Overview

The integration between the CAS Server and ADFS delegates user authentication from CAS Server to ADFS, making CAS Server a WS-Federation client. Claims released from ADFS are made available as attributes to CAS Server, and by extension CAS Clients.

Remember

The functionality described here allows CAS to use ADFS as an external identity provider. If you wish to do the opposite, allowing ADFS to become a CAS client and using CAS as an identity provider, you may take advantage of SAML2 support in CAS as one integration option.

Support is enabled by including the following dependency in the WAR overlay:

<dependency>
    <groupId>org.apereo.cas</groupId>
    <artifactId>cas-server-support-wsfederation-webflow</artifactId>
    <version>${cas.version}</version>
</dependency>

implementation "org.apereo.cas:cas-server-support-wsfederation-webflow:${project.'cas.version'}"

dependencyManagement {
    imports {
        mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
    }
}

dependencies {
    implementation "org.apereo.cas:cas-server-support-wsfederation-webflow"
}

dependencies {
    /*
    The following platform references should be included automatically and are listed here for reference only.
            
    implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
    implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
    */

    implementation "org.apereo.cas:cas-server-support-wsfederation-webflow"
}

You may also need to declare the following repository in your CAS Overlay to be able to resolve dependencies:

repositories {
    maven { 
        mavenContent { releasesOnly() }
        url "https://build.shibboleth.net/maven/releases/" 
    }
}

JCE Requirement

It's safe to make sure you have the proper JCE bundle installed in your Java environment that is used by CAS, specially if you need to consume encrypted payloads issued by ADFS. Be sure to pick the right version of the JCE for your Java version. Java versions can be detected via the java -version command.

WsFed Configuration

Adjust and provide settings for the ADFS instance, and make sure you have obtained the ADFS signing certificate and made it available to CAS at a location that can be resolved at runtime.

The following settings and properties are available from the CAS configuration catalog:

_{The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.}

cas.authn.wsfed[0].attribute-mutator-script.location=

The location of the resource. Resources can be URLS, or files found either on the classpath or outside somewhere in the file system.

In the event the configured resource is a Groovy script, specially if the script set to reload on changes, you may need to adjust the total number of inotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf: fs.inotify.max_user_instances = 256.

You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

org.apereo.cas.configuration.model.SpringResourceProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value. The only possible exception to this rule is when naming actuator endpoints; The name of the actuator endpoints (i.e. ssoSessions) MUST remain in camelCase mode.

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].attribute-mutator-script.location=...

This is the most common form of property configuration that is recognized by CAS, regardless of the actual property source, which might in fact be managed separately outside the CAS environment, by another system or cloud framework.

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      attribute-mutator-script: 
        location: "..."

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].attribute-mutator-script.location="..." -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory. Note the placement of the system property which must be specified before the CAS web application is launched.

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_ATTRIBUTE_MUTATOR_SCRIPT_LOCATION="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].attribute-mutator-script.location="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.encryption.key=EMPTY

The encryption key is a JWT whose length is defined by the encryption key size setting.

org.apereo.cas.configuration.model.core.util.EncryptionJwtCryptoProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.encryption.key=EMPTY

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "EMPTY"          encryption: 
            key: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.encryption.key="EMPTY" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_ENCRYPTION_KEY="EMPTY"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.encryption.key="EMPTY"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.signing.key=EMPTY

The signing key is a JWT whose length is defined by the signing key size setting.

org.apereo.cas.configuration.model.core.util.SigningJwtCryptoProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.signing.key=EMPTY

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "EMPTY"          signing: 
            key: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.signing.key="EMPTY" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_SIGNING_KEY="EMPTY"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.signing.key="EMPTY"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.groovy.location=

The location of the resource. Resources can be URLS, or files found either on the classpath or outside somewhere in the file system.

