CAS module - disabling auto login / want nonpersistent cookies - deleted when browser closes

Question

Our security team says we need to modify the cas module so that it either deletes the session cookies when the browser closes or use a session variable rather than a cookie. I can't figure out how to satisfy their requirements. I don't see such a setting in the cas module.

Currently, the cas module auto logs in users even though the Gateway autologin setting is disabled. The security team says this is OK on the first load but after the browser is closed, the site is not reauthenticating but instead relying on the cookie which is not acceptable. I don't know how they know this is what is happening.

I'm using Drupal 8.5.3.

It seems to me that the CAS settings under Configuration -> CAS

Gateway Feature (Auto Login)
when the radio button "disable gateway feature" is checked, that users should be required to login but though this option is checked, they are not required to login.

The cas module READ.md file writes this about the Gateway feature,
"This feature is not currently compatible with any form of page caching."

Page caching is disabled in settings

$settings['cache']['bins']['render'] = 'cache.backend.null';

Dynamic Page cache is also disabled

$settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.null';

In addition, the CAS settings "Forced Login" is enabled.

php.ini has cookie lifetime set to 0

; Lifetime in seconds of cookie or, if 0, until browser is restarted.

session.cookie_lifetime = 0

Thanks for any help.

---

Resolved:

I resolved this issue by making the following changes to the following files:

core.services.yml
default.services.yml
services.yml

# Set session cookie lifetime (in seconds), i.e. the time from the session
# is created to the cookie expires, i.e. when the browser is expected to
# discard the cookie. The value 0 means "until the browser is closed".
# @default 2000000
cookie_lifetime: 0

Answer 1

Not sure if this would meet your requirements but look at the require_login module. I'v done CAS and Shib authenticated sites using this module.

My solution was to have an excluded custom login page that was set up as the user login path in this module. This page generally had the welcome / security blurb and a button that linked to the Authentication agent (CAS / Shib). I seem to remember having to custom craft this to include the page to return to after login.

The part that might not work for you is that if a user had authenticated via CAS on another site and then came to this site, they did not see this page but where autologged into Drupal.. after all CAS, Shib, and the like are Single Sign On solution.. ;)

This might work for you with the Gateway option off.

Otherwise you might have to look at creating a custom event subscriber that handles the CAS authentication. E.g., if a user logs in and they are a CAS user, send them to the login page. Set some flag on the login page and then allow them to "login".