Skip to end of metadata
Go to start of metadata
Table of Contents

New CAS documentation site

Icon

CAS documentation has moved over to apereo.github.io/cas, starting with CAS version 4.x. The wiki will no longer be maintained. For the most recent version of the documentation, please refer to the aforementioned link.

Trusted Authentication Handler

Including the Handler

In the pom.xml file for your CAS Maven2 WAR Overlay, add the following dependency:

Set Up CAS

Set up the login webflow

The CAS 3 Login Webflow needs to be modified. This webflow is located in /WEB-INF/login-webflow.xml. There is one new action state to place before the state viewLoginForm.

In 3.4.2 and later, change <action bean="principalFromRemoteAction" /> to <evaluate expression="principalFromRemoteAction" />.

And 3 existing transitions need to be update:

  • In the decision-state gatewayRequestCheck, replace reference to viewLoginForm by remoteAuthenticate
  • In the decision-state renewRequestCheck, replace reference to viewLoginForm by remoteAuthenticate
  • In the action-state generateServiceTicket, replace reference to viewLoginForm by remoteAuthenticate

In 3.4.12 (before?) ignore the above 3 transition declarations. Update the "generateLoginTicket" action-state to have the following transition.

<transition on="generated" to="remoteAuthenticate" />

/WEB-INF/cas-servlet.xml

Add the bean needed for the login flow :

/WEB-INF/deployerConfigContext.xml

In the bean authenticationManager, add:

  • org.jasig.cas.adaptors.trusted.authentication.principal.PrincipalBearingCredentialsToPrincipalResolver as credentialsToPrincipalResolvers
  • org.jasig.cas.adaptors.trusted.authentication.handler.support.PrincipalBearingCredentialsAuthenticationHandler as authenticationHandlers

Build the cas-webapp

Inside the ${project.home}/cas-server-webapp/ folder, run the command :

mvn package

You may now deploy the new webapp.

Tomcat & Apache integration issue

If you are using, a frontal Apache with mod_jk and Apache is handling the REMOTE_USER, you have to check the AJP connector in your Tomcat server.xml file. You should add the parameter tomcatAuthentication to false

  • No labels