Command-line Shell
The CAS command-line shell provides the ability to query the CAS server for help on available settings/modules and various other utility functions.
To invoke and work with the utility, execute:
1
java -jar /path/to/cas-server-support-shell-$casVersion.jar
…where $casVersion
needless to say is the CAS version that is deployed.
The interface that is next presented will guide you through with available parameters and methods of querying. You will learn how to launch into the interactive shell and query the CAS engine dynamically.
Make sure you have the proper JCE bundle installed in your
Java environment that is used by CAS, specially if you need to use specific signing/encryption algorithms and methods.
Be sure to pick the right version of the JCE for your Java version. Java versions can be detected via the java -version
command.
Note that the WAR Overlay deployment strategy should already be equipped with this functionality. You should not have to do anything special and extra to interact with the shell. See the relevant overlay documentation for more info on how to invoke and work with the shell.
Shell Commands
The following commands are available and exposed by the CAS command-line shell.
generate-key
Generate signing/encryption crypto keys for CAS settings
Name | Description | Default |
---|---|---|
key-size,--key-size
|
Key size
|
256
|
cipher-text,encode-text
Sign and encrypt text data using keys
Name | Description | Default |
---|---|---|
value,--value
|
Value to put through the cipher
|
__NULL__
|
encryption-key,--encryption-key
|
Encryption key
|
__NULL__
|
encryption-alg,--encryption-alg
|
Encryption alg
|
A256CBC-HS512
|
signing-key,--signing-key
|
Signing key
|
__NULL__
|
encryption-key-size,--encryption-key-size
|
Encryption key size
|
512
|
signing-key-size,--signing-key-size
|
Signing key size
|
512
|
enable-encryption,--enable-encryption
|
Whether value should be encrypted
|
true
|
enable-signing,--enable-signing
|
Whether value should be signed
|
true
|
decipher-text,decode-text
Decrypt and verify text data using keys
Name | Description | Default |
---|---|---|
value,--value
|
Value to put through the cipher
|
__NULL__
|
encryption-key,--encryption-key
|
Encryption key
|
__NULL__
|
encryption-alg,--encryption-alg
|
Encryption alg
|
A256CBC-HS512
|
signing-key,--signing-key
|
Signing key
|
__NULL__
|
encryption-key-size,--encryption-key-size
|
Encryption key size
|
512
|
signing-key-size,--signing-key-size
|
Signing key size
|
512
|
enable-encryption,--enable-encryption
|
Whether value should be encrypted
|
true
|
enable-signing,--enable-signing
|
Whether value should be signed
|
true
|
generate-ddl
Generate database DDL scripts
Name | Description | Default |
---|---|---|
file,--file
|
DDL file to contain to generated script
|
/etc/cas/config/cas-db-schema.sql
|
dialect,--dialect
|
Database dialect class
|
HSQL
|
url,--url
|
JDBC database connection URL
|
jdbc:hsqldb:mem:cas
|
delimiter,--delimiter
|
Delimiter to use for separation of statements when generating SQL
|
;
|
pretty,--pretty
|
Format DDL scripts and pretty-print the output
|
false
|
dropSchema,--dropSchema
|
Generate DROP SQL statements in the DDL
|
false
|
createSchema,--createSchema
|
Generate DROP SQL statements in the DDL
|
false
|
haltOnError,--haltOnError
|
Halt if an error occurs during the generation process
|
false
|
decrypt-value
Decrypt a CAS property value/setting via Jasypt
Name | Description | Default |
---|---|---|
value,--value
|
Value to decrypt
|
__NONE__
|
alg,--alg
|
Algorithm to use to decrypt
|
__NULL__
|
provider,--provider
|
Security provider to use to decrypt
|
__NULL__
|
password,--password
|
Password (encryption key) to decrypt
|
__NONE__
|
initvector,--initvector,iv,--iv
|
Use initialization vector to encrypt
|
false
|
iterations,--iterations
|
Key obtention iterations to decrypt, default 1000
|
__NULL__
|
encrypt-value
Encrypt a CAS property value/setting via Jasypt
Name | Description | Default |
---|---|---|
value,--value
|
Value to encrypt
|
__NULL__
|
file,--file
|
File to encrypt
|
__NULL__
|
alg,--alg
|
Algorithm to use to encrypt
|
__NULL__
|
provider,--provider
|
Security provider to use to encrypt
|
__NULL__
|
password,--password
|
Password (encryption key) to encrypt
|
__NONE__
|
initvector,--initvector,iv,--iv
|
Use initialization vector to encrypt
|
false
|
iterations,--iterations
|
Key obtention iterations to encrypt, default 1000
|
__NULL__
|
jasypt-list-algorithms
List alogrithms you can use with Jasypt for property encryption
Name | Description | Default |
---|---|---|
includeBC,--includeBC
|
Include Bouncy Castle provider
|
false
|
jasypt-list-providers
List encryption providers with PBE Ciphers you can use with Jasypt
Name | Description | Default |
---|---|---|
includeBC,--includeBC
|
Include Bouncy Castle provider
|
false
|
jasypt-test-algorithms
Test encryption algorithms you can use with Jasypt to make sure encryption and decryption both work
Name | Description | Default |
---|
generate-full-jwt
Generate JWT and sign it using a given keystore
Name | Description | Default |
---|---|---|
jwks,--jwks
|
Path to the JWKS file used to sign the token
|
|
iss,--iss
|
Issuer
|
https://localhost:8443/cas/oidc
|
claims,--claims
|
JWT claims as JSON
|
{}
|
aud,--aud
|
Audience
|
CAS
|
exp,--exp
|
Expiration in seconds
|
300
|
sub,--sub
|
Subject
|
__NONE__
|
generate-jwt
Generate a JWT with given size and algorithm for signing and encryption.
