APEREO CASDocumentation

Enterprise Authentication for All Earthlings and Beyond

Identity, Single Sign-On and Access Management
View on GitHub

Encode Database Authentication

A JDBC querying handler that will pull back the password and the private salt value for a user to validate the encoded password using the public salt value. Assumes everything is inside the same database table. Supports settings for number of iterations as well as private salt.

This password encoding method combines the private Salt and the public salt which it prepends to the password before hashing. If multiple iterations are used, the bytecode hash of the first iteration is rehashed without the salt values. The final hash is converted to hex before comparing it to the database value.

The following settings and properties are available from the CAS configuration catalog:

cas.authn.jdbc.encode[0].driver-classThe JDBC driver used to connect to the database.
no default
Required

The JDBC driver used to connect to the database.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].passwordThe database connection password.
no default
Required

The database connection password.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].password-encoder.encoding-algorithmThe encoding algorithm to use such as MD5 .
no default
Required

The encoding algorithm to use such as MD5. Relevant when the type used is DEFAULT or GLIBC_CRYPT. When used with PasswordEncoderTypes#PBKDF2, it should be one of PBKDF2WithHmacSHA1, PBKDF2WithHmacSHA256 or PBKDF2WithHmacSHA512.

Type
String
Default
none
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-encoder.typeDefine the password encoder type to use.
NONE
Required

Define the password encoder type to use. Type may be specified as blank or NONE to disable password encoding. It may also refer to a fully-qualified class name that implements the Spring Security's PasswordEncoder interface if you wish you define your own encoder.

The following types may be used:
  • NONE: No password encoding (i.e. plain-text) takes place.
  • DEFAULT: Use the DefaultPasswordEncoder of CAS. For message-digest algorithms via character-encoding and encoding-algorithm.
  • BCRYPT: Use the BCryptPasswordEncoder based on the strength provided and an optional secret.
  • SCRYPT: Use the SCryptPasswordEncoder.
  • PBKDF2: Use the Pbkdf2PasswordEncoder based on the strength provided and an optional secret.
  • STANDARD: Use the StandardPasswordEncoder based on the secret provided.
  • SSHA: Use the LdapShaPasswordEncoder supports Ldap SHA and SSHA (salted-SHA). The values are base-64 encoded and have the label {SHA} or {SSHA} prepended to the encoded hash.
  • GLIBC_CRYPT: Use the GlibcCryptPasswordEncoder based on the encoding-algorithm, strength provided and an optional secret.
  • org.example.MyEncoder: An implementation of PasswordEncoder of your own choosing.
  • file:///path/to/script.groovy: Path to a Groovy script charged with handling password encoding operations.
Type
String
Default
NONE
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].principal-transformation.groovy.locationTransform usernames using a Groovy resource.
no default
Required

Transform usernames using a Groovy resource. The location of the resource. Resources can be URLs, or files found either on the classpath or outside somewhere in the file system.

In the event the configured resource is a Groovy script, especially if the script is set to reload on changes, you may need to adjust the total number of inotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf: fs.inotify.max_user_instances = 256.

You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

In situations and scenarios where CAS is able to automatically watch the underlying resource for changes and detect updates and modifications dynamically, you may be able to specify the following setting as either an environment variable or system property with a value of false to disable the resource watcher: org.apereo.cas.util.io.PathWatcherService.

Type
Resource
Default
none
Defined by
SpringResourceProperties
cas.authn.jdbc.encode[0].salt-field-nameField/column name that indicates the salt used for password hashing.
salt
Required

Field/column name that indicates the salt used for password hashing.

Type
String
Default
salt
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].sqlSQL query to execute and look up accounts.
no default
Required

SQL query to execute and look up accounts. Example: SELECT * FROM table WHERE username=?.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].urlThe database connection URL.
no default
RequiredSpEL

The database connection URL.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
Supports
Spring Expression Language
cas.authn.jdbc.encode[0].userThe database user.
no default
Required

The database user.

The database user must have sufficient permissions to be able to handle schema changes and updates, when needed.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encodeSettings related to query-encode-mode jdbc authentication.
no default

Settings related to query-encode-mode jdbc authentication. A JDBC querying handler that will pull back the password and the private salt value for a user and validate the encoded password using the public salt value. Assumes everything is inside the same database table. Supports settings for number of iterations as well as private salt. This password encoding method combines the private Salt and the public salt which it prepends to the password before hashing. If multiple iterations are used, the byte code hash of the first iteration is rehashed without the salt values. The final hash is converted to hex before comparing it to the database value.

