Command-line Shell

The CAS command-line shell provides the ability to query the CAS server for help on available settings/modules and various other utility functions.

To invoke and work with the utility, execute:



1



java -jar /path/to/cas-server-support-shell-$casVersion.jar

…where $casVersion needless to say is the CAS version that is deployed.

The interface that is next presented will guide you through with available parameters and methods of querying. You will learn how to launch into the interactive shell and query the CAS engine dynamically.

:information_source: JCE Requirement

Make sure you have the proper JCE bundle installed in your Java environment that is used by CAS, specially if you need to use specific signing/encryption algorithms and methods. Be sure to pick the right version of the JCE for your Java version. Java versions can be detected via the java -version command.

Note that the WAR Overlay deployment strategy should already be equipped with this functionality. You should not have to do anything special and extra to interact with the shell. See the relevant overlay documentation for more info on how to invoke and work with the shell.

Shell Commands

The following commands are available and exposed by the CAS command-line shell.

cipher-text,encode-text

Sign and encrypt text data using keys

Name Description Default
value Value to put through the cipher
secretKeyEncryption Encryption key
encryptionAlg Encryption alg A256CBC-HS512
secretKeySigning Signing key
secretKeyEncryptionSize Encryption key size 512
secretKeySigningSize Signing key size 512
encryptionEnabled Whether value should be encrypted true
signingEnabled Whether value should be signed true

generate-key

Generate signing/encryption crypto keys for CAS settings

Name Description Default
keySize Key size 256

decipher-text,decode-text

Decrypt and verify text data using keys

Name Description Default
value Value to put through the cipher
secretKeyEncryption Encryption key
encryptionAlg Encryption alg A256CBC-HS512
secretKeySigning Signing key
secretKeyEncryptionSize Encryption key size 512
secretKeySigningSize Signing key size 512
encryptionEnabled Whether value should be encrypted true
signingEnabled Whether value should be signed true

generate-ddl

Generate database DDL scripts

Name Description Default
file DDL file to contain to generated script /etc/cas/config/cas-db-schema.sql
dialect Database dialect class HSQL
jdbcUrl JDBC database connection URL jdbc:hsqldb:mem:cas
delimiter Delimiter to use for separation of statements when generating SQL ;
pretty Format DDL scripts and pretty-print the output false
dropSchema Generate DROP SQL statements in the DDL false
createSchema Generate DROP SQL statements in the DDL false
haltOnError Halt if an error occurs during the generation process false

decrypt-value

Decrypt a CAS property value/setting via Jasypt

Name Description Default
value Value to decrypt
alg Algorithm to use to decrypt
provider Security provider to use to decrypt
password Password (encryption key) to decrypt
initVector Use initialization vector to encrypt false
iterations Key obtention iterations to decrypt, default 1000

encrypt-value

Encrypt a CAS property value/setting via Jasypt

Name Description Default
value Value to encrypt
file File to encrypt
alg Algorithm to use to encrypt
provider Security provider to use to encrypt
password Password (encryption key) to encrypt
initVector Use initialization vector to encrypt false
iterations Key obtention iterations to encrypt, default 1000

jasypt-list-algorithms

List algorithms you can use with Jasypt for property encryption

Name Description Default
includeBC Include Bouncy Castle provider false

jasypt-list-providers

List encryption providers with PBE Ciphers you can use with Jasypt

Name Description Default
includeBC Include Bouncy Castle provider false

jasypt-test-algorithms

Test encryption algorithms you can use with Jasypt to make sure encryption and decryption both work

Name Description Default

generate-full-jwt

Generate JWT and sign it using a given keystore

Name Description Default
jwks Path to the JWKS file used to sign the token
iss Issuer https://localhost:8443/cas/oidc
claims JWT claims as JSON {}
aud Audience CAS
exp Expiration in seconds 300
sub Subject

generate-jwt

Generate a JWT with given size and algorithm for signing and encryption.

Name Description Default
signingSecretSize Size of the signing secret 256
encryptionSecretSize Size of the encryption secret 48
signingAlgorithm Algorithm to use for signing HS256
encryptionAlgorithm Algorithm to use for encryption dir
encryptionMethod Method to use for encryption A192CBC-HS384
subject Subject to use for the JWT

generate-oidc-jwks

Generate OIDC JSON Web Keystore

Name Description Default
jwksFile Location of the JSON web keystore file. /etc/cas/config/keystore.jwks
jwksKeyId The key identifier to set for the generated key in the keystore. cas
jwksKeySize The key size (an algorithm-specific) for the generated jwks. 2048
jwksKeyType The type of the JWKS used to handle signing/encryption of authentication tokens. RSA

add-properties

Add properties associated with a CAS group/module to a Properties/Yaml configuration file.

Name Description Default
file Path to the CAS configuration file /etc/cas/config/cas.properties
group Group/module whose associated settings should be added to the CAS configuration file

convert-props

Convert CAS properties to YAML file at the same location.

Name Description Default
properties Path to a properties file that contains CAS settings /etc/cas/config/cas.properties

export-props

Export CAS properties and settings from configuration metadata.

Name Description Default
dir Path to a directory where reference configuration files would be exported. ./etc/cas/config

find

Look up properties associated with a CAS group/module.

Name Description Default
name Property name regex pattern .+
strict Whether pattern should be done in strict-mode which means the matching engine tries to match the entire region for the query. false
summary Whether results should be presented in summarized mode false

generate-idp-metadata

Generate SAML2 IdP Metadata

Name Description Default
metadataLocation Directory location to hold metadata and relevant keys/certificates /etc/cas/saml
entityId Entity ID to use for the generated metadata cas.example.org
serverPrefix CAS server prefix to be used at the IdP host name when generating metadata https://cas.example.org/cas
scope Scope to use when generating metadata example.org
force Force metadata generation (XML only, not certs), overwriting anything at the specified location
subjectAltNames Comma separated list of other subject alternative names for the certificate (besides entityId)

generate-anonymous-user

Generate an anonymous (persistent) username identifier

Name Description Default
username Authenticated username
service Service application URL for which CAS may generate the identifier
salt Salt used to generate and encode the anonymous identifier

generate-yaml

Generate a YAML registered service definition

Name Description Default
file Path to the JSON service definition file
destination Path to the destination YAML service definition file

validate-service

Validate a given JSON/YAML service definition by path or directory

Name Description Default
file Path to the JSON/YAML service definition file
directory Path to the JSON/YAML service definitions directory

validate-endpoint

Test connections to an endpoint to verify connectivity, SSL, etc

Name Description Default
url Endpoint URL to test
proxy Proxy address to use when testing the endpoint url
timeout Timeout to use in milliseconds when testing the url 5000

validate-ldap

Test connections to an LDAP server to verify connectivity, SSL, etc

Name Description Default
url LDAP URL to test, comma-separated.
bindDn bindDn to use when testing the LDAP server
bindCredential bindCredential to use when testing the LDAP server
baseDn baseDn to use when testing the LDAP server, searching for accounts (i.e. OU=some,DC=org,DC=edu)
searchFilter Filter to use when searching for accounts (i.e. (&(objectClass=*) (sAMAccountName=user)))
userPassword Password for the user found in the search result, to attempt authentication
userAttributes User attributes, comma-separated, to fetch for the user found in the search result