Authenticate

Initialize

Let’s try to authenticate to cas.unilim.fr using the given credentials. Doing the following will create a new authentication session on their end, thanks to LemonLDAP::NG.

.ts

import { CAS, type PendingAuth } from "unilim/cas";
const auth: PendingAuth = await CAS.initialize("username", "password");

.rs

use unilim::cas::{ CAS, PendingAuth };
let auth: PendingAuth = CAS::initialize("username", "password").await?;

.swift

import UnilimCAS
var auth: PendingAuth = try await CAS.initialize(username: "username", password: "password")

Once a session has been initialized, you’ll end up with a PendingAuth instance. This is an intermediary step where you have to resolve a 2FA challenge if solved property is falsy.

.ts

if (!auth.solved) {
  // You have to solve 2FA, check the "Resolve 2FA" section below.
}

.rs

if !auth.solved {
  // You have to solve 2FA, check the "Resolve 2FA" section below.
}

.swift

if !auth.solved {
  // You have to solve 2FA, check the "Resolve 2FA" section below.
}

Resolve 2FA

You’ll be asked to resolve a 2FA challenge when solved is falsy on PendingAuth. This challenge can be either resolved through an email code or a previously registered TOTP code.

This library does not support the case where you don’t have any 2FA method attached to your account - they might prompt you to add one - so please add a 2FA method.

You might want to know which 2FA option is available, if you don’t know.

.ts

if (auth.isTotpAvailable) {
  // You can use TOTP method.
}

if (auth.isEmailAvailable) {
  // You can use the email code method.
}

.rs

if auth.is_totp_available {
  // You can use TOTP method.
}

if auth.is_email_available {
  // You can use the email code method.
}

.swift

if auth.isTotpAvailable {
  // You can use TOTP method.
}

if auth.isEmailAvailable {
  // You can use the email code method.
}

As a side note, if the 2FA was already solved both properties will be falsy, by default.

TOTP

.ts

await auth.solveWithTotp("123456");

.rs

auth.solve_with_totp("123456".into()).await?;

.swift

try await auth.solveWithTotp(totp: "123456")

You’re done! You can go ahead to the finish section.

Email

This is split into two methods, one to send the email and the other to input the code received.

You must not call the TOTP method after calling the method to send an email, otherwise it’ll fail.

.ts

await auth.sendEmailCode();
await auth.solveWithEmailCode("123456");

.rs

auth.send_email_code().await?;
auth.solve_with_email_code("123456".into()).await?;

.swift

try await auth.sendEmailCode()
try await auth.solveWithEmailCode(code: "123456")

You’re done! You can go ahead to the finish section.

Finish

Let’s exchange our authentication session with an authenticated CAS instance.

.ts

const cas: CAS = await auth.finish();

.rs

let cas: CAS = auth.finish().await?;

.swift

let cas: CAS = try await auth.finish()

Restore

Once your session has expired, you’ll have to create a new one. Using the previously created session, you can make up a new one without having to solve 2FA manually, thanks to the TrustedBrowser plugin they enabled.

You’ll need the cookie llngconnection and a key, generated on first authentication, that you can retrieve using the following on an authenticated CAS instance.

.ts

const llngconnection: string = cas.connection; // <- the cookie
const key: string = cas.key; // <- the linked totp key

.rs

let llngconnection: String = cas.connection; // <- the cookie
let key: String = cas.key; // <- the linked totp key

.swift

let llngconnection: String = cas.connection; // <- the cookie
let key: String = cas.key; // <- the linked totp key

You’ll still need username and password since this is not a refresh token. It is only kind of a 2FA bypass.

.ts

const cas: CAS = await CAS.restore(
  "username", "password", // <- the usual you'd give in initialize()
  llngconnection, key     // <- the variables we retrieved
);

.rs

let cas: CAS = CAS::restore(
  "username", "password", // <- the usual you'd give in initialize()
  llngconnection, key     // <- the variables we retrieved
).await?;

.swift

let cas: CAS = try await CAS.restore(
  username: "username", password: "password",  // <- the usual you'd give in initialize()
  llngconnection: llngconnection, key: key     // <- the variables we retrieved
)

As you can see, we get directly a CAS instance and we don’t have to deal with PendingAuth anymore.

Their cookie llngconnection is available for one month, after this it’ll be expired and you’ll have to go through a manual 2FA solve once again.

Temporary

You can create a temporary CAS instance by providing a lemonldap cookie value.

.ts

const cas: CAS = CAS.temporary("value");

.rs

let cas: CAS = CAS::temporary("value".into());

.swift

let cas: CAS = CAS.temporary(cookie: "value")