Type
List<QueryEncodeJdbcAuthenticationProperties>
Default
none
Defined by
JdbcAuthenticationProperties
cas.authn.jdbc.encode[0].algorithm-nameAlgorithm used for hashing.
no default

Algorithm used for hashing.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].autocommitThe default auto-commit behavior of connections in the pool.
no default

The default auto-commit behavior of connections in the pool. Determined whether queries such as update/insert should be immediately executed without waiting for an underlying transaction.

Type
boolean
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].batch-sizeA non-zero value enables use of JDBC2 batch updates by Hibernate. e.g. recommended values between 5 and 30.
no default

A non-zero value enables use of JDBC2 batch updates by Hibernate. e.g. recommended values between 5 and 30.

Type
int
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].connection-timeoutIndicates the maximum number of milliseconds that the service can wait to obtain a connection.
no default
Duration

Indicates the maximum number of milliseconds that the service can wait to obtain a connection.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].credential-criteriaA number of authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase.
no default
Regex
A number of authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase. The credential criteria may be one of the following options:
  • 1) A regular expression pattern that is tested against the credential identifier.
  • 2) A fully qualified class name of your own design that implements Predicate.
  • 3) Path to an external Groovy script that implements the same interface.
Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].data-source-nameAttempts to do a JNDI data source look up for the data source name specified.
no default

Attempts to do a JNDI data source look up for the data source name specified. Will attempt to locate the data source object as is.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].ddl-autoHibernate feature to automatically validate and exports DDL to the schema.
no default
Hibernate feature to automatically validate and exports DDL to the schema. By default, creates and drops the schema automatically when a session is starts and ends. Setting the value to validate or none may be more desirable for production, but any of the following options can be used:
  • validate: Validate the schema, but make no changes to the database.
  • update: Update the schema.
  • create: Create the schema, destroying previous data.
  • create-drop: Drop the schema at the end of the session.
  • none: Do nothing.

Note that during a version migration where any schema has changed create-drop will result in the loss of all data as soon as CAS is started. For transient data like tickets this is probably not an issue, but in cases like the audit table important data could be lost. Using `update`, while safe for data, is confirmed to result in invalid database state. validate or none settings are likely the only safe options for production use.

For more info, see this.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].default-catalogQualifies unqualified table names with the given catalog in generated SQL.
no default

Qualifies unqualified table names with the given catalog in generated SQL.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].default-schemaQualify unqualified table names with the given schema/tablespace in generated SQL.
no default

Qualify unqualified table names with the given schema/tablespace in generated SQL.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].dialectThe database dialect is a configuration setting for platform independent software (JPA, Hibernate, etc) which allows such software to translate its generic SQL statements into vendor specific DDL, DML.
no default

The database dialect is a configuration setting for platform independent software (JPA, Hibernate, etc) which allows such software to translate its generic SQL statements into vendor specific DDL, DML.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].disabled-field-nameColumn name that indicates whether account is disabled.
no default

Column name that indicates whether account is disabled.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].expired-field-nameColumn name that indicates whether account is expired.
no default

Column name that indicates whether account is expired.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].fail-fast-timeoutSet the pool initialization failure timeout.
no default
Set the pool initialization failure timeout.
  • Any value greater than zero will be treated as a timeout for pool initialization. The calling thread will be blocked from continuing until a successful connection to the database, or until the timeout is reached. If the timeout is reached, then a PoolInitializationException will be thrown.
  • A value of zero will not prevent the pool from starting in the case that a connection cannot be obtained. However, upon start the pool will attempt to obtain a connection and validate that the connectionTestQuery and connectionInitSql are valid. If those validations fail, an exception will be thrown. If a connection cannot be obtained, the validation is skipped and the pool will start and continue to try to obtain connections in the background. This can mean that callers to DataSource#getConnection() may encounter exceptions.
  • A value less than zero will not bypass any connection attempt and validation during startup, and therefore the pool will start immediately. The pool will continue to try to obtain connections in the background. This can mean that callers to DataSource#getConnection() may encounter exceptions.
Note that if this timeout value is greater than or equal to zero (0), and therefore an initial connection validation is performed, this timeout does not override the connectionTimeout or validationTimeout; they will be honored before this timeout is applied. The default value is one millisecond.
Type
long
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].fetch-sizeUsed to specify number of rows to be fetched in a select query.
no default

Used to specify number of rows to be fetched in a select query.

Type
int
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].generate-statisticsAllow hibernate to generate query statistics.
no default

Allow hibernate to generate query statistics.

