mijutu Start with https://apereo.github.io/cas/6.2.x/
Clone https://github.com/apereo/cas-overlay-template
Checkout the 6.2 branch and then create a new branch from it for your own changes. Later you need to add more implementation-lines to build.gradle depending on your needs. Run ./gradlew build to get a war package.
You need to add configuration to /etc/cas/config/cas.properties to let CAS know from where it should verify passwords.
You need to write at least one /etc/cas/services/foo-1.json to tell CAS which service-parameters are allowed.
CAS documentation is actually quite good, but at first it might seem confusing. Note how all the configuration properties are listed in one huge webpage that you should not try to read all at once. Instead each topic has links to the correct places on the properties page.
I suggest you first build a war package and get it running. After that, decide how cas should validate user's passwords and add configuration for it.
mijutu And the json service registry is only one option. (The "you need to" I wrote was actually wrong). Service definitions can be set up in many other ways: https://apereo.github.io/cas/6.2.x/services/Service-Management.html#storage
but the question is: How we can read and release this type of attributes with Apereo CAS. For example i defined studentNumber attribute on properties file, but it just return studentNumber without any tags! if we store attribute with tags, cas doesn't return that. anyone has a solution for this?
=============================================================
WHO: P0888888
WHAT: [result=Service Access Granted,service=http://localhost:8088/index.jsp,principal=SimplePrincipal(id=P0888888, attributes={mail=[sstest3@pacteraedge.com], employeeNumber=[P0888888]}),requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Tue Nov 24 16:09:51 CST 2020
CLIENT IP ADDRESS: 127.0.0.1
SERVER IP ADDRESS: 127.0.0.1
>
2020-11-24 16:09:51,669 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
WHO: P0888888
WHAT: TGT-1-**-JXR63rzNhsBAC1500995-PC
ACTION: TICKET_GRANTING_TICKET_CREATED
APPLICATION: CAS
WHEN: Tue Nov 24 16:09:51 CST 2020
CLIENT IP ADDRESS: 127.0.0.1
SERVER IP ADDRESS: 127.0.0.1
>
2020-11-24 16:09:51,685 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
WHO: P0888888
WHAT: [result=Service Access Granted,service=http://localhost:8088/index.jsp,requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Tue Nov 24 16:09:51 CST 2020
CLIENT IP ADDRESS: 127.0.0.1
SERVER IP ADDRESS: 127.0.0.1
>
2020-11-24 16:09:51,702 INFO [org.apereo.cas.DefaultCentralAuthenticationService] - <Granted ticket [ST-1-xxYlJ4yG8XdlqLrnb1qx9AAdGdYBAC1500995-PC] for service [http://localhost:8088/index.jsp] and principal [P0888888]>
2020-11-24 16:09:51,706 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
WHO: P0888888
WHAT: ST-1-xxYlJ4yG8XdlqLrnb1qx9AAdGdYBAC1500995-PC for http://localhost:8088/index.jsp
ACTION: SERVICE_TICKET_CREATED
APPLICATION: CAS
WHEN: Tue Nov 24 16:09:51 CST 2020
CLIENT IP ADDRESS: 127.0.0.1
SERVER IP ADDRESS: 127.0.0.1
>
2020-11-24 16:09:51,811 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
WHO: audit:unknown
WHAT: [result=Service Access Granted,service=http://localhost:8088/index.jsp,principal=SimplePrincipal(id=P0888888, attributes={}),requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Tue Nov 24 16:09:51 CST 2020
CLIENT IP ADDRESS: 127.0.0.1
SERVER IP ADDRESS: 127.0.0.1
mijutu I got it to work recently (with 6.2.5) by setting cas.authn.mfa.global-principal-attribute-name-triggers=foo and cas.authn.mfa.global-principal-attribute-value-regex=bar. Where foo is pricipal attribute name (not ldap attribute name) from cas.authn.ldap[0].principalAttributeList
We are using some tags on ldap attributes. for example if we want to store user's cn in different language we can use cn and cn;lang-en-US and cn;lang-fr and ... or maybe when we want to store student number for BSC and MSC, we can use tags (called ldap attribute option too) for it. for example edu-bsc and edu-msc.
but the question is: How we can read and release this type of attributes with Apereo CAS. For example i defined studentNumber attribute on properties file, but it just return studentNumber without any tags! if we store attribute with tags, cas doesn't return that. anyone has a solution for this?
who can help me about this matter?
cas-server-support-json-service-registry as a dependency in my pom. The app is allowing logins from any HTTPS service id, instead of the app listed in my JSON file (/etc/cas/services/casSecuredApp-8900.json). Any ideas about why my config is not being used?
cas-management_1 | 2020-11-26 14:58:24,452 WARN [org.apereo.cas.support.saml.SamlUtils] - <Resource [class path resource [incommon.pem]] cannot be located>
cas-management_1 | 2020-11-26 14:58:24,456 WARN [org.apereo.cas.mgmt.web.CasManagementWebApplicationContext] - <Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'samlController' defined in class path resource [org/apereo/cas/mgmt/config/CasManagementSamlConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.mgmt.SamlController]: Factory method 'samlController' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadataAggregateResolver' defined in class path resource [org/apereo/cas/mgmt/config/CasManagementSamlConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.mgmt.MetadataAggregateResolver]: Factory method 'metadataAggregateResolver' threw exception; nested exception is java.lang.NullPointerException>
cas-management_1 | 2020-11-26 14:58:24,489 ERROR [org.springframework.boot.SpringApplication] - <Application run failed>
cas-management_1 | org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'samlController' defined in class path resource [org/apereo/cas/mgmt/config/CasManagementSamlConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.mgmt.SamlController]: Factory method 'samlController' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadataAggregateResolver' defined in class path resource [org/apereo/cas/mgmt/config/CasManagementSamlConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.mgmt.MetadataAggregateResolver]: Factory method 'metadataAggregateResolver' threw exception; nested exception is java.lang.NullPointerException
cas_1 | 2020-11-27 13:47:21,351 ERROR [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <Authentication has failed. Credentials may be incorrect or CAS cannot find authentication handler that supports [UsernamePasswordCredential(username=toto, source=null, customFields={})] of type [UsernamePasswordCredential]. Examine the configuration to ensure a method of authentication is defined and analyze CAS logs at DEBUG level to trace the authentication event.>
cas_1 | 2020-11-27 13:47:21,352 ERROR [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <[app_users]: [I/O error on POST request for "https://users.docker:3443/cas/authenticate": PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target / PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]>
The fact is that I can navigate to https://users.docker:3443 from my local browser. Do you have any tip on how to make this work ?
cas.authn.attributeRepository.ldap[0].allowMultipleEntries=true
