Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 12 Next »

This article describes how to use MS-AD (or any LDAP directory) as the account store for authenticating with CAS to Google Apps, and how to use the "mail" attribute of the AD account object as the Google Apps user id. If the "mail" attribute is not set, the regular username will be used.

Eg. a user logs into AD as "jdoe" or "jdoe@ad.yourschool.edu", but said user has the email address "john.doe@yourschool.edu" (hosted at GMail). This value is set in the AD object "mail" attribute. (Note that you can use any LDAP attribute, as long as you map this LDAP attribute to the CAS Principal attribute called "EmailAddress"; see below.)

Prerequisites:

  • functioning CAS 3.3 setup, with localization via the Maven overlay method, see Maintaining local customizations using Maven 2
  • MS-AD authentication is function, see Active Directory
  • You can get LDAP attributes from AD (or any LDAP) into the CAS Princical (ie. the CAS user object )
    You will need to map the AD "mail" attribute (or any other LDAP attribute you wish to use) to the CAS princical "EmailAddress" attribute, eg. in the mapping section of the Attributes article, use: 
    <map>
  <entry key="mail" value="EmailAddress" />
</map>
    See Attributes for more. 

Modifications:

In your Maven customization folder, here called cas-server-local/, create the following directory structure (if it doesn't already exist.)

mkdir -p src/main/java/org/jasig/cas/authentication/principal/

Copy the Google apps account service bean into this directory from the cas-server-core directory. From the top of your cas build directory: 

cp cas-server-core/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java
cas-server-local/src/main/java/org/jasig/cas/authentication/principal/

Now apply the following patch to this java bean file in your customization folder (here: cas-server-local/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java):
(this patch is also attached to this page.)

--- cas-server-core/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java     2009-03-18 08:27:22.000000000 -0700
+++ cas-server-local/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java      2009-03-18 08:25:53.000000000 -0700
@@ -25,6 +25,9 @@
 import java.util.zip.Inflater;
 import java.util.zip.InflaterInputStream;

+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 /**
  * Implementation of a Service that supports Google Accounts (eventually a more
  * generic SAML2 support will come).
@@ -160,8 +163,36 @@
         c.setTime(new Date());
         c.add(Calendar.YEAR, 1);

-        samlResponse = samlResponse.replace("<USERNAME_STRING>", getPrincipal()
-            .getId());
+       /**
+        * samlResponse = samlResponse.replace("<USERNAME_STRING>", getPrincipal()
+        *   .getId());
+        */
+        /**
+         * Modify Google return to pass in EmailAddress attribute, if exists.
+         *
+        */
+       String username = getPrincipal().getId();
+       Map<String, Object> attributes = getPrincipal().getAttributes();
+
+       /** Log instance for logging events, info, warnings, errors, etc. */
+       final Log log = LogFactory.getLog(this.getClass());
+
+        if (log.isInfoEnabled()) {
+            log.info("User [" + getPrincipal().getId() + "] has " + attributes.size() + " principal attributes");
+       }
+
+       /**
+        * try to find the attribute mapped in the CredentialsToLDAPAttributePrincipalResolver
+        * configuration in deployerConfigContext.xml
+        */
+       if(attributes.containsKey("EmailAddress")) {
+               username = (String)attributes.get("EmailAddress");
+               if (log.isInfoEnabled()) {
+                               log.info("User [" + getPrincipal().getId() + "]: using EmailID [" + username + "]");
+               }
+       }
+       samlResponse = samlResponse.replace("<USERNAME_STRING>",username);
+
         samlResponse = samlResponse.replace("<RESPONSE_ID>", createID());
         samlResponse = samlResponse.replace("<ISSUE_INSTANT>", SamlUtils
             .getCurrentDateAndTime());

Rebuild your overlay with maven; this should not produce any errors:

cd cas-server-local
mvn install package

Finally, if all looks well, configure your Google Apps domain to use your CAS setup for authentication. See SAML 2.0 (Google Accounts Integration) (You will need to rebuild your package after your make these final modifications.)

If all looks good, deploy the target/cas.war file.

Logging:
Every time Google Apps calls CAS, there will be some new INFO level messages in the log file to show you what is happening. The first line shows you how many (if any) attributes are attached to the CAS principal. This will show you if your attribute mapping is working. The second line shows what email-id is actually sent to Google for the current CAS principal.

2009-03-26 14:57:25,744 INFO [org.jasig.cas.authentication.principal.GoogleAccountsService] - <User [jdoe] has 1 principal attributes>
2009-03-26 14:57:25,744 INFO [org.jasig.cas.authentication.principal.GoogleAccountsService] - <User [jdoe]: using EmailID [john.doe@yourschool.edu]>
 


  • No labels