Trusted Authentication Handler

Including the Handler

In the pom.xml file for your CAS Maven2 WAR Overlay, add the following dependency:

<dependency>
     <groupId>org.jasig.cas</groupId>
     <artifactId>cas-server-support-trusted</artifactId>
     <version>${cas.version}</version>
</dependency>

Set Up CAS

Set up the login webflow

The CAS 3 Login Webflow needs to be modified. This webflow is located in /WEB-INF/login-webflow.xml. There is one new action state to place before the state viewLoginForm.

<action-state id="remoteAuthenticate">
  <action bean="principalFromRemoteAction" />
  <transition on="success" to="sendTicketGrantingTicket" />
  <transition on="error" to="viewLoginForm" />
</action-state>

In 3.4.2 and later, change <action bean="principalFromRemoteAction" /> to <evaluate expression="principalFromRemoteAction" />.

And 3 existing transitions need to be update:

• In the decision-state gatewayRequestCheck, replace reference to viewLoginForm by remoteAuthenticate
• In the decision-state renewRequestCheck, replace reference to viewLoginForm by remoteAuthenticate
• In the action-state generateServiceTicket, replace reference to viewLoginForm by remoteAuthenticate

In 3.4.12 (before?) ignore the above 3 transition declarations. Update the "generateLoginTicket" action-state to have the following transition.

<transition on="generated" to="remoteAuthenticate" />

/WEB-INF/cas-servlet.xml

Add the bean needed for the login flow :

<bean id="principalFromRemoteAction" class="org.jasig.cas.adaptors.trusted.web.flow.PrincipalFromRequestRemoteUserNonInteractiveCredentialsAction"
p:centralAuthenticationService-ref="centralAuthenticationService" />

/WEB-INF/deployerConfigContext.xml

In the bean authenticationManager, add:

• org.jasig.cas.adaptors.trusted.authentication.principal.PrincipalBearingCredentialsToPrincipalResolver as credentialsToPrincipalResolvers

• org.jasig.cas.adaptors.trusted.authentication.handler.support.PrincipalBearingCredentialsAuthenticationHandler as authenticationHandlers

  <bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">
    <property name="credentialsToPrincipalResolvers">
      <list>
        <!--  ... the others credentialsToPrincipalResolvers ... -->
        <bean class="org.jasig.cas.adaptors.trusted.authentication.principal.PrincipalBearingCredentialsToPrincipalResolver" />
      </list>
    </property>
    <property name="authenticationHandlers">
      <list>
        <bean class="org.jasig.cas.adaptors.trusted.authentication.handler.support.PrincipalBearingCredentialsAuthenticationHandler" />
        <!--  ... the others authenticationHandlers... -->
      </list>
    </property>
  </bean>
  

Build the cas-webapp

Inside the ${project.home}/cas-server-webapp/ folder, run the command :

mvn package

You may now deploy the new webapp.

Tomcat & Apache integration issue

If you are using, a frontal Apache with mod_jk and Apache is handling the REMOTE_USER, you have to check the AJP connector in your Tomcat server.xml file. You should add the parameter tomcatAuthentication to false

Connector port="8009"
  enableLookups="false" redirectPort="8443" debug="0"
  protocol="AJP/1.3"
  tomcatAuthentication="false" />