mmoayyed on 6.6.x
Update to 6.6.4-SNAPSHOT (#5556) (compare)
mmoayyed on master
Make LoggingUtils configurable … (compare)
mmoayyed on master-loggingutils
Hello friends, someone has this error when debugging cas:
Task :api:cas-server-core-api-configuration-model:generateConfigurationMetadata FAILED
Error: Could not find or load main class org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator
Caused by: java.lang.ClassNotFoundException: org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator
Could not find or load main class org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator
@messageSourcein spel. so looks like i need to fork the
org.apereo.cas.util.spring.SpringExpressionLanguageValueResolver. but may be there is a better way?
i want to customize email templates but cas doesn't find them in the classpath, so i am forced to place them somewhere on the file system outside of the cas.war. this would make deployment harder than it should be. i tried something like
text: classpath:ResetPasswordEmailTemplate.html but then it doesn't find it
Caused by: java.io.FileNotFoundException: class path resource [ResetPasswordEmailTemplate.html] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/home/user/cas/build/libs/cas.war!/WEB-INF/classes!/ResetPasswordEmailTemplate.html even though the file is there. So it looks like the
EmailMessageBodyBuilder is loading files only from fs.
Any ideas how to solve this?
another question, may be will get some answers ;)
cas is configured to use locale cookie for localization. i use locale resolver which sets request attributes and it works for the whole UI. But the password managment email builder doesn't respect the locale cookie because it uses
request.getLocale() which reads from
here is the snippet from cas email builder
val text = EmailMessageBodyBuilder.builder() .properties(reset) .parameters(parameters) .locale(Optional.ofNullable(request.getLocale()))
any suggestion on how to set request locale somewhere in locale resolver so it works here as well. otherwise i would need to fork the class and make it use request attribute instead of
getLocale(). but that would be very dirty hack
If I only have a Provider, how do I make the delegated authentication redirect directly to it?
I want CAS to be transparent to users and not make them choose which delegated authentication to use.
I'm configure proces on CAS 6.5 to automaticaly go to Dynamic Delegation Resolver View, and then base on email go to providers
So, we're attempting to implement surrogate authentication / impersonation in CAS 220.127.116.11, using a JDBC repository. Basic impersonation works, and I see the new user id pass through to other applications. However we have SAML integrated applications that rely on the email address as the user identifier (not username), and in these situations, all of the attributes are those of the primary, not the surrogate, which results in the SAML authentication passing the primary's email address to the SP application.
I've tried configuring some of the settings related to
cas.authn.surrogate.principal.attribute-resolution-enabled and some of the associated settings, without success.
I guess my question is - is this feature just working 'as intended', and we are correctly seeing the surrogateId of the surrogateUser, with rest of the attributes from the surrogatePrincipal (email, group memberships, etc.) or am I missing a key configuration here?
Hi. We are upgrading our CAS4.x application to 6.x. Looking at the documentation, a lot has changed in Webflows. We plan to change our main login flow with the token login process to use the new method.
However, we have two custom authentication flows and I don't know how to connect to the CAS service. Looking at our 4.x configuration, we first define servlet mappings, map URLs, then update the supportedFlowIds set, and finally point Spring to the actual XML to specify these flows. These are called by the application to /token_login_flow on the CAS servlet.
Configure CAS to know when to see /token_login_flow to start custom webflow?
Make CAS actions (like granting tickets, etc.) available to this custom web process?
<bean id="loginHandlerAdapter" class="cas.tokensso.SelectiveFlowHandlerAdapter" p:flowExecutor-ref="loginFlowExecutor" p:flowUrlHandler-ref="loginFlowUrlHandler" >
<webflow:flow-registry id="loginFlowRegistry" flow-builder-services="builder">
<webflow:flow-location path="/WEB-INF/login-webflow.xml" id="login" />
<webflow:flow-location path="/WEB-INF/token-login-webflow.xml" id="token_login"/>
Please, can anybody help me? Thank you!
Another issue with Surrogate/Impersonation. This time, I've run into an interesting situation with Impersonation + MFA. Using out of the box 6.6.0, I can get mfa-simple and impersonation/surrogate working separately. However, as soon as I try and turn them both on, things break.
