CAS Community - Google Groups

Groups

1–30 of 5452

Welcome to the CAS community mailing list. Please take a look at the following resources to better understand support options:

Support: https://apereo.github.io/cas/Support.html
Documentation: https://apereo.github.io/cas
Blog: https://apereo.github.io/
Contributor Guidelines: https://apereo.github.io/cas/developer/Contributor-Guidelines.html

CAS is an open-source Apache v2 project under the sponsorship of the Apereo Foundation. Please review the Apereo Welcoming Policy for more info: https://www.apereo.org/content/apereo-welcoming-policy

Thank you.

0 selected

Vallee Romain, … Jonathon Taylor6

Jul 24

OIDC with 7.3 and code

We ran into a similar issue early on with our OIDC implementation where CAS returns attributes in a

unread,

OIDC with 7.3 and code

We ran into a similar issue early on with our OIDC implementation where CAS returns attributes in a

Jul 24

Matthew Gordon, … Robert3

Jul 21

Same problem here. More than 1 request results in rate limiting. Not very usable. Seems like Misagh

unread,

Same problem here. More than 1 request results in rate limiting. Not very usable. Seems like Misagh

Jul 21

Jul 20

[CAS 7.2.2] Device Code Authorization Returning Device Code

Upgraded to 7.3.8: The same issue persists. On Thursday, July 16, 2026 at 11:32:19 AM UTC+10 Anthony

unread,

[CAS 7.2.2] Device Code Authorization Returning Device Code

Upgraded to 7.3.8: The same issue persists. On Thursday, July 16, 2026 at 11:32:19 AM UTC+10 Anthony

Jul 20

Jul 20

[CAS 7.3.7] Error on mobile device with MFA-Simple

Hi, After multiple tests, it appears that changing the setting `cas.webflow.session.storage=false` to

unread,

[CAS 7.3.7] Error on mobile device with MFA-Simple

Hi, After multiple tests, it appears that changing the setting `cas.webflow.session.storage=false` to

Jul 20

Louis Chanouha, … Matthew Gordon7

Jul 15

OIDC Delegated regression on 7.3 => Delegated client identifier [] is undefined in request URL

Hello, The fix on config should be an xx.xx.cookie.secure = true, but I patched the code (revert of

unread,

OIDC Delegated regression on 7.3 => Delegated client identifier [] is undefined in request URL

Hello, The fix on config should be an xx.xx.cookie.secure = true, but I patched the code (revert of

Jul 15

spfma...@e.mail.fr, Ray Bon2

Jul 10

LDAP attributes with options and resolver

Unfortunate about the semicolon. There is groovy scripting [1]. Attribute sources can be ordered (

unread,

LDAP attributes with options and resolver

Unfortunate about the semicolon. There is groovy scripting [1]. Attribute sources can be ordered (

Jul 10

John Adams, Ray Bon2

Jul 8

Upgrading from CAS 6.1.5 to 7.x?

John, The underlaying OS should have no effect on how cas runs. Check your version of java against

unread,

Upgrading from CAS 6.1.5 to 7.x?

John, The underlaying OS should have no effect on how cas runs. Check your version of java against

Jul 8

William Vincent (Wix31), … Mike Osterman6

Jul 3

CAS 7.3.x - Intermittent Unable to resolve user dn errors during LDAP authentication after migrating from CAS 6.x

Thank you for your replies, I'll answer everyone here: - I don't have any filter; we are

unread,

CAS 7.3.x - Intermittent Unable to resolve user dn errors during LDAP authentication after migrating from CAS 6.x

Thank you for your replies, I'll answer everyone here: - I don't have any filter; we are

Jul 3

Misagh, CAS Community2

Jul 2

CAS Security Vulnerability Disclosure

Security grace window closing. Updated: https://apereo.github.io/2026/06/06/vuln/ On Monday, June 8,

unread,

CAS Security Vulnerability Disclosure

Security grace window closing. Updated: https://apereo.github.io/2026/06/06/vuln/ On Monday, June 8,

Jul 2

Mohamed Iheb JEMAI, Ray Bon2

Jul 1

CAS 7.3.5 migration - TGT timeout configured for 2 hours but application logs out after 1 hour

Mohamed, The cas session (TGT) is for SSO only; it has nothing to do with any other application. 2.

unread,

CAS 7.3.5 migration - TGT timeout configured for 2 hours but application logs out after 1 hour

Mohamed, The cas session (TGT) is for SSO only; it has nothing to do with any other application. 2.

Jul 1

Arkady Keppert, Ray Bon3

Jun 25

CAS SAML2 Integration Issue with Amazon Cognito (InResponseTo mismatch)

I did manage to fix it authn request and response was same problem was that i had in configuration:

unread,

CAS SAML2 Integration Issue with Amazon Cognito (InResponseTo mismatch)

I did manage to fix it authn request and response was same problem was that i had in configuration:

Jun 25

Jun 23

CAS Community Office Hours: #9

The next episode of CAS community office hours will be held on this Thursday, June 25th, 2026 and it

unread,

CAS Community Office Hours: #9

The next episode of CAS community office hours will be held on this Thursday, June 25th, 2026 and it

Jun 23

Jun 23

Changes to CAS Security Vulnerability Response

Please see https://apereo.github.io/2026/06/23/sec-grace-window/

unread,

Changes to CAS Security Vulnerability Response

Please see https://apereo.github.io/2026/06/23/sec-grace-window/

Jun 23

Misagh, CAS Community2

Jun 23

CAS Security Vulnerability Disclosure

Security grace window closing. Updated: https://apereo.github.io/2026/05/27/oidc-vuln/ On Wednesday,

unread,

CAS Security Vulnerability Disclosure

Security grace window closing. Updated: https://apereo.github.io/2026/05/27/oidc-vuln/ On Wednesday,

