Customized MFA bypass in CAS 5.1.x

183 views
Skip to first unread message

Adam Causey

unread,
Oct 19, 2017, 11:52:46 AM10/19/17
to cas-...@apereo.org
Is there a way to add our own custom bypass logic to CAS 5.1.x? Specifically I would like to make a call to a RESTful API that returns a boolean value that says whether the user can bypass or not.

Thanks,
Adam

Misagh Moayyed

unread,
Oct 19, 2017, 12:46:06 PM10/19/17
to cas-...@apereo.org
Not unless you write your own trigger. One other option would be to make the REST call and populate the principal with an attribute that says "bypass=true". Then let the bypass logic use that attribute. Likely more performant. 

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAN6MV5ON1ibwsupJjYCJ2cnF3MA4OXnzoqH%2B29pwiP8OLY%2BX2Q%40mail.gmail.com.

--
--Misagh

Adam Causey

unread,
Oct 19, 2017, 12:59:31 PM10/19/17
to cas-...@apereo.org
How and where would I populate the Principal? Are there any examples you could provide.

Thanks,
Adam

On Thu, Oct 19, 2017 at 12:46 PM, Misagh Moayyed <mmoa...@unicon.net> wrote:
Not unless you write your own trigger. One other option would be to make the REST call and populate the principal with an attribute that says "bypass=true". Then let the bypass logic use that attribute. Likely more performant. 

From: "Adam Causey" <apca...@vcu.edu>
To: cas-...@apereo.org
Sent: Thursday, October 19, 2017 8:52:20 AM
Subject: [cas-user] Customized MFA bypass in CAS 5.1.x
Is there a way to add our own custom bypass logic to CAS 5.1.x? Specifically I would like to make a call to a RESTful API that returns a boolean value that says whether the user can bypass or not.

Thanks,
Adam

 --
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1598432640.5707319.1508431562461.JavaMail.zimbra%40unicon.net.

Misagh Moayyed

unread,
Oct 19, 2017, 1:14:15 PM10/19/17
to cas-...@apereo.org
Sorry; too many versions to keep track of. I was of thinking of 5.2 where you can hit a rest endpoint and have it return attributes for you. No such thing in 5.1. My bad. Alternatively, you write a groovy script that would do the same.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAN6MV5MpDqd-j04ykxuJ5Ae3iWz%2Bs53BLD0Wvd_ZWPAFvb1Bng%40mail.gmail.com.

--
--Misagh

Adam Causey

unread,
Dec 5, 2017, 3:40:21 PM12/5/17
to cas-...@apereo.org
Is there a way to not cache the attributes that are retrieved via a Groovy script?  I noticed they are cached, and I need the bypass check to occur on every login, including the SSO logins.

Thanks,
Adam

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
 To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1396343839.5711719.1508433250798.JavaMail.zimbra%40unicon.net.

Misagh Moayyed

unread,
Dec 5, 2017, 8:13:58 PM12/5/17
to cas-...@apereo.org
Caching can be controlled but it’s today based on a per-app basis:

Also, it might better to review this page for options that handle bypass more dynamically:

…which should get invoked every time.

--Misagh
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAN6MV5NpVr1XrsJ7LUBsBEeGXy3k1RHXqoEXXbkKuMEfjFCqyg%40mail.gmail.com.

Adam Causey

unread,
Dec 7, 2017, 10:43:28 AM12/7/17
to cas-...@apereo.org
Misagh,

Do you have any other examples of the custom triggers? I have written a custom trigger but am getting a NullPointerException as follows:

2017-12-07 10:36:53,826 [https-jsse-nio-8444-exec-1] WARN  org.apereo.cas.web.flow.resolver.impl.InitialAuthenticationAttemptWebflowEventResolver - null

java.lang.NullPointerException: null

at edu.vcu.cas.duo.web.CustomWebFlowEventResolver.resolveInternal(CustomWebFlowEventResolver.java:53) ~[classes!/:5.1.4]

at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolve(AbstractCasWebflowEventResolver.java:475) ~[cas-server-core-webflow-5.1.4.jar!/:5.1.4]

at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolveSingle(AbstractCasWebflowEventResolver.java:480) ~[cas-server-core-webflow-5.1.4.jar!/:5.1.4]

...


