[Fusionforge-commits] r15779 - trunk/src/plugins/authcas

Olivier Berger olberger at fusionforge.org
Thu Jun 14 14:29:53 CEST 2012


Author: olberger
Date: 2012-06-14 14:29:53 +0200 (Thu, 14 Jun 2012)
New Revision: 15779

Modified:
   trunk/src/plugins/authcas/README
Log:
Add warning about use of LDAP

Modified: trunk/src/plugins/authcas/README
===================================================================
--- trunk/src/plugins/authcas/README	2012-06-14 12:29:47 UTC (rev 15778)
+++ trunk/src/plugins/authcas/README	2012-06-14 12:29:53 UTC (rev 15779)
@@ -1,8 +1,15 @@
 fusionforge-plugin-authcas
 --------------------------
 
-This is the external CAS authentication plugin for FusionForge.
+This is the external CAS authentication plugin for FusionForge. It is
+meant to be used in conjunction with the AuthLDAP plugin : CAS
+validates lognames (SSO perceived by the user) while LDAP retrieves
+her attributes.
 
+ATTENTION : if used with DB users (without LDAP), nothing guarantees
+that users logging in through CAS will be owners of the FusionForge
+accounts with the same login. This could leak to account hijacking.
+
 Installation:
 
 - files from include/ go to /usr/share/gforge/plugins/authcas/include/
@@ -20,7 +27,7 @@
 (which means you can't add someone to a group before his/her first
 login).
 
- -- Roland Mas <lolando at debian.org>, Wed, 23 Feb 2011 15:01:24 +0100
+ -- Olivier Berger <obergix at debian.org>, Thu, 14 Jun 2012 14:17:31 +0200
 
 External requirement:
 




More information about the Fusionforge-commits mailing list