Jun 23

Jun 20

Hi, I found the solution by extracting cas-server-support-thymeleaf and customizing the

unread,

Hi, I found the solution by extracting cas-server-support-thymeleaf and customizing the

Jun 20

Mohamed Iheb JEMAI, … Eugene Willis3

Jun 19

CAS SSO Session Timeout Not Honored by Integrated Application After Migration to CAS 7.3.5

I think by default the setting now built into cas. So you may be able to remove that stanza. I would

unread,

CAS SSO Session Timeout Not Honored by Integrated Application After Migration to CAS 7.3.5

I think by default the setting now built into cas. So you may be able to remove that stanza. I would

Jun 19

Jun 18

CAS Security Vulnerability Disclosure

Please see https://apereo.github.io/2026/06/18/vuln/

unread,

CAS Security Vulnerability Disclosure

Please see https://apereo.github.io/2026/06/18/vuln/

Jun 18

Mohamed Iheb JEMAI, … Eugene Willis5

Jun 15

CAS 7.3.5 SAML Attribute Names Changed to OID URNs After Migration from 6.6.15

Hi CAS Community, The samlidp-attribute-definitions.json workaround fixed the original issue, and

unread,

CAS 7.3.5 SAML Attribute Names Changed to OID URNs After Migration from 6.6.15

Hi CAS Community, The samlidp-attribute-definitions.json workaround fixed the original issue, and

Jun 15

Adarsh Kuntal, … Ray Bon3

Jun 9

[CAS 7.3.7] Login Success View Triggers POST Resubmission on Browser Refresh — Seeking PRG Pattern Guidance

Adarsh, Under most conditions, the login flow redirects to the service the user was intending to

unread,

[CAS 7.3.7] Login Success View Triggers POST Resubmission on Browser Refresh — Seeking PRG Pattern Guidance

Adarsh, Under most conditions, the login flow redirects to the service the user was intending to

Jun 9

Jun 8

CAS Community Office Hours: #8

The next episode of CAS community office hours will be held on Thursday, June 11th 2026 and it will

unread,

CAS Community Office Hours: #8

The next episode of CAS community office hours will be held on Thursday, June 11th 2026 and it will

Jun 8

livio dezorzi, Ray Bon6

Jun 5

attributes released vs id_token

Hi, After a few hours of fruitless searching, I started from scratch and the value of the problematic

unread,

attributes released vs id_token

Hi, After a few hours of fruitless searching, I started from scratch and the value of the problematic

Jun 5

spfma...@e.mail.fr, … Ray Bon4

May 29

Login page and attributes

principal-attribute-list should only return those attributes from LDAP, no more. Cas generates a

unread,

Login page and attributes

principal-attribute-list should only return those attributes from LDAP, no more. Cas generates a

May 29

Jeremiah Garmatter, … Ray Bon8

May 28

Condensing multiple SSO integrations?

Shit vendor. Tell them to include it. When the SP sends an AuthnRequest, the

unread,

Condensing multiple SSO integrations?

Shit vendor. Tell them to include it. When the SP sends an AuthnRequest, the

May 28

May 27

mod_auth_cas 1.3 Release

The mod_auth_cas team is pleased to announce the release of mod_auth_cas 1.3. https://github.com/

unread,

mod_auth_cas 1.3 Release

The mod_auth_cas team is pleased to announce the release of mod_auth_cas 1.3. https://github.com/

May 27

May 26

Instructions for Palantir users to create service entries?

Turns out I selected the SAML2-2 service definition template by mistake. Selecting the SAML2-

unread,

Instructions for Palantir users to create service entries?

Turns out I selected the SAML2-2 service definition template by mistake. Selecting the SAML2-

May 26

May 21

Java CAS Client Security Vulnerability Disclosure

Please see https://apereo.github.io/2026/05/20/casc-jwt-vuln/

unread,

Java CAS Client Security Vulnerability Disclosure

Please see https://apereo.github.io/2026/05/20/casc-jwt-vuln/

May 21

May 19

CAS Community Office Hours: #7

The next episode of CAS community office hours will be held on this Thursday, May 21st, 2026 and it

unread,

CAS Community Office Hours: #7

The next episode of CAS community office hours will be held on this Thursday, May 21st, 2026 and it

May 19

Mohamed Iheb JEMAI, … Ray Bon7

May 11

CAS 7.3.5 Migration - 403 Forbidden when accessing service registry

Mohamed, Some of the endpoints are built into spring [1], some are custom to cas. Most of the

unread,

CAS 7.3.5 Migration - 403 Forbidden when accessing service registry

Mohamed, Some of the endpoints are built into spring [1], some are custom to cas. Most of the

May 11

May 1

CAS Community Office Hours: #6

The next episode of CAS community office hours will be held on Tuesday, May 5th 2026 and it will run

unread,

CAS Community Office Hours: #6

The next episode of CAS community office hours will be held on Tuesday, May 5th 2026 and it will run

May 1

Alex Kauchak, Ray Bon4

Apr 30

Issue with redirecting after interrupt

Alex, If you have the crypto values set correctly, do you still need the custom configuration? You

unread,

Issue with redirecting after interrupt

Alex, If you have the crypto values set correctly, do you still need the custom configuration? You

Apr 30

Search

Clear search

Close search

Google apps

Main menu