Type
boolean
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].health-queryThe SQL query to be executed to test the validity of connections.
no default

The SQL query to be executed to test the validity of connections. This is for "legacy" databases that do not support the JDBC4 Connection.isValid() API.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].idle-timeoutControls the maximum amount of time that a connection is allowed to sit idle in the pool.
no default
Duration

Controls the maximum amount of time that a connection is allowed to sit idle in the pool.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].isolate-internal-queriesThis property determines whether data source isolates internal pool queries, such as the connection alive test, in their own transaction.
no default

This property determines whether data source isolates internal pool queries, such as the connection alive test, in their own transaction.

Since these are typically read-only queries, it is rarely necessary to encapsulate them in their own transaction. This property only applies if #autocommit is disabled.

Type
boolean
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].isolation-level-nameDefines the isolation level for transactions.
no default

Defines the isolation level for transactions.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].leak-thresholdControls the amount of time that a connection can be out of the pool before a message is logged indicating a possible connection leak.
no default
Duration

Controls the amount of time that a connection can be out of the pool before a message is logged indicating a possible connection leak.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].nameName of the authentication handler.
no default

Name of the authentication handler.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].number-of-iterationsDefault number of iterations for hashing.
no default

Default number of iterations for hashing.

Type
int
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].number-of-iterations-field-nameField/column name that indicates the number of iterations used for password hashing.
numIterations

Field/column name that indicates the number of iterations used for password hashing.

Type
String
Default
numIterations
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].orderOrder of the authentication handler in the chain.
no default

Order of the authentication handler in the chain.

Type
int
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].password-encoder.character-encodingThe encoding algorithm to use such as 'UTF-8'.
UTF-8

The encoding algorithm to use such as 'UTF-8'. Relevant when the type used is DEFAULT.

Type
String
Default
UTF-8
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-encoder.hash-lengthWhen used by PasswordEncoderTypes#ARGON2 , it indicates the hash strength/length.
16

When used by PasswordEncoderTypes#ARGON2, it indicates the hash strength/length.

Type
int
Default
16
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-encoder.iterationsWhen used by PasswordEncoderTypes#PBKDF2 , it indicates the required number of iterations.
310000

When used by PasswordEncoderTypes#PBKDF2, it indicates the required number of iterations.

Type
int
Default
310000
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-encoder.secretSecret to use with PasswordEncoderTypes#STANDARD , PasswordEncoderTypes#PBKDF2 , PasswordEncoderTypes#BCRYPT , PasswordEncoderTypes#GLIBC_CRYPT password encoders.
no default

Secret to use with PasswordEncoderTypes#STANDARD, PasswordEncoderTypes#PBKDF2, PasswordEncoderTypes#BCRYPT, PasswordEncoderTypes#GLIBC_CRYPT password encoders. Secret usually is an optional setting.

Type
String
Default
none
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-encoder.strengthStrength or number of iterations to use for password hashing.
16

Strength or number of iterations to use for password hashing. Usually relevant when dealing with PasswordEncoderTypes#BCRYPT, PasswordEncoderTypes#PBKDF2 or PasswordEncoderTypes#GLIBC_CRYPT. When used by PasswordEncoderTypes#ARGON2 or PasswordEncoderTypes#PBKDF2, it indicates the salt strength.

Type
int
Default
16
Defined by
PasswordEncoderProperties
cas.authn.jdbc.encode[0].password-field-namePassword column name.
password

Password column name.

Type
String
Default
password
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].physical-naming-strategy-class-nameFully-qualified name of the class that can control the physical naming strategy of hibernate.
no default

Fully-qualified name of the class that can control the physical naming strategy of hibernate.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].pool.keep-alive-timeThis property controls the keepalive interval for a connection in the pool.
0
Duration

This property controls the keepalive interval for a connection in the pool. An in-use connection will never be tested by the keepalive thread, only when it is idle will it be tested. Default is zero, which disables this feature.

Type
String
Default
0
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.max-sizeControls the maximum number of connections to keep in the pool, including both idle and in-use connections.
18

Controls the maximum number of connections to keep in the pool, including both idle and in-use connections.

Type
int
Default
18
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.max-waitSets the maximum time in seconds that this data source will wait while attempting to connect to a database.
PT2S
Duration

Sets the maximum time in seconds that this data source will wait while attempting to connect to a database.

A value of zero specifies that the timeout is the default system timeout if there is one; otherwise, it specifies that there is no timeout.

Type
String
Default
PT2S
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.maximum-lifetimeThis property controls the maximum lifetime of a connection in the pool.
PT10M
Duration

This property controls the maximum lifetime of a connection in the pool. When a connection reaches this timeout, even if recently used, it will be retired from the pool. An in-use connection will never be retired, only when it is idle will it be removed.

