apereo/cas

Apereo CAS - Single Sign On for All

Daniel Maldonado

@dannymk

I turned on debugging, attribute resolution looks good in the log but I still cannot do things like: <shiro:principal property="firstName" />

Daniel Maldonado

@dannymk

@billjojo Upgraded to 6.5.2 and everything is working as expected :-). Thank you for your help.

Daniel Maldonado

@dannymk

OK, unfortunately I spoke too soon, ran into the same problem that this person is having: https://groups.google.com/a/apereo.org/g/cas-user/c/kfOyXA8WSNA

The pattern: cas.authn.pm.core.password-policy-pattern=^(?=.[a-z])(?=.[A-Z])(?=.\d)(?=.[$@$!%?&])[A-Za-z\d$@$!%?&]{8,20}

No matter what pattern we type into the password boxes we get: "Password does not match the password policy requirement."

dhanesh238

@dhanesh238

Hi.. I am using CAS 6.4.6.2 version with x509 REST authentication. Have noticed that 'x509RestHttpRequestCredentialFactoryConfigurer' from 'X509RestConfiguration.java' is getting initialized twice. Because of this, CAS is not starting up and getting the following stacktrace. Similar use-case on CAS 6.3.4 is working fine. Seems like something is changed in CAS 6.4.x which is causing this issue. Have cross-verified if there are any duplicate jars which might be causing the issue as well.

Following are the jars added to CAS war for enabling x509:

cas-server-core-api-throttle-6.4.6.2.jar
cas-server-core-authentication-throttle-6.4.6.2.jar
cas-server-core-rest-6.4.6.2.jar
cas-server-core-webflow-6.4.6.2.jar
cas-server-core-webflow-api-6.4.6.2.jar
cas-server-support-rest-6.4.6.2.jar
cas-server-support-rest-core-6.4.6.2.jar
cas-server-support-rest-x509-6.4.6.2.jar
cas-server-support-throttle-6.4.6.2.jar
cas-server-support-throttle-core-6.4.6.2.jar
cas-server-support-x509-6.4.6.2.jar
cas-server-support-x509-core-6.4.6.2.jar
cas-server-support-x509-webflow-6.4.6.2.jar

Stacktrace:

2022-04-07 16:47:58,902 TRACE [org.apereo.cas.rest.config.CasCoreRestConfiguration] - <building REST credential factory from [[org.apereo.cas.rest.config.CasCoreRestConfiguration$$Lambda$1489/0x0000000100d06840@79c849c7, org.apereo.cas.support.x509.rest.config.X509RestConfiguration$$Lambda$1490/0x0000000100d06c40@457b8fc3, org.apereo.cas.support.x509.rest.config.X509RestConfiguration$$Lambda$1490/0x0000000100d06c40@457b8fc3]]>
2022-04-07 16:47:58,903 TRACE [org.apereo.cas.rest.config.CasCoreRestConfiguration] - <Configuring credential factory: [org.apereo.cas.rest.config.CasCoreRestConfiguration$$Lambda$1489/0x0000000100d06840@79c849c7]>
2022-04-07 16:47:58,905 TRACE [org.apereo.cas.rest.config.CasCoreRestConfiguration] - <Configuring credential factory: [org.apereo.cas.support.x509.rest.config.X509RestConfiguration$$Lambda$1490/0x0000000100d06c40@457b8fc3]>
2022-04-07 16:47:58,910 TRACE [org.apereo.cas.support.x509.rest.config.X509RestConfiguration] - <Is certificate extractor available? = [org.apereo.cas.adaptors.x509.authentication.RequestHeaderX509CertificateExtractor@8c3b634], headerAuth = [true], bodyAuth = [true], tlsClientAuth = [false]>
2022-04-07 16:47:58,917 WARN [org.apereo.cas.web.CasWebApplicationContext] - <Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'serviceTicketResource' defined in class path resource [org/apereo/cas/config/CasRestConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.support.rest.resources.ServiceTicketResource]: Factory method 'serviceTicketResource' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'restHttpRequestCredentialFactory' defined in class path resource [org/apereo/cas/rest/config/CasCoreRestConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas.rest.factory.RestHttpRequestCredentialFactory]: Factory method 'restHttpRequestCredentialFactory' threw exception; nested exception is java.lang.ClassCastException: class com.sun.proxy.$Proxy282 cannot be cast to class org.apereo.cas.rest.plan.RestHttpRequestCredentialFactoryConfigurer (com.sun.proxy.$Proxy282 and org.apereo.cas.rest.plan.RestHttpRequestCredentialFactoryConfigurer are in unnamed module of loader org.springframework.boot.loader.LaunchedURLClassLoader @3cbbc1e0)>

