Hi, we are using CAS 6.4.0 with GoogleAuthenticator Multi-Factor enabled, but every time we reboot CAS the tokens provided by the GoogleAuthenticator App for the users stops working.
This seems to be related to the secret for the specific couple user/device that CAS is not able to recover after reboot (the internal service endpoint 'gauthCredentialRepository' doesn't return it in response to a GET /{username} endpoint).
To reproduce this issue:
- Configure CAS for MF GoogleAuthenticator
- Login with a user
- Scan the code with GoogleAuthenticator App and complete the device association
- Login using credential and the token provided by the app --> OK
- Reboot CAS
- Login using credential and the token provided by the app --> KO Token not valid
We think this is a bug, but any help to resolve this critical issue will be appreciated.
1 reply
Hi guys, I am setting up the CAS version 6.3.6 via K8s . I just prepare the image in the Container Registry. The gradle.build is remain the same as I don't add any new dependencies. But I don't know why it keeps saying this error.
"WARN [org.apereo.cas.web.CasWebApplicationContext] - <Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanDefinitionStoreException: Failed to process import candidates for configuration class [org.apereo.cas.web.CasWebApplication]; nested exception is java.lang.IllegalStateException: Error processing condition on org.springframework.boot.actuate.autoconfigure.quartz.QuartzEndpointAutoConfiguration>"
Hope someone helps me! Much appreciated
Hello, I am using jasig 6.3 and I am trying customize it with the overlay. I m trying to override some bean with Java code but the gradle build is unable to compile due to missing symbols, even the most core symbols are missing in the compilation process (i.e. UsernamePasswordCredential from cas-server-core-authentication.
Is there something to tune in build.gradle to allow override java beans?
2021-10-12 18:06:47,586 ERROR [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlIdPProfileHandlerController] - <NullPointerException>
java.lang.NullPointerException: null
at java.util.HashMap.putMapEntries(Unknown Source) ~[?:?]
at java.util.HashMap.putAll(Unknown Source) ~[?:?]
Hi, I'm using the CAS (6.3.5) OIDC module and a REST authentication backend. It's working fine, but now I'd like to provide a better error explanation when using the "password grant" workflow. The REST backend is returning different 4xx codes according to the specific situation (invalid credentials, expired password, etc). However, this information is lost somewhere inside the authentication request, resulting in just a generic 401 error code.
Is there a way to customize the "unauthorized" message so it includes a message (or message key) related to the actual exception thrown by the backend provider ?
hi i install CAS 6.5 snapshot and i configure the LDAP authentication like this but i can't connexion with ldap users (ubuntu 20.04)
apt install tomcat9 tomcat9-admin tomcat9-user openjdk-11-jdk openjdk-11-jre maven build-essential git -y
echo "JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64/" >> /etc/environment
source /etc/environment
add this line /etc/default/tomcat9
JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
add these lines /etc/tomcat9/tomcat-users.xml
<role rolename="admin-gui"/>
<user username="admin" password="passer" roles="manager-gui,admin-gui"/>
systemctl restart tomcat9
keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore cas.keystore
complete questions...
mv cas.keystore /etc/tomcat9/
add these lines /etc/tomcat9/server.xml
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystoreFile="/etc/tomcat7/cas.keystore"
keystorePass="123456" />
service tomcat9 restart
cd /opt/
git clone https://github.com/apereo/cas-overlay-template
cd cas-overlay-template
add this line in build.gradle
dependencies {
// Add modules in format compatible with overlay casModules property
if (project.hasProperty("casModules")) {
def dependencies = project.getProperty("casModules").split(",")
dependencies.each {
def projectsToAdd = rootProject.subprojects.findAll {project ->
project.name == "cas-server-core-${it}" || project.name == "cas-server-support-${it}"
}
projectsToAdd.each {implementation it}
}
}
// CAS dependencies/modules may be listed here statically...
