Hi CAS people! I'm new to CAS and have been trying to setup Delegated Authentication to an external SAML IDP. I've reached the point where CAS is creating the SP metadata, however I've hit a wall trying to get my IDP and the CAS to communicate. I'm also not that versed in SAML which is not helping.
My first focus is resolving the location that shows in the SP metadata. It is showing the backend server host addresses instead of the load balancer address. But I don't know how to change it. Anyone have any guidance on that?
Hello
I'm using cas 6.1.x with oidc configure, but I'm unable to validate my jwt, with my application using spring-security(got an error "signed JWT rejected") after investigation, I see that ca/oic/jwks not return algorithm field:
{"keys":[{"kty":"RSA","n":"gEenxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxXKRbhiTm5g8l-DIw","e":"AQAB"}]}by example "alg": "A256CBC-HS512" field, is missing, is there a way to configure cas to returning this field?
Can the cas server work as a reverse proxy for the web applications themselves? so that all requests get validated through cas?
I also noticed that the latest version was v6.1.6, but the docker image was only v6.1.3
ERROR [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController] - <CAS has found a match for service [xxxx] in registry but the match is not defined as a SAML service>"?
what's going on with "
ERROR [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController] - <CAS has found a match for service [xxxx] in registry but the match is not defined as a SAML service>"?
I bet that's because you have a wildcarded CAS service registry entry that is picking up first, fix that and you will probably get your service to request correctly
Property: cas.single-logout.enabled
Value: true
Origin: class path resource [application.yml]:324:14
Reason: The elements [cas.single-logout.enabled] were left unbound.
MultifactorAuthenticationVerifyTrustAction fails because it cannot decide if it shouldBypassTrustedDevice. My login fails with an UnauthorizedServiceException. Any help with this is greatly appreciated!
Hello, Looking for some insight on how to enable the gauthCredentialRepository endpoint for Google Authenticator MFA. I am building a docker image from the 6.2 branch from here cas-overlay. I can't seem to find an example anywhere. So far everything is working as expected with LDAPS(Active Directory) and the registration of the devices and tokens but I'd like to have that endpoint to manage the devices if need be without going in and mucking with the DB. Would like to have that endpoint authenticated if possible which I believe I can from what I have been reading. I just do not know the values to put in the cas properties files to enable it.
Thank you
Hi
Is it possible to suppress the client_name from the url of IDP [Custom IDP] for delegated authentication ? Trying CAS 5.2
https://stackoverflow.com/questions/62782606/cas-server-delegated-authentication
On clicking IDP Authentication link, the url is appended with %3Fclient_name%3DGenericOAuth20Client. If I manually replace %3F with "&" or remove the whole param, the idp link get displayed or else error out saying invalid redirect_url. Param separator in rest of the url comes as "&" though.
Thanks
{"_id":{"$oid":"5e17bdf6e86e43023c89b9f4"},"name":"cas.authn.accept.name","value":""}
{"_id":{"$oid":"5e17be04e86e43023c89b9f5"},"name":"cas.authn.accept.credentialCriteria","value":""}
{"_id":{"$oid":"5e17be1be86e43023c89b9f6"},"name":"cas.authn.mongo.name","value":"users"}
{"_id":{"$oid":"5e17be28e86e43023c89b9f7"},"name":"cas.authn.mongo.databaseName","value":"users"}
{"_id":{"$oid":"5e17be3ae86e43023c89b9f8"},"name":"cas.authn.mongo.collection","value":"users"}
{"_id":{"$oid":"5e17be78e86e43023c89b9f9"},"name":"cas.authn.mongo.usernameAttribute","value":"username"}
{"_id":{"$oid":"5e17be8be86e43023c89b9fa"},"name":"cas.authn.mongo.passwordAttribute","value":"password"}
Pom.xml:
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-pm-ldap</artifactId>
<version>${cas.version}</version>
</dependency>
