rubycas-server 0.6.0 → 0.7.0

data/lib/casserver/authenticators/ldap.rb

@@ -28,23 +28,34 @@ class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
     return false if @password.blank?
    
     raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
-    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless @options[:ldap]
-    raise CASServer::AuthenticatorError, "You must specify an ldap server in the configuration!" unless @options[:ldap][:server]
-    
+    raise CASServer::AuthenticatorError, "Invalid LDAP authenticator configuration!" unless @options[:ldap]
+    raise CASServer::AuthenticatorError, "You must specify a server host in the LDAP configuration!" unless @options[:ldap][:host] || @options[:ldap][:server]
+        
     raise CASServer::AuthenticatorError, "The username '#{@username}' contains invalid characters." if (@username =~ /[*\(\)\0\/]/)
     
     preprocess_username
     
     @ldap = Net::LDAP.new
-    @ldap.host = @options[:ldap][:server]
+    
+    
+    @options[:ldap][:host] ||= @options[:ldap][:server]
+    @ldap.host = @options[:ldap][:host]
     @ldap.port = @options[:ldap][:port] if @options[:ldap][:port]
+    @ldap.encryption(@options[:ldap][:encryption].intern) if @options[:ldap][:encryption]
     
     begin
       if @options[:ldap][:auth_user]
-        bind_with_preauthentication
+        bind_success = bind_by_username_with_preauthentication
       else
-        bind_directly
+        bind_success = bind_by_username
       end
+      
+      return false unless bind_success
+      
+      entry = find_user
+      extract_extra_attributes(entry)
+      
+      return true
     rescue Net::LDAP::LdapError => e
       raise CASServer::AuthenticatorError,
         "LDAP authentication failed with '#{e}'. Check your authenticator configuration."
@@ -53,56 +64,75 @@ class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
   
   protected
     def default_username_attribute
-      "uid"
+      "cn"
     end
   
   private
+    # Add prefix to username, if :username_prefix was specified in the :ldap config.
     def preprocess_username
-      # add prefix to username, if prefix was specified in the config
       @username = @options[:ldap][:username_prefix] + @username if @options[:ldap][:username_prefix]
     end
-    
-    def bind_with_preauthentication
-      # If an auth_user is specified, we will connect ("pre-authenticate") to the
-      # LDAP server using the authenticator account, and then attempt to bind as the
-      # user who is actually trying to authenticate. Note that you need to set up 
-      # the special authenticator account first. Also, auth_user must be the authenticator
-      # user's full CN, which is probably not the same as their username.
-      #
-      # This pre-authentication process is necessary because binding can only be done
-      # using the CN, so having just the username is not enough. We connect as auth_user, 
-      # and then try to find the target user's CN based on the given username. Then we bind
-      # as the target user to validate their credentials.
+
+    # Attempt to bind with the LDAP server using the username and password entered by
+    # the user. If a :filter was specified in the :ldap config, the filter will be
+    # added to the LDAP query for the username.
+    def bind_by_username
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
       
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+
+    # If an auth_user is specified, we will connect ("pre-authenticate") with the
+    # LDAP server using the authenticator account, and then attempt to bind as the
+    # user who is actually trying to authenticate. Note that you need to set up 
+    # the special authenticator account first. Also, auth_user must be the authenticator
+    # user's full CN, which is probably not the same as their username.
+    #
+    # This pre-authentication process is necessary because binding can only be done
+    # using the CN, so having just the username is not enough. We connect as auth_user, 
+    # and then try to find the target user's CN based on the given username. Then we bind
+    # as the target user to validate their credentials.
+    def bind_by_username_with_preauthentication
       raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless 
         @options[:ldap][:auth_password]
       
       @ldap.authenticate(@options[:ldap][:auth_user], @options[:ldap][:auth_password])
       
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+  
+    # Combine the filter for finding the user with the optional extra filter specified in the config
+    # (if any).
+    def user_filter
       username_attribute = options[:ldap][:username_attribute] || default_username_attribute
       