You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

org.apereo.cas.configuration.model.SpringResourceProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.groovy.location=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "..."          groovy: 
            location: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.groovy.location="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_GROOVY_LOCATION="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.groovy.location="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].id=

Internal identifier for this wsfed configuration. If undefined, the identifier would be auto-generated by CAS itself. In the event that there is more than on CAS server defined in a clustered deployment, this identifier must be statically defined in the configuration.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].id=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      id: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].id="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_ID="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].id="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].identity-attribute=upn

The attribute extracted from the assertion and used to construct the CAS principal id.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].identity-attribute=upn

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      identity-attribute: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].identity-attribute="upn" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_IDENTITY_ATTRIBUTE="upn"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].identity-attribute="upn"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].identity-provider-identifier=http://adfs.example.org/adfs/services/trust

The entity id or the identifier of the Wsfed instance.

This setting supports the Spring Expression Language.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].identity-provider-identifier=http://adfs.example.org/adfs/services/trust

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      identity-provider-identifier: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].identity-provider-identifier="http://adfs.example.org/adfs/services/trust" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_IDENTITY_PROVIDER_IDENTIFIER="http://adfs.example.org/adfs/services/trust"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].identity-provider-identifier="http://adfs.example.org/adfs/services/trust"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].identity-provider-url=https://adfs.example.org/adfs/ls/

Wsfed identity provider url.

This setting supports the Spring Expression Language.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].identity-provider-url=https://adfs.example.org/adfs/ls/

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      identity-provider-url: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].identity-provider-url="https://adfs.example.org/adfs/ls/" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_IDENTITY_PROVIDER_URL="https://adfs.example.org/adfs/ls/"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].identity-provider-url="https://adfs.example.org/adfs/ls/"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].relying-party-identifier=urn:cas:localhost

The identifier for CAS (RP) registered with wsfed.

This setting supports the Spring Expression Language.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].relying-party-identifier=urn:cas:localhost

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      relying-party-identifier: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].relying-party-identifier="urn:cas:localhost" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_RELYING_PARTY_IDENTIFIER="urn:cas:localhost"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].relying-party-identifier="urn:cas:localhost"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].signing-certificate-resources=classpath:adfs-signing.crt

Locations of signing certificates used to verify assertions. Locations could be specified as static file-system resources(certificates) or they could also be federation XML metadata, either as a URL or an XML file. If federation metadata XML is provided, the signing certificate is extracted from the IDPSSODescriptor's key descriptor that is marked for signing.

org.apereo.cas.configuration.model.support.wsfed.WsFederationDelegationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].signing-certificate-resources=classpath:adfs-signing.crt

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      signing-certificate-resources: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].signing-certificate-resources="classpath:adfs-signing.crt" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_SIGNING_CERTIFICATE_RESOURCES="classpath:adfs-signing.crt"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].signing-certificate-resources="classpath:adfs-signing.crt"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

# The location of the resource.
# cas.authn.wsfed[0].attribute-mutator-script.location=

# The encryption key is a JWT whose length is defined by the encryption key size setting.
# cas.authn.wsfed[0].cookie.crypto.encryption.key=EMPTY

# The signing key is a JWT whose length is defined by the signing key size setting.
# cas.authn.wsfed[0].cookie.crypto.signing.key=EMPTY

# The location of the resource.
# cas.authn.wsfed[0].principal.principal-transformation.groovy.location=

# Internal identifier for this wsfed configuration.
# cas.authn.wsfed[0].id=

# The attribute extracted from the assertion and used to construct the CAS principal id.
# cas.authn.wsfed[0].identity-attribute=upn

# The entity id or the identifier of the Wsfed instance.
# cas.authn.wsfed[0].identity-provider-identifier=http://adfs.example.org/adfs/services/trust

# Wsfed identity provider url.
# cas.authn.wsfed[0].identity-provider-url=https://adfs.example.org/adfs/ls/

# The identifier for CAS (RP) registered with wsfed.
# cas.authn.wsfed[0].relying-party-identifier=urn:cas:localhost

# Locations of signing certificates used to verify assertions.
# cas.authn.wsfed[0].signing-certificate-resources=classpath:adfs-signing.crt

_{The configuration settings listed below are tagged as Optional in the CAS configuration metadata. This
flag indicates that the presence of the setting
is not immediately necessary in the end-user CAS configuration, because a default value is assigned or
the activation of the feature is not conditionally controlled by the setting value. You should only include this field in your
configuration if you need to modify the default value.}

cas.authn.wsfed[0].principal.active-attribute-repository-ids=

Activated attribute repository identifiers that should be used for fetching attributes if attribute resolution is enabled. The list here may include identifiers separated by comma.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.active-attribute-repository-ids=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        active-attribute-repository-ids: "..."

