PHPackages                             cas-system/laravel-client - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. cas-system/laravel-client

ActiveLibrary[Authentication & Authorization](/categories/authentication)

cas-system/laravel-client
=========================

Laravel client package for CAS (Central Authentication Service) integration

1.0.2(1mo ago)04↓80%MITPHPPHP ^7.2|^7.3|^7.4|^8.0

Since Jul 8Pushed 1mo agoCompare

[ Source](https://github.com/insol-dev/laravel-cas-client)[ Packagist](https://packagist.org/packages/cas-system/laravel-client)[ RSS](/packages/cas-system-laravel-client/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (10)Versions (4)Used By (0)

Laravel CAS Client Package
==========================

[](#laravel-cas-client-package)

A Laravel package for seamless single sign-on against **One System** (the CAS server). This package provides secure SSO authentication with JWT tokens, optional HMAC signature validation, and role-based access control.

Requirements
------------

[](#requirements)

- PHP `^7.2 | ^7.3 | ^7.4 | ^8.0` (PHP 8.1+ recommended)
- Laravel `^7.0 | ^8.0 | ^9.0 | ^10.0 | ^11.0 | ^12.0`
- `firebase/php-jwt ^6.0`, `guzzlehttp/guzzle ^7.0` (installed automatically)

Features
--------

[](#features)

- 🔐 **Secure SSO Authentication** - JWT token-based authentication
- 🛡️ **Signature Validation** - HMAC SHA-256 request signing
- 👥 **Role-Based Access Control** - Middleware for role protection
- 🔧 **Easy Configuration** - Environment-based setup
- 📝 **Comprehensive Logging** - Authentication event tracking
- ⚡ **Performance Optimized** - Token caching and validation
- 🎯 **Laravel Integration** - Native Laravel guards and middleware

Installation
------------

[](#installation)

### 1. Install via Composer

[](#1-install-via-composer)

```
composer require cas-system/laravel-client
```

### 2. Run the Installer (recommended)

[](#2-run-the-installer-recommended)

```
php artisan cas:install
```

The installer publishes the config and seeds the required `.env` keys. The package stores CAS authentication state in Laravel's session and cache, so it does **not** add database columns and you do **not** need to run a package migration.

Prefer to do it by hand? Publish just the config with the `cas-client-config` tag:

```
php artisan vendor:publish --tag=cas-client-config
```

### 3. Configure Environment Variables

[](#3-configure-environment-variables)

Add the following to your `.env` file. The `client_id` / `client_secret` are issued when you register this client in **One System** — store the secret server-side only, never in browser code:

```
# One System (CAS) server
CAS_SERVER_URL=http://127.0.0.1:8001
CAS_CLIENT_ID=your_client_id
CAS_CLIENT_SECRET=your_client_secret
CAS_CREATE_LOCAL_USERS=true

# Callback the browser is sent back to after login
CAS_CALLBACK_URL=https://yourapp.com/cas/callback

# Security settings (optional — must match the server if enabled)
CAS_ENABLE_SIGNATURE_VALIDATION=true
CAS_SIGNATURE_SECRET=your-shared-signature-secret
```

Quick Start
-----------

[](#quick-start)

### 1. Protect Routes with Middleware

[](#1-protect-routes-with-middleware)

The service provider auto-registers two middleware aliases: `cas.auth` and `cas.role`.

```
// In routes/web.php

// Any authenticated CAS user
Route::middleware(['cas.auth'])->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
    Route::get('/profile', [ProfileController::class, 'show']);
});

// Restrict by role — user needs ANY of the listed roles
Route::middleware(['cas.auth', 'cas.role:admin,manager'])->group(function () {
    Route::get('/admin', [AdminController::class, 'index']);
});
```

### 2. Manual Authentication

[](#2-manual-authentication)

```
use CasSystem\LaravelClient\Facades\CasClient;

class AuthController extends Controller
{
    public function login(Request $request)
    {
        $returnUrl = $request->query('return_url', route('dashboard'));
        $loginUrl = CasClient::getLoginUrl($returnUrl);
        return redirect($loginUrl);
    }

    public function callback(Request $request)
    {
        $token = $request->query('token');

        if (!$token) {
            return redirect()->route('login')->with('error', 'No authentication token provided');
        }

        $user = CasClient::validateToken($token);

        if ($user) {
            // Store user data in session
            session([
                'cas_user' => $user,
                'cas_token' => $token,
                'authenticated' => true
            ]);

            return redirect()->route('dashboard')->with('success', 'Login successful');
        }

        return redirect()->route('login')->with('error', 'Authentication failed');
    }

    public function logout(Request $request)
    {
        $token = session('cas_token');

        // Logout from CAS server
        CasClient::logout($token);

        // Clear local session
        session()->forget(['cas_user', 'cas_token', 'authenticated']);
        session()->invalidate();
        session()->regenerateToken();

        return redirect('/')->with('success', 'Logged out successfully');
    }
}
```