-      filter = Net::LDAP::Filter.construct(@options[:ldap][:filter]) if 
-        @options[:ldap][:filter] && !@options[:ldap][:filter].blank?
-      username_filter = Net::LDAP::Filter.eq(username_attribute, @username)
-      if filter
-        filter &= username_filter
-      else
-        filter = username_filter
+      filter = Net::LDAP::Filter.eq(username_attribute, @username)
+      unless @options[:ldap][:filter].blank?
+        filter &= Net::LDAP::Filter.construct(@options[:ldap][:filter])
       end
-      
-      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => filter)
     end
-    
-    def bind_directly
-      # When no auth_user is specified, we will try to connect directly as the user
-      # who is trying to authenticate. Note that for this to work, the username must
-      # be equivalent to the user's CN, and this is often not the case (for example,
-      # in Active Directory, the username is the 'sAMAccountName' attribute, while the
-      # user's CN is generally their full name.)
-      
-      cn = @username
+  
+    # Finds the user based on the user_filter (this is called after authentication).
+    # We do this to make it possible to extract extra_attributes.
+    def find_user
+      results = @ldap.search( :base => options[:ldap][:base], :filter => user_filter)
+      return results.first
+    end
+  
+    def extract_extra_attributes(ldap_entry)
+      @extra_attributes = {}
+      extra_attributes_to_extract.each do |attr|
+        v = !ldap_entry[attr].blank? && ldap_entry[attr].first
+        if v
+          @extra_attributes[attr] = v.to_s
+        end
+      end
       
-      @ldap.authenticate(cn, @password)
-      @ldap.bind
+      if @extra_attributes.empty?
+        $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+      else
+        $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+      end
+      ldap_entry
     end
 end

data/lib/casserver/authenticators/ntlm.rb

@@ -0,0 +1,88 @@
+# THIS AUTHENTICATOR DOES NOT WORK (not even close!)
+#
+# I started working on this but run into a wall, so I am commiting what I've got
+# done and leaving it here with hopes of one day finishing it.
+# 
+# The main problem is that although I've got the Lan Manager/NTLM password hash,
+# I'm not sure what to do with it. i.e. I need to check it against the AD or SMB
+# server or something... maybe faking an SMB share connection and using the LM
+# response for authentication might do the trick?
+
+require 'casserver/authenticators/base'
+
+# Ruby/NTLM package from RubyForge
+require 'net/ntlm'
+
+module CASServer
+  module Authenticators
+    class NTLM
+      # This will have to be somehow called by the top of the 'get' method
+      # in the Login controller (maybe via a hook?)... if this code fails
+      # then the controller should fall back to some other method of authentication
+      # (probably AD/LDAP or something).
+      def filter_for_top_of_login_get_controller_method
+        $LOG.debug @env.inspect
+        if @env['HTTP_AUTHORIZATION'] =~ /NTLM ([^\s]+)/
+          # if we're here, then the client has sent back a Type1 or Type3 message
+          # in reply to our NTLM challenge or our Type2 message
+          data_raw = Base64.decode64($~[1])
+          $LOG.debug "T1 RAW: #{t1_raw}"
+          t = Net::NTLM::Message::Message.parse(t1_raw)
+          if t.kind_of? Net::NTLM::Type1
+            t1 = t
+          elsif t.kind_of? Net::NTLM::Type3
+            t3 = t
+          else
+            raise "Invalid NTLM reply from client."
+          end
+          
+          if t1
+            $LOG.debug "T1: #{t1.inspect}"
+            
+            # now put together a Type2 message asking for the client to send
+            # back NTLM credentials (LM hash and such)
+            t2 = Net::NTLM::Message::Type2.new
+            t2.set_flag :UNICODE
+            t2.set_flag :NTLM
+            t2.context = 0x0000000000000000 # this can probably just be left unassigned
+            t2.challenge = 0x0123456789abcdef # this should be a random 8-byte integer
+            
+            $LOG.debug "T2: #{t2.inspect}"
+            $LOG.debug "T2: #{t2.serialize}"
+            headers["WWW-Authenticate"] = "NTLM #{t2.encode64}"
+            
+            # the client should respond to this with a Type3 message...
+            r('401', '', headers)
+            return
+          else
+            # NOTE: for some reason the server never receives the T3 response, even though monitoring
+            # the HTTP traffic I can see that the client does send it back... there's probably
+            # another bug hiding somewhere here
+          
+            lm_response = t3.lm_response
+            ntlm_response = t3.ntlm_response
+            username = t3.user
+            # this is where we run up against a wall... we need some way to check the lm and/or ntlm
+            # reponse against the authentication server (probably Active Directory)... maybe a samba
+            # call would do it?
+            $LOG.debug "T3 LM: #{lm_response.inspect}"
+            $LOG.debug "T3 NTLM: #{ntlm_response.inspect}"
+            
+            # assuming the authentication was successful, we'll now need to do something in the 
+            # controller acting as if we'd received correct login credentials (i.e. proceed as if
+            # CAS authentication was successful).... if authentication failed, then we should
+            # just fall back to old-school web-based authentication, asking the user to enter
+            # their username and password the normal CAS way
+          end
+        else
+          # this sends the initial NTLM challenge, asking the browser
+          # to send back a Type1 message
+          headers['WWW-Authenticate'] = "NTLM"
+          headers['Connection'] = "Close"
+          r('401', '', headers)
+          return
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/open_id.rb

