Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • 11:08
    apereocas-bot labeled #5557
  • 11:08
    apereocas-bot labeled #5557
  • 11:08
    apereocas-bot milestoned #5557
  • 11:08
    apereocas-bot milestoned #5557
  • 11:07
    CLAassistant commented #5557
  • 11:07
    antoine777 opened #5557
  • 09:31

    mmoayyed on 6.6.x

    Update to 6.6.4-SNAPSHOT (#5556) (compare)

  • 09:31
    mmoayyed closed #5556
  • 09:26
    apereocas-bot labeled #5556
  • 09:26
    apereocas-bot labeled #5556
  • 09:26
    apereocas-bot labeled #5556
  • 09:26
    apereocas-bot milestoned #5556
  • 09:26
    apereocas-bot milestoned #5556
  • 09:26
    CLAassistant commented #5556
  • 09:26
    apereocas-bot labeled #5556
  • 09:26
    leleuj opened #5556
  • Nov 30 16:40
    mmoayyed commented #5555
  • Nov 30 16:40

    mmoayyed on master

    Make LoggingUtils configurable … (compare)

  • Nov 30 16:40

    mmoayyed on master-loggingutils

    (compare)

  • Nov 30 16:40
    mmoayyed closed #5555
Ron Olson
@tachoknight
i believe there's a way to intercept the login and check and redirect to the appropriate flow, but wanted to make sure that idea was generally correct
vbryandc
@vbryandc

Hello friends, someone has this error when debugging cas:

Task :api:cas-server-core-api-configuration-model:generateConfigurationMetadata FAILED
Error: Could not find or load main class org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator
Caused by: java.lang.ClassNotFoundException: org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator
Could not find or load main class org.apereo.cas.configuration.metadata.ConfigurationMetadataGenerator

dargur mikk
@dargurm_gitlab
HI all, can anyone suggest me how to make subjects of the emails sent by cas to be translated just as everything else? cannot access @messageSource in spel. so looks like i need to fork the org.apereo.cas.util.spring.SpringExpressionLanguageValueResolver. but may be there is a better way?
1 reply
dargur mikk
@dargurm_gitlab

HI all,
i want to customize email templates but cas doesn't find them in the classpath, so i am forced to place them somewhere on the file system outside of the cas.war. this would make deployment harder than it should be. i tried something like text: classpath:ResetPasswordEmailTemplate.html but then it doesn't find it Caused by: java.io.FileNotFoundException: class path resource [ResetPasswordEmailTemplate.html] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/home/user/cas/build/libs/cas.war!/WEB-INF/classes!/ResetPasswordEmailTemplate.html even though the file is there. So it looks like the EmailMessageBodyBuilder is loading files only from fs.

Any ideas how to solve this?

1 reply
Frédéric Praca
@FredPraca
Hi all
I'm facing a problem which should not be. When setting cas.pm-links.enabled=false in my theme property file, I still get a link for forgotten password. The value false is correctly sent through the template. Do I have to edit loginform.html to get rid of it ?
5 replies
dargur mikk
@dargurm_gitlab
it feels like this channel is like a church: its place for questions and not for answers ;)
its quite rare that a question from anyone gets an answer
Frédéric Praca
@FredPraca
@dargurm_gitlab unless you find it yourself and post it here :)
cctgteddy
@cctgteddy
Hi, I'm working on developing a new theme for our CAS server. Is there any way to "hot edit" the theme files in such a way I don't need to recompile the war file each time? I'm compiling it as a standalone executable
2 replies
XianzheTM
@xianzheTM
Hello ,firends.
If I only have a Provider, how do I make the delegated authentication redirect directly to it?
I want CAS to be transparent to users and not make them choose which delegated authentication to use.
image.png
dargur mikk
@dargurm_gitlab

another question, may be will get some answers ;)
cas is configured to use locale cookie for localization. i use locale resolver which sets request attributes and it works for the whole UI. But the password managment email builder doesn't respect the locale cookie because it uses request.getLocale() which reads from Accept-Language header.
here is the snippet from cas email builder

val text = EmailMessageBodyBuilder.builder()
                .properties(reset)
                .parameters(parameters)
                .locale(Optional.ofNullable(request.getLocale()))

any suggestion on how to set request locale somewhere in locale resolver so it works here as well. otherwise i would need to fork the class and make it use request attribute instead of getLocale(). but that would be very dirty hack