Type
String
Default
PT10M
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.min-sizeControls the minimum size that the pool is allowed to reach, including both idle and in-use connections.
6

Controls the minimum size that the pool is allowed to reach, including both idle and in-use connections.

Type
int
Default
6
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.nameSet the name of the connection pool.
no default

Set the name of the connection pool. This is primarily used for the MBean to uniquely identify the pool configuration.

Type
String
Default
none
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.suspensionWhether or not pool suspension is allowed.
no default

Whether or not pool suspension is allowed.

There is a performance impact when pool suspension is enabled. Unless you need it (for a redundancy system for example) do not enable it.

Type
boolean
Default
none
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].pool.timeout-millisThe maximum number of milliseconds that the pool will wait for a connection to be validated as alive.
1000

The maximum number of milliseconds that the pool will wait for a connection to be validated as alive.

Type
long
Default
1000
Defined by
ConnectionPoolingProperties
cas.authn.jdbc.encode[0].principal-attribute-listList of column names to fetch as user attributes.
no default

List of column names to fetch as user attributes. This is only effective in scenarios where the JDBC authentication method is able to execute a SQL query against a database table and return results. Authentication methods that merely check for the user account's existence or verify the user with just a simple bind are not able to fetch attributes.

Attributes name are separated by a comma and may use a "directed list" syntax where the allowed syntax would be column-name->cas-attribute.

Type
List<String>
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].principal-transformation.blocking-patternA regular expression that will be used against the username to match for blocking/forbidden values.
no default
SpEL

A regular expression that will be used against the username to match for blocking/forbidden values. If a match is found, an exception will be thrown and principal transformation will fail.

Type
String
Default
none
Defined by
PrincipalTransformationProperties
Supports
Spring Expression Language
cas.authn.jdbc.encode[0].principal-transformation.case-conversionIndicate whether the principal identifier should be transformed into upper-case, lower-case, etc.
NONE
Indicate whether the principal identifier should be transformed into upper-case, lower-case, etc. Available values are as follows:
  • NONE: No conversion.
  • LOWERCASE: Lowercase conversion.
  • UPPERCASE: Uppercase conversion.
Type
PrincipalTransformationProperties.CaseConversion
Default
NONE
Defined by
PrincipalTransformationProperties
cas.authn.jdbc.encode[0].principal-transformation.patternA regular expression that will be used against the provided username for username extractions.
no default
SpEL

A regular expression that will be used against the provided username for username extractions. On a successful match, the first matched group in the pattern will be used as the extracted username.

Type
String
Default
none
Defined by
PrincipalTransformationProperties
Supports
Spring Expression Language
cas.authn.jdbc.encode[0].principal-transformation.prefixPrefix to add to the principal id prior to authentication.
no default
SpEL

Prefix to add to the principal id prior to authentication.

Type
String
Default
none
Defined by
PrincipalTransformationProperties
Supports
Spring Expression Language
cas.authn.jdbc.encode[0].principal-transformation.suffixSuffix to add to the principal id prior to authentication.
no default
SpEL

Suffix to add to the principal id prior to authentication.

Type
String
Default
none
Defined by
PrincipalTransformationProperties
Supports
Spring Expression Language
cas.authn.jdbc.encode[0].propagation-behavior-nameDefines the propagation behavior for transactions.
no default

Defines the propagation behavior for transactions.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].propertiesAdditional settings provided by Hibernate (or the connection provider) in form of key-value pairs.
no default

Additional settings provided by Hibernate (or the connection provider) in form of key-value pairs.

Type
Map<String,String>
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].read-onlyConfigures the Connections to be added to the pool as read-only Connections.
no default

Configures the Connections to be added to the pool as read-only Connections.

Type
boolean
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].stateDefine the scope and state of this authentication handler and the lifecycle in which it can be invoked or activated.
no default
Define the scope and state of this authentication handler and the lifecycle in which it can be invoked or activated. Available values are as follows:
  • ACTIVE: Active authentication handler, and is invoked by default automatically to verify credentials globally.
  • STANDBY: Authentication handler is in a semi-enabled state, waiting to be called only on-demand when explicitly asked for.
Type
AuthenticationHandlerStates
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties
cas.authn.jdbc.encode[0].static-saltStatic salt to be used for hashing.
no default

Static salt to be used for hashing.

Type
String
Default
none
Defined by
QueryEncodeJdbcAuthenticationProperties

Required settings may be needed to activate or affect the feature; review them even when they have a default. Optional settings only need to be set to change a default or to turn on the behavior they control. Third party settings belong to libraries such as Spring Boot that CAS builds on; their own documentation may have more detail.