@@ -0,0 +1,22 @@
+require 'casserver/authenticators/base'
+
+require 'openid'
+require 'openid/extensions/sreg'
+require 'openid/extensions/pape'
+require 'openid/store/memory'
+
+
+# CURRENTLY UNIMPLEMENTED
+# This is just starter code.
+class CASServer::Authenticators::OpenID < CASServer::Authenticators::Base
+
+  def validate(credentials)
+    raise NotImplementedError, "The OpenID authenticator is not yet implemented. "+
+      "See http://code.google.com/p/rubycas-server/issues/detail?id=36 if you are interested in helping this along."
+    
+    read_standard_credentials(credentials)
+    
+    store = OpenID::Store::Memory.new
+    consumer = OpenID::Consumer.new({}, store)
+  end
+end

data/lib/casserver/authenticators/sql.rb

@@ -7,6 +7,51 @@ rescue LoadError
   require 'active_record'
 end
 
+# Authenticates against a plain SQL table. 
+# 
+# This assumes that all of your users are stored in a table that has a 'username' 
+# column and a 'password' column. When the user logs in, CAS conects to the 
+# database and looks for a matching username/password in the users table. If a 
+# matching username and password is found, authentication is successful.
+#
+# Any database backend supported by ActiveRecord can be used.
+# 
+# Config example:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#       username: root
+#       password: 
+#       server: localhost
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#
+# When replying to a CAS client's validation request, the server will normally
+# provide the client with the authenticated user's username. However it is now
+# possible for the server to provide the client with additional attributes.
+# You can configure the SQL authenticator to provide data from additional
+# columns in the users table by listing the names of the columns under the 
+# 'extra_attributes' option. Note though that this functionality is experimental.
+# It should work with RubyCAS-Client, but may or may not work with other CAS
+# clients. 
+#
+# For example, with this configuration, the 'full_name' and 'access_level'
+# columns will be provided to your CAS clients along with the username:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#     extra_attributes: full_name, access_level
+# 
 class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
 
   def validate(credentials)
@@ -24,7 +69,27 @@ class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
     results = CASUser.find(:all, :conditions => ["#{username_column} = ? AND #{password_column} = ?", @username, @password])
     
     if results.size > 0
-      $LOG.warn("Multiple matches found for user '#{@username}'") if results.size > 1
+      $LOG.warn("#{self.class}: Multiple matches found for user #{@username.inspect}") if results.size > 1
+      
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          user = results.first
+          
+          @extra_attributes = {}
+          extra_attributes_to_extract.each do |col|
+            @extra_attributes[col] = user.send(col)
+          end
+          
+          if @extra_attributes.empty?
+            $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+          else
+            $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+          end
+        end
+      end
+      
       return true
     else
       return false