If I have them both on, and try to log in as +username, I go through the MFA routine and it logs in as username, without giving me the option of selecting a surrogate user.
If I have them both on, and try to log in as surrogateusername+username, I start the MFA routine, but CAS throws the following error:
2022-09-21 10:43:13,779 WARN [org.apereo.cas.mfa.simple.validation.DefaultCasSimpleMultifactorAuthenticationService] - <Principal assigned to token [username] is unauthorized for token [CASMFA-#######]>
2022-09-21 10:43:13,811 ERROR [org.apereo.cas.mfa.simple.CasSimpleMultifactorAuthenticationHandler] - <Failed to authenticate code CASMFA-###### DefaultCasSimpleMultifactorAuthenticationService.java:validate:76 CasSimpleMultifactorAuthenticationHandler.java:doAuthentication:63 AbstractPreAndPostProcessingAuthenticationHandler.java:authenticate:47 >
This means that, if I want Impersonation, it seems that I need to disable MFA, and vice versa. Has anyone been able to get both of these working simultaneously with recent (6.5.x, 6.6.x) versions of CAS?
Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:
version=7.0.0-SNAPSHOT # CAS server version cas.version=7.0.0-SNAPSHOT
:point_up: Edit: Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:
version=7.0.0-SNAPSHOT # CAS server version cas.version=7.0.0-SNAPSHOT
doChangePasswordparameter is present? the problem is when a user is not logged in
doChangePasswordtriggers password change flow after successful login. but if a customer is already logged in (TGC) it doesn't show login view in order o change password but redirects directly to the service
The CAS project management committee has prepared a survey to request
feedback from CAS deployers:
Our intention is to help clarify specific areas in the CAS ecosystem
that need attention, understand user demographics and common use cases
and explore opportunities to support and prioritize funding of
There is no submission due date yet though ideally, it would be best
to finalize the results before 2022 ends. I will try to send out
monthly reminders to the list here.
Please try to keep your answers realistic, concise and objective as
much as possible. As per the last surveys, responses will surely help
and guide the project's direction. Survey results will be anonymized,
aggregated and published accordingly for wider community's review on
the Apereo blog. Details to follow.
On behalf of the CAS project management committee,
P.S. If you are not able to pull up the link or have questions, please
reach out to the PMC or me directly.
I'm trying to upgrade from CAS 6.5.5 to 6.6.1 but even though the process went successfully, we can't manage to connect on any service, all tickets are considered invalid ("Ticket is not recognized")
We are using a Redis store for tickets. The configuration file is the exact same between the two versions.
Any hint to debug that please ?
required-ip-addresses: ["127.0.0.1", "172.18.0.0/22", "10.0.0.0/8"]don't work anymore. this undocumented breaking change caused deployment to fail because health endpoint cannot be accessed anymore
Dear Apereo CAS community, I am in need of some help if someone has come across a similar issue.
I'n on CAS 6.6.0 and I'm trying to implement SAML 2.0 integration by having CAS acting as a SP and delegating authentication to external IDP.
I have configured all settings to generate the SP metadata file, and I was provided with the IDP metadata file as well.
The problem is that the IDP entity wants to use the Artifact resolution service and sends us back a SAMLart (artifact). At this point, the flow returns back to CAS and it stays there.
It seems that CAS does not know what to do with the SAML artifact once it receives it from IDP, when technically it should be calling the endpoint specified by the ArtifactResolutionService from the IDP metadata file.
From tracing the SAML request/responses, I can tell that CAS is not calling anything else once it receives the SAMLart from the IDP after user authenticates successfully.
I ran a separate test by using the IDP service at https://samltest.id/ and everything is working fine, but I think the difference here is that this IDP doesn't use artifact binding, it goes a simpler way of HTTP-POST I believe.
So my question is: Does CAS SAML 2.0 integration support this artifact binding (sending artifact resolve request / receiving artifact response)?
If so, what could I be missing in my configurations?
If not, where would I need to modify CAS code to perform a SOAP request with the SAML artifact to receive the assertion?