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.active-attribute-repository-ids="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_ACTIVE_ATTRIBUTE_REPOSITORY_IDS="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.active-attribute-repository-ids="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.attribute-resolution-enabled=UNDEFINED

Whether attribute repositories should be contacted to fetch person attributes. Defaults to true if not set.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.attribute-resolution-enabled=UNDEFINED

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        attribute-resolution-enabled: "UNDEFINED"

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.attribute-resolution-enabled="UNDEFINED" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_ATTRIBUTE_RESOLUTION_ENABLED="UNDEFINED"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.attribute-resolution-enabled="UNDEFINED"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-attribute=

Attribute name to use to indicate the identifier of the principal constructed. If the attribute is blank or has no values, the default principal id will be used determined by the underlying authentication engine. The principal id attribute usually is removed from the collection of attributes collected, though this behavior depends on the schematics of the underlying authentication strategy.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-attribute=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-attribute: "..."

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-attribute="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_ATTRIBUTE="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-attribute="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-resolution-conflict-strategy=last

In the event that the principal resolution engine resolves more than one principal, (specially if such principals in the chain have different identifiers), this setting determines strategy by which the principal id would be chosen from the chain. Accepted values are: last, first.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-resolution-conflict-strategy=last

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-resolution-conflict-strategy: "last"

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-resolution-conflict-strategy="last" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_RESOLUTION_CONFLICT_STRATEGY="last"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-resolution-conflict-strategy="last"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-resolution-failure-fatal=UNDEFINED

When true, throws an error back indicating that principal resolution has failed and no principal can be found based on the authentication requirements. Otherwise, logs the condition as an error without raising a catastrophic error.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-resolution-failure-fatal=UNDEFINED

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-resolution-failure-fatal: "UNDEFINED"

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-resolution-failure-fatal="UNDEFINED" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_RESOLUTION_FAILURE_FATAL="UNDEFINED"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-resolution-failure-fatal="UNDEFINED"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.blocking-pattern=

A regular expression that will be used against the username to match for blocking/forbidden values. If a match is found, an exception will be thrown and principal transformation will fail.

org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.blocking-pattern=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "..."          blocking-pattern: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.blocking-pattern="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_BLOCKING_PATTERN="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.blocking-pattern="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.case-conversion=NONE

Indicate whether the principal identifier should be transformed into upper-case, lower-case, etc. Available values are as follows:

NONE: No conversion.
LOWERCASE: Lowercase conversion.
UPPERCASE: Uppercase conversion.

org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.case-conversion=NONE

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "NONE"          case-conversion: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.case-conversion="NONE" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_CASE_CONVERSION="NONE"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.case-conversion="NONE"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.pattern=

A regular expression that will be used against the provided username for username extractions. On a successful match, the first matched group in the pattern will be used as the extracted username.

org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.pattern=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "..."          pattern: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.pattern="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_PATTERN="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.pattern="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.prefix=

Prefix to add to the principal id prior to authentication.

org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.prefix=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "..."          prefix: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.prefix="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_PREFIX="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.prefix="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.principal-transformation.suffix=

Suffix to add to the principal id prior to authentication.

org.apereo.cas.configuration.model.core.authentication.PrincipalTransformationProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.principal-transformation.suffix=...

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        principal-transformation: "..."          suffix: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.principal-transformation.suffix="..." -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_PRINCIPAL_TRANSFORMATION_SUFFIX="..."

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.principal-transformation.suffix="..."

