What would be the best way to file a bug with CAS? We're implementing SSO through JWT with a client that uses CAS. We've noticed that the JWTs issued by CAS do not follow the JWT spec as they include base64 padding (https://tools.ietf.org/html/rfc7515#section-2). This means the tokens fail on JWT libraries like https://github.com/brianloveswords/node-jws and https://github.com/panva/jose
Sorry if this has been covered already, I couldn't find anything on this topic.
Hi @wsaca !
The issued token says "authenticationMethod": "MongoDbAuthenticationHandler".
We have no control over their CAS installation, but I doubt they would be using the latest RC.
We can probably circumvent the problem, I just wanted to file a bug as I could not find anything mentioned about this non-rfc-compliant behaviour.
@wsaca I now noticed there was a similar PR about this by you: apereo/cas#4142
Changing the encoding to base64url should solve this, but as far as I can see we're already getting back base64url encoded data (as + and / are replaced with - and _) but it does include the padding, which is optional for base64url. Org.apache.commons.codec.binary.Base64 should omit the padding according to the docs, so I don't really know what's going on.
Anyway, thanks for the help and let's hope 6.1.0 fixes this!
"https://github.com/apereo/cas/blob/master/webapp/cas-server-webapp-resources/src/main/resources/templates/casPasswordUpdateSuccessView.html"
then the user is redirected to the login page but the service param is lost. is that the right behavior? Maybe this file should be modified:
"https://github.com/apereo/cas/blob/master/support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/PasswordManagementWebflowConfigurer.java#L147"
=============================================================
WHO: bob
WHAT: Supplied credentials: [UsernamePasswordCredential(username=bob)]
ACTION: AUTHENTICATION_SUCCESS
APPLICATION: CAS
WHEN: Tue Sep 17 09:58:03 MDT 2019
CLIENT IP ADDRESS: 192.168.126.202
SERVER IP ADDRESS: 192.168.112.11
=============================================================
>
2019-09-17 09:58:03,631 DEBUG [org.apereo.cas.authentication.DefaultAuthenticationTransactionManager] - <Successful authentication; Collecting authentication result [org.apereo.cas.authentication.DefaultAuthentication@952fbcc5]>
2019-09-17 09:58:03,631 DEBUG [org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy] - <Skipping access strategy policy, since no attributes rules are defined>
2019-09-17 09:58:03,632 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: bob
WHAT: [result=Service Access Granted,service=https://cas.i.secure64.com:8443/cas/i...,principal=SimplePrincipal(id=bob, attributes={Callback-Number=1.970.555.6666}),requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Tue Sep 17 09:58:03 MDT 2019
CLIENT IP ADDRESS: 192.168.126.202
SERVER IP ADDRESS: 192.168.112.11
=============================================================
>
2019-09-17 09:58:03,635 ERROR [org.apereo.cas.adaptors.radius.web.flow.RadiusAccessChallengedAuthenticationWebflowEventResolver] - <No multifactor authentication providers are available in the application context>
cas.authn.x509.maxPathLengthAllowUnspecified=true
cas.authn.x509.checkKeyUsage=false
cas.authn.x509.requireKeyUsage=false
cas.authn.x509.principalType=CN_EDIPI
cas.authn.x509.ldap.ldapUrl=ldaps://ldap.abc.edu:636
cas.authn.x509.ldap.useSsl=true
cas.authn.x509.ldap.baseDn=dc=abc,dc=edu
cas.authn.x509.ldap.bindDn=uid=ldapreader,ou=Special Users,dc=abc,dc=edu
cas.authn.x509.ldap.bindCredential=password
cas.authn.x509.ldap.poolPassivator=BIND
cas.authn.x509.ldap.connectTimeout=5000
cas.authn.x509.ldap.validateOnCheckout=true
cas.authn.x509.ldap.validatePeriodically=true
cas.authn.x509.ldap.validatePeriod=600
cas.authn.x509.ldap.failFast=true
cas.authn.x509.ldap.searchFilter=usuhsEDIPI={user}
cas.authn.x509.ldap.principalAttributeList=uid
Hi,
I've a RADIUS MFA setup simular to what Misagh Moayyed describe here: https://apereo.github.io/2018/10/18/cas5-radius-mfa-authn/
I can not get ldap to fetch attributes. The only attributes I see is from radius:
2019-09-18 11:54:02,373 DEBUG [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <Final principal resolved for this authentication event is [SimplePrincipal(id=xxx@xxx.xx, attributes={State=[Binary Data (length=38)], Reply-Message=Enter PASSCODE})]>
2019-09-18 11:54:16,515 DEBUG [org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] - <Determined primary authentication principal to be [SimplePrincipal(id=user@xxx.xx, attributes={MS-CHAP2-Success=[[Binary Data (length=43)]], MS-MPPE-Send-Key=[[Binary Data (length=34)]], Class=[[Binary Data (length=44)]], Reply-Message=[Enter PASSCODE], State=[[Binary Data (length=38)]], MS-MPPE-Recv-Key=[[Binary Data (length=34)]]})]>When change to use builtin test auth cas.authn.accept.users=user@xxx.xx::xxx the attrbutes are fetched from ldap. I've tried CAS overlays 5.3.8 - 5.3.12.
I guess I've missed somthing in config. Also see this:
No principal resolution is configured for [RadiusAuthenticationHandler]
