sbglasius opened a new pull request, #16174: URL: https://github.com/apache/grails-core/pull/16174
## Summary `grails-spring-security-cas` had no tests, and its only exerciser was a `bootRun`-only demo pointed at a hand-run CAS server. Two defects were living in that gap. This fixes both, makes a security-relevant default explicit, and puts the plugin under integration tests that run against a real Apereo CAS server. ## Fixes **`proxyReceptorUrl` was set unconditionally.** Spring Security 7.1 rejects a null pattern, so an application that did not configure a proxy receptor — the default — failed to start with `IllegalArgumentException: pattern cannot be null`. It is now only set when configured, which is how `CasAuthenticationFilter` expresses that proxy support is off. Before Spring Security 7.1 the unguarded assignment produced a matcher for the literal path `/**null`, quietly giving unconfigured applications a live proxy receptor. **Single sign-out never worked.** The plugin set `useSessionFixationPrevention = false` from `doWithSpring`, but it declares `loadAfter = ['springSecurityCore']`, so the core plugin had already defined `sessionAuthenticationStrategy` from the original value. The session was still replaced on login, so CAS logout requests matched no session and were silently dropped. The bean is now redefined from the CAS plugin as well, through the same `BeanTypeResolver` the core plugin uses, so an application's `sessionAuthenticationStrategyBeanClass` override still wins. Overriding a core bean from a sibling security plugin is the established pattern in this module family — CAS already overrides `authenticationEntryPoint`, LDAP overrides `userDetailsService`, ACL overrides `passwordEncoder`/`permissionEvaluator`/`runAsManager`. ## Behaviour change `cas.useSingleSignout` now defaults to `false`. Enabling it disables session fixation prevention, which an application should choose deliberately rather than inherit. The plugin logs and prints a warning at startup when it is enabled. Because single sign-out did not actually work before, applications upgrading are unlikely to lose working behaviour. Documented in the CAS configuration reference and in a new section of the Grails 8 upgrade guide. ## Tests `grails-test-examples-spring-security-cas-test1` now runs against a real `apereo/cas` server started with Testcontainers, gated on Docker availability, and no longer needs an externally managed CAS server for `bootRun` either. An `EnvironmentPostProcessor` starts the container and supplies the CAS URLs before the context is built. The service URL and proxy callback URL depend on the port the embedded server binds, so they are set once the server is up but before it serves a request. Three configurations run via the existing `TESTCONFIG` idiom, all added to CI: | `TESTCONFIG` | Configuration | |---|---| | `cas` | proxy settings unset; login, validation, roles, single sign-out | | `casProxy` | full proxy-granting-ticket round trip | | `casNoSingleSignout` | asserts the new default | Proxy coverage obtains a real `PT-` proxy ticket through `AttributePrincipal.getProxyTicketFor(...)`, so it exercises the whole callback round trip rather than inspecting internals. Logout requests are posted from a cookie-less client, as CAS does on its own connection — posting from the authenticated client would clear the session through failed authentication anyway, which is indistinguishable from single sign-out working. Verified that reverting either fix turns the relevant specs red. ## Notes for reviewers Two findings worth knowing, both documented in the code: - Do **not** add `attributeReleasePolicy.authorizedToReleaseProxyGrantingTicket` to the CAS service definition. Despite the name it is a different feature, it needs a service public key, and without one CAS drops `<cas:proxyGrantingTicket>` from the validation response entirely, silently breaking proxy authentication. - The stock `apereo/cas` image only authorises `https` services, so a service definition permitting `http` is copied into the container. This branches from and targets `8.0.x` because the default change is documented in the Grails 8 upgrade guide. The two bug fixes are independently backportable to `7.0.x` if wanted. Also included: `Grails BOM Hibernate7 Micronaut.adoc` is generated and gitignored but was missing from the rat exclusions, so `./gradlew rat` failed after any docs build. One line, unrelated to CAS — happy to split it out. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