cas.properties:
cas.authn.accept.users=
cas.authn.ldap[0].order=0
cas.authn.ldap[0].name=LDAP Server
cas.authn.ldap[0].type=AUTHENTICATED
cas.authn.ldap[0].ldapUrl=ldap://localhost
cas.authn.ldap[0].useSsl=false
cas.authn.ldap[0].useStartTls=false
cas.authn.ldap[0].connectTimeout=50000
cas.authn.ldap[0].subtreeSearch=true
cas.authn.ldap[0].validatePeriod=270
cas.authn.ldap[0].userFilter=cn={user}
cas.authn.ldap[0].userFilter=(|(uid={user})(cn={user})(mail={user}))
cas.authn.ldap[0].baseDn=dc=example,dc=com
cas.authn.ldap[0].enhanceWithEntryResolver=true
cas.authn.ldap[0].dnFormat:cn=%s,cn=admin,dc=example,dc=com
cas.authn.ldap[0].bindDn=cn=admin,dc=example,dc=com
cas.authn.ldap[0].bindCredential=administrator
cas.authn.ldap[0].enhanceWithEntryResolver=true
cas.authn.ldap[0].dnFormat:cn=%s,cn=admin,dc=example,dc=com
cas.authn.ldap[0].principalAttributeList=memberOf,uid,cn,mail
cas.authn.ldap[0].collectDnAttribute=false
cas.authn.ldap[0].principalAttributeId=cn
cas.authn.ldap[0].principalAttributePassword=userPassword
attributes to be retrieved from LDAP userPassword
cas.authn.ldap[0].principalAttributeList=uid,cn,mail
cas.authn.ldap[0].collectDnAttribute=false
cas.authn.ldap[0].principalDnAttributeName=principalLdapDn
cas.authn.ldap[0].allowMultiplePrincipalAttributeValues=true
cas.authn.ldap[0].allowMissingPrincipalAttributeValue=true
cas.authn.ldap[0].credentialCriteria=
LDAP Password Encoding
cas.authn.ldap[0].passwordEncoder.type=
cas.authn.ldap[0].passwordEncoder.characterEncoding=UTF-8
cas.authn.ldap[0].passwordEncoder.encodingAlgorithm=SHA
LDAP Pooling
cas.authn.ldap[0].minPoolSize=3
cas.authn.ldap[0].maxPoolSize=50
cas.authn.ldap[0].validateOnCheckout=true
cas.authn.ldap[0].validatePeriodically=true
cas.authn.ldap[0].validatePeriod=600
cas.authn.ldap[0].failFast=true
cas.authn.ldap[0].idleTime=5000
cas.authn.ldap[0].prunePeriod=5000
cas.authn.ldap[0].blockWaitTime=5000
cas.authn.ldap[0].providerClass=org.ldaptive.provider.unboundid.UnboundIDProvide
r
cas.authn.ldap[0].allowMultipleDns=false#Password Management
spring.mail.host=mail.technology.com
spring.mail.port=587
spring.mail.username=xyz@technology.com
spring.mail.password=xxxxxx
spring.mail.testConnection=true
spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true
cas.authn.pm.enabled=true
cas.authn.pm.policyPattern=^(?=.?[A-Z])(?=.?[a-z])(?=.?[0-9])(?=.?[#?!@$
%~()_{}-]).{8,}$
cas.authn.pm.reset.text=password reset:%s
cas.authn.pm.reset.text=Reset your password with this link: %s
cas.authn.pm.reset.subject=armor password reset
cas.authn.pm.reset.subject=Password Reset Request
cas.authn.pm.reset.from=${spring.mail.username}
cas.authn.pm.reset.expirationMinutes=10
cas.authn.pm.reset.emailAttribute=mail
cas.authn.pm.reset.securityQuestionsEnabled=false
cas.authn.pm.autoLogin=false
cas.authn.pm.reset.crypto.encryption.key=xxxxxxxxxxxxxxxxxxxxxxxx
cas.authn.pm.reset.crypto.signing.key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cas.authn.pm.reset.crypto.enabled=true
cas.authn.pm.enabled=true
cas.authn.pm.ldap.type=GENERIC
cas.authn.pm.ldap.ldapUrl=${cas.authn.ldap[0].ldapUrl}
cas.authn.pm.ldap.useSsl=false
cas.authn.pm.ldap.connectTimeout=5000
cas.authn.pm.ldap.baseDn=${cas.authn.ldap[0].baseDn}
cas.authn.pm.ldap.userFilter=${cas.authn.ldap[0].userFilter}
cas.authn.pm.ldap.subtreeSearch=true
cas.authn.pm.ldap.bindDn=cn=admin,dc=example,dc=com
cas.authn.pm.ldap.bindCredential=administrator
cas.authn.pm.ldap.poolPassivator=BIND
cas.authn.pm.ldap.minPoolSize=3
cas.authn.pm.ldap.maxPoolSize=10
cas.authn.pm.ldap.validateOnCheckout=true
cas.authn.pm.ldap.validatePeriodically=true
cas.authn.pm.ldap.validatePeriod=600
cas.authn.pm.ldap.validateTimeout=5000
cas.authn.pm.ldap.failFast=true
cas.authn.pm.ldap.idleTime=500
cas.authn.pm.ldap.prunePeriod=600
cas.authn.pm.ldap.blockWaitTime=5000
cas.authn.pm.ldap.providerClass=org.ldaptive.provider.unboundid.
validator
cas.authn.pm.ldap.validator.type=SEARCH
cas.authn.pm.ldap.validator.baseDn=dc=example,dc=com
cas.authn.pm.ldap.validator.searchFilter=(objectClass=*)
cas.authn.pm.ldap.validator.scope=SUBTREE