This is the configuration class


@Configuration("customWebFlowEventResolverConfiguration")

@EnableConfigurationProperties(CasConfigurationProperties.class)

public class CustomWebFlowEventResolverConfiguration {


@Autowired

@Qualifier("initialAuthenticationAttemptWebflowEventResolver")

private CasDelegatingWebflowEventResolver initialEventResolver;


@Autowired

@Qualifier("centralAuthenticationService")

private CentralAuthenticationService centralAuthenticationService;


@Autowired

@Qualifier("defaultAuthenticationSystemSupport")

private AuthenticationSystemSupport authenticationSystemSupport;


@Autowired

@Qualifier("defaultTicketRegistrySupport")

private TicketRegistrySupport ticketRegistrySupport;


@Autowired

@Qualifier("servicesManager")

private ServicesManager servicesManager;


@Autowired(required = false)

@Qualifier("multifactorAuthenticationProviderSelector")

private MultifactorAuthenticationProviderSelector multifactorAuthenticationProviderSelector = new RankedMultifactorAuthenticationProviderSelector();


@Autowired

@Qualifier("warnCookieGenerator")

private CookieGenerator warnCookieGenerator;


@Autowired

@Qualifier("authenticationServiceSelectionPlan")

private AuthenticationServiceSelectionPlan authenticationRequestServiceSelectionStrategies;


@RefreshScope

@Bean

public CasWebflowEventResolver customWebflowEventResolver() {

return new CustomWebFlowEventResolver(authenticationSystemSupport, centralAuthenticationService,

servicesManager, ticketRegistrySupport, warnCookieGenerator,

authenticationRequestServiceSelectionStrategies, multifactorAuthenticationProviderSelector);

}


@PostConstruct

public void initialize() {

initialEventResolver.addDelegate(customWebflowEventResolver());

}


}


This is the WebflowEventResolver:


public class CustomWebFlowEventResolver extends AbstractCasWebflowEventResolver {


public CustomWebFlowEventResolver(AuthenticationSystemSupport authenticationSystemSupport,

CentralAuthenticationService centralAuthenticationService, ServicesManager servicesManager,

TicketRegistrySupport ticketRegistrySupport, CookieGenerator warnCookieGenerator,

AuthenticationServiceSelectionPlan authenticationSelectionStrategies,

MultifactorAuthenticationProviderSelector selector) {

super(authenticationSystemSupport, centralAuthenticationService, servicesManager, ticketRegistrySupport,

warnCookieGenerator, authenticationSelectionStrategies, selector);

}


@Override

public Set<Event> resolveInternal(RequestContext context) {

final RegisteredService service = WebUtils.getRegisteredService(context);

final Authentication authentication = WebUtils.getAuthentication(context);


final Map<String, MultifactorAuthenticationProvider> providerMap = WebUtils

.getAvailableMultifactorAuthenticationProviders(applicationContext);

final MultifactorAuthenticationProvider provider = providerMap.get("mfa-duo");

final Map eventAttributes = buildEventAttributeMap(authentication.getPrincipal(), service,

provider);

final Event event = validateEventIdForMatchingTransitionInContext(provider.getId(), context, eventAttributes);

return ImmutableSet.of(event);

}


}



I have registered the Configuration in the META-INF/spring.factories configuration file.


Thanks,
Adam


To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
 To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/892964821.9246869.1512522834850.JavaMail.zimbra%40unicon.net.

Adam Causey

unread,
Dec 7, 2017, 11:29:03 AM12/7/17
to cas-...@apereo.org
I
​ ​
think I
​ ​
found the issue.
​ ​
The comments in the example say "
​​
Choose the provider you need from the above map (i.e. 'mfa-duo`)
​"​
, however the actual value for Duo is "duoMultifactorAuthenticationProvider".
​

final MultifactorAuthenticationProvider provider = providerMap.get("duoMultifactorAuthenticationProvider");

Adam

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
--Misagh

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
Reply all
Reply to author
Forward
0 new messages