Page Comparison

...

Code Block

mysql> select * from VW_USER_ROLES;
+----+-----------+---------------+
| ID | LOGINNAME | ROLENAME      |
+----+-----------+---------------+
|  1 | pame        | DEBUG         |
|  1 | pame        | Super User    |
+----+-----------+---------------+

Currently only works with SAML 1.1 from jasig or by utilizing

server add-on https://github.com/Unicon/cas-addons/wiki/Configuring-JSON-Validation-Response ( server version 3.5.1 and above )

and client add-on https://github.com/Unicon/cas-java-clients-addons ( client version 3.2.1 )

(for CAS 2.0 see http://www.ja-sig.org/issues/browse/CAS-655).

Client Mods

- dependencies
  Code Block

<dependency>
  <groupId>org.apache.santuario</groupId>
  <artifactId>xmlsec</artifactId>
  <version>1.4.5</version>
</dependency>

<dependency>
  <groupId>org.opensaml</groupId>
  <artifactId>opensaml</artifactId>
  <version>1.1b</version>
</dependency>

org.jasig.cas.client.authentication.Saml11AuthenticationFilter
org.jasig.cas.client.validation.Saml11TicketValidationFilter
org.jasig.cas.client.util.HttpServletRequestWrapperFilter
Add init-param to HttpServletRequestWrapperFilter :
Code Block

<param-name>roleAttribute</param-name>
<param-value>USER_ROLE</param-value>

Server Mods

On deployerConfigContext.xml add :

Code Block


<bean id="multiRowJdbcPersonAttributeDao" class="org.jasig.services.persondir.support.jdbc.MultiRowJdbcPersonAttributeDao">
   <constructor-arg index="0" ref="dataSource" />
   <constructor-arg index="1" value="select LOGINNAME, 'USER_ROLE' as attr_name, ROLENAME FROM VW_USER_ROLES WHERE {0}" />
   <property name="nameValueColumnMappings">
       <map>
          <entry key="attr_name" value="ROLENAME" />
       </map>
   </property>
   <property name="queryAttributeMapping">
       <map>
         <entry key="username" value="LOGINNAME" />
      </map>
   </property>
</bean>

 
...
 
<bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">
	<property name="credentialsToPrincipalResolvers">
		<list>
			<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" >
				<property name="attributeRepository" ref="multiRowJdbcPersonAttributeDao"/>
			</bean>
...

Runtime changes

in Services Management i.e. /cas/services/ manage.html Edit service to 'Ignore Attribute Management via this Tool'

Note

If you are using InMemoryServiceRegistryDaoImpl as serviceRegistryDao (default config), a way to avoid to edit services at each restart of cas-server is to add a property to the corresponding service in deployerConfigContext.xml :

Code Block
<bean class="org.jasig.cas.services.RegisteredServiceImpl"> ... <property name="allowedAttributes"> <list> <value>USER_ROLE</value> </list> </property> ...

Versions Compared

Old Version 1

New Version Current

Key