CAS 5 LDAP AuthN and Jasypt Configuration

This is a short and sweet tutorial on how to configure CAS for LDAP authentication and secure bind credentials via Jasypt encryption. Most of the material is based on the available documentation here and here.

This tutorial specifically focuses on:

  • CAS 5.1.0-RC3-SNAPSHOT
  • Java 8
  • Docker 1.13.x
  • Apache Tomcat 8.5.x
  • Jasypt CLI. You can download the distribution from here.

This tutorial assumes that you are running CAS in its standalone mode, described here.

LDAP Setup

For this tutorial, I am using a 398-ds LDAP server from this docker image. Once you have the image running, you can connect to the underlying LDAP server at localhost:10389 with cn=Directory Manager and password. The LDAP server is also prepped with a users.ldif file that contains the test account jsmith:password.

docker ps

CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                    NAMES
0f2a75441fb5        jtgasper3/389ds-basic   "/bin/sh -c '/usr/..."   11 days ago         Up 6 minutes>389/tcp   ldap-server

Sweet! Moving on…

Deploy CAS

Hop over to the overlay installation and get CAS built and deployed. The CAS version I am using today is 5.1.0-RC3-SNAPSHOT. It does not matter whether you end up using Maven or Gradle. Choose what fits you best. When you have a baseline functioning build, continue on.

Configure CAS

Once you have added the LDAP module to your build as is described here, you then need to teach CAS about the running LDAP server.

Here is what I did in the file, along with all the other usual suspects:

cas.authn.ldap[0].bindDn=cn=Directory Manager

I also need to disable static authentication. It would also be very nice if I could turn on DEBUG logs and see what CAS attempts to do:

Build and Deploy

Once you get CAS built and deployed, logs should indicate something like this:

2017-03-22 16:01:06,915 INFO [o.a.c.c.LdapAuthenticationConfiguration] - <Ldap authentication for [LdapAuthenticationHandler] is to chain principal resolvers via [[org.apereo.cas.authentication.principal.resolvers.ChainingPrincipalResolver@1452f4cb[chain=[org.apereo.cas.authentication.principal.resolvers.PersonDirectoryPrincipalResolver@1b7c5e6a[returnNullIfNoAttributes=false,principalAttributeName=<null>], org.apereo.cas.authentication.principal.resolvers.EchoingPrincipalResolver@6824495c[]]]]] for attribute resolution>

Great. Next, pull up CAS in your browser and log in with jsmith and password and you should be in. Viola!

Jasypt Encryption

You may have noted that the LDAP bindCredential is put into the file in plain-text. As the next steps:

  • We will first encrypt the bindCredential value via Jasypt and put it into CAS.
  • We will instruct CAS to decrypt the setting at runtime invisibly and resume as usual.

Note that there is nothing stopping you from encrypting any other setting!

Encrypt via Jasypt

Once you download the Jasypt CLI, at a minimum you need to decide which algorithm you want to use for encryption and what your encryption key/password should be which is the thing that is later taught to CAS to decode the value. In the bin directory of the distribution, you can invoke ./|bat to see what may be possible for algorithms and then use the ./|bat to encrypt values.

So for me to encrypt the value of bindCredential, I ran the following command:

./ input=password algorithm=PBEWithMD5AndTripleDES password=MySuperPassword

Runtime: Oracle Corporation Java HotSpot(TM) 64-Bit Server VM 25.121-b13 

algorithm: PBEWithMD5AndTripleDES
input: password
password: MySuperPassword


I can also confirm that this value can be decoded as well:

./ input=mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS algorithm=PBEWithMD5AndTripleDES password=MySuperPassword

Runtime: Oracle Corporation Java HotSpot(TM) 64-Bit Server VM 25.121-b13 

algorithm: PBEWithMD5AndTripleDES
input: mqWuN+/U7oofNhdSVNcEgmVcwGmxiOaS
password: MySuperPassword


Cool. Let’s move on.

Configure CAS

So now that I have encrypted value in the OUTPUT section, I am going to slightly massage my configuration as such:


Finally, we need to teach CAS to handle the reverse of this operation. Consulting the docs here, I ended up adjusting my configuration as such:

Using the embedded tomcat container, I configured my “run CAS” command to pass along the encryption key as a command-line parameter. If you prefer, you could do the same thing with environment variables and system properties.

java -jar target/cas.war

Next time when attempt to deploy and run CAS, you should be able to bind and connect to LDAP and authenticate as before.

That’s it!

Misagh Moayyed

Related Posts

CAS 6.0.0 RC1 Feature Release which I present an overview of CAS 6.0.0 RC1 release.

Get Productive with Shell Aliases

A collection of useful shell aliases, gathered over the years to help increase one's productivity and developer happiness.

feat(conventional_commits): signal breaking changes in commit titles

In which I suggest Conventional Commits should be enhanced to reflect the breakingness of commits in their commit message titles.

uPortal annual report, June 2018 edition

Ecoysystem. Releases. Community. Fiscal responsibility.

One Can Only Hope in Buchistan

A true story inspired by real events. Seriously. Bryan Cranston has been approached for the role of "Some".

Apereo CAS - Extending Webflows

Learn and master extending CAS 5 Spring Webflow definitions.

Apereo CAS - Administrative Endpoints & Monitoring

Gain insight into your running Apereo CAS deployment in production. Learn how to monitor and manage the server by using HTTP endpoints and gather metrics to diagnose issues and improve performance.

Apereo CAS - Custom Authentication & Attribute Sources

Master writing custom authentication handlers/schemes in CAS and learn how to design custom data sources that can produce user claims and attributes.

Apereo CAS - User Interface Customizations

A short tutorial on Apereo CAS user interface customizations, including themes, localization and dynamic views for all those who enjoy front-end development and suffer from instant gratification.

CAS Multifactor Authentication with Google Authenticator

A short walkthrough to demonstrate how one might turn on multifactor authentication with CAS using Google Authenticator, leveraging a variety of triggers.