Hibernate & JDBC

Control global properties that are relevant to Hibernate, when CAS attempts to employ and utilize database resources, connections and queries.

cas.jdbc.gen-ddlWhether to generate DDL after the EntityManagerFactory has been initialized creating/updating all relevant tables.
true

Whether to generate DDL after the EntityManagerFactory has been initialized creating/updating all relevant tables.

Type
Boolean
Default
true
Defined by
DatabaseProperties
cas.jdbc.physical-table-namesIndicate a physical table name to be used by the hibernate naming strategy in case table names need to be customized for the specific type of database.
no default

Indicate a physical table name to be used by the hibernate naming strategy in case table names need to be customized for the specific type of database. The key here indicates the CAS-provided table name and the value is the translate physical name for the database. If a match is not found for the CAS-provided table name, then that name will be used by default.

Type
Map<String,String>
Default
none
Defined by
DatabaseProperties
cas.jdbc.show-sqlWhether SQL queries should be displayed in the console/logs.
false

Whether SQL queries should be displayed in the console/logs.

Type
Boolean
Default
false
Defined by
DatabaseProperties
Groovy scripting

CAS takes advantage of Apache Groovy in forms of either embedded or external scripts that allow one to, by default, dynamically build constructs, attributes, access strategies and a lot more. To activate the functionality described here, you may need to prepare CAS to support and integrate with Apache Groovy.

Please review this guide to configure your build.

Authentication

Certain authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase. The credential criteria may be one of the following options:

  • A regular expression pattern that is tested against the credential identifier.
  • A fully qualified class name of your own design that looks similar to the below example:


1
2
3
4
5
6
7
8
9



import java.util.function.Predicate;
import org.apereo.cas.authentication.Credential;

public class PredicateExample implements Predicate<Credential> {
    @Override
    public boolean test(final Credential credential) {
        // Examine the credential and return true/false
    }
}
  • Path to an external Groovy script that looks similar to the below example:


1
2
3
4
5
6
7
8
9



import org.apereo.cas.authentication.Credential
import java.util.function.Predicate

class PredicateExample implements Predicate<Credential> {
    @Override
    boolean test(final Credential credential) {
        // test and return result
    }
}

To prepare CAS to support and integrate with Apache Groovy, please review this guide.

Password encoding

If you need to design your own password encoding scheme where the type is specified as a fully qualified Java class name, the structure of the class would be similar to the following:



1
2
3
4
5
6
7
8
9
10
11



package org.example.cas;

import org.springframework.security.crypto.codec.*;
import org.springframework.security.crypto.password.*;

public class MyEncoder extends AbstractPasswordEncoder {
    @Override
    protected byte[] encode(CharSequence rawPassword, byte[] salt) {
        return ...
    }
}

If you need to design your own password encoding scheme where the type is specified as a path to a Groovy script, the structure of the script would be similar to the following:



1
2
3
4
5
6
7
8
9
10
11
12



import java.util.*

byte[] run(final Object... args) {
    def (rawPassword,generatedSalt,logger,applicationContext) = args
    logger.debug("Encoding password...")
    return ...
}

Boolean matches(final Object... args) {
    def (rawPassword,encodedPassword,logger,applicationContext) = args
    logger.debug("Does match or not ?");
    return ...

To prepare CAS to support and integrate with Apache Groovy, please review this guide.

Principal transformation

Authentication handlers that generally deal with username-password credentials can be configured to transform the user id prior to executing the authentication sequence. Each authentication strategy in CAS provides settings to properly transform the principal. Refer to the relevant settings for the authentication strategy at hand to learn more.

Authentication handlers as part of principal transformation may also be provided a path to a Groovy script to transform the provided username. The outline of the script may take on the following form:



1
2
3
4



String run(final Object... args) {
    def (providedUsername,logger) = args
    return providedUsername.concat("SomethingElse")
}

To prepare CAS to support and integrate with Apache Groovy, please review this guide.

Notes on configuration

Configuration Metadata

The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.

Be Selective

This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.

YAGNI

Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.

Naming Convention

Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc.

:information_source: Note

When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value. The only possible exception to this rule is when naming actuator endpoints; The name of the actuator endpoints (i.e. ssoSessions) MUST remain in camelCase mode.

Settings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.

Validation

Configuration properties are automatically validated on CAS startup to report issues with configuration binding, especially if defined CAS settings cannot be recognized or validated by the configuration schema. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.

Indexed Settings

CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.

Multitenancy

Configuration settings for database authentication can be specified in a multitenant environment. Please review this guide for more information.