1 reply
Łukasz
@lgwozniak

Hello ,firends.
If I only have a Provider, how do I make the delegated authentication redirect directly to it?
I want CAS to be transparent to users and not make them choose which delegated authentication to use.

I'm configure proces on CAS 6.5 to automaticaly go to Dynamic Delegation Resolver View, and then base on email go to providers

1 reply
Marc K.
@V3ndetta
Anyone else expecting errors on TicketCleanup with 6.4 ERROR [org.apereo.cas.ticket.registry.DefaultTicketRegistryCleaner] - <Expected valid string character at 1:2887>
mijutu
@mijutu:ellipsis.fi
[m]
@xianzheTM: You could redirect users who want to login to https://domain.tld/cas/clientredirect?client_name=NAME&sercvice=https://... where NAME is a client-name from cas.properties. This way cas asks the user nothing and forwards directly to the delegated login page.
1 reply
Chip Ivormi
@Ivormi_twitter

So, we're attempting to implement surrogate authentication / impersonation in CAS 6.3.7.4, using a JDBC repository. Basic impersonation works, and I see the new user id pass through to other applications. However we have SAML integrated applications that rely on the email address as the user identifier (not username), and in these situations, all of the attributes are those of the primary, not the surrogate, which results in the SAML authentication passing the primary's email address to the SP application.

I've tried configuring some of the settings related to cas.authn.surrogate.principal.attribute-resolution-enabled and some of the associated settings, without success.

I guess my question is - is this feature just working 'as intended', and we are correctly seeing the surrogateId of the surrogateUser, with rest of the attributes from the surrogatePrincipal (email, group memberships, etc.) or am I missing a key configuration here?

1 reply
Joro Kushev
@jorokushev:matrix.org
[m]
Hi All. Can someone point me to any release notes/comparison between CAS 7 and CAS 6? We are about to upgrade to the latest release of CAS 6.6, but we also see that CAS 7 is about to be released in early 2023. Where we can get some insights of the expected features and comparison between v6 and v7? Thanks
4 replies
dargur mikk
@dargurm_gitlab
Can someone advice how to prevent form resubmission on some pages? e.g. password reset email is resent every time successfully sent page is refreshed. same applies to password change or login resubmission pages. i can change password by just refreshing a page.
choidkdk
@choidkdk

hi, I got this error after run cas about 1 day. Im runing CAS overlay 6.5. How I can resolve that? 🙇‍♂️

Screen Shot 2022-09-09 at 15.50.52.png

1 reply
zhang wn
@zhangw9_gitlab

Hi. We are upgrading our CAS4.x application to 6.x. Looking at the documentation, a lot has changed in Webflows. We plan to change our main login flow with the token login process to use the new method.
However, we have two custom authentication flows and I don't know how to connect to the CAS service. Looking at our 4.x configuration, we first define servlet mappings, map URLs, then update the supportedFlowIds set, and finally point Spring to the actual XML to specify these flows. These are called by the application to /token_login_flow on the CAS servlet.

Configure CAS to know when to see /token_login_flow to start custom webflow?
Make CAS actions (like granting tickets, etc.) available to this custom web process?

<bean id="loginHandlerAdapter" class="cas.tokensso.SelectiveFlowHandlerAdapter" p:flowExecutor-ref="loginFlowExecutor" p:flowUrlHandler-ref="loginFlowUrlHandler" >

<property name="supportedFlowIds">

<util:list list-class="java.util.ArrayList">

<value>login</value>

<value>token_login</value>
<!-- <value>ip_login</value>-->
</util:list>
</property>
</bean>

<webflow:flow-registry id="loginFlowRegistry" flow-builder-services="builder">

<webflow:flow-location path="/WEB-INF/login-webflow.xml" id="login" />

<webflow:flow-location path="/WEB-INF/token-login-webflow.xml" id="token_login"/>
</webflow:flow-registry>
Please, can anybody help me? Thank you!

