CAS 5 LDAP AuthN and Jasypt Configuration


This is a short and sweet tutorial on how to configure CAS for LDAP authentication and secure bind credentials via Jasypt encryption. Most of the material is based on the available documentation here and here.

This tutorial specifically focuses on:

  • CAS 5.1.0-RC3-SNAPSHOT
  • Java 8
  • Docker 1.13.x
  • Apache Tomcat 8.5.x
  • Jasypt CLI. You can download the distribution from here.

This tutorial assumes that you are running CAS in its standalone mode, described here.

LDAP Setup

For this tutorial, I am using a 398-ds LDAP server from this docker image. Once you have the image running, you can connect to the underlying LDAP server at localhost:10389 with cn=Directory Manager and password. The LDAP server is also prepped with a users.ldif file that contains the test account jsmith:password.

docker ps

CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                    NAMES
0f2a75441fb5        jtgasper3/389ds-basic   "/bin/sh -c '/usr/..."   11 days ago         Up 6 minutes        0.0.0.0:10389->389/tcp   ldap-server

Sweet! Moving on…

Deploy CAS

Hop over to the overlay installation and get CAS built and deployed. The CAS version I am using today is 5.1.0-RC3-SNAPSHOT. It does not matter whether you end up using Maven or Gradle. Choose what fits you best. When you have a baseline functioning build, continue on.

Configure CAS

Once you have added the LDAP module to your build as is described here, you then need to teach CAS about the running LDAP server.

Here is what I did in the cas.properties file, along with all the other usual suspects:

cas.authn.ldap[0].type=AUTHENTICATED
cas.authn.ldap[0].ldapUrl=ldap://localhost:10389
cas.authn.ldap[0].useSsl=false
cas.authn.ldap[0].baseDn=ou=People,dc=example,dc=edu
cas.authn.ldap[0].userFilter=uid={user}
cas.authn.ldap[0].bindDn=cn=Directory Manager
cas.authn.ldap[0].bindCredential=password

I also need to disable static authentication. It would also be very nice if I could turn on DEBUG logs and see what CAS attempts to do:

logging.level.org.apereo=DEBUG
cas.authn.accept.users=

Build and Deploy

Once you get CAS built and deployed, logs should indicate something like this:

2017-03-22 16:01:06,915 INFO [o.a.c.c.LdapAuthenticationConfiguration] - <Ldap authentication for [LdapAuthenticationHandler] is to chain principal resolvers via [[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver@1452f4cb[chain=[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver@1b7c5e6a[returnNullIfNoAttributes=false,principalAttributeName=<null>], org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@6824495c[]]]]] for attribute resolution>

Great. Next, pull up CAS in your browser and log in with jsmith and password and you should be in. Viola!

Jasypt Encryption

You may have noted that the LDAP bindCredential is put into the cas.properties file in plain-text. As the next steps:

  • We will first encrypt the bindCredential value via Jasypt and put it into CAS.
  • We will instruct CAS to decrypt the setting at runtime invisibly and resume as usual.

Note that there is nothing stopping you from encrypting any other setting!

Encrypt via Jasypt

Once you download the Jasypt CLI, at a minimum you need to decide which algorithm you want to use for encryption and what your encryption key/password should be which is the thing that is later taught to CAS to decode the value. In the bin directory of the distribution, you can invoke ./listAlgorithms.sh|bat to see what may be possible for algorithms and then use the ./encrypt.sh|bat to encrypt values.

So for me to encrypt the value of bindCredential, I ran the following command:

./encrypt.sh input=password algorithm=PBEWithMD5AndTripleDES password=MySuperPassword

----ENVIRONMENT-----------------
Runtime: Oracle Corporation Java HotSpot(TM) 64-Bit Server VM 25.121-b13 

----ARGUMENTS-------------------
algorithm: PBEWithMD5AndTripleDES
input: password
password: MySuperPassword

----OUTPUT----------------------
mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS

I can also confirm that this value can be decoded as well:

./decrypt.sh input=mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS algorithm=PBEWithMD5AndTripleDES password=MySuperPassword

----ENVIRONMENT-----------------
Runtime: Oracle Corporation Java HotSpot(TM) 64-Bit Server VM 25.121-b13 

----ARGUMENTS-------------------
algorithm: PBEWithMD5AndTripleDES
input: mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS
password: MySuperPassword

----OUTPUT----------------------
password

Cool. Let’s move on.

Configure CAS

So now that I have encrypted value in the OUTPUT section, I am going to slightly massage my configuration as such:

...
cas.authn.ldap[0].bindCredential={cipher}mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS
...

Finally, we need to teach CAS to handle the reverse of this operation. Consulting the docs here, I ended up adjusting my configuration as such:

cas.standalone.config.security.alg=PBEWithMD5AndTripleDES

Using the embedded tomcat container, I configured my “run CAS” command to pass along the encryption key as a command-line parameter. If you prefer, you could do the same thing with environment variables and system properties.

java -jar target/cas.war --cas.standalone.config.security.psw=MySuperPassword

Next time when attempt to deploy and run CAS, you should be able to bind and connect to LDAP and authenticate as before.

That’s it!

Misagh Moayyed

Related Posts

CAS 5.3.0 RC4 Feature Release

...in which I present an overview of CAS 5.3.0 RC4 release.

Apereo CAS - Identity Impersonation

You do not always have to be you. Allow the Apereo CAS server to allow you to pretend to be another person for fun and profit.

Apereo CAS - Customized Settings

Extend the Apereo CAS server to allow custom configuration properties and settings.

Apereo CAS - Handling Multiple Logout URLs

Extend the Apereo CAS server to allow for multiple logout URLs during SLO operations.

Apereo CAS - Access Strategy External URL Redirects

A quick use case walkthrough where the authentication flow in CAS is to be redirected to a customized external URL if service access is denied.

Apereo CAS - Linking Accounts with Delegated Authentication

A quick use case walkthrough where profiles provided by external identity providers to CAS need to be looked up by an identifier in internal databases before CAS can successfully establish an authenticated subject.

Nominate awesome fits for the Apereo board

Provoking thoughts about who might serve well on Apereo board.

Apereo CAS - Test-Driving Feature Modules

An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc.

Feedback on draft Apereo strategy

Focus on revenue to achieve sustainability. Defer everything else.

Apereo CAS Best [Mal]Practice - Supercharged Overlays

An overview of how a CAS overlay prepped for deployment can tap into internal components, altering logic and behavior for good and evil...but mostly evil.