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.return-null=UNDEFINED

Return a null principal object if no attributes can be found for the principal.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.return-null=UNDEFINED

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        return-null: "UNDEFINED"

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.return-null="UNDEFINED" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_RETURN_NULL="UNDEFINED"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.return-null="UNDEFINED"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].principal.use-existing-principal-id=UNDEFINED

Uses an existing principal id that may have already been established in order to run person directory queries. This is generally useful in situations where authentication is delegated to an external identity provider and a principal is first established to then query an attribute source.

org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].principal.use-existing-principal-id=UNDEFINED

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      principal: 
        use-existing-principal-id: "UNDEFINED"

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].principal.use-existing-principal-id="UNDEFINED" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_PRINCIPAL_USE_EXISTING_PRINCIPAL_ID="UNDEFINED"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].principal.use-existing-principal-id="UNDEFINED"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.alg=DEFAULT_CONTENT_ENCRYPTION_ALGORITHM

The signing/encryption algorithm to use.

org.apereo.cas.configuration.model.core.util.EncryptionJwtSigningJwtCryptographyProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.alg=DEFAULT_CONTENT_ENCRYPTION_ALGORITHM

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "DEFAULT_CONTENT_ENCRYPTION_ALGORITHM"          alg: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.alg="DEFAULT_CONTENT_ENCRYPTION_ALGORITHM" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_ALG="DEFAULT_CONTENT_ENCRYPTION_ALGORITHM"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.alg="DEFAULT_CONTENT_ENCRYPTION_ALGORITHM"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.enabled=true

Whether crypto operations are enabled.

org.apereo.cas.configuration.model.core.util.EncryptionJwtSigningJwtCryptographyProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.enabled=true

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "true"          enabled: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.enabled="true" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_ENABLED="true"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.enabled="true"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.encryption.key-size=512

The encryption key size.

org.apereo.cas.configuration.model.core.util.EncryptionJwtCryptoProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.encryption.key-size=512

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "512"          encryption: 
            key-size: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.encryption.key-size="512" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_ENCRYPTION_KEY_SIZE="512"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.encryption.key-size="512"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.signing.key-size=512

The signing key size.

org.apereo.cas.configuration.model.core.util.SigningJwtCryptoProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.signing.key-size=512

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "512"          signing: 
            key-size: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.signing.key-size="512" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_SIGNING_KEY_SIZE="512"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.signing.key-size="512"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

cas.authn.wsfed[0].cookie.crypto.strategy-type=ENCRYPT_AND_SIGN

Control the cipher sequence of operations. The accepted values are:

ENCRYPT_AND_SIGN: Encrypt the value first, and then sign.
SIGN_AND_ENCRYPT: Sign the value first, and then encrypt.

org.apereo.cas.configuration.model.core.util.EncryptionJwtSigningJwtCryptographyProperties.

_{How can I configure this property?}

Configuration properties can be included and activated using the following strategies.

:information_source: Note

CAS properties can be specified using the Java configuration property syntax in any and all .properties files:

cas.authn.wsfed[0].cookie.crypto.strategy-type=ENCRYPT_AND_SIGN

CAS properties can be specified using the YAML syntax:

cas: 
  authn: 
    - wsfed: 
      cookie: 
        crypto: "ENCRYPT_AND_SIGN"          strategy-type: 

Note that YAML is very specific about structure and indentation. Be sure to verify the correctness of the final result with your YAML validator of choice.

CAS properties can be passed to the CAS web application as system properties, when the application is launched:

java -Dcas.authn.wsfed[0].cookie.crypto.strategy-type="ENCRYPT_AND_SIGN" -jar build/libs/cas.war

CAS properties can specified as system environment variables before the CAS web application is launched:

export CAS_AUTHN_WSFED[0]_COOKIE_CRYPTO_STRATEGY_TYPE="ENCRYPT_AND_SIGN"

java -jar build/libs/cas.war

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.

CAS properties can be passed to the CAS web application as command-line arguments, when the application is launched:

java -jar build/libs/cas.war --cas.authn.wsfed[0].cookie.crypto.strategy-type="ENCRYPT_AND_SIGN"

The above example assumes that the CAS web application is packaged as cas.war with an embedded server container and can be found in the build/libs directory.