1 reply
Andrea Orellana
@DaniuKb_twitter
Hola a todos, estoy usando la versión de CAS gradle 6.5.6, estoy intentando crear temas propios, al desplegarlo si me presenta la pantalla de login el problema se da cuando intento navegar hacia otra pantalla, no me reconoce el tema y me presenta las pantallas por default del CAS. Cómo puedo hacer para que siempre me presente las pantallas del tema indicado en el service? Alguién conoce una forma de solucionar esto?
dargur mikk
@dargurm_gitlab
Can someone advice me how to "configure" cas to support password reset by email instead of username? there is forgot username function but what i want is reset by "username or email" directly. we already have login by username or email. with custom password change in a external app. now we want to use cas pm for that.
1 reply
Mostafa Qanbaryan
@mostafaqanbaryan
Hi.
I want to implement a CAS passwordless service.
I did that with Initializr and everything (so far) works fine.
But now I want to use CAS REST API for logins, but based on https://apereo.github.io/cas/6.5.x/protocol/REST-Protocol-CredentialAuthentication.html, I have to provide password.
How can I use passwordless with REST?
Chip Ivormi
@Ivormi_twitter

Another issue with Surrogate/Impersonation. This time, I've run into an interesting situation with Impersonation + MFA. Using out of the box 6.6.0, I can get mfa-simple and impersonation/surrogate working separately. However, as soon as I try and turn them both on, things break.

If I have them both on, and try to log in as +username, I go through the MFA routine and it logs in as username, without giving me the option of selecting a surrogate user.

If I have them both on, and try to log in as surrogateusername+username, I start the MFA routine, but CAS throws the following error:

2022-09-21 10:43:13,779 WARN [org.apereo.cas.mfa.simple.validation.DefaultCasSimpleMultifactorAuthenticationService] - <Principal assigned to token [username] is unauthorized for token [CASMFA-#######]>
2022-09-21 10:43:13,811 ERROR [org.apereo.cas.mfa.simple.CasSimpleMultifactorAuthenticationHandler] - <Failed to authenticate code CASMFA-###### DefaultCasSimpleMultifactorAuthenticationService.java:validate:76 CasSimpleMultifactorAuthenticationHandler.java:doAuthentication:63 AbstractPreAndPostProcessingAuthenticationHandler.java:authenticate:47 >

This means that, if I want Impersonation, it seems that I need to disable MFA, and vice versa. Has anyone been able to get both of these working simultaneously with recent (6.5.x, 6.6.x) versions of CAS?

Thanks!

Ripplet
@ripplet:matrix.org
[m]

Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:

version=7.0.0-SNAPSHOT
# CAS server version
cas.version=7.0.0-SNAPSHOT

Inside gradle.properties

Ripplet
@ripplet:matrix.org
[m]

:point_up: Edit: Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:

version=7.0.0-SNAPSHOT
# CAS server version
cas.version=7.0.0-SNAPSHOT

Inside "gradle.properties"

:point_up: Edit: Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:

version=7.0.0-SNAPSHOT
# CAS server version
cas.version=7.0.0-SNAPSHOT

Inside gradle.properties

dargur mikk
@dargurm_gitlab
can someone advice me how to force cas auth again when doChangePassword parameter is present? the problem is when a user is not logged in doChangePassword triggers password change flow after successful login. but if a customer is already logged in (TGC) it doesn't show login view in order o change password but redirects directly to the service
jordi-balaguer
@jordi-balaguer
Hi all, we are using 6.3.x with Git service registry and we are experiencing some issue when it's deployed in HA. We enabled pushes in the service registry in order to push dynamic registrations to the Git remote repository. However, as "writes" may come from any of the nodes.. If we had a previous write (push) in a different node, the current node is not able to pull or push. Did you have a similar issue? Do you know if Git service registry is designed to be used in HA deployments when you enable pushes?
Misagh Moayyed
@mmoayyed

@/all

Hello all,

The CAS project management committee has prepared a survey to request
feedback from CAS deployers:

https://bit.ly/3Egdoe4

Our intention is to help clarify specific areas in the CAS ecosystem
that need attention, understand user demographics and common use cases
and explore opportunities to support and prioritize funding of
development activities.

