu0oA4nciWjF9cBdKXCXDDSomJ8s78Jbev0DIu9g5S5TW
+iTh2Kew30F9PC0kgVlsXCQL+Mq/Xn/zshaUoSbbQ5HPjeOR2CDj3Og==
+-----END RSA PRIVATE KEY-----

test/certs/rootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKjCCAhICCQCOPWEqfXiMczANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJB
+VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRAwDgYDVQQDDAdSb290IENBMB4XDTE4MDczMTAzMzc1NFoXDTM4
+MDcyNjAzMzc1NFowVzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEQMA4GA1UEAwwHUm9v
+dCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANemAnEdILloG/Le
+1hVxfCQT45sAYSqS/HQ/jEq2yl7xUxMx/pR0/w5fqfQ3OLCo3OXFwOnPdsYyT4/C
+KsPJMtX+SDkedAdmz3CG5kxeJ3NrAZGwMfZ3o6MFnSjPSEJcX+KBBQrLVbeeXzXW
+GoyQ8UEANn14pDfDvQikteJC89EbEAUAaV7fOzgNV3etBYZdUTmAHgeQwzQNuqhj
+OCGlHe4mSe1bC2/Mkj2EhtqLtUHAlTmS09ktiuiRmo3HOKNULaopvXiHtql7FiW0
+DvAiOjAeiaug+I2RsjQYozpvt8ow9edEi0AlPgyx0J/LtqB7yaURIUhiG//d2/5o
+VSs5ZCUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAHXvl2ehFGqJ2TEuSj2AtVjs2
+WOGB5bLKK/qx4Mn7Q75uO7ICEcFQ9atPxBpiIaofO1v+GMcJkRoPLTyPDGaeBDD6
+47YczoTcx4GkHTnllpM+4hTeMhV7lGnEgH10k9LXoquMDM5kUOSP8wYYZxfLHb+E
+ODPQSrm9HvEN92M0p/G3ASqJVcWi6QK37IiqijpIJl1nOCEw0P0r3+wFG4I4TO9D
+L2TJ6C5aZQNCIF7UxeKLexX0Maa3vz76DUPEPkezHlE7zdI0ZUdWjThY9RiGyxPT
+3CeB12NR8QjgA/vHMHFbuTO0rlu2WLcqUlJFQoWA6phvhkSaMm9Pq+e0Y4sSNA==
+-----END CERTIFICATE-----

test/certs/rootCA.srl

@@ -0,0 +1 @@
+A7E0EAEFE026FBB6

test/proxy-ticket.spec.js

@@ -5,15 +5,17 @@ var should = require('should');
 var parseUrl = require('url').parse;
 var request = require('request').defaults({strictSSL: false, followRedirect: false});
 var https = require('https');
-var http = require('http');
 var q = require('q');
 var fs = require('fs');
 
 var lastRequest;
 cas.configure({
-    protocol: 'http',
+    protocol: 'https',
     hostname: 'localhost',
-    port: 1337
+    port: 1337,
+    agentOptions : {
+        ca : fs.readFileSync(__dirname + "/certs/rootCA.pem"),
+    },
 });
 
 describe('#proxyTicket', function(){
@@ -100,10 +102,14 @@ var casServerSetup = function(done){
             res.send('<cas:serviceResponse><cas:proxyFailed></cas:proxyFailed></cas:serviceResponse>');
         }
     });
-    var server = http.createServer(app).listen(1337, done);
-    server.setTimeout(20);
+    var server = https.createServer({
+      key: fs.readFileSync(__dirname + '/certs/localhost.key'),
+      cert: fs.readFileSync(__dirname + '/certs/localhost.crt')
+    }, app).listen(1337, done);
+    // server.setTimeout(20);
     return server;
 };
+
 var serverSetup = function(options, done){
     var app = express()
     .use(connect.cookieParser())
@@ -119,8 +125,8 @@ var serverSetup = function(options, done){
         res.send('hello world');
     });
     var server = https.createServer({
-        key: fs.readFileSync(__dirname + '/certs/localhost3000.key'),
-        cert: fs.readFileSync(__dirname + '/certs/localhost3000.crt')
+        key: fs.readFileSync(__dirname + '/certs/localhost.key'),
+        cert: fs.readFileSync(__dirname + '/certs/localhost.crt')
     }, app).listen(3000, done);
     return server;
 };

