Apereo CAS usernames

This article will demonstrate how to strip off your domain in Apereo CAS usernames being entered for authentication. Often users will be accustomed to entering an email address to sign in, but if your CAS instance requires just the username, then the log in will fail. If the email address is always the username@domain, then this article will provide a solution for you.

Authentication Handler

This solution assumes you already have an authentication handler configured.

Our example config uses the samAccountName as the username attribute in an ldap handler.

cas.authn.ldap[0].type=AUTHENTICATED
cas.authn.ldap[0].searchFilter=(saMAccountName={user})

Principal Transformation Facility

To strip off the domain part of the username if present, use the following property.

cas.authn.ldap[0].principal-transformation.pattern=(.+)@example.com

Now, both username and username@example.com are supported for authentication.

Conclusion – Apereo CAS usernames

This article has demonstrated how to support both a username and email address as the username at the same time by using the principal transformation pattern CAS property. Let us know in the comments if you have any questions. If you found this article helpful check out more of our articles on the Apereo CAS Identity Provider (IDP).