Name | Description | Default |
---|---|---|
signingSecretSize,--signingSecretSize
|
Size of the signing secret
|
256
|
encryptionSecretSize,--encryptionSecretSize
|
Size of the encryption secret
|
48
|
signingAlgorithm,--signingAlgorithm
|
Algorithm to use for signing
|
HS256
|
encryptionAlgorithm,--encryptionAlgorithm
|
Algorithm to use for encryption
|
dir
|
encryptionMethod,--encryptionMethod
|
Method to use for encryption
|
A192CBC-HS384
|
subject,--subject
|
Subject to use for the JWT
|
__NONE__
|
generate-oidc-jwks
Generate OIDC JSON Web Keystore
Name | Description | Default |
---|---|---|
jwksFile,--jwksFile
|
Location of the JSON web keystore file.
|
/etc/cas/config/keystore.jwks
|
jwksKeyId,--jwksKeyId
|
The key identifier to set for the generated key in the keystore.
|
cas
|
jwksKeySize,--jwksKeySize
|
The key size (an algorithm-specific) for the generated jwks.
|
2048
|
jwksKeyType,--jwksKeyType
|
The type of the JWKS used to handle signing/encryption of authentication tokens.
|
RSA
|
add-properties
Add properties associated with a CAS group/module to a Properties/Yaml configuration file.
Name | Description | Default |
---|---|---|
file,--file
|
Path to the CAS configuration file
|
/etc/cas/config/cas.properties
|
group,--group
|
Group/module whose associated settings should be added to the CAS configuration file
|
__NONE__
|
convert-props
Convert CAS properties to YAML file at the same location.
Name | Description | Default |
---|---|---|
properties,--properties
|
Path to a properties file that contains CAS settings
|
/etc/cas/config/cas.properties
|
export-props
Export CAS properties and settings from configuration metadata.
Name | Description | Default |
---|---|---|
dir,--dir
|
Path to a directory where reference configuration files would be exported.
|
./etc/cas/config
|
find
Look up properties associated with a CAS group/module.
Name | Description | Default |
---|---|---|
name,--name
|
Property name regex pattern
|
.+
|
strict-match,--strict-match
|
Whether pattern should be done in strict-mode which means the matching engine tries to match the entire region for the query.
|
__NONE__
|
summary,--summary
|
Whether results should be presented in summarized mode
|
__NONE__
|
generate-idp-metadata
Generate SAML2 IdP Metadata
Name | Description | Default |
---|---|---|
metadataLocation,--metadataLocation
|
Directory location to hold metadata and relevant keys/certificates
|
/etc/cas/saml
|
entityId,--entityId
|
Entity ID to use for the generated metadata
|
cas.example.org
|
hostName,--hostName
|
CAS server prefix to be used at the IdP host name when generating metadata
|
https://cas.example.org/cas
|
scope,--scope
|
Scope to use when generating metadata
|
example.org
|
force,--force
|
Force metadata generation (XML only, not certs), overwriting anything at the specified location
|
__NONE__
|
subjectAltNames,--subjectAltNames
|
Comma separated list of other subject alternative names for the certificate (besides entityId)
|
|
generate-anonymous-user
Generate an anonymous (persistent) username identifier
Name | Description | Default |
---|---|---|
username,--username
|
Authenticated username
|
__NONE__
|
service,--service
|
Service application URL for which CAS may generate the identifier
|
__NONE__
|
salt,--salt
|
Salt used to generate and encode the anonymous identifier
|
__NONE__
|
generate-yaml
Generate a YAML registered service definition
Name | Description | Default |
---|---|---|
file,--file
|
Path to the JSON service definition file
|
__NONE__
|
destination,--destination
|
Path to the destination YAML service definition file
|
__NONE__
|
validate-service
Validate a given JSON/YAML service definition by path or directory
Name | Description | Default |
---|---|---|
file,--file
|
Path to the JSON/YAML service definition file
|
|
directory,--directory
|
Path to the JSON/YAML service definitions directory
|
|
validate-endpoint
Test connections to an endpoint to verify connectivity, SSL, etc
Name | Description | Default |
---|---|---|
url,--url
|
Endpoint URL to test
|
__NONE__
|
proxy,--proxy
|
Proxy address to use when testing the endpoint url
|
|
timeout,--timeout
|
Timeout to use in milliseconds when testing the url
|
5000
|
validate-ldap
Test connections to an LDAP server to verify connectivity, SSL, etc
Name | Description | Default |
---|---|---|
url,--url
|
LDAP URL to test, comma-separated.
|
__NONE__
|
bindDn,--bindDn
|
bindDn to use when testing the LDAP server
|
__NONE__
|
bindCredential,--bindCredential
|
bindCredential to use when testing the LDAP server
|
__NONE__
|
baseDn,--baseDn
|
baseDn to use when testing the LDAP server, searching for accounts (i.e. OU=some,DC=org,DC=edu)
|
__NONE__
|
searchFilter,--searchFilter
|
Filter to use when searching for accounts (i.e. (&(objectClass=*) (sAMAccountName=user)))
|
|
userPassword,--userPassword
|
Password for the user found in the search result, to attempt authentication
|
|
userAttributes,--userAttributes
|
User attributes, comma-separated, to fetch for the user found in the search result
|
|