Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • 08:58
    codecov[bot] commented #4267
  • 08:58
    vinayknl synchronize #4267
  • 08:57
    codecov[bot] commented #4262
  • 08:57
    vinayknl synchronize #4262
  • 08:52
    codecov[bot] commented #4262
  • 08:52
    vinayknl synchronize #4262
  • 07:10
    codecov[bot] commented #4264
  • 07:10
    apereocas-bot synchronize #4264
  • 07:10

    apereocas-bot on attributetests

    Fixing Tests (#4281) Merged branch master into attri… (compare)

  • 06:41

    mmoayyed on master

    Fixing Tests (#4281) (compare)

  • 06:41

    mmoayyed on fix-tests

    (compare)

  • 06:41
    mmoayyed closed #4281
  • Sep 23 22:08
    apereocas-bot labeled #4281
  • Sep 23 22:08
    apereocas-bot milestoned #4281
  • Sep 23 22:07
    hdeadman opened #4281
  • Sep 23 22:06

    hdeadman on fix-tests

    fix proxyBeanMethods = false on… (compare)

  • Sep 23 21:10
    apereocas-bot synchronize #4264
  • Sep 23 21:10

    apereocas-bot on attributetests

    wip: fixing test cases Merge branch 'master' of github… fix test cases and 2 more (compare)

  • Sep 23 20:19

    mmoayyed on master

    wip: fixing test cases Merge branch 'master' of github… fix test cases and 1 more (compare)

  • Sep 23 13:10
    codecov[bot] commented #4264
Misagh Moayyed
@mmoayyed
Sure. I’ll take a look.
Wilber Saca
@wsaca
@mmoayyed There are things that I don't understand for now, but I will continue reading the code to learn and report any issue found. Thanks you.
Scott Williams
@vwbusguy
Thanks to all who worked on 5.3.12. We're using a mongodb backend and the CAS deployments are now using less than 1/3 of the memory they were on 5.3.11 and the logins are noticeably faster as well.
sga1122
@sga1122
How does the TGT getLastTimeUsed get updated? My client is active but because the TGT date doesn’t get update my session expires... is there something that needs to be set on the client that forces updating of this value?
sga1122
@sga1122
Or is there a programmatic way to logout of cas so that I can set TGT to never expire?
howieqdd
@howieqdd
hello boy
i
need help
The website and the background realize login by accessing different login addresses, do not want the website to develop a system, and develop a system in the background.
CAS
Can a CAS configure multiple login paths?
For example, the website login accesses cas/a/login, and the other accesses cas/b/login
ok
Cemal
@cmlonder
Hi everyone, I described in detail my problem here, glad if I can get some clue how to continue: https://stackoverflow.com/questions/57788482/cas-custom-authentication-handler-principal-json-problem
springnirps
@springnirps
can an oauth2 client using spring security work with a cas oauth2 server? Looks like tokens are written to different tables.
Cemal
@cmlonder
I solved my problem about Principal attributes, I may create a pull request @mmoayyed just for information to others but it is not directly related with CAS so I'm not sure for PR, anyway you can have a look : https://stackoverflow.com/a/57819588/3000280
Wilber Saca
@wsaca
@mmoayyed If you don't have enough time I would like to fix the reset password issue that I reported, I only need to know if I should use the ticketRegistry to store a transient ticket or not?
Wilber Saca
@wsaca
We need to improve the password history, I needed to create my custom implementation to use a different SQL schema, the documentation is not clear explaining how to use the jdbc password history.
Ilkka Järstä
@ilu

What would be the best way to file a bug with CAS? We're implementing SSO through JWT with a client that uses CAS. We've noticed that the JWTs issued by CAS do not follow the JWT spec as they include base64 padding (https://tools.ietf.org/html/rfc7515#section-2). This means the tokens fail on JWT libraries like https://github.com/brianloveswords/node-jws and https://github.com/panva/jose

Sorry if this has been covered already, I couldn't find anything on this topic.

Wilber Saca
@wsaca
What auth method are you using? have you tested the latest RC?
Ilkka Järstä
@ilu

Hi @wsaca !

The issued token says "authenticationMethod": "MongoDbAuthenticationHandler".
We have no control over their CAS installation, but I doubt they would be using the latest RC.

We can probably circumvent the problem, I just wanted to file a bug as I could not find anything mentioned about this non-rfc-compliant behaviour.

Wilber Saca
@wsaca
Maybe this problem was fixed in CAS 6.1.0, the class that encode a JWT ticket is JwtTicketCipherExecutor.
Ilkka Järstä
@ilu

@wsaca I now noticed there was a similar PR about this by you: apereo/cas#4142

Changing the encoding to base64url should solve this, but as far as I can see we're already getting back base64url encoded data (as + and / are replaced with - and _) but it does include the padding, which is optional for base64url. Org.apache.commons.codec.binary.Base64 should omit the padding according to the docs, so I don't really know what's going on.

