Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:
version=7.0.0-SNAPSHOT
# CAS server version
cas.version=7.0.0-SNAPSHOTInside gradle.properties
:point_up: Edit: Hello there, I think casinit.herokuapp.com is broken because regardless of the specified cas version I get:
version=7.0.0-SNAPSHOT
# CAS server version
cas.version=7.0.0-SNAPSHOTInside gradle.properties
doChangePassword parameter is present? the problem is when a user is not logged in doChangePassword triggers password change flow after successful login. but if a customer is already logged in (TGC) it doesn't show login view in order o change password but redirects directly to the service
@/all
Hello all,
The CAS project management committee has prepared a survey to request
feedback from CAS deployers:
Our intention is to help clarify specific areas in the CAS ecosystem
that need attention, understand user demographics and common use cases
and explore opportunities to support and prioritize funding of
development activities.
There is no submission due date yet though ideally, it would be best
to finalize the results before 2022 ends. I will try to send out
monthly reminders to the list here.
Please try to keep your answers realistic, concise and objective as
much as possible. As per the last surveys, responses will surely help
and guide the project's direction. Survey results will be anonymized,
aggregated and published accordingly for wider community's review on
the Apereo blog. Details to follow.
Thank you!
On behalf of the CAS project management committee,
Misagh
P.S. If you are not able to pull up the link or have questions, please
reach out to the PMC or me directly.
1 reply
Hello,
I'm trying to upgrade from CAS 6.5.5 to 6.6.1 but even though the process went successfully, we can't manage to connect on any service, all tickets are considered invalid ("Ticket is not recognized")
We are using a Redis store for tickets. The configuration file is the exact same between the two versions.
Any hint to debug that please ?
I could be wrong but I think it's this commit.
RESP3 was introduced in Redis 6.
So if you're using version 5, like me, it may not function.
required-ip-addresses: ["127.0.0.1", "172.18.0.0/22", "10.0.0.0/8"] don't work anymore. this undocumented breaking change caused deployment to fail because health endpoint cannot be accessed anymore
Dear Apereo CAS community, I am in need of some help if someone has come across a similar issue.
I'n on CAS 6.6.0 and I'm trying to implement SAML 2.0 integration by having CAS acting as a SP and delegating authentication to external IDP.
I have configured all settings to generate the SP metadata file, and I was provided with the IDP metadata file as well.
The problem is that the IDP entity wants to use the Artifact resolution service and sends us back a SAMLart (artifact). At this point, the flow returns back to CAS and it stays there.
It seems that CAS does not know what to do with the SAML artifact once it receives it from IDP, when technically it should be calling the endpoint specified by the ArtifactResolutionService from the IDP metadata file.
From tracing the SAML request/responses, I can tell that CAS is not calling anything else once it receives the SAMLart from the IDP after user authenticates successfully.
I ran a separate test by using the IDP service at https://samltest.id/ and everything is working fine, but I think the difference here is that this IDP doesn't use artifact binding, it goes a simpler way of HTTP-POST I believe.
So my question is: Does CAS SAML 2.0 integration support this artifact binding (sending artifact resolve request / receiving artifact response)?
If so, what could I be missing in my configurations?
If not, where would I need to modify CAS code to perform a SOAP request with the SAML artifact to receive the assertion?
1 reply
somehow
classpath:config/appliction.yamlis being ignored butclasspath:application.yamlgets loaded. according to spring boot 2.7 docsconfig/application.yamlshould be loaded as before. so what did change in cas 6.6 that changed this behavior?