//i only add this line
implementation "org.apereo.cas:cas-server-support-ldap:${project.'cas.version'}"
add these lines in cas.properties
cas.server.name=https://192.168.1.6:8443
#######mes mes ajouts
cas.authn.ldap[0].type=AUTHENTICATED
cas.authn.ldap[0].ldapUrl=ldap://192.168.1.6:389
cas.authn.ldap[0].baseDn=dc=retel,dc=sn
cas.authn.ldap[0].searchFilter=uid={user}
cas.authn.ldap[0].subtreeSearch=true
cas.authn.ldap[0].bindDn=cn=admin,dc=retel,dc=sn
cas.authn.ldap[0].bindCredential=passer
cas.authn.ldap[0].principalAttributeId=uid
cas.authn.ldap[0].principalAttributePassword=password
########## fin ajout
cd /opt/cas-overlay-template
./gradlew clean
success
./gradlew clean copyCasConfiguration build
success
./gradlew createKeystore
success
cp /opt/cas-overlay-template/build/libs/cas.war /var/lib/tomcat9/webapps/
systemctl restart tomcat9.service
https://192.168.1.6:8443/cas i have the web interface
but connexion with ldap users failed
slapcat
617ea503 /etc/ldap/slapd.conf: line 103: rootdn is always granted unlimited privileges.
617ea503 /etc/ldap/slapd.conf: line 120: rootdn is always granted unlimited privileges.
dn: dc=retel,dc=sn
objectClass: top
objectClass: dcObject
objectClass: organization
o: retel.sn
dc: retel
structuralObjectClass: organization
entryUUID: 5d28ef16-ce92-103b-941c-010debc66135
creatorsName: cn=admin,dc=retel,dc=sn
createTimestamp: 20211031123232Z
entryCSN: 20211031123232.443947Z#000000#000#000000
modifiersName: cn=admin,dc=retel,dc=sn
modifyTimestamp: 20211031123232Z
dn: cn=admin,dc=retel,dc=sn
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9bnRBeUlGVlQyYU4wSzE1cnVUZ01UMUs2TjhIcVB2VmI=
structuralObjectClass: organizationalRole
entryUUID: 5d2ae1a4-ce92-103b-941d-010debc66135
creatorsName: cn=admin,dc=retel,dc=sn
createTimestamp: 20211031123232Z
entryCSN: 20211031123232.456707Z#000000#000#000000
modifiersName: cn=admin,dc=retel,dc=sn
modifyTimestamp: 20211031123232Z
dn: ou=people,dc=retel,dc=sn
objectClass: organizationalUnit
ou: people
structuralObjectClass: organizationalUnit
entryUUID: 67503832-ce92-103b-8113-ed77ac459179
creatorsName: cn=admin,dc=retel,dc=sn
createTimestamp: 20211031123249Z
entryCSN: 20211031123249.478623Z#000000#000#000000
modifiersName: cn=admi
cas.authn.ldap[0].providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider
reason for it is
https://www.mail-archive.com/cas-user@apereo.org/msg08477.html
I'm not sure if that is a problem anymore in 6.5
i have add these lines
dependencies {
// Add modules in format compatible with overlay casModules property
if (project.hasProperty("casModules")) {
def dependencies = project.getProperty("casModules").split(",")
dependencies.each {
def projectsToAdd = rootProject.subprojects.findAll {project ->
project.name == "cas-server-core-${it}" || project.name == "cas-server-support-${it}"
}
projectsToAdd.each {implementation it}
}
}
// CAS dependencies/modules may be listed here statically...
implementation "org.apereo.cas:cas-server-webapp-init:${casServerVersion}"
implementation "org.apereo.cas:cas-server-support-ldap:${project.'cas.version'}"
implementation "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}"
}
they dont know casServerVersion only ${project.'casversion'} works
Hello,
I have a web application which uses for the react js front part and the symfony backend and a cas sso authentication server.
I have configured react to authenticate with case and the backend part also configured with case. The user is authenticated on both applications. But the problem that I can not use the api rest of the backend because it is not recognized that it is connected to because via axios http requests.
I saw that it was necessary to set up a proxy case.
Do you have any information on this use case and how to do it?
Does your example take into account the proxy case?
This link details the API call in case.
https://apereo.github.io/cas/5.0.x/installation/Configuring-Proxy-Authentication.html
Regards