There is no submission due date yet though ideally, it would be best
to finalize the results before 2022 ends. I will try to send out
monthly reminders to the list here.

Please try to keep your answers realistic, concise and objective as
much as possible. As per the last surveys, responses will surely help
and guide the project's direction. Survey results will be anonymized,
aggregated and published accordingly for wider community's review on
the Apereo blog. Details to follow.

Thank you!

On behalf of the CAS project management committee,
Misagh

P.S. If you are not able to pull up the link or have questions, please
reach out to the PMC or me directly.

1 reply
mijutu
@mijutu:ellipsis.fi
[m]
Can I read the questions or answer them without a google account?
Juliusz Marciniak
@rechandler12
is there possible to use serviceA with LDAP A and serviceB with LDAP B? CAS 6.5.4
Łukasz
@lgwozniak
Hi, i use Oauth with JWT with CAS6.5.x and when I request for Refresh Token the "aud" field is diffrent than requested for access_token. Any idea why ?
Robin Dupret
@rdupret_gitlab

Hello,

I'm trying to upgrade from CAS 6.5.5 to 6.6.1 but even though the process went successfully, we can't manage to connect on any service, all tickets are considered invalid ("Ticket is not recognized")

We are using a Redis store for tickets. The configuration file is the exact same between the two versions.

Any hint to debug that please ?

kjkeane
@kjkeane:matrix.org
[m]

I could be wrong but I think it's this commit.

apereo/cas@21e163c

RESP3 was introduced in Redis 6.

So if you're using version 5, like me, it may not function.

Robin Dupret
@rdupret_gitlab
@kjkeane:matrix.org : Unfortunately we are already on Redis 6 but thank you very much for your answer !
Robin Dupret
@rdupret_gitlab

Okay so there's like 99% of chance that there is a regression between 6.5.x and 6.6.x

With the exact same cas-overlay-template project, just changing version and cas.version from 6.5.9 to 6.6.1 (keeping springBootVersion as 2.6.3) makes the CAS either work or fail

Robin Dupret
@rdupret_gitlab
The regression seems to be between 6.0.0-RC5 and 6.6.0
kjkeane
@kjkeane:matrix.org
[m]
I do know when I went from 6.5.2 to 6.6.0 I had to clear out our Redis keys. Because it was failing to encrypt/decrypt them.
Robin Dupret
@rdupret_gitlab
@kjkeane:matrix.org : Thanks again but I already tried to empty Redis, restart it and reboot the whole machine, still the same :-/
Robin Dupret
@rdupret_gitlab
Actually, I still have INVALID_TICKET disabling Redis and using the default registry
dargur mikk
@dargurm_gitlab
After upgrading from 6.5.6 to 6.6.1 my application.yaml & application-foo.yaml don't get loaded anymore. Has anyone faced similar issue?
dargur mikk
@dargurm_gitlab
somehow classpath:config/appliction.yaml is being ignored but classpath:application.yaml gets loaded. according to spring boot 2.7 docs config/application.yaml should be loaded as before. so what did change in cas 6.6 that changed this behavior?
dargur mikk
@dargurm_gitlab
another weird bug: the commit cda8b7ff016cb3631ee7fdc47249b95e556e64bc after 6.6.0-RC5 introduced regex matching for ip addresses defined for actuator endpoint. seriously, regex for ip matching? so the proper ranges which were working before now don't work anymore. e.g.. required-ip-addresses: ["127.0.0.1", "172.18.0.0/22", "10.0.0.0/8"] don't work anymore. this undocumented breaking change caused deployment to fail because health endpoint cannot be accessed anymore
julioromero
@julioromero

Dear Apereo CAS community, I am in need of some help if someone has come across a similar issue.

