Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

This article describes how to use MS-AD (or any LDAP directory) as the account store for authenticating with CAS to Google Apps, and how to use the "mail" attribute of the AD account object as the Google Apps user id. If the "mail" attribute is not set, the regular username will be used.

Eg. a user logs into AD as "jdoe" or "jdoe@ad.yourschool.edu", but said user has the email address "john.doe@yourschool.edu" (hosted at GMail), and this is set in the AD object "mail" attribute. (Note that you can use any LDAP attribute, as long as you map this LDAP attribute to the CAS Principal attribute called "EmailAddress"; see below.)

 Prerequisites:

  • functioning CAS 3.3 setup, with localization via the Maven overlay method, see Maintaining+local+customizations+using+Maven+2
  • MS-AD authentication is function, see Active+Directory
  • You can get LDAP attributes from AD (or any LDAP) into the CAS Princical (ie. the CAS user object )
    You will need to map the AD "mail" attribute (or any other LDAP attribute you wish to use) to the CAS princical "EmailAddress" attribute, eg. in the mapping section of the Attributesarticle, use: 
    <map>
  <entry key="mail" value="EmailAddress" />
</map>
    See  Attributes for more.

In your Maven customization folder, here called cas-server-local/, create the following directory structure (if it doesn't already exist.)

mkdir -p src/main/java/org/jasig/cas/authentication/principal/

Copy the Google apps account service bean into this directory from the cas-server-core directory. From the top of your cas build directory: 

cp cas-server-core/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java
cas-server-local/src/main/java/org/jasig/cas/authentication/principal/

Now apply the following patch or diffs to this java bean file in your customization folder (here: cas-server-local/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java):

--- cas-server-core/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java     2009-03-18 08:27:22.000000000 -0700
+++ cas-server-local/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java      2009-03-18 08:25:53.000000000 -0700
@@ -25,6 +25,9 @@
 import java.util.zip.Inflater;
 import java.util.zip.InflaterInputStream;

+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 /**
  * Implementation of a Service that supports Google Accounts (eventually a more
  * generic SAML2 support will come).
@@ -160,8 +163,36 @@
         c.setTime(new Date());
         c.add(Calendar.YEAR, 1);

-        samlResponse = samlResponse.replace("<USERNAME_STRING>", getPrincipal()
-            .getId());
+       /**
+        * samlResponse = samlResponse.replace("<USERNAME_STRING>", getPrincipal()
+        *   .getId());
+        */
+        /**
+         * Modify Google return to pass in EmailAddress attribute, if exists.
+         *
+        */
+       String username = getPrincipal().getId();
+       Map<String, Object> attributes = getPrincipal().getAttributes();
+
+       /** Log instance for logging events, info, warnings, errors, etc. */
+       final Log log = LogFactory.getLog(this.getClass());
+
+        if (log.isInfoEnabled()) {
+            log.info("User [" + getPrincipal().getId() + "] has " + attributes.size() + " principal attributes");
+       }
+
+       /**
+        * try to find the attribute mapped in the CredentialsToLDAPAttributePrincipalResolver
+        * configuration in deployerConfigContext.xml
+        */
+       if(attributes.containsKey("EmailAddress")) {
+               username = (String)attributes.get("EmailAddress");
+               if (log.isInfoEnabled()) {
+                               log.info("User [" + getPrincipal().getId() + "]: using EmailID [" + username + "]");
+               }
+       }
+       samlResponse = samlResponse.replace("<USERNAME_STRING>",username);
+
         samlResponse = samlResponse.replace("<RESPONSE_ID>", createID());
         samlResponse = samlResponse.replace("<ISSUE_INSTANT>", SamlUtils
             .getCurrentDateAndTime());

Rebuild your overlay with maven:

cd cas-server-local
mvn install package

If all looks good, deploy the target/cas.war file.

Finally, if all looks well, configure your Google Apps domain to use your CAS setup for authentication. See SAML+2.0+(Google+Accounts+Integration)
Every time Google Apps calls CAS, there will be some new INFO level messages in the tomcat log file, typically <tomcat>/logs/catalina.out to show you what is happening. The first line shows you how many (if any) attributes are attached to the CAS principal. This will show you if your attribute mapping is working. The second line show what user id is actually sent to Google for the current CAS principal.

2009-03-26 14:57:25,744 INFO [org.jasig.cas.authentication.principal.GoogleAccountsService] - <User [jdoe] has 1 principal attributes>
2009-03-26 14:57:25,744 INFO [org.jasig.cas.authentication.principal.GoogleAccountsService] - <User [jdoe]: using EmailID [john.doe@yourschool.edu]>
 


  • No labels