Anyway, thanks for the help and let's hope 6.1.0 fixes this!

springnirps
@springnirps
Can I assign a scope in CAS OAuth Server for a client_credentials grant for each client_id?
Omar Bouras
@bourasom
Hello,
I am working on CAS SAML2 integration as IDP. The SP side redirect to the CAS authent. However, after authent, cas doesn't recognize the final destination to reach.
Can somebody help please?
springnirps
@springnirps
-Dcas.standalone.configurationDirectory=/my/path does not seem to work for me, deploying to wildfly ... i would like to use config path other than default /etc/cas/config
Rushita Trivedi
@rushita-trivedi
Hello, I want to integrate CAS auth SSO service in serverless. but I am not getting any appropriate result related to that. can anyone help me with this?
Wilber Saca
@wsaca
@mmoayyed This commit "https://github.com/apereo/cas/commit/34d55a8b189d2b8a0ec2a4037c4d63197b6a8ab9#diff-01fb73bbe90d1e3ed02364b36eef3db3" appends the service param to the url that is sent to the user email, but when the user click the button on this page:
"https://github.com/apereo/cas/blob/master/webapp/cas-server-webapp-resources/src/main/resources/templates/casPasswordUpdateSuccessView.html"
then the user is redirected to the login page but the service param is lost. is that the right behavior? Maybe this file should be modified:
"https://github.com/apereo/cas/blob/master/support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/PasswordManagementWebflowConfigurer.java#L147"
rattobondo
@rattobondo
hello guys i am trying to integrate cas-simple mfa with the native Rest APi for TGT and ST. It seems that those components are completely indipendent. Creating TGT with Rest API does not trigger the MFA. Does anybody have done something similar=
?
Jyotish
@jyotishp
Hi, we are using CAS at our university. We recently upgraded to 6.0.x and we started seeing this weird behavior where CAS opens a connection to LDAP but doesn't seem to close it. The number of open connections from CAS don't seem to be going down at all but are gradually increasing (and our LDAP is running out of FDs eventually). Can someone point a few directions to debug this?
Ian Shannon
@50L1DU5
Hey all, I am willing to bet someone has run into this issue: Authentication is successful (using SAML2), and I can see the success messages logged in debug mode. The SSO page renders "Invalid Credentials"
=============================================================
WHO: bob
WHAT: Supplied credentials: [UsernamePasswordCredential(username=bob)]
ACTION: AUTHENTICATION_SUCCESS
APPLICATION: CAS
WHEN: Tue Sep 17 09:58:03 MDT 2019
CLIENT IP ADDRESS: 192.168.126.202
SERVER IP ADDRESS: 192.168.112.11
=============================================================

>
2019-09-17 09:58:03,631 DEBUG [org.apereo.cas.authentication.DefaultAuthenticationTransactionManager] - <Successful authentication; Collecting authentication result [org.apereo.cas.authentication.DefaultAuthentication@952fbcc5]>
2019-09-17 09:58:03,631 DEBUG [org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy] - <Skipping access strategy policy, since no attributes rules are defined>
2019-09-17 09:58:03,632 INFO [org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: bob
WHAT: [result=Service Access Granted,service=https://cas.i.secure64.com:8443/cas/i...,principal=SimplePrincipal(id=bob, attributes={Callback-Number=1.970.555.6666}),requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Tue Sep 17 09:58:03 MDT 2019
CLIENT IP ADDRESS: 192.168.126.202
SERVER IP ADDRESS: 192.168.112.11
=============================================================

>
2019-09-17 09:58:03,635 ERROR [org.apereo.cas.adaptors.radius.web.flow.RadiusAccessChallengedAuthenticationWebflowEventResolver] - <No multifactor authentication providers are available in the application context>
the ERROR in the last line, is it a symptom of the authentication failing?
shimashi
@shimashi
Hi.. I am CAS newbie and running some issue with X509 and ldap authentication integration. I was able to pull EDIPI from the smart card but it's not followed with LDAP search base on EDIPI. Here is my config snippet. Thanks for your help.
cas.authn.x509.regExTrustedIssuerDnPattern=CN=CA-[1-4][0-9]xxxx
cas.authn.x509.maxPathLengthAllowUnspecified=true
cas.authn.x509.checkKeyUsage=false
cas.authn.x509.requireKeyUsage=false
cas.authn.x509.principalType=CN_EDIPI
cas.authn.x509.ldap.ldapUrl=ldaps://ldap.abc.edu:636
cas.authn.x509.ldap.useSsl=true
cas.authn.x509.ldap.baseDn=dc=abc,dc=edu
cas.authn.x509.ldap.bindDn=uid=ldapreader,ou=Special Users,dc=abc,dc=edu
cas.authn.x509.ldap.bindCredential=password
cas.authn.x509.ldap.poolPassivator=BIND
cas.authn.x509.ldap.connectTimeout=5000
cas.authn.x509.ldap.validateOnCheckout=true
cas.authn.x509.ldap.validatePeriodically=true
cas.authn.x509.ldap.validatePeriod=600
cas.authn.x509.ldap.failFast=true
cas.authn.x509.ldap.searchFilter=usuhsEDIPI={user}
cas.authn.x509.ldap.principalAttributeList=uid
Torben Breitkreutz
@dasnebbi
Hi, is there a documentation for the CAS Management App 6.0.x? I've only found some docs 5.3...? https://apereo.github.io/cas-management/5.3.x/index.html
Henrik Larsen
@skruestik

