Update CAS authentication for WeBWorK 2.19 and higher

[mackensen]

As discussed at https://webwork.maa.org/moodle/mod/forum/discuss.php?d=8737 the CAS module isn't working well with newer versions of WeBWorK. Known issues:

• Course upgrade doesn't work
• Constant ticket revalidation (Issue editing a problem when using CAS authentication #2698)

[mackensen]

@drgrice1 is there more detailed documentation than https://wiki.openwebwork.org/wiki/Authentication? I've attempted a refactoring following it and didn't get very far. I've tried comparing the way the various modules implement authentication (SAML2, Shib, Ldap), but they're so different from each other it's hard to understand what's actually necessary.

The main challenge is getting a session to persist. Even with some fixes, WeBWorK is still getting a new CAS ticket on every page load. This was true prior to WeBWorK 2.19, and has led to various bug reports such as #2698. I suspect it's something to do with verify(), but (again) it's not clear what's supposed to happen in that function vs what get_credentials() is supposed to be doing.

[drgrice1]

That documentation is quite out of date. Things have changed quite a bit in the last few releases. The list of available authentication modules at the top of the page has been updated, but the rest of the documentation about the authentication process is quite old.

Authentication starts in the dispatch method of lib/WeBWorK.pm.

• First an authentication module can have its own ContentGenerator module if it needs dedicated routes (Saml2 and the LTI authentication modules have this). If so, then that module can provide an initializeRoute method to do things very early in the dispatch cycle (this is called at line 96 of lib/WeBWorK.pm.
• Next, the initial authentication module is chosen (at line 129 by calling the WeBWorK::Authen::class method). This is always the first module listed in the user_module array from the course environment.
• Then the verify method of that module is called at line 152. If the default WeBWorK::Authen method is overridden, it is important that the override method call $self->SUPER::verify, and the first thing that method does is makes sure that the chosen authentication module is correct by calling the request_has_data_for_this_verification_module. That method really should be overridden by all authentication modules (other than the default). It should return 1 if the module is to be used, and 0 otherwise. If it returns 0, then the next module in the user_module array will be tried.
• Next the do_verify method is called. If that is not overridden, then it calls get_credentials, check_user, and verify_normal_user (or verify_practice_user if guest users are allowed).
• Things get more complicated from here. You need to delve into the three methods in the last step to really see the primary authentication in action, but any module can override any or all of the WeBWorK::Authen methods to achieve what is needed.

I recommend that you look at lib/WeBWorK/Authen.pm (the base authentication module), and lib/WeBWorK/Saml2.pm and lib/WeBWorK/Shibboleth.pm which are going to be the closest to what the CAS module uses, and are up to date authentication modules. Note that the LTI authentication modules are up to date, but I suspect they are quite different from what the CAS module needs.

[somiaj]

Just checking in to see if CAS authentication is something we want to update and continue to support, leave it as it is, or remove it for the 2.21 release.