io.dropwizard.metrics
libraries to 4.0.x
can also address this. Is this an option running on Spring Boot 1.5.8 ?
Also relevant: https://www.zdnet.com/article/second-log4j-vulnerability-found-apache-log4j-2-16-0-released/
2.15.0
might not be "enough."
Building cas
Step 1/20 : FROM adoptopenjdk/openjdk11:alpine-slim AS overlay
---> 68d79b94d8b9
Step 2/20 : RUN mkdir -p cas-overlay
---> Using cache
---> 2fbf67e30ccc
Step 3/20 : COPY ./src cas-overlay/src/
---> 492ae4217531
Step 4/20 : COPY ./gradle/ cas-overlay/gradle/
---> d44ca8ef2c0e
Step 5/20 : COPY ./gradlew ./settings.gradle ./build.gradle ./gradle.properties /cas-overlay/
---> 6c0d5aaa1d06
Step 6/20 : RUN mkdir -p ~/.gradle && echo "org.gradle.daemon=false" >> ~/.gradle/gradle.properties && echo "org.gradle.configureondemand=true" >> ~/.gradle/gradle.properties && cd cas-overlay && chmod 750 ./gradlew && ./gradlew --version;
---> Running in 17e37e5f3ced
Downloading https://services.gradle.org/distributions/gradle-7.3.1-bin.zip
...........10%...........20%...........30%...........40%...........50%...........60%...........70%...........80%...........90%...........100%
Welcome to Gradle 7.3.1!
Here are the highlights of this release:
- Easily declare new test suites in Java projects
- Support for Java 17
- Support for Scala 3
For more details see https://docs.gradle.org/7.3.1/release-notes.html
------------------------------------------------------------
Gradle 7.3.1
------------------------------------------------------------
Build time: 2021-12-01 15:42:20 UTC
Revision: 2c62cec93e0b15a7d2cd68746f3348796d6d42bd
Kotlin: 1.5.31
Groovy: 3.0.9
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 11.0.8 (AdoptOpenJDK 11.0.8+10)
OS: Linux 4.18.0-348.2.1.el8_5.x86_64 amd64
Removing intermediate container 17e37e5f3ced
---> f0df1a5519e8
Step 7/20 : RUN cd cas-overlay && ./gradlew clean build --parallel --no-daemon;
---> Running in 89755da20e71
To honour the JVM settings for this build a single-use Daemon process will be forked. See https://docs.gradle.org/7.3.1/userguide/gradle_daemon.html#sec:disabling_the_daemon.
Daemon will be stopped at the end of the build
Configuration on demand is an incubating feature.
> Task :clean
> Task :extractCasBootWarOverlay
> Task :bootBuildInfo
> Task :generateMainEffectiveLombokConfig1
> Task :checkLombokConfig
> Task :compileJava FAILED
Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.
You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.
See https://docs.gradle.org/7.3.1/userguide/command_line_interface.html#sec:command_line_warnings
6 actionable tasks: 6 executed
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':compileJava'.
