Configuring Apereo CAS

20 minutes

This tutorial is designed to help a new CAS user to set up the Apereo CAS server and client to their applications. The code of this tutorial is open-sourced on GitLab .

What’s CAS?

Enterprise Single Sign-On - CAS provides a friendly open source community that actively supports and contributes to the project. While the project is rooted in higher-ed open source, it has grown to an international audience spanning Fortune 500 companies and small special-purpose installations.

CAS provides enterprise single sign-on service for the Web:

  • An open and well-documented protocol
  • An open-source Java server component
  • Pluggable authentication support (LDAP, database, X.509, 2-factor)
  • Support for multiple protocols (CAS, SAML, OAuth, OpenID)
  • A library of clients for Java, .Net, PHP, Perl, Apache, uPortal, and others
  • Integrates with uPortal, BlueSocket, TikiWiki, Mule, Liferay, Moodle, and others
  • Community documentation and implementation support
  • An extensive community of adopters

Setup Aperro CAS Server

Download Source Code

Before start, you need to download the source code from the Git repo . In this tutorial, we are about to use the 4.x release.

Create Maven Project

After the download completes, uncompress the source code and copy cas-server-webapp/src/main/webapp and cas-server-webapp/src/main/resources to webapp and resources folder of the new created Maven project respectively.

Setup Maven Dependencies

Setup Maven dependencies in pom.xml as following:

<properties>
    <spring.version>4.2.3.RELEASE</spring.version>
    <cas-server.version>4.1.10</cas-server.version>
    <cs.dir>${project.parent.basedir}</cs.dir>
</properties>
<repositories>
    <repository>
        <id>codelds</id>
        <url>https://code.lds.org/nexus/content/groups/main-repo</url>
    </repository>
</repositories>
<dependencies>
    <dependency>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-webapp-support</artifactId>
        <version>${cas-server.version}</version>
    </dependency>
    <dependency>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-support-jdbc</artifactId>
        <version>${cas-server.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-beans</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-tx</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-web</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>com.ryantenney.metrics</groupId>
        <artifactId>metrics-spring</artifactId>
        <version>3.0.1</version>
    </dependency>
    <dependency>
        <groupId>com.oracle</groupId>
        <artifactId>ojdbc7</artifactId>
        <version>12.1.0.2</version>
    </dependency>
    <!-- JSTL Tags -->
    <dependency>
        <groupId>jstl</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>
    <dependency>
        <groupId>taglibs</groupId>
        <artifactId>standard</artifactId>
        <version>1.1.2</version>
    </dependency>
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>jsp-api</artifactId>
        <version>2.0</version>
        <scope>provided</scope>
    </dependency>
    <dependency>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-security-filter</artifactId>
        <version>2.0.4</version>
    </dependency>
    <dependency>
        <groupId>com.alibaba</groupId>
        <artifactId>druid</artifactId>
        <version>1.0.22</version>
    </dependency>
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>servlet-api</artifactId>
        <version>2.5</version>
        <scope>provided</scope>
    </dependency>
</dependencies>

HTTP Support

We strongly recommend you use HTTPS in the production environment! But in the development environment, you may want to use HTTP. You need to edit WEB-INF/spring-configuration/ticketGrantingTicketCookieGenerator.xml as following:

<bean id="ticketGrantingTicketCookieGenerator"
    class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator"
          c:casCookieValueManager-ref="cookieValueManager"
          p:cookieSecure="false"  <!-- Edit this value -->
          p:cookieMaxAge="-1"
          p:cookieName="TGC"
          p:cookiePath=""/>

And WEB-INF/deployerConfigContext.xml:

<bean id="proxyAuthenticationHandler"
    class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
    p:requireSecure="false" <!-- Add this attribute -->
    p:httpClient-ref="supportsTrustStoreSslSocketFactoryHttpClient" />

Database Configuration

The structure of the user table (named users) is listed below:

Field NameField Type
usernameVARCHAR2
passwordVARCHAR2

To add database support, you need to edit WEB-INF/deployerConfigContext.xml. Just change the following lines

<bean id="primaryAuthenticationHandler"
      class="org.jasig.cas.authentication.AcceptUsersAuthenticationHandler">
    <property name="users">
        <map>
            <entry key="casuser" value="Mellon"/>
        </map>
    </property>

to

<!-- Replace driverClassName to MySQL Connector if you're using MySQL -->
<!-- Replace url, username, password to yours -->
<bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource"
    init-method="init" destroy-method="close">
    <property name="driverClassName" value="oracle.jdbc.driver.OracleDriver" />
    <property name="url" value="jdbc:oracle:thin:@localhost:1521/xe" />
    <property name="username" value="Your-Username" />
    <property name="password" value="Your-Password" />
</bean>
<bean id="MD5PasswordEncoder" class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">
    <constructor-arg index="0" value="MD5" />
</bean>
<bean id="primaryAuthenticationHandler"
      class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">
    <property name="dataSource" ref="dataSource" />
    <property name="passwordEncoder" ref="MD5PasswordEncoder"/>
    <property name="sql" value="select password from users where username = ?" />
</bean>

Finally, we need to set up the applications that authenticate via this CAS server. Replace the following lines in WEB-INF/deployerConfigContext.xml:

<bean id="serviceRegistryDao" class="org.jasig.cas.services.JsonServiceRegistryDao"
    c:configDirectory="${service.registry.config.location:classpath:services}" />

to

<bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl"
    p:registeredServices-ref="registeredServicesList" />
<util:list id="registeredServicesList">
    <bean class="org.jasig.cas.services.RegexRegisteredService">
        <property name="id" value="10000001"/>
        <property name="name" value="Your Service Name"/>
        <property name="description" value="Your Service Description"/>
        <property name="serviceId" value="^(http?|https?|imaps?)://((127\.0\.0\.1)|(localhost))(:[\d]+)?/.*"/>
        <property name="evaluationOrder" value="10000001"/>
    </bean>
</util:list>

Setup Aperro CAS Client

It’s easier to set up CAS clients in the application. First of all, you need to add the dependency to pom.xml:

<dependency>
    <groupId>org.jasig.cas.client</groupId>
    <artifactId>cas-client-core</artifactId>
    <version>3.4.1</version>
</dependency>

Then, add the following lines in web.xml:

<filter>
    <filter-name>CAS Authentication Filter</filter-name>
    <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
    <init-param>
        <param-name>casServerLoginUrl</param-name>
        <param-value>http://localhost/cas/login</param-value>
    </init-param>
    <init-param>
        <param-name>casServerLogoutUrl</param-name>
        <param-value>http://localhost/cas/logout</param-value>
    </init-param>
    <init-param>
        <param-name>serverName</param-name>
        <param-value>localhost</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CAS Authentication Filter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

References

The Disqus comment system is loading ...
If the message does not appear, please check your Disqus configuration.

Search
Recent Projects
Recent Posts
Categories
Tags
Who is visiting?