test/service-validate.spec.js

@@ -3,15 +3,22 @@ var connect = require('connect');
 var cas = require('../');
 var should = require('should');
 var parseUrl = require('url').parse;
-var request = require('request').defaults({followRedirect: false, strictSSL: false});
-var https = require('https');
 var fs = require('fs');
-var http = require('http');
+var request = require('request').defaults({
+  followRedirect: false,
+  agentOptions : {
+      ca : fs.readFileSync(__dirname + '/certs/rootCA.pem'),
+  }
+});
+var https = require('https');
 
 cas.configure({
-    protocol: 'http',
+    protocol: 'https',
     hostname: 'localhost',
-    port: 1337
+    port: 1337,
+    agentOptions : {
+        ca : fs.readFileSync(__dirname + '/certs/rootCA.pem')
+    }
 });
 
 var lastRequest;
@@ -30,6 +37,16 @@ describe('#serviceValidate', function(){
         });
 
         describe('when ticket presented', function(){
+
+            it("can talk to cas server directly", function(done) {
+                request.get("https://localhost:1337/cas/serviceValidate?ticket=validTicket",
+                    { strictSSL : true, agentOptions : { ca : fs.readFileSync(__dirname + "/certs/rootCA.pem") } },
+                    function(err, response) {
+                    response.statusCode.should.equal(200);
+                    done();
+                });
+            });
+
             it('success if ticket valid', function(done){
                 request.get('https://localhost:3000/somePath?ticket=validTicket', function(err, response){
                     response.statusCode.should.equal(200);
@@ -49,7 +66,7 @@ describe('#serviceValidate', function(){
             it('redirect to login when no session and ticket invalid', function(done){
                 request.get({uri: 'https://localhost:3000/?ticket=invalidTicket', followRedirect: false}, function(err, response){
                     response.statusCode.should.equal(307);
-                    response.headers.location.should.equal('http://localhost:1337/cas/login?service=https%3A%2F%2Flocalhost%3A3000%2F');
+                    response.headers.location.should.equal('https://localhost:1337/cas/login?service=https%3A%2F%2Flocalhost%3A3000%2F');
                     done();
                 });
             });
@@ -96,7 +113,7 @@ describe('#serviceValidate', function(){
             it('keeps the querystring parameters during the redirect', function(done){
                 request.get({uri: 'https://localhost:3000/?randomquerystring=true', followRedirect: false}, function(err, response){
                     response.statusCode.should.equal(307);
-                    response.headers.location.should.equal('http://localhost:1337/cas/login?service=https%3A%2F%2Flocalhost%3A3000%2F%3Frandomquerystring%3Dtrue');
+                    response.headers.location.should.equal('https://localhost:1337/cas/login?service=https%3A%2F%2Flocalhost%3A3000%2F%3Frandomquerystring%3Dtrue');
                     done();
                 });
             });
@@ -227,10 +244,14 @@ var casServerSetup = function(done){
         }
         res.end(response);
     });
-    var server = http.createServer(app).listen(1337, done);
-    server.setTimeout(50);
+    var server = https.createServer({
+      key: fs.readFileSync(__dirname + '/certs/localhost.key'),
+      cert: fs.readFileSync(__dirname + '/certs/localhost.crt')
+    }, app).listen(1337, done);
+    // server.setTimeout(50);
     return server;
 };
+
 var serverSetup = function(options, done){
     var app = express()
     .use(connect.cookieParser())
@@ -250,8 +271,8 @@ var serverSetup = function(options, done){
         res.end('hello world');
     });
     var server = https.createServer({
-        key: fs.readFileSync(__dirname + '/certs/localhost3000.key'),
-        cert: fs.readFileSync(__dirname + '/certs/localhost3000.crt')
+        key: fs.readFileSync(__dirname + '/certs/localhost.key'),
+        cert: fs.readFileSync(__dirname + '/certs/localhost.crt')
     }, app).listen(3000, done);
     //server.setTimeout(20);
     return server;