data/lib/casserver/authenticators/sql_md5.rb

@@ -0,0 +1,19 @@
+require 'casserver/authenticators/sql'
+
+require 'digest/md5'
+
+# Essentially the same as the standard SQL authenticator, but this version
+# assumes that your password is stored as an MD5 hash.
+#
+# This was contributed by malcomm for Drupal authentication. To work with
+# Drupal, you should use 'name' for the :username_column config option, and
+# 'pass' for the :password_column.
+class CASServer::Authenticators::SQLMd5 < CASServer::Authenticators::SQL
+  
+  protected
+    def read_standard_credentials(credentials)
+      super
+      @password = Digest::MD5.hexdigest(@password)
+    end
+
+end

data/lib/casserver/authenticators/test.rb

@@ -10,6 +10,10 @@ class CASServer::Authenticators::Test < CASServer::Authenticators::Base
     
     raise CASServer::AuthenticatorError, "Username is 'do_error'!" if @username == 'do_error'
     
-    return @username == "testuser" && @password == "testpassword"
+    @extra_attributes[:test_string] = "testing!"
+    @extra_attributes[:test_numeric] = 123.45
+    @extra_attributes[:test_serialized] = {:foo => 'bar', :alpha => [1,2,3]}
+    
+    return @password == "testpassword"
   end
 end

data/lib/casserver/cas.rb

@@ -11,32 +11,41 @@ module CASServer::CAS
     # 3.5 (login ticket)
     lt = LoginTicket.new
     lt.ticket = "LT-" + CASServer::Utils.random_string
-    lt.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
+    lt.client_hostname = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_HOST'] || env['REMOTE_ADDR']
     lt.save!
     $LOG.debug("Generated login ticket '#{lt.ticket}' for client" +
       " at '#{lt.client_hostname}'")
     lt
   end
   
-  def generate_ticket_granting_ticket(username)
+  # Creates a TicketGrantingTicket for the given username. This is done when the user logs in
+  # for the first time to establish their SSO session (after their credentials have been validated).
+  #
+  # The optional 'extra_attributes' parameter takes a hash of additional attributes
+  # that will be sent along with the username in the CAS response to subsequent 
+  # validation requests from clients.
+  def generate_ticket_granting_ticket(username, extra_attributes = {})
     # 3.6 (ticket granting cookie/ticket)
     tgt = TicketGrantingTicket.new
     tgt.ticket = "TGC-" + CASServer::Utils.random_string
     tgt.username = username
-    tgt.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
+    tgt.extra_attributes = extra_attributes
+    tgt.client_hostname = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_HOST'] || env['REMOTE_ADDR']
     tgt.save!
     $LOG.debug("Generated ticket granting ticket '#{tgt.ticket}' for user" +
-      " '#{tgt.username}' at '#{tgt.client_hostname}'")
+      " '#{tgt.username}' at '#{tgt.client_hostname}'" + 
+      (extra_attributes.blank? ? "" : " with extra attributes #{extra_attributes.inspect}"))
     tgt
   end
   
-  def generate_service_ticket(service, username)
+  def generate_service_ticket(service, username, tgt)
     # 3.1 (service ticket)
     st = ServiceTicket.new
     st.ticket = "ST-" + CASServer::Utils.random_string
     st.service = service
     st.username = username
-    st.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
+    st.ticket_granting_ticket = tgt
+    st.client_hostname = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_HOST'] || env['REMOTE_ADDR']
     st.save!
     $LOG.debug("Generated service ticket '#{st.ticket}' for service '#{st.service}'" +
       " for user '#{st.username}' at '#{st.client_hostname}'")
@@ -50,7 +59,8 @@ module CASServer::CAS
     pt.service = target_service
     pt.username = pgt.service_ticket.username
     pt.proxy_granting_ticket_id = pgt.id
-    pt.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
+    pt.ticket_granting_ticket = pgt.service_ticket.ticket_granting_ticket
+    pt.client_hostname = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_HOST'] || env['REMOTE_ADDR']
     pt.save!
     $LOG.debug("Generated proxy ticket '#{pt.ticket}' for target service '#{pt.service}'" +
       " for user '#{pt.username}' at '#{pt.client_hostname}' using proxy-granting" +
@@ -77,7 +87,7 @@ module CASServer::CAS
       pgt.ticket = "PGT-" + CASServer::Utils.random_string(60)
       pgt.iou = "PGTIOU-" + CASServer::Utils.random_string(57)
       pgt.service_ticket_id = st.id
-      pgt.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
+      pgt.client_hostname = env['HTTP_X_FORWARDED_FOR'] || env['REMOTE_HOST'] || env['REMOTE_ADDR']
       