1 reply

billjojo

@billjojo

@dannymk the following pass in Java matches(): ^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[$@$!%?&])[A-Za-z\\d$@$!%?&]{8,20} and ^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[@$!%?&])[A-Za-z0-9d@$!%?&]{8,20}

Daniel Maldonado

@dannymk

Yup, that first pattern passes. Thank you.

Documentation pattern does not: https://apereo.github.io/cas/6.5.x/password_management/Password-Management.html

billjojo

@billjojo

That is because the backslashes need to be escaped so \d must be written as \\d. I always just use [0-9], but I am an old crank who gets stuck in the old ways on occasion. :-)

Palmurugan

@palmuruganchandran

Hi Team, I am trying to generate JWT token using 6.6.X gradle overlay. I did all the configuration mentioned in the documentation.

JWT Token Details

cas.authn.token.crypto.encryption-enabled=true
cas.authn.token.crypto.signing-enabled=true

cas.authn.token.crypto.encryption.key=tfvWcDVrxhIX7_d9mfLBXfRAmRZawFSPxwkXQtFwtuU
cas.authn.token.crypto.signing.key=qQhJicEW7P019WYG1VuJz8X8SowI2nXhbTIPNeFs5iTZ8hg6CLt1wB7e3vHC_oMJRE_am4x41In_y5IV9j_unQ

But still its not generating the JWT token. I am getting ST Token only.

Can anyone please guide me.

I am getting the below log

2022-04-12 22:45:39,203 INFO [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Signing is not enabled for [Token/JWT Tickets]. The cipher [RegisteredServiceJwtTicketCipherExecutor] will attempt to produce plain objects>

@billjojo

billjojo

@billjojo

@palmuruganchandran Looks like cas.authn.token.crypto.signing.key-size=512 cas.authn.token.crypto.encryption.key-size=512 are the defaults.

You can run wget https://raw.githubusercontent.com/apereo/cas/master/etc/jwk-gen.jar

Then java -jar jwk-gen.jar -t oct -s 512 | grep k.: | cut -f4 -d\" for each.

Palmurugan

@palmuruganchandran

@billjojo I have generated both and updated properties but still I am not getting the JWT token. Kindly help me

cas.authn.token.crypto.encryption.key=urcOPA6okI_UPhUdr7mDmzgl2BTan55Qmqh0n5tZNgsGTxv-6XKGqc-6r9z2ogS8VORHrH6Om9ZJLyVD5Pnz8Q
cas.authn.token.crypto.signing.key=gKAejbstj8HuELbfwampu9zOT6lyd-Jm5Ylj33yESnsnT5WwwEi3240BY5RnqtjMcWdVtiUYoA4l9-EKi7KnNg

2022-04-13 07:12:49,953 INFO [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Encryption is not enabled for [Token/JWT Tickets]. The cipher [RegisteredServiceJwtTicketCipherExecutor] will only attempt to produce signed objects>
2022-04-13 07:12:49,953 INFO [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Signing is not enabled for [Token/JWT Tickets]. The cipher [RegisteredServiceJwtTicketCipherExecutor] will attempt to produce plain objects>

Palmurugan

@palmuruganchandran

cas.authn.token.principal-transformation.groovy.location=

is this property mandatory, if it so what value I have to provide

billjojo

@billjojo

@palmuruganchandran Have you tested this with 6.5.2 or 6.4.6.2? As 6.6 is RC1, I am wondering if this may be a bug. Unless the docs are incorrect, encryption and signing are on by default and the order is ENCRYPT_AND_SIGN. You may want to turn on debugging in the log to see if there is another clue to be found.