Hi,
I've a RADIUS MFA setup simular to what Misagh Moayyed describe here: https://apereo.github.io/2018/10/18/cas5-radius-mfa-authn/
I can not get ldap to fetch attributes. The only attributes I see is from radius:

2019-09-18 11:54:02,373 DEBUG [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <Final principal resolved for this authentication event is [SimplePrincipal(id=xxx@xxx.xx, attributes={State=[Binary Data (length=38)], Reply-Message=Enter PASSCODE})]>

2019-09-18 11:54:16,515 DEBUG [org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] - <Determined primary authentication principal to be [SimplePrincipal(id=user@xxx.xx, attributes={MS-CHAP2-Success=[[Binary Data (length=43)]], MS-MPPE-Send-Key=[[Binary Data (length=34)]], Class=[[Binary Data (length=44)]], Reply-Message=[Enter PASSCODE], State=[[Binary Data (length=38)]], MS-MPPE-Recv-Key=[[Binary Data (length=34)]]})]>

When change to use builtin test auth cas.authn.accept.users=user@xxx.xx::xxx the attrbutes are fetched from ldap. I've tried CAS overlays 5.3.8 - 5.3.12.
I guess I've missed somthing in config. Also see this:

No principal resolution is configured for [RadiusAuthenticationHandler]
mohamed ahmed
@habi3000
Hello everyone, we are facing a weird issue with cas 6.0.4 it seems like it does not close connections with users. we are getting too many open files error-running on centos 7- at the begging we thought that maybe the default limit is just too low for our env but after monitoring it in real-time, I can definitely say that it does not go down, it just keeps going up. We restarted the service at 3 PM, now its 7 PM and there are around 1400 open file descriptors keep in mind this is not peak time. Is there is any way we can find the source of this leak? when does cas close the connection? did we misconfigure something? is there is a recommended limit for # of file descriptors?
Jyotish
@jyotishp
@habi3000 We are facing a similar issue with CAS 6.0.4 and 6.0.5 as well. It's not only exhausting FDs on CAS host but also the FDs on our auth back-end. We tried limiting the FDs to ~2000 and then CAS basically froze after exhausting FDs. So, limiting FDs is probably not going to work.
straldev
@straldev
I have a client who's attempting to setup SAML2 via Apereo CAS against our SP. The problem is their SAMLResponse POST variable is not base64 encoded, which is breaking our OneLogin SP lib. Any idea why the SAMLResponse value is not base64 encoded?
mohamed ahmed
@habi3000
@jyotishp That is confusing, tomorrow I will inspect the source code maybe I can find out when does it close the connection if does. I will keep you updated if I find anything please, please do likewise.
Frank
@frank-cq
hey guys. Do I set custom payload of jwt when i use jwt as ST ? My version is cas 6.0
Torben Breitkreutz
@dasnebbi
Hi, is there a way to handle different dnFormats using one LDAP configuration, e.g. via regex?
Wilber Saca
@wsaca
CAS Overlay can't be built because of this error "Could not HEAD 'https://oss.jfrog.org/artifactory/oss-snapshot-local/com/github/coova/jradius/jradius-1.1.5/jradius-jradius-1.1.5.pom'. Received status code 409 from server: " I think the groupId is wrong.
mohamed ahmed
@habi3000
Hello, @jyotishp after further investigation we found out that cas does not close connections to LDAP and does not respect pool size at all, we monitored the connections on LDAP port and we found out it does not close any of them
lardyNiji
@lardyNiji
Hi, is there a good way to handle 301 CAS redirect after a session lost with xhr request in a signle page application like angular or react ?
MD Fazla Rabby
@fazla043264
Google reCAPTCHA is not working on CAS 6.0.0
Petr Gašparík
@PetrGasparik
Hi, is https://apereo.atlassian.net the place where to look for open issues in CAS?