       # FIXME: The CAS protocol spec says to use 'pgt' as the parameter, but in practice
       #         the JA-SIG and Yale server implementations use pgtId. We'll go with the
@@ -150,27 +160,27 @@ module CASServer::CAS
     $LOG.debug("Validating service/proxy ticket '#{ticket}' for service '#{service}'")
   
     if service.nil? or ticket.nil?
-      error = Error.new("INVALID_REQUEST", "Ticket or service parameter was missing in the request.")
+      error = Error.new(:INVALID_REQUEST, "Ticket or service parameter was missing in the request.")
       $LOG.warn("#{error.code} - #{error.message}")
     elsif st = ServiceTicket.find_by_ticket(ticket)
       if st.consumed?
-        error = Error.new("INVALID_TICKET", "Ticket '#{ticket}' has already been used up.")
+        error = Error.new(:INVALID_TICKET, "Ticket '#{ticket}' has already been used up.")
         $LOG.warn("#{error.code} - #{error.message}")
       elsif st.kind_of?(CASServer::Models::ProxyTicket) && !allow_proxy_tickets
-        error = Error.new("INVALID_TICKET", "Ticket '#{ticket}' is a proxy ticket, but only service tickets are allowed here.")
+        error = Error.new(:INVALID_TICKET, "Ticket '#{ticket}' is a proxy ticket, but only service tickets are allowed here.")
         $LOG.warn("#{error.code} - #{error.message}")
       elsif Time.now - st.created_on > CASServer::Conf.service_ticket_expiry
-        error = Error.new("INVALID_TICKET", "Ticket '#{ticket}' has expired.")
+        error = Error.new(:INVALID_TICKET, "Ticket '#{ticket}' has expired.")
         $LOG.warn("Ticket '#{ticket}' has expired.")
-      elsif st.matches_service? service
-        $LOG.info("Ticket '#{ticket}' for service '#{service}' for user '#{st.username}' successfully validated.")
-      else
-        error = Error.new("INVALID_SERVICE", "The ticket '#{ticket}' belonging to user '#{st.username}' is valid,"+
+      elsif !st.matches_service? service
+        error = Error.new(:INVALID_SERVICE, "The ticket '#{ticket}' belonging to user '#{st.username}' is valid,"+
           " but the requested service '#{service}' does not match the service '#{st.service}' associated with this ticket.")
         $LOG.warn("#{error.code} - #{error.message}")
+      else
+        $LOG.info("Ticket '#{ticket}' for service '#{service}' for user '#{st.username}' successfully validated.")
       end
     else
-      error = Error.new("INVALID_TICKET", "Ticket '#{ticket}' not recognized.")
+      error = Error.new(:INVALID_TICKET, "Ticket '#{ticket}' not recognized.")
       $LOG.warn("#{error.code} - #{error.message}")
     end
     
@@ -187,9 +197,9 @@ module CASServer::CAS
     
     if pt.kind_of?(CASServer::Models::ProxyTicket) && !error
       if not pt.proxy_granting_ticket
-        error = Error.new("INTERNAL_ERROR", "Proxy ticket '#{pt}' belonging to user '#{pt.username}' is not associated with a proxy granting ticket.")
+        error = Error.new(:INTERNAL_ERROR, "Proxy ticket '#{pt}' belonging to user '#{pt.username}' is not associated with a proxy granting ticket.")
       elsif not pt.proxy_granting_ticket.service_ticket
-        error = Error.new("INTERNAL_ERROR", "Proxy granting ticket '#{pt.proxy_granting_ticket}'"+
+        error = Error.new(:INTERNAL_ERROR, "Proxy granting ticket '#{pt.proxy_granting_ticket}'"+
           " (associated with proxy ticket '#{pt}' and belonging to user '#{pt.username}' is not associated with a service ticket.")
       end
     end
@@ -199,23 +209,61 @@ module CASServer::CAS
   