Palmurugan

@palmuruganchandran

@billjojo Thank you, I just tried the same with 6.5.2. Its working as expected.

Palmurugan

@palmuruganchandran

@billjojo I am integrating oAuth now. As part of that I have added the dependency and created service. Now I am able to get the code but not able to get the accessToken. I am getting below error.

2022-04-15 19:37:43,380 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] - <Access token request is not supported>
java.lang.UnsupportedOperationException: Access token request is not supported

My Service

{
"@class" : "org.apereo.cas.support.oauth.services.OAuthRegisteredService",
"clientId": "clientid",
"clientSecret": "clientSecret",
"serviceId" : "^(https|imaps)://cas-client.com/.*",
"name" : "oauthservice",
"id" : 1,
"bypassApprovalPrompt": true
}

Kindly help me

Palmurugan

@palmuruganchandran

@billjojo Kindly advice me what I have to do for the above error

jojowil

@jojowil

@palmuruganchandran I was on holiday. OAuth is not my area of expertise, but I would say your config is incomplete. Please see the service properties and sample configs near the bottom of https://apereo.github.io/cas/6.5.x/authentication/OAuth-Authentication-TokenExpirationPolicy.html

Palmurugan

@palmuruganchandran

Thank you @jojowil I ll try the same.

TimPionnier

@TimPionnier

Hi, did anyone manage to implement fido webauthn with cas 6.5. I am new with cas and kinda struggling

TimPionnier

@TimPionnier

Actually, to be more precise, I am trying to understand how to fill these requirements: cas.authn.mfa.web-authn.core.application-id , cas.authn.mfa.web-authn.core.relying-party-id

SpaceFox

@SpaceFox

Hy everyone,
I try to run Spring Boot "integration tests" on an Apereo CAS overlay.
I have this test class with JUnit 5 and CAS 6.5.x:

@ExtendWith(SpringExtension.class)
@ActiveProfiles({"test"})
@SpringBootTest(webEnvironment =  SpringBootTest.WebEnvironment.RANDOM_PORT,
                classes = {
                        MyConfigurationClasses.class
                })
class RunTest {

    @Test
    public void run() {
        // Test the starting of SpringBoot application
    }
}

My application works fine when launched by hand with the "test" profile, but in the test context, I only got a Unable to start ServletWebServerApplicationContext due to missing ServletWebServerFactory bean. exception.
If someone has any idea of why this error?

mijutu

@mijutu:ellipsis.fi

[m]

I'm logging in with mfa: first ldap then gauth. But there is only GoogleAuthenticatorAuthenticationHandler in <cas:successfulAuthenticationHandlers> and no LdapAuthenticationHandler. Is there some setting I could change to get LdapAuthenticationHandler there too or is this a bug?

Palmurugan

@palmuruganchandran

Hi I configured oAuth related configuration that you mentioned @jojowil But still I am getting the below exception. Please help me

============= OAuth ==================================

cas.authn.oauth.access-token.crypto.encryption.key=92KEd0m4i9q0DjT8BoYRcN3MDjhhM4QSB6qR0elMhdVoKk4_RMW9jterIIVehJmoo5RMp5wbZtwyz7iHOtfFxw
cas.authn.oauth.access-token.crypto.signing.key=ucoR35oNkUPQzCmlmjFsqsdj2JRXrdjZKd58_a7LlFALIOn2ku8wL9ufdvkR9rkF4fG1J9ym_uH6aU53g_MqBQ
cas.authn.oauth.crypto.encryption.key=TSQouPQPwnOcEIbsWJ8ETWujJQy_SnEaOjGJ544UPVRl36fzu6AH0JjsUkHNWADfIUFli5hZ2uqy7uYvvByQTQ
cas.authn.oauth.crypto.signing.key=9yJv_k8A_AuJEjHtWb01GIuWenKPP4hG76mZLy4HL2ojhdEWN0EFlHws2Ms0fCtrqLP9bBc3TSQMOeOqkcilRg