I'n on CAS 6.6.0 and I'm trying to implement SAML 2.0 integration by having CAS acting as a SP and delegating authentication to external IDP.
I have configured all settings to generate the SP metadata file, and I was provided with the IDP metadata file as well.

The problem is that the IDP entity wants to use the Artifact resolution service and sends us back a SAMLart (artifact). At this point, the flow returns back to CAS and it stays there.
It seems that CAS does not know what to do with the SAML artifact once it receives it from IDP, when technically it should be calling the endpoint specified by the ArtifactResolutionService from the IDP metadata file.
From tracing the SAML request/responses, I can tell that CAS is not calling anything else once it receives the SAMLart from the IDP after user authenticates successfully.
I ran a separate test by using the IDP service at https://samltest.id/ and everything is working fine, but I think the difference here is that this IDP doesn't use artifact binding, it goes a simpler way of HTTP-POST I believe.

So my question is: Does CAS SAML 2.0 integration support this artifact binding (sending artifact resolve request / receiving artifact response)?
If so, what could I be missing in my configurations?
If not, where would I need to modify CAS code to perform a SOAP request with the SAML artifact to receive the assertion?

1 reply
dargur mikk
@dargurm_gitlab

somehow classpath:config/appliction.yaml is being ignored but classpath:application.yaml gets loaded. according to spring boot 2.7 docs config/application.yaml should be loaded as before. so what did change in cas 6.6 that changed this behavior?

i tracked down this issue to some changes between 6.6.0-RC5 and 6.6.0. both versions use spring boot 2.7. so its not a boot problem. the changes in the cas code cause config files from classpath:config not being loaded even when are specified in src/main/resources/application.yml spring.config.additional-location=config/

dargur mikk
@dargurm_gitlab

can someone advice me how to force cas auth again when doChangePassword parameter is present? the problem is when a user is not logged in doChangePassword triggers password change flow after successful login. but if a customer is already logged in (TGC) it doesn't show login view in order o change password but redirects directly to the service

@mmoayyed can you please advice, how to trigger password change when sso is active (valid TGC present)? I tried renew=true but it just prompts for password and after login it redirects back to the service=foo instead of showing password change flow. so the only current way is to logout customer and redirect him to cas change his password. but if he cancels the password change action then he kind of logged out for nothing and has to log in back. not the best UX I guess. so the best would be i guess, to redirect to cas with renew=true&doChangePassword, after successful login, perform change password operation and logout (quite common flow on many portals)

1 reply
mrokitka
@mrokitka
Hi, is there a rough ETA on java-cas-client 4.x release? We're evaluating upgrading to Jakarta Servlet API, but lack of support in 3.x line is a blocker for this
mwbi
@mwbi

Hi, we want to use apareo cas as oidc server , but we have the problem, that attribute in the scope email, openid are returned as array not as string. we use ldap as datasource
cas.authn.attribute-repository.ldap[0].attributes.mail=email
cas.authn.attribute-repository.ldap[0].attributes.cn=name
cas.authn.attribute-repository.ldap[0].attributes.sn=family_name
cas.authn.attribute-repository.ldap[0].attributes.cn=name
cas.authn.attribute-repository.ldap[0].attributes.givenName=given_name

in the logs we see
attributes={name=[customuser2], given_name=[Elke], family_name=[Tretsuser], email=[foo2@bar.com]}, id=customuser2, scopes=[email, openid, profile], client_id=clientid}

cas version 6.6.0

dargur mikk
@dargurm_gitlab
anyone has idea how to visualize the webflow of cas? I need to figure out on which state can I hook my custom action but to get overview whats happening is very cumbersome
1 reply
dargur mikk
@dargurm_gitlab
image.png