LDAP Service Registry Does not auto-intalize

242 views
Skip to first unread message

Mallory, Erik

unread,
Jun 30, 2017, 12:54:03 PM6/30/17
to CAS Community

Hello,

I’ve have my CAS 5.1 instance configured to use a local (same machine) LDAP server for the CAS services registry. I extended the schema with attributes delineated at the end of this email, I also tested auto-initialization after removing the cas related objectclass and attributes. Still it failed.

 

With the schema extended by hand, I was able to manually add a service definition via LDIF so I could gain access to the cas-management application and attempt to add a service definition from the web interface, with no luck.

 

CAS is properly connecting to the servicesRegistry LDAP server.

CAS is able to read values from the servicesRegistry LDAP server.

CAS does not auto initialize the two base service definitions Apereo and HTTPS/IMAPS.

I am unable to add new services to the servicesRegistry.

 

Help with the above issues would be greatly appreciated.

 

Related question:

Do I need to extend the schema of my LDAP server with the casRegisteredService objectClass and related attibiuteTypes?

 

Below are relevant configurations, logs and the casRegisteredService LDAP objectClass and attributeTypes:

Thanks!

 

Pom.xml

<dependency>

            <groupId>org.apereo.cas</groupId>

            <artifactId>cas-server-support-ldap-service-registry</artifactId>

            <version>${cas.version}</version>

        </dependency>

 

<cas.version>5.1.1</cas.version>

 

application.properties

##

#cas ldap service registry

#

 cas.serviceRegistry.ldap.serviceDefinitionAttribute=description

 cas.serviceRegistry.ldap.idAttribute=uid

 cas.serviceRegistry.ldap.objectClass=casRegisteredService

 cas.serviceRegistry.ldap.ldapUrl=ldap://apptest-523.wichita.edu:389

 cas.serviceRegistry.ldap.baseDn=ou=cas-services,dc=wichita,dc=edu

 cas.serviceRegistry.ldap.bindDn=cn=Directory Manager

 cas.serviceRegistry.ldap.bindCredential=derp

 cas.serviceRegistry.ldap.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider

 cas.serviceRegistry.ldap.connectTimeout=5000

 cas.serviceRegistry.ldap.minPoolSize=2

 cas.serviceRegistry.ldap.maxPoolSize=10

 cas.serviceRegistry.ldap.validateOnCheckout=true

 cas.serviceRegistry.ldap.validatePeriodically=true

 cas.serviceRegistry.ldap.validatePeriod=600

 cas.serviceRegistry.ldap.failFast=true

 cas.serviceRegistry.ldap.idleTime=500

 cas.serviceRegistry.ldap.prunePeriod=600

 cas.serviceRegistry.ldap.blockWaitTime=5000

# cas.serviceRegistry.ldap.trustCertificates=

# cas.serviceRegistry.ldap.keystore=

# cas.serviceRegistry.ldap.keystorePassword=

# cas.serviceRegistry.ldap.keystoreType=JKS|JCEKS|PKCS12

 cas.serviceRegistry.ldap.useSsl=false

 cas.serviceRegistry.ldap.useStartTls=false

 

##

#JSON Service Registry

#

 cas.serviceRegistry.watcherEnabled=true

 cas.serviceRegistry.repeatInterval=120000

 cas.serviceRegistry.startDelay=15000

 cas.serviceRegistry.initFromJson=true

 

Relevant Log data:

CAS.log

2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection factory for [ldap://apptest-523.wichita.edu:389]>

2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection configuration for [ldap://apptest-523.wichita.edu:389]>

2017-06-30 11:37:33,563 DEBUG [org.apereo.cas.configuration.support.Beans] - <Transformed LDAP urls from [ldap://apptest-523.wichita.edu:389] to [ldap://apptest-523

.wichita.edu:389]>

2017-06-30 11:37:33,571 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP SSL configuration via the native JVM truststore>

2017-06-30 11:37:33,572 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP bind connection initializer via [cn=Directory Manager]>

2017-06-30 11:37:33,598 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection pool configuration for [ldap://apptest-523.wichita.edu:389]>

2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] - <Created [BIND] passivator for [ldap://apptest-523.wichita.edu:389]>

2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] - <Initializing ldap connection pool for [ldap://apptest-523.wichita.edu:389] and bindDn 

[cn=Directory Manager]>

2017-06-30 11:37:33,867 DEBUG [org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured search filter to [(uid={0})]>

2017-06-30 11:37:33,867 DEBUG [org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured load filter to [(objectClass=casRegisteredService)]>

2017-06-30 11:37:33,885 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]>

2017-06-30 11:37:33,925 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry contains [0] service definitions>

2017-06-30 11:37:33,925 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry will be auto-initialized from default JSON services>