cas.authn.oauth.code.number-of-uses=1
cas.authn.oauth.code.remove-related-access-tokens=false
cas.authn.oauth.code.storage-name=oauthCodesCache
cas.authn.oauth.code.time-to-kill-in-seconds=30

cas.authn.oauth.access-token.crypto.enabled=false
cas.authn.oauth.access-token.crypto.signing-enabled=false
cas.authn.oauth.access-token.crypto.encryption-enabled=false

======================================================

2022-04-28 22:11:58,625 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] - <Access token request is not supported>
java.lang.UnsupportedOperationException: Access token request is not supported
at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.lambda$verifyAccessTokenRequest$2(OAuth20AccessTokenEndpointController.java:187) ~[cas-server-support-oauth-core-api-6.5.3.jar!/:6.5.3]

2022-04-28 22:11:58,625 ERROR [org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController] - <Access token request is not supported> java.lang.UnsupportedOperationException: Access token request is not supported at org.apereo.cas.support.oauth.web.endpoints.OAuth20AccessTokenEndpointController.lambda$verifyAccessTokenRequest$2(OAuth20AccessTokenEndpointController.java:187) ~[cas-server-support-oauth-core-api-6.5.3.jar!/:6.5.3]

Palmurugan

@palmuruganchandran

{
"grant_type": "authorization_code",
"client_id": "clientid",
"client_secret": "clientSecret",
"code": "OC-1-2hshFPar2So9iu91ke504xq69vK-5MzQ",
"redirect_uri": "https://cas-client.com/intermediate"
}

https://cas.example.org:8443/cas/oauth2.0/accessToken

This is the request information

POST call

Robin Dupret

@rdupret_gitlab

Hello everyone,

I'm struggling to set up CAS proxy for an application.

IIUC, the pgtUrl passed is called by the CAS server and should provide the pgtId and pgtIou parameters. The URL is properly called but neither param is passed.

I'm running CAS version 4 and my application is allowed to be a proxy in the CAS management application.

Can anyone help me please ?

1 reply

@jnbdz

Hi all!
I am new to CAS I am having some issues.
I posted a question on Stackoverflow: https://stackoverflow.com/questions/72131500/unable-to-use-default-username-password-and-make-jsonresourcepassword-json-work

I am trying to follow the tutorial of: https://www.baeldung.com/spring-security-cas-sso

But it seems a bit out of date.

Does anyone have a few minutes to help me out?

Thank you!

2 replies

dhanesh238

@dhanesh238

Hi all

I am using CAS 6.4.6 version. Have noticed that the authentication process is getting called twice because of which it is taking longer time compared to the behaviour in 6.3.x version.

On checking the code, noticed that from DefaultRestAuthenticationService.java, it is calling handleInitialAuthenticationTransaction( ) method twice once directly and other via finalizeAuthenticationTransaction( ).

Can you let us know if it is expected behaviour or an issue?

1 reply

ohinckel

@ohinckel

Hi, we configured some services required MFA when authenticate against these services. While this works for CAS applications, it doesn't work for SAML application. In this case MFA is not triggered when the user authenticates earlier against a non-MFA application. Even when logging in without a service/application (which does not trigger MFA at all) and then logging into a MFA application, MFA is not triggered and user is directly redirected back to the application. We're using CAS 6.3.6 - this this intended behavior?

5 replies

The log shows an authentication or services is required, but not available in the case of SAML applications:

[org.apereo.cas.authentication.mfa.trigger.RegisteredServiceMultifactorAuthenticationTrigger] - No service or authentication is available to determine event for principal

Where communities thrive

People

Repo info

Activity

JWT Token Details

============= OAuth ==================================

======================================================