   def validate_proxy_granting_ticket(ticket)
     if ticket.nil?
-      error = Error.new("INVALID_REQUEST", "pgt parameter was missing in the request.")
+      error = Error.new(:INVALID_REQUEST, "pgt parameter was missing in the request.")
       $LOG.warn("#{error.code} - #{error.message}")
     elsif pgt = ProxyGrantingTicket.find_by_ticket(ticket)
       if pgt.service_ticket
         $LOG.info("Proxy granting ticket '#{ticket}' belonging to user '#{pgt.service_ticket.username}' successfully validated.")
       else
-        error = Error.new("INTERNAL_ERROR", "Proxy granting ticket '#{ticket}' is not associated with a service ticket.")
+        error = Error.new(:INTERNAL_ERROR, "Proxy granting ticket '#{ticket}' is not associated with a service ticket.")
         $LOG.error("#{error.code} - #{error.message}")
       end
     else
-      error = Error.new("BAD_PGT", "Invalid proxy granting ticket '#{ticket}' (no matching ticket found in the database).")
+      error = Error.new(:BAD_PGT, "Invalid proxy granting ticket '#{ticket}' (no matching ticket found in the database).")
       $LOG.warn("#{error.code} - #{error.message}")
     end
     
     [pgt, error]
   end
   
+  # Takes an existing ServiceTicket object (presumably pulled from the database)
+  # and sends a POST with logout information to the service that the ticket
+  # was generated for.
+  #
+  # This makes possible the "single sign-out" functionality added in CAS 3.1.
+  # See http://www.ja-sig.org/wiki/display/CASUM/Single+Sign+Out
+  def send_logout_notification_for_service_ticket(st)
+    uri = URI.parse(st.service)
+    http = Net::HTTP.new(uri.host, uri.port)
+    #http.use_ssl = true if uri.scheme = 'https'
+    
+    time = Time.now
+    rand = CASServer::Utils.random_string
+    
+    path = uri.path
+    path = '/' if path.empty?
+    
+    req = Net::HTTP::Post.new(path)
+    req.set_form_data(
+      'logoutRequest' => %{<samlp:LogoutRequest ID="#{rand}" Version="2.0" IssueInstant="#{time.rfc2822}">
+<saml:NameID></saml:NameID>
+<samlp:SessionIndex>#{st.ticket}</samlp:SessionIndex>
+</samlp:LogoutRequest>}
+    )
+    
+    http.start do |conn|
+      response = conn.request(req)
+            
+      if response.kind_of? Net::HTTPSuccess
+        $LOG.info "Logout notification successfully posted to #{st.service.inspect}."
+        return true
+      else
+        $LOG.error "Service #{st.service.inspect} responed to logout notification with code '#{response.code}'!"
+        return false
+      end
+    end
+  end
+  
   def service_uri_with_ticket(service, st)
     raise ArgumentError, "Second argument must be a ServiceTicket!" unless st.kind_of? CASServer::Models::ServiceTicket
     
@@ -237,4 +285,31 @@ module CASServer::CAS
     service_with_ticket
   end
   
+  # Strips CAS-related parameters from a service URL and normalizes it,
+  # removing trailing / and ?. Also converts any spaces to +.
+  #
+  # For example, "http://google.com?ticket=12345" will be returned as
+  # "http://google.com". Also, "http://google.com/" would be returned as
+  # "http://google.com".
+  #
+  # Note that only the first occurance of each CAS-related parameter is
+  # removed, so that "http://google.com?ticket=12345&ticket=abcd" would be
+  # returned as "http://google.com?ticket=abcd".
+  def clean_service_url(dirty_service)
+    return dirty_service if dirty_service.blank?
+    clean_service = dirty_service.dup
+    ['service', 'ticket', 'gateway', 'renew'].each do |p|
+      clean_service.sub!(Regexp.new("#{p}=[^&]*"), '')
+    end
+    
+    clean_service.gsub!(/[\/\?]$/, '')
+    clean_service.gsub!(' ', '+')
+    
+    $LOG.debug("Cleaned dirty service URL #{dirty_service.inspect} to #{clean_service.inspect}") if
+      dirty_service != clean_service
+      
+    return clean_service
+  end
+  module_function :clean_service_url
+  
 end