> error: release version 11 not supported
* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
* Get more help at https://help.gradle.org
BUILD FAILED in 53s
java.lang.IllegalAccessError: class org.pac4j.oidc.profile.creator.OidcProfileCreator tried to access protected method 'void com.nimbusds.oauth2.sdk.ProtectedResourceRequest.<init>(java.net.URI, com.nimbusds.oauth2.sdk.token.AccessToken)' (org.pac4j.oidc.profile.creator.OidcProfileCreator and com.nimbusds.oauth2.sdk.ProtectedResourceRequest are in unnamed module of loader org.springframework.boot.loader.LaunchedURLClassLoader @277050dc)
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:94)
at org.pac4j.core.client.BaseClient.retrieveUserProfile(BaseClient.java:126)
at org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:105)
at org.apereo.cas.support.pac4j.authentication.handler.support.DelegatedClientAuthenticationHandler.doAuthentication(DelegatedClientAuthenticationHandler.java:78)
at org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:44)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
Hello I'm using CAS 6.4.2 (log4j 2.14.1) i rebuilding the project and i add these lines
-- add to build.gradle dependencies section
implementation "org.apache.logging.log4j:log4j-api:2.16.0"
implementation "org.apache.logging.log4j:log4j-core:2.16.0"
implementation "org.apache.logging.log4j:log4j-jcl:2.16.0"
implementation "org.apache.logging.log4j:log4j-jul:2.16.0"
implementation "org.apache.logging.log4j:log4j-web:2.16.0"
implementation "org.apache.logging.log4j:log4j-slf4j18-impl:2.16.0"
-- add to the end of build.gradle
bootWar {
entryCompression = ZipEntryCompression.STORED
overlays {
cas {
from "org.apereo.cas:cas-server-webapp${project.appServer}:${casServerVersion}@war"
provided = false
excludes = ["WEB-INF/lib/log4j2.12..jar","WEB-INF/lib/log4j2.14..jar"]
}
}
}
Hi, We are currently using 6.3.2
version of CAS. To fix the log4j Vulnerability, we have upgraded the cas version to 6.3.7.4
. After updating the version, we are facing the below issue
> Could not resolve all files for configuration ':casBootWarOverlay'.
> Could not resolve org.apereo.cas:cas-server-webapp-tomcat:6.3.7.4.
Required by:
project :
> Cannot choose between the following variants of org.apereo.cas:cas-server-webapp-tomcat:6.3.7.4:
- master
- samplessources
All of them match the consumer attributes:
- Variant 'master' capability org.apereo.cas:cas-server-webapp-tomcat:6.3.7.4:
- Unmatched attributes:
- Provides org.gradle.status 'release' but the consumer didn't ask for it
- Provides org.gradle.usage 'java-runtime' but the consumer didn't ask for it
- Variant 'samplessources' capability org.apereo.cas:cas-server-webapp-tomcat:6.3.7.4:
- Unmatched attributes:
- Provides org.gradle.category 'documentation' but the consumer didn't ask for it
- Provides org.gradle.docstype 'samplessources' but the consumer didn't ask for it
- Provides org.gradle.status 'release' but the consumer didn't ask for it
As per the gradle documentation, looks like there are multiple variants. Can you please help me to resolve this issue?
Hey! Nobody noticed that the last version of CAS client for Java, its build for Java 8, but have a dependency to JAXB 2.3.1 that its for Java 9 ?
Also, the READMED should clarify what version of Java it's being supported.
Anyone could annotate this on the issues system that you are using ? I would liked to do this, but I don't see that I could done on GitHub repo, and I don't see a Jira o r Mantis to do it.
attributeReleasePolicy: !<org.apereo.cas.services.ReturnMappedAttributeReleasePolicy>
allowedAttributes: !<java.util.TreeMap>
mail: !<java.util.ArrayList>
- "mail"
principalAttributesRepository: !<org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository>
attributeRepositoryIds: !<java.util.HashSet>
- "*"
consentPolicy: !<org.apereo.cas.services.consent.DefaultRegisteredServiceConsentPolicy>
status: "FALSE"
excludeDefaultAttributes: true
authorizedToReleaseAuthenticationAttributes: false
For 6.4x -> 6.5-SNAPSHOT we're trying to identify the following issue:
2022-02-03 12:19:54,805 -0700 WARN [io.netty.bootstrap.Bootstrap] - <Failed to set channel option 'CONNECT_TIMEOUT_MILLIS' with value '5000' for channel '[id: 0xf39d1e89]'>
This appears to break LDAP connection for the service registry.
We've also seen a few parameters change formatting in docs, but don't necessarily error/warn in the container, so it seems confusing to debug at the moment.
Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize value of typejava.lang.String
from Array value (tokenJsonToken.START_ARRAY
)
at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apereo.cas.support.oauth.services.OAuthRegisteredService["supportedGrantTypes"]->java.util.HashSet[1])