Hi, everyone.
I'm having the same issue for a month, now. I can't seem to resolve it.
I'm configuring a SAML delegation and my IdP requires that I use SHA1 with RSA. The thing is pac4j isn't letting me using it. It returns me this message:
ERROR [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl] - <An error occured computing the digital signature: The requested algorithm SHA1withRSA does not exist. Original Message was: SHA1withRSA MessageDigest not available>
My configuration option is this:
[...]signatureReferenceDigestMethods: http://www.w3.org/2000/09/xmldsig#rsa-sha1
3 replies
Hi, all!
I am thinking about upgrading CAS 5.3 to CAS 6.1.
As far as I understand, cas-overlay-template does not support Maven anymore.
I still use Maven in my project which is inspired by old Maven overlay template (not exactly, I do not like the concept of class shading, but still uses the same plugins). It also relies on cas-server-support-bom
Is there any success stories about upgrading cas from version 5.3 and also staying with Maven build? I tried to update versions in my pom.xml. Seems like dependencies are resolved successfully but I still need to migrate my custom code.
Can I concentrate on migrating my code or should I rewrite my build configurations to gradle?
Hi everyone I have the following issue,I implemented a CAS client and configure the CAS overlay server, everything works fine if I get authenticated by web explorer, however, when I authenticated by restful service I cannot do it, I did the following steps:
I get the ticket with this endpoint https://localhost:8443/v1/tickets and returned this:
TGT-6-D-SS3TDLIpY5RDUqSXVjV-8NF4odaD4kecdTwv7fwAUg7qfYY-9sShkYqR3xPeRnp-Y-DESKTOP-SV9Q6OU
then with this ticket, I get the token with the following endpoint:
And it returned this:
ST-23-GbT6Tq2Rh6i-qo8GVaH-yld--9A-DESKTOP-SV9Q6OU
My cas client has the following service
http://localhost:8900/test_service
But I dont know how to consume my service that is protected by CAS, I tried
http://localhost:8900/test_service?ticket=ST-23-GbT6Tq2Rh6i-qo8GVaH-yld--9A-DESKTOP-SV9Q6OU
however it returns the page to get authenticated by cas
Having another little issue with Spring Security & CAS. Following this example here still: https://www.baeldung.com/spring-security-cas-sso
Everything looks like it works, I log in through my CAS system, but it still thinks my email address is test@test.com. I'm sure it has to do with this snippet of code, but not sure how to modify it for my usage:
@Bean
public CasAuthenticationProvider casAuthenticationProvider(
TicketValidator ticketValidator,
ServiceProperties serviceProperties) {
CasAuthenticationProvider provider = new CasAuthenticationProvider();
provider.setServiceProperties(serviceProperties);
provider.setTicketValidator(ticketValidator);
provider.setUserDetailsService(
s -> new User("test@test.com", "Mellon", true, true, true, true,
AuthorityUtils.createAuthorityList("ROLE_ADMIN")));
provider.setKey("CAS_PROVIDER_LOCALHOST_8900");
return provider;
}
Hello there,
I have a problem with CAS 6.1.6 in a Tomcat 9 (JDK11).
The server responds correctly, but as soon as it is called in HTTPS via a Load Balancer, Tomcat loops on 302 responses.
The problem seems the same as apereo/cas#4784, except that it happens on an external servlet container.
Do you know if I need to add something special in the configuration?
Hello,
Is there anybody used "Multi Domain CAS Login Filter" at https://web.liferay.com/marketplace/-/mp/application/54315044 or appreciate your multi domain for CAS suggestions.
thanks.
recently, i have occurred one problem , when i login the cas with my service and test the error scene , for example type the wrong password or use the invalidate user login , i have found the web page transition to the cas/login without my service , have someone solved the same problem? pls share the method to me , thank you all .
Hey guys,
I am new to CAS and shall evaluate the project an get stuck at the beginning.
Since I know I need some aspects like Oauth2, JWT, MFA I tried to start with the Oauth2 example(https://apereo.github.io/2019/02/19/cas61-as-oauth-authz-server/), but didn't get it running since the client failed to build
so i included my changes according to the example into cas-overlay-template and started it with docker-compose.
GOOD -> it builds, runs and I can use the "normal" endpoint to authenitcate casuser
BAD -> trying to reach the accessToken endpoint via https://localhost:8443/cas/oauth2.0/accessToken?grant_type=password&username=casuser&password=Mellon&client_id=foo&client_secret=bar fails, I always get2020-05-14 07:50:10,167 WARN [org.apereo.cas.services.RegisteredServiceAccessStrategyUtils] - <Unauthorized Service Access. Service [] is not found in service registry.>
CAS Server is running inside docker, Request comes from my host machine. I added an oauth.json with the following content
{
"@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
"clientId": "foo",
"clientSecret": "bar",
"serviceId" : "^https://localhost.*",
"name" : "OAuthService",
"id" : 1000,
"supportedGrantTypes": [ "password" ]
}Any clues what I have done wrong?
Thanks in advance.
Its just the part where the "code" should be sent and a "authorization_code" grant_type should be returned... I get a 403 there... I've been playing for a few days with all sorts of config, and even tried the suggested example app on the documentation... All give the same 403 when trading in the code... So I'm pretty sure it's some silly config I'm missing :(
${configurationKey}.ldapUrl=ldaps://ldap1.example.edu ldaps://ldap2.example.edu ldaps://ldap3.example.edu ldaps://ldap4.example.edu
${configurationKey}.bindDn=cn=Directory Manager,dc=example,dc=org
${configurationKey}.bindCredential=Password
${configurationKey}.poolPassivator=BIND
${configurationKey}.connectionStrategy=
${configurationKey}.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider
${configurationKey}.connectTimeout=PT5S
${configurationKey}.minPoolSize=3
${configurationKey}.maxPoolSize=10
${configurationKey}.validateOnCheckout=true
${configurationKey}.validatePeriodically=true
${configurationKey}.validatePeriod=PT5M
${configurationKey}.validateTimeout=PT5S
${configurationKey}.failFast=true
${configurationKey}.idleTime=PT10M
${configurationKey}.prunePeriod=PT2H
${configurationKey}.blockWaitTime=PT3S
${configurationKey}.useSsl=true
${configurationKey}.useStartTls=false
${configurationKey}.responseTimeout=PT5S
${configurationKey}.allowMultipleDns=false
${configurationKey}.allowMultipleEntries=false
${configurationKey}.followReferrals=false
${configurationKey}.binaryAttributes=objectGUID,someOtherAttribute
Both apps must use G Suite credentials. 2nd app has a native configuration, but 1st one doesn't. Any ideas for implemeting CAS SSO?
Hi @vwbusguy ! thanks a lot for replying. Let me check if I understood well.
If my 2nd App already is integrated with G Suite and signs In perfectly.
1 ) Do I only have to plug my 1st App with CAS with achieve SAML 2.0 and Sign in?
or
2) Do I have to plug both Apps to my CAS Server to login with G Suite?
My problem here is the hybrid solution I already have. My cloud app opens a new tab which jumps to my onpremise solution to run a report. Here is where I need to avoid 2nd login
Best regards
I need some backup!
https://stackoverflow.com/questions/62096130/cas-sso-docker-image-fails-caused-by-tomcat-server