Logback Logging
CAS does also support Logback as an alternative logging engine. At a high level,
the Logback architecture is similar to that of Log4j where you have Logger
, Appender
and Layout
components typically defined inside a logback.xml
file.
Refer to the Logback documentation to learn more.
Configuration
Support is enabled by including the following dependency in the WAR overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-logback</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-logback:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-logback"
}
1
2
3
4
5
6
7
8
9
10
dependencies {
/*
The following platform references should be included automatically and are listed here for reference only.
implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
*/
implementation "org.apereo.cas:cas-server-support-logback"
}
You must also make sure the following modules and dependencies are excluded from the WAR overlay:
1
2
3
4
5
6
7
8
9
10
configurations.all {
exclude(group: "org.apache.logging.log4j", module: "log4j-api")
exclude(group: "org.apache.logging.log4j", module: "log4j-jakarta-web")
exclude(group: "org.apache.logging.log4j", module: "log4j-web")
exclude(group: "org.apache.logging.log4j", module: "log4j-jcl")
exclude(group: "org.apache.logging.log4j", module: "log4j-slf4j-impl")
exclude(group: "org.apache.logging.log4j", module: "log4j-slf4j2-impl")
exclude(group: "org.apereo.cas", module: "cas-server-core-logging")
}
A sample logback.xml
file follows:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="30 seconds">
<appender name="console" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern>%white(%d{yyyy-MM-dd HH:mm:ss}) %highlight(%-5level) %cyan(%logger{15}) - %msg%n</Pattern>
</layout>
</appender>
<logger name="org.apereo.cas" level="info" additivity="false">
<appender-ref ref="console" />
</logger>
<root level="info">
<appender-ref ref="console" />
</root>
</configuration>

Sanitizing log data to remove sensitive ticket ids such as ticket-granting tickets or proxy-granting tickets is not handled by CAS when Logback is used. While this may be worked out in future releases, you should be extra careful to cleanse log data prior to sharing it with external systems such as Splunk or Syslog, etc.
The following settings and properties are available from the CAS configuration catalog:
cas.logging.cloudwatch.credential-access-key=
Use access-key provided by AWS to authenticate. This setting supports the Spring Expression Language.
CAS Property:
|
1 |
cas.logging.cloudwatch.credential-access-key=... |
cas:
logging:
cloudwatch:
credential-access-key: "..."
1
java -Dcas.logging.cloudwatch.credential-access-key="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_CREDENTIAL_ACCESS_KEY="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.credential-access-key="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.credential-secret-key=
Use secret key provided by AWS to authenticate.
This setting supports the Spring Expression Language.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.credential-secret-key

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.credential-secret-key=...
cas:
logging:
cloudwatch:
credential-secret-key: "..."
1
java -Dcas.logging.cloudwatch.credential-secret-key="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_CREDENTIAL_SECRET_KEY="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.credential-secret-key="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.endpoint=
AWS custom endpoint.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.endpoint

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.endpoint=...
cas:
logging:
cloudwatch:
endpoint: "..."
1
java -Dcas.logging.cloudwatch.endpoint="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_ENDPOINT="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.endpoint="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.log-group-name=
A log group is a container that organizes and stores log streams that share the same retention, monitoring, and access control settings. Each log group can have a unique name, and you can think of it as a logical grouping of logs that relate to a specific application, service, or environment.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.log-group-name

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.log-group-name=...
cas:
logging:
cloudwatch:
log-group-name: "..."
1
java -Dcas.logging.cloudwatch.log-group-name="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_LOG_GROUP_NAME="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.log-group-name="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.log-stream-name=
A log stream is a sequence of log events that share the same source. Each log stream belongs to a log group, and you can have multiple log streams within a single log group. Log streams are typically used to separate log data from different sources within the same application or service.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.log-stream-name

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.log-stream-name=...
cas:
logging:
cloudwatch:
log-stream-name: "..."
1
java -Dcas.logging.cloudwatch.log-stream-name="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_LOG_STREAM_NAME="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.log-stream-name="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.client-execution-timeout=10000
Client execution timeout. This settings supports the
CAS Property:
|
1 |
cas.logging.cloudwatch.client-execution-timeout=10000 |
cas:
logging:
cloudwatch:
client-execution-timeout: "10000"
1
java -Dcas.logging.cloudwatch.client-execution-timeout="10000" -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_CLIENT_EXECUTION_TIMEOUT="10000"
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.client-execution-timeout="10000"
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.connection-timeout=5000
Connection timeout.
This settings supports the
java.time.Duration
syntax [?].
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.connection-timeout