i tracked down this issue to some changes between 6.6.0-RC5 and 6.6.0. both versions use spring boot 2.7. so its not a boot problem. the changes in the cas code cause config files from classpath:config not being loaded even when are specified in src/main/resources/application.yml spring.config.additional-location=config/
can someone advice me how to force cas auth again when
doChangePasswordparameter is present? the problem is when a user is not logged indoChangePasswordtriggers password change flow after successful login. but if a customer is already logged in (TGC) it doesn't show login view in order o change password but redirects directly to the service
@mmoayyed can you please advice, how to trigger password change when sso is active (valid TGC present)? I tried renew=true but it just prompts for password and after login it redirects back to the service=foo instead of showing password change flow. so the only current way is to logout customer and redirect him to cas change his password. but if he cancels the password change action then he kind of logged out for nothing and has to log in back. not the best UX I guess. so the best would be i guess, to redirect to cas with renew=true&doChangePassword, after successful login, perform change password operation and logout (quite common flow on many portals)
1 reply
Hi, we want to use apareo cas as oidc server , but we have the problem, that attribute in the scope email, openid are returned as array not as string. we use ldap as datasource
cas.authn.attribute-repository.ldap[0].attributes.mail=email
cas.authn.attribute-repository.ldap[0].attributes.cn=name
cas.authn.attribute-repository.ldap[0].attributes.sn=family_name
cas.authn.attribute-repository.ldap[0].attributes.cn=name
cas.authn.attribute-repository.ldap[0].attributes.givenName=given_name
in the logs we see
attributes={name=[customuser2], given_name=[Elke], family_name=[Tretsuser], email=[foo2@bar.com]}, id=customuser2, scopes=[email, openid, profile], client_id=clientid}
cas version 6.6.0
org.apereo.cas.pm.web.flow.actions.PasswordChangeAction and may be other actions are not localized which leads to such inconsistent ux. any suggestions on how to link those with messageSource?
DefaultCommunicationsManager uses messageSource to localize email subject and message property resolution using #{foo.bar} works but the locale is wrong. the email body is correct because of the EmailMessageBodyBuilder uses resolved locale but communication manager never receives locale to use, thus, it uses default locale. so the email is body is in german but subject in english. public class DefaultCommunicationsManager { ....
return messageSource.getMessage(matcher.group(1), args.toArray(),
"Email Subject", ObjectUtils.defaultIfNull(emailRequest.getLocale(), Locale.getDefault()));
...
}public class SendPasswordResetInstructionsAction { .....
val emailRequest = EmailMessageRequest.builder().emailProperties(reset)
.principal(person)
.to(List.of(to)).body(text).build();
return this.communicationsManager.email(emailRequest);
}
There is a new vulnerability with a very high CVE score (9.8) reported for Apache Commons Text. The vulnerable version is anything, between v1.5 till 1.9. In the current (latest) Apareo CAS 6.6 the version of the library which is in use is 1.9. Is there a plan for this to be upgraded to v1.10 or later?
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
Looks like they updated it, just haven't made a release
2 replies
2 replies
def run(Object[] args) {
def ALLOWED_EMAIL_DOMAIN="whatever.com"
def attributes = args[0];
def id = args[1];
def service = args[2];
def logger = args[3];
def suffix = "@" + ALLOWED_EMAIL_DOMAIN.toLowerCase()
if (id.toLowerCase().endsWith(suffix)) {
return id.substring(0, id.length() - suffix.length())
}
return id}
Hello All, I am trying to build cas management app and when I enable AWS service registry like dynamodb or S3, I get the following error, for dynamodb it creates the table and then fails to start:
APPLICATION FAILED TO START
Description:
Parameter 1 of method restAuthenticationService in org.apereo.cas.rest.config.CasCoreRestConfiguration$CasCoreRestAuthenticationConfiguration required a bean of type 'org.apereo.cas.authentication.MultifactorAuthenticationTriggerSelectionStrategy' that could not be found.
The injection point has the following annotations:
- @org.springframework.beans.factory.annotation.Qualifier(value="defaultMultifactorTriggerSelectionStrategy")Action:
Consider defining a bean of type 'org.apereo.cas.authentication.MultifactorAuthenticationTriggerSelectionStrategy' in your configuration.
Anyone have any ideas why this would be happening? if I remove the cas management AWS dependency it works fine.