### 3. Access User Data

[](#3-access-user-data)

```
// In your controllers
public function dashboard(Request $request)
{
    $user = session('cas_user');
    $username = $user['username'];
    $email = $user['email'];
    $roles = $user['roles'] ?? [];

    return view('dashboard', compact('user', 'username', 'email', 'roles'));
}

// Check user roles
use CasSystem\LaravelClient\Facades\CasClient;

if (CasClient::userHasRole($user, 'admin')) {
    // User has admin role
}

if (CasClient::userHasAnyRole($user, ['admin', 'manager'])) {
    // User has admin OR manager role
}

if (CasClient::userHasAllRoles($user, ['user', 'verified'])) {
    // User has BOTH user AND verified roles
}
```

### 4. Blade Templates

[](#4-blade-templates)

```
{{-- In your Blade templates --}}
@if(session('authenticated'))

        Welcome, {{ session('cas_user.name') }}
        Email: {{ session('cas_user.email') }}
        Roles: {{ implode(', ', session('cas_user.roles', [])) }}

        @csrf
        Logout

@else
    Sign in with One System
@endif
```

Configuration
-------------

[](#configuration)

### Environment Variables

[](#environment-variables)

```
# Required Settings
CAS_SERVER_URL=http://127.0.0.1:8001              # One System (CAS) server URL
CAS_CLIENT_ID=your_client_id                      # Your registered client ID
CAS_CLIENT_SECRET=your_client_secret              # Client secret (server-side only)

# Callback Configuration
CAS_CALLBACK_URL=https://yourapp.com/cas/callback # Where the server redirects after login

# Security Settings
CAS_ENABLE_SIGNATURE_VALIDATION=true              # Enable HMAC request signing
CAS_SIGNATURE_SECRET=your-shared-signature-secret # HMAC signature secret (must match server)
CAS_VERIFY_SSL=true                               # Verify SSL certificates

# Optional Settings
CAS_TIMEOUT=30                                     # HTTP request timeout (seconds)
CAS_USER_MODEL=App\Models\User                     # Eloquent model for optional local login/provisioning
CAS_USER_DASHBOARD=/dashboard                      # Redirect target after login
CAS_ROUTES_ENABLED=true                            # Register the package's /cas/* routes
CAS_CACHE_ENABLED=true                            # Enable user data caching
CAS_CACHE_TTL=3600                                # Cache time-to-live (seconds)
CAS_LOGGING_ENABLED=true                          # Enable authentication logging
```

### Advanced Configuration

[](#advanced-configuration)

Edit `config/cas-client.php` for advanced options:

```
return [
    // User management — a local User record is found/created on successful login
    'user' => [
        'create_local_users' => env('CAS_CREATE_LOCAL_USERS', true),
        'model' => env('CAS_USER_MODEL', 'App\Models\Auth\User'),
        'defaults' => [
            'user_type' => 'Guest',
        ],
    ],

    // Route configuration — package routes auto-registered under this prefix
    'routes' => [
        'enabled' => env('CAS_ROUTES_ENABLED', true),
        'prefix' => env('CAS_ROUTES_PREFIX', 'cas'),
        'middleware' => ['web'],
        'user_dashboard' => env('CAS_USER_DASHBOARD', '/dashboard'),
    ],

    // Cache validated user data to cut calls to the server
    'cache' => [
        'enabled' => env('CAS_CACHE_ENABLED', true),
        'ttl' => env('CAS_CACHE_TTL', 3600),
        'prefix' => 'cas_',
    ],

    // Logging configuration
    'logging' => [
        'enabled' => env('CAS_LOGGING_ENABLED', true),
        'channel' => env('CAS_LOG_CHANNEL', 'single'),
        'level' => env('CAS_LOG_LEVEL', 'info'),
    ],
];
```

Middleware
----------

[](#middleware)

### CasAuthentication Middleware

[](#casauthentication-middleware)

Protects routes requiring CAS authentication:

```
Route::middleware(['cas.auth'])->group(function () {
    Route::get('/protected', [Controller::class, 'method']);
});
```

### CasRole Middleware

[](#casrole-middleware)

Protects routes requiring specific roles:

```
// Single role
Route::middleware(['cas.auth', 'cas.role:admin'])->group(function () {
    Route::get('/admin', [AdminController::class, 'index']);
});

// Multiple roles (user needs ANY of these roles)
Route::middleware(['cas.auth', 'cas.role:admin,manager,supervisor'])->group(function () {
    Route::get('/management', [ManagementController::class, 'index']);
});
```

API Reference
-------------

[](#api-reference)