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.connection-timeout=5000
cas:
logging:
cloudwatch:
connection-timeout: "5000"
1
java -Dcas.logging.cloudwatch.connection-timeout="5000" -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_CONNECTION_TIMEOUT="5000"
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.connection-timeout="5000"
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.local-address=
Local address.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.local-address

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.local-address=...
cas:
logging:
cloudwatch:
local-address: "..."
1
java -Dcas.logging.cloudwatch.local-address="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_LOCAL_ADDRESS="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.local-address="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.max-connections=10
Maximum connections setting.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.max-connections

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.max-connections=10
cas:
logging:
cloudwatch:
max-connections: "10"
1
java -Dcas.logging.cloudwatch.max-connections="10" -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_MAX_CONNECTIONS="10"
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.max-connections="10"
cas.war
with an embedded server container and can be found in the build/libs
directory.
cas.logging.cloudwatch.profile-name=
Profile name to use.
org.apereo.cas.configuration.model.support.aws.AmazonCloudWatchLogsProperties.
CAS Property: cas.logging.cloudwatch.profile-name

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
cas.logging.cloudwatch.profile-name=...
cas:
logging:
cloudwatch:
profile-name: "..."
1
java -Dcas.logging.cloudwatch.profile-name="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export CAS_LOGGING_CLOUDWATCH_PROFILE_NAME="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --cas.logging.cloudwatch.profile-name="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
logging.charset.console=
Charset to use for console output. How can I configure this property?
CAS Property:
|
1 |
logging.charset.console=... |
logging:
charset:
console: "..."
1
java -Dlogging.charset.console="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export LOGGING_CHARSET_CONSOLE="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --logging.charset.console="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
logging.charset.file=
Charset to use for file output.
How can I configure this property?
CAS Property: logging.charset.file

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
logging.charset.file=...
logging:
charset:
file: "..."
1
java -Dlogging.charset.file="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export LOGGING_CHARSET_FILE="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --logging.charset.file="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
logging.config=
Location of the logging configuration file. For instance, `classpath:logback.xml` for Logback.
org.springframework.boot.context.logging.LoggingApplicationListener.
CAS Property: logging.config

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
logging.config=...
logging:
config: "..."
1
java -Dlogging.config="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export LOGGING_CONFIG="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --logging.config="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
logging.exception-conversion-word=%wEx
Conversion word used when logging exceptions.
org.springframework.boot.context.logging.LoggingApplicationListener.
CAS Property: logging.exception-conversion-word

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
logging.exception-conversion-word=%wEx
logging:
exception-conversion-word: "%wEx"
1
java -Dlogging.exception-conversion-word="%wEx" -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export LOGGING_EXCEPTION_CONVERSION_WORD="%wEx"
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --logging.exception-conversion-word="%wEx"
cas.war
with an embedded server container and can be found in the build/libs
directory.
logging.file.clean-history-on-start=false
Whether to clean the archive log files on startup. Only supported with the default logback setup.
org.springframework.boot.context.logging.LoggingApplicationListener.
CAS Property: logging.file.clean-history-on-start

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
.properties
files:
1
logging.file.clean-history-on-start=...
logging:
file:
clean-history-on-start: "..."
1
java -Dlogging.file.clean-history-on-start="..." -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory. Note the placement of the system property which must be
specified before the CAS web application is launched.
1
2
3
export LOGGING_FILE_CLEAN_HISTORY_ON_START="..."
java -jar build/libs/cas.war
cas.war
with an embedded server container and can be found in the build/libs
directory.
1
java -jar build/libs/cas.war --logging.file.clean-history-on-start="..."
cas.war
with an embedded server container and can be found in the build/libs
directory.
Deprecation status is WARNING
with a replacement setting: logging.logback.rollingpolicy.clean-history-on-start
.
Configuration Metadata
The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.
Be Selective
This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.
YAGNI
Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.
Naming Convention
Property names can be specified in very relaxed terms. For instance cas.someProperty
, cas.some-property
, cas.some_property
are all valid names. While all
forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where
this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those
that might be presented to the system via an external library or framework such as Spring Boot, etc.

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value
.
The only possible exception to this rule is when naming actuator endpoints; The name of the
actuator endpoints (i.e. ssoSessions
) MUST remain in camelCase mode.
Settings and properties that are controlled by the CAS platform directly always begin with the prefix cas
. All other settings are controlled and provided
to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with
the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition
or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the
way you intend.
Validation
Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.
Indexed Settings
CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value
. The index [0]
is meant to be
incremented by the adopter to allow for distinct multiple configuration blocks.