Swivel Secure Authentication

Swivel Secure offers a wide range of authentication factors, allowing the use of 2FA and image based authentication. To learn more, please refer to the official website.

Usage

This feature is deprecated and is scheduled to be removed in the future.

CAS supports Swivel Secure’s TURing-image based authentication. TURing uses the PINsafe protocol to provide a One Time Code for authentication. Each image is unique for that session.

image

Configuration

Support is enabled by including the following module in the overlay:

1
2
3
4
5
<dependency>
    <groupId>org.apereo.cas</groupId>
    <artifactId>cas-server-support-swivel</artifactId>
    <version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-swivel:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
    imports {
        mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
    }
}

dependencies {
    implementation "org.apereo.cas:cas-server-support-swivel"
}
1
2
3
4
5
6
7
8
9
10
dependencies {
    /*
    The following platform references should be included automatically and are listed here for reference only.
            
    implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
    implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
    */

    implementation "org.apereo.cas:cas-server-support-swivel"
}

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting may be needed to activate or affect the behavior of the CAS feature and generally should be reviewed, possibly owned and adjusted. If the setting is assigned a default value, you do not need to strictly put the setting in your copy of the configuration, but should review it nonetheless to make sure it matches your deployment expectations.

  • cas.authn.mfa.swivel.bypass.groovy.location=
  • The location of the resource. Resources can be URLS, or files found either on the classpath or outside somewhere in the file system.

    In the event the configured resource is a Groovy script, specially if the script set to reload on changes, you may need to adjust the total number of inotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf: fs.inotify.max_user_instances = 256.

    You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

    org.apereo.cas.configuration.model.support.mfa.GroovyMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.rest.url=
  • The endpoint URL to contact and retrieve attributes.

    org.apereo.cas.configuration.model.support.mfa.RestfulMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.shared-secret=
  • Shared secret to authenticate against the swivel server.

    org.apereo.cas.configuration.model.support.mfa.SwivelMultifactorAuthenticationProperties.

    How can I configure this property?

    Deprecation status is ERRORwithout a replacement setting.

  • cas.authn.mfa.swivel.swivel-turing-image-url=
  • URL endpoint response to generate a turing image.

    org.apereo.cas.configuration.model.support.mfa.SwivelMultifactorAuthenticationProperties.

    How can I configure this property?

    Deprecation status is ERRORwithout a replacement setting.

  • cas.authn.mfa.swivel.swivel-url=
  • Swivel endpoint url for verification of credentials.

    org.apereo.cas.configuration.model.support.mfa.SwivelMultifactorAuthenticationProperties.

    How can I configure this property?

    Deprecation status is ERRORwithout a replacement setting.

    The configuration settings listed below are tagged as Optional in the CAS configuration metadata. This flag indicates that the presence of the setting is not immediately necessary in the end-user CAS configuration, because a default value is assigned or the activation of the feature is not conditionally controlled by the setting value. You should only include this field in your configuration if you need to modify the default value.

  • cas.authn.mfa.swivel.bypass.authentication-attribute-name=
  • Skip multifactor authentication based on designated authentication attribute names.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.authentication-attribute-value=
  • Optionally, skip multifactor authentication based on designated authentication attribute values.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.authentication-handler-name=
  • Skip multifactor authentication depending on form of primary authentication execution. Specifically, skip multifactor if the a particular authentication handler noted by its name successfully is able to authenticate credentials in the primary factor.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.authentication-method-name=
  • Skip multifactor authentication depending on method/form of primary authentication execution. Specifically, skip multifactor if the authentication method attribute collected as part of authentication metadata matches a certain value.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.credential-class-type=
  • Skip multifactor authentication depending on form of primary credentials. Value must equal the fully qualified class name of the credential type.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.http-request-headers=
  • Skip multifactor authentication if the http request contains the defined header names. Header names may be comma-separated and can be regular expressions; values are ignored.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.http-request-remote-address=
  • Skip multifactor authentication if the http request's remote address or host matches the value defined here. The value may be specified as a regular expression.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.principal-attribute-name=
  • Skip multifactor authentication based on designated principal attribute names.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.principal-attribute-value=
  • Optionally, skip multifactor authentication based on designated principal attribute values.

    org.apereo.cas.configuration.model.support.mfa.MultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.rest.basic-auth-password=
  • If REST endpoint is protected via basic authentication, specify the password for authentication.

    org.apereo.cas.configuration.model.support.mfa.RestfulMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.rest.basic-auth-username=
  • If REST endpoint is protected via basic authentication, specify the username for authentication.

    org.apereo.cas.configuration.model.support.mfa.RestfulMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.rest.headers=
  • Headers, defined as a Map, to include in the request when making the REST call. Will overwrite any header that CAS is pre-defined to send and include in the request. Key in the map should be the header name and the value in the map should be the header value.

    org.apereo.cas.configuration.model.support.mfa.RestfulMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?

  • cas.authn.mfa.swivel.bypass.rest.method=GET
  • HTTP method to use when contacting the rest endpoint. Examples include GET, POST, etc.

    org.apereo.cas.configuration.model.support.mfa.RestfulMultifactorAuthenticationProviderBypassProperties.

    How can I configure this property?