2017-06-30 11:37:34,099 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Loading JSON services are [[id=10000002,name=Apereo,description=Apereo foundat

ion sample service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>, id=10000001,name=HTTPS and IMAPS,description=This service definition authorized all application urls that support HTTPS and IMAPS protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>]]>

2017-06-30 11:37:34,099 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]>

2017-06-30 11:37:34,109 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000002)]>

2017-06-30 11:37:34,119 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service registry with the [id=10000002,name=Apereo,description=Apereo foundation sample service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>] JSON service definition...>

2017-06-30 11:37:34,119 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000002)]>

2017-06-30 11:37:34,124 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]>

2017-06-30 11:37:34,126 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000001)]>

2017-06-30 11:37:34,134 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service registry with the [id=10000001,name=HTTPS and IMAPS,description=This service definition authorized all application urls that support HTTPS and IMAPS protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>] JSON service definition...>

 

dirsrv-access.log shows search only.

 

 

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.1

    NAME 'casServiceUrlPattern'

    DESC 'Service URL pattern.'

    EQUALITY caseIgnoreMatch

    SUBSTR caseIgnoreSubstringsMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.2

    NAME 'casServiceEnabled'

    DESC 'Service enabled flag.'

    EQUALITY booleanMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.3

    NAME 'casServiceSsoEnabled'

    DESC 'TRUE to participate in SSO, FALSE to force authentication.'

    EQUALITY booleanMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.4

    NAME 'casServiceAnonymousAccess'

    DESC 'TRUE to use opaque, anonymous identifier for NetID, FALSE otherwise.'

    EQUALITY booleanMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.5

    NAME 'casServiceAllowedToProxy'

    DESC 'TRUE to enable proxy authentication support, FALSE otherwise.'

    EQUALITY booleanMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.6

    NAME 'casServiceTheme'

    DESC 'Spring theme name to use for service.'

    EQUALITY caseIgnoreMatch

    SUBSTR caseIgnoreSubstringsMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.7

    NAME 'casUsernameAttribute'

    DESC 'Attribute name whose value should be used for service-specific NetID.'

    EQUALITY caseIgnoreMatch

    SUBSTR caseIgnoreSubstringsMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.8

    NAME 'casAllowedAttributes'

    DESC 'Names of attributes to be released to service. Facilitates service-specific attribute release.'

    EQUALITY caseIgnoreMatch

    SUBSTR caseIgnoreSubstringsMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.9

    NAME 'casIgnoreAttributes'

    DESC 'TRUE to disable service-specific attribute release, FALSE otherwise. Supersedes casAllowedAttributes.'

    EQUALITY booleanMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.10

    NAME 'casEvaluationOrder'

    DESC 'Numerical evaluation order of this service.'

    EQUALITY integerMatch

    ORDERING integerOrderingMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27

    SINGLE-VALUE )

#

################################################################################

#

attributeTypes: (

    1.3.6.1.4.1.6760.6.1.11

    NAME 'casRequiredHandlers'

    DESC 'Names of authentication handlers that must succeed to gain access to this service. Part of MFA support.'

    EQUALITY caseIgnoreMatch

    SUBSTR caseIgnoreSubstringsMatch

    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

########################################################

#  Objectclasses below                                 #

########################################################

objectClasses: (

    1.3.6.1.4.1.6760.6.2.1

    SUP top

    STRUCTURAL

    NAME 'casRegisteredService'

    DESC 'CAS registered service.'

    MUST ( uid $ casServiceUrlPattern $ cn )

    MAY ( description $ casServiceEnabled $ casServiceSsoEnabled $ casServiceAnonymousAccess $

          casServiceAllowedToProxy $ casServiceTheme $ casUsernameAttribute $ casAllowedAttributes $

          casIgnoreAttributes $ casEvaluationOrder $ casRequiredHandlers ))

 

 

 

Erik Mallory

Server Analyst 

Wichita State University

 

Bergner, Arnold

unread,
Jul 3, 2017, 3:38:01 AM7/3/17
to cas-...@apereo.org

I had a similar problem and also used “description“ for the beginning. In the end, the string size allowed (1024) was too small. Now using 64k field, which seems ok.

 

Cheers

Arnold

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7B902700-C2D6-48D8-909C-1D458B9BBA08%40wichita.edu.

Mallory, Erik

unread,
Jul 3, 2017, 12:35:52 PM7/3/17
to cas-...@apereo.org

I did get it to work by reading the log files and checking them against the objectclass definition  I wound up editing following line

MUST ( uid $ casServiceUrlPattern $ cn ) to MUST ( uid $ description  )

I was able to edit/duplicate/create service definitions after that.

I think it’s kinda “hacky” though. I believe that CAS should have auto initialized, which it didn’t. Weather it’s my fault, a bug in the code, or a lapse in documentation, I am not sure.

Thanks,

Reply all
Reply to author
Forward
0 new messages