### CasAuthService Methods

[](#casauthservice-methods)

```
// Build the SSO login URL -> {CAS_SERVER_URL}/sso/login?client_id=...
$loginUrl = CasClient::getLoginUrl($returnUrl);

// Validate a single-use token SERVER-TO-SERVER.
// POST {CAS_SERVER_URL}/api/sso/validate  { token, client_id, client_secret }
// On 200 returns the user array { id, username, email, ... }, else null.
$user = CasClient::validateToken($token);

// Get cached user data (no network call)
$user = CasClient::getUserFromToken($token);

// Service-to-service token issuance for a known user.
// POST {CAS_SERVER_URL}/api/sso/token  { client_id, client_secret, username }
$result = CasClient::generateSSOToken('jane.doe'); // ['token' => ..., 'redirect_url' => ...]

// Logout -> POST {CAS_SERVER_URL}/api/logout
$success = CasClient::logout($token);

// Role checking helpers
$hasRole = CasClient::userHasRole($user, 'admin');
$hasAnyRole = CasClient::userHasAnyRole($user, ['admin', 'manager']);
$hasAllRoles = CasClient::userHasAllRoles($user, ['user', 'verified']);
```

### User Data Structure

[](#user-data-structure)

```
$user = [
    'id' => 1,
    'username' => 'john_doe',
    'email' => 'john@example.com',
    'name' => 'John Doe',
    'roles' => ['user', 'manager'],
    // Additional fields from CAS server
];
```

Security Features
-----------------

[](#security-features)

### Signature Validation

[](#signature-validation)

When enabled, all requests to the CAS server are signed with HMAC SHA-256:

```
// Automatic signature generation
$signature = hash_hmac('sha256', $payload, $secret);
```

The payload includes:

- HTTP method
- Request URI
- Request body
- Timestamp
- Client ID

### Token Caching

[](#token-caching)

User data is cached to reduce CAS server load:

```
// Cached for performance
Cache::put("cas_user_{$token}", $userData, $ttl);
```

### Error Handling

[](#error-handling)

Comprehensive error handling for all CAS operations:

```
try {
    $user = CasClient::validateToken($token);
} catch (CasAuthException $e) {
    Log::error('CAS authentication failed', ['error' => $e->getMessage()]);
}
```

Troubleshooting
---------------

[](#troubleshooting)

### Common Issues

[](#common-issues)

1. **Authentication Loop**

    - Check `CAS_CALLBACK_URL` matches your route
    - Verify session configuration
    - Ensure middleware order is correct
2. **Token Validation Fails**

    - Verify client credentials in CAS server
    - Check `CAS_SIGNATURE_SECRET` if using signatures
    - Ensure CAS server is accessible
3. **Role Access Denied**

    - Verify user has required roles in CAS
    - Check role middleware configuration
    - Ensure roles are properly synced

### Debug Mode

[](#debug-mode)

Enable debug logging:

```
CAS_LOGGING_ENABLED=true
CAS_LOG_LEVEL=debug
```

### Testing

[](#testing)

Test your configuration:

```
# Test One System (CAS) server connectivity
curl -I http://127.0.0.1:8001/health

# Test token validation
php artisan tinker
>>> app(\CasSystem\LaravelClient\Services\CasAuthService::class)->validateToken('your-test-token');
```

License
-------

[](#license)

This package is open-sourced software licensed under the [MIT license](LICENSE).

Support
-------

[](#support)

For support, please contact your CAS system administrator or create an issue in the project repository.

Contributing
------------

[](#contributing)

Please see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to contribute to this package.

Changelog
---------

[](#changelog)

Please see [CHANGELOG.md](CHANGELOG.md) for details on recent changes.

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance91

Actively maintained with recent releases

Popularity4

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity41

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~2 days

Total

3

Last Release

44d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/8c0dbd2af5fde2be430dd79177075b571ffdf1d3e424af1ab2ecfe726ae3ff7f?d=identicon)[insol\_user](/maintainers/insol_user)

---

Top Contributors

[![rkalyan01](https://avatars.githubusercontent.com/u/4374994?v=4)](https://github.com/rkalyan01 "rkalyan01 (3 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/cas-system-laravel-client/health.svg)

```
[![Health](https://phpackages.com/badges/cas-system-laravel-client/health.svg)](https://phpackages.com/packages/cas-system-laravel-client)
```

###  Alternatives

[google/auth

Google Auth Library for PHP

1.4k302.1M243](/packages/google-auth)[backpack/crud

Quickly build admin interfaces using Laravel, Bootstrap and JavaScript.

3.4k3.8M228](/packages/backpack-crud)[statamic/cms

The Statamic CMS Core Package

4.9k3.8M1.2k](/packages/statamic-cms)[unopim/unopim

UnoPim Laravel PIM

10.8k2.5k](/packages/unopim-unopim)[ellaisys/aws-cognito

Laravel Authentication using AWS Cognito (Web and API)

121269.8k1](/packages/ellaisys-aws-cognito)[leantime/leantime

Open source project management system for non-project managers. Simple like Trello, powerful like Jira. Built with neurodiversity in mind.

11.3k4.0k](/packages/leantime-leantime)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)