Is it name of an attribute that cas generates as a warning or is it a name of an attribute that ldap is supposed to give to cas as a warning?
And when cas does warn about soon expiring password, is that done by showing a webpage before forwarding back to service or by adding an attribute?
I have a random question about CAS and was wondering if you guys could help? Is it possible for a CAS server to process requests both using the CAS and OAuth2 protocols so that it is able to process requests using either. I am working on a very old codebase and need to integrate new services using modern Auth and want to know if I need to set up a second CAS server or not?
Hi @chris_hodgson:matrix.org - I've not done this - but I'm almost positive you can. If you have both OAuth2 and CAS enabled - they'll both have different targets. A CAS protocol service would connect to (for example) /cas/validate, where a OAuth one would go to /cas/OAuth2.0/ (https://apereo.github.io/cas/5.2.x/installation/OAuth-OpenId-Authentication.html)
Sorry - I'm going a slightly different method to handle newer protocols and delegating auth from CAS to an external SAML provider (Azure) - and also pointing OAuth clients there instead of at CAS so haven't done it myself :(
i'm using jpa with an entity, repository, service classes. I'm trying to autowire my service class but getting a been not defined . I already have included ComponentScan in my calling class but still not picking up my service class. Is there something special I need to do with CAS?
Hey folks. I am trying to get a Spring Security based OIDC client to talk to a CAS 6.4.0-SNAPSHOT (current Master) instance with active cas-server-support-oidc module. The client is using the authorization code flow. After CAS has authenticated my test user, it creates a Service Ticket for the response, which is quite confusing. Of course the client which is registered as "@class" : "org.apereo.cas.services.OidcRegisteredService" does not understand the ST from the CAS protocol and expects an OIDC token. Logmessage from CAS: 2021-05-14 09:29:23,497 DEBUG [org.apereo.cas.authentication.principal.DefaultResponse] - <Final redirect response is [https://[myserver.tld]/testservice/login/oauth2/code/reg?ticket=ST-11-xgSjofkciebg00IvY1B-fdkDkh8-....]>
. Can anyone tell me this makes any sense at all or if it could be a bug in the current CAS version?
. Can anyone tell me this makes any sense at all or if it could be a bug in the current CAS version?
In case this might be a bug and you need to view at some log files, this might help: https://pastebin.com/UXwjMNyu
Explicitly calling https://myhost.tld/testservice/oauth2/authorization/appOidcEndpoint afterwards on the other hand works perfectly fine.... :)
Here is log: ERROR [org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlIdPObjectSigner] - <Credential private key cannot be null>
net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Credential private key cannot be null
net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Credential private key cannot be null
I don't know why the private key is null
Hello.
I just realized that SSO (single sign-out) is not playing well with Spring sessions stored on the DB (
Can anybody confirm that this is indeed an issue?
Does anybody know of a fix or a workaround?
I just realized that SSO (single sign-out) is not playing well with Spring sessions stored on the DB (
spring.session.store-type=jdbc) at least on the project I'm working on. Apparently SingleSignOutFilter and SingleSignOutHandler cannot find the session to invalidate in SessionMappingStorage.Can anybody confirm that this is indeed an issue?
Does anybody know of a fix or a workaround?
When using CAS as oauth client with pac4j, what is my "Authorization callback URL" that I'm supposed to give to the oauth server?
I tried "https://my.address/cas/login", but that just brought me back from oauth server to cas login page and did not log me in.
Authorization callback URL is "https://my.addess/cas/login/NAME" where NAME is probably the value of cas.authn.pac4j.xxx.client-name from cas.properties. And at least for github: cas.authn.pac4j.github.callback-url-type=PATH_PARAMETER
What do I need to write to a service registry json file if I want a service to NOT be available with any delegated authentication methods? I have other services that need deletgated authentication and I don't want to confuse users of all services with the extra buttons on login screen.
I could probably hide the buttons by creating a new theme, but I'd rather just configure them out in the service registry json.
2 replies
Hi guys, my issue described here : https://groups.google.com/a/apereo.org/g/cas-user/c/rGU-xgmp-Mw/m/ISSqFkxFCwAJ
is resolved on last 6.4 rc but still here in the las 6.3, will the fix back to 6.3 ?
is resolved on last 6.4 rc but still here in the las 6.3, will the fix back to 6.3 ?
Hello!
jcifs-ext is not accessible. The repository dl.bintray.com/uniconiam/maven/ is down. It is a dependency of cas-server-support-spnego.
{"level":"error","ts":1623440653.4036229,"msg":"no User found in jwt"}
{"level":"debug","ts":1623440653.4036324,"msg":"setting the cookie domain to grouperdev.idm.xxx.edu"}
{"level":"debug","ts":1623440653.4036362,"msg":"deleting cookie: my-vouch-ct"}
{"level":"debug","ts":1623440653.4036474,"msg":"CaptureWriter.Write set w.StatusCode 401"}
{"level":"debug","ts":1623440653.4036324,"msg":"setting the cookie domain to grouperdev.idm.xxx.edu"}
{"level":"debug","ts":1623440653.4036362,"msg":"deleting cookie: my-vouch-ct"}
{"level":"debug","ts":1623440653.4036474,"msg":"CaptureWriter.Write set w.StatusCode 401"}
this is the error i recieve post authentication
Hello, is it possible to use https://casserver.herokuapp.com/ to test integration of a SAML SP with a CAS IdP? I looked for the IdP metadata at https://casserver.herokuapp.com/cas/idp/metadata but got a page not found. Thanks.
- What went wrong:
Execution failed for task ':compileJava'.error: release version 11 not supported
building from https://github.com/apereo/cas-overlay-template with gradlew
any hint for me ?
hi, im configuring x509 auth, with ldap extra attributes, but i have a problem with matchin cert data with LDAP fields for filter. I have a principal like ABCD-1234567Z and need a searchfilter like cas.authn.attribute-repository.ldap[0].searchFilter=<ldapfield>=1234567Z, how can i trim principal in order to use them in searchfilter. thx