Hello,
I’ve have my CAS 5.1 instance configured to use a local (same machine) LDAP
server for the CAS services registry. I extended the schema with attributes
delineated at the end of this email, I also tested auto-initialization after
removing the cas related objectclass and attributes. Still it failed.
With the schema extended by hand, I was able to manually add a service
definition via LDIF so I could gain access to the cas-management application
and attempt to add a service definition from the web interface, with no luck.
CAS is properly connecting to the servicesRegistry LDAP server.
CAS is able to read values from the servicesRegistry LDAP server.
CAS does not auto initialize the two base service definitions Apereo and
HTTPS/IMAPS.
I am unable to add new services to the servicesRegistry.
Help with the above issues would be greatly appreciated.
Related question:
Do I need to extend the schema of my LDAP server with the casRegisteredService
objectClass and related attibiuteTypes?
Below are relevant configurations, logs and the casRegisteredService LDAP
objectClass and attributeTypes:
Thanks!
Pom.xml
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-ldap-service-registry</artifactId>
<version>${cas.version}</version>
</dependency>
<cas.version>5.1.1</cas.version>
application.properties
##
#cas ldap service registry
#
cas.serviceRegistry.ldap.serviceDefinitionAttribute=description
cas.serviceRegistry.ldap.idAttribute=uid
cas.serviceRegistry.ldap.objectClass=casRegisteredService
cas.serviceRegistry.ldap.ldapUrl=ldap://apptest-523.wichita.edu:389
cas.serviceRegistry.ldap.baseDn=ou=cas-services,dc=wichita,dc=edu
cas.serviceRegistry.ldap.bindDn=cn=Directory Manager
cas.serviceRegistry.ldap.bindCredential=derp
cas.serviceRegistry.ldap.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider
cas.serviceRegistry.ldap.connectTimeout=5000
cas.serviceRegistry.ldap.minPoolSize=2
cas.serviceRegistry.ldap.maxPoolSize=10
cas.serviceRegistry.ldap.validateOnCheckout=true
cas.serviceRegistry.ldap.validatePeriodically=true
cas.serviceRegistry.ldap.validatePeriod=600
cas.serviceRegistry.ldap.failFast=true
cas.serviceRegistry.ldap.idleTime=500
cas.serviceRegistry.ldap.prunePeriod=600
cas.serviceRegistry.ldap.blockWaitTime=5000
# cas.serviceRegistry.ldap.trustCertificates=
# cas.serviceRegistry.ldap.keystore=
# cas.serviceRegistry.ldap.keystorePassword=
# cas.serviceRegistry.ldap.keystoreType=JKS|JCEKS|PKCS12
cas.serviceRegistry.ldap.useSsl=false
cas.serviceRegistry.ldap.useStartTls=false
##
#JSON Service Registry
#
cas.serviceRegistry.watcherEnabled=true
cas.serviceRegistry.repeatInterval=120000
cas.serviceRegistry.startDelay=15000
cas.serviceRegistry.initFromJson=true
Relevant Log data:
CAS.log
2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection factory for [ldap://apptest-523.wichita.edu:389]>
2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection configuration for
[ldap://apptest-523.wichita.edu:389]>
2017-06-30 11:37:33,563 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Transformed LDAP urls from [ldap://apptest-523.wichita.edu:389] to
[ldap://apptest-523
.wichita.edu:389]>
2017-06-30 11:37:33,571 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP SSL configuration via the native JVM truststore>
2017-06-30 11:37:33,572 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP bind connection initializer via [cn=Directory Manager]>
2017-06-30 11:37:33,598 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Creating LDAP connection pool configuration for
[ldap://apptest-523.wichita.edu:389]>
2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Created [BIND] passivator for [ldap://apptest-523.wichita.edu:389]>
2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Initializing ldap connection pool for [ldap://apptest-523.wichita.edu:389] and
bindDn
[cn=Directory Manager]>
2017-06-30 11:37:33,867 DEBUG
[org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured
search filter to [(uid={0})]>
2017-06-30 11:37:33,867 DEBUG
[org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured
load filter to [(objectClass=casRegisteredService)]>
2017-06-30 11:37:33,885 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(objectClass=casRegisteredService)]>
2017-06-30 11:37:33,925 DEBUG
[org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry
contains [0] service definitions>
2017-06-30 11:37:33,925 DEBUG
[org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry will
be auto-initialized from default JSON services>
2017-06-30 11:37:34,099 DEBUG
[org.apereo.cas.services.ServiceRegistryInitializer] - <Loading JSON services
are [[id=10000002,name=Apereo,description=Apereo foundat
ion sample
service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>,
id=10000001,name=HTTPS and IMAPS,description=This service definition
authorized all application urls that support HTTPS and IMAPS
protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>]]>
2017-06-30 11:37:34,099 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(objectClass=casRegisteredService)]>
2017-06-30 11:37:34,109 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(uid=10000002)]>
2017-06-30 11:37:34,119 DEBUG
[org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service
registry with the [id=10000002,name=Apereo,description=Apereo foundation sample
service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>]
JSON service definition...>
2017-06-30 11:37:34,119 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(uid=10000002)]>
2017-06-30 11:37:34,124 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(objectClass=casRegisteredService)]>
2017-06-30 11:37:34,126 DEBUG [org.apereo.cas.configuration.support.Beans] -
<Constructed LDAP search filter [(uid=10000001)]>
2017-06-30 11:37:34,134 DEBUG
[org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service
registry with the [id=10000001,name=HTTPS and IMAPS,description=This service
definition authorized all application urls that support HTTPS and IMAPS
protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>]
JSON service definition...>
dirsrv-access.log shows search only.
attributeTypes: (
1.3.6.1.4.1.6760.6.1.1
NAME 'casServiceUrlPattern'
DESC 'Service URL pattern.'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.2
NAME 'casServiceEnabled'
DESC 'Service enabled flag.'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.3
NAME 'casServiceSsoEnabled'
DESC 'TRUE to participate in SSO, FALSE to force authentication.'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.4
NAME 'casServiceAnonymousAccess'
DESC 'TRUE to use opaque, anonymous identifier for NetID, FALSE otherwise.'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.5
NAME 'casServiceAllowedToProxy'
DESC 'TRUE to enable proxy authentication support, FALSE otherwise.'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.6
NAME 'casServiceTheme'
DESC 'Spring theme name to use for service.'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.7
NAME 'casUsernameAttribute'
DESC 'Attribute name whose value should be used for service-specific NetID.'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.8
NAME 'casAllowedAttributes'
DESC 'Names of attributes to be released to service. Facilitates
service-specific attribute release.'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.9
NAME 'casIgnoreAttributes'
DESC 'TRUE to disable service-specific attribute release, FALSE otherwise.
Supersedes casAllowedAttributes.'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.10
NAME 'casEvaluationOrder'
DESC 'Numerical evaluation order of this service.'
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
#
################################################################################
#
attributeTypes: (
1.3.6.1.4.1.6760.6.1.11
NAME 'casRequiredHandlers'
DESC 'Names of authentication handlers that must succeed to gain access to
this service. Part of MFA support.'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
########################################################
# Objectclasses below #
########################################################
objectClasses: (
1.3.6.1.4.1.6760.6.2.1
SUP top
STRUCTURAL
NAME 'casRegisteredService'
DESC 'CAS registered service.'
MUST ( uid $ casServiceUrlPattern $ cn )
MAY ( description $ casServiceEnabled $ casServiceSsoEnabled $
casServiceAnonymousAccess $
casServiceAllowedToProxy $ casServiceTheme $ casUsernameAttribute $
casAllowedAttributes $
casIgnoreAttributes $ casEvaluationOrder $ casRequiredHandlers ))
Erik Mallory
Server Analyst
Wichita State University
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/7B902700-C2D6-48D8-909C-1D458B9BBA08%40wichita.edu.
