Apereo CAS Authentication Handler

This article will demonstrate how to configure a specific authentication handler for a given service in the Apereo CAS Identity Provider (IDP). The article assumes the json service registry is used.

CAS supports multiple authentication handlers being configured at once and in my experience follows each handler in the list until a handler is found that finds the given credentials. This is a general statement and should not be taken as fact. To be sure, an order can be specified as in the example below.

You may be in a situation where you have multiple authentication handlers defined in CAS properties but wish to specify in a service which handler to use. This will improve efficiency in your user authentications.

Is it possible to specify that a given service in the json registry use a specific authentication handler defined in CAS properties? Read further to find out.

CAS Properties

For example, we have an authentication handler configured here in cas.groovy properties.

This particular authentication handler uses starttls, encrypted secrets, and the pwdLastSet attribute used for a custom password policy in groovy. Let us know if you would like to see an article published on those features.

cas.authn.ldap["0"].name="handler0"
cas.authn.ldap["0"].order=0
cas.authn.ldap["0"].type="AUTHENTICATED"
cas.authn.ldap["0"].ldapUrl="ldap://ldap-1.example.com:389,ldap://ldap-2.example.com:389"
cas.authn.ldap["0"].baseDn="cn=users,dc=example,dc=com|cn=external,dc=example,dc=com"
cas.authn.ldap["0"].bindDn="cn=ldapmanager,dc=example,dc=com"
cas.authn.ldap["0"].bindCredential="{cas-cipher}abc123"
cas.authn.ldap["0"].searchFilter="(sAMAccountName={user})"
cas.authn.ldap["0"].useStartTls="true"
cas.authn.ldap["0"].trustStore="file:/etc/cas/config/truststore.p12"
cas.authn.ldap["0"].trustStorePassword="changeit"
cas.authn.ldap["0"].trustStoreType="PKCS12"
cas.authn.ldap["0"].principalAttributeList="cn,givenName,sn,mail,samAccountName"
cas.authn.ldap["0"].additionalAttributes="pwdLastSet"
cas.authn.ldap["0"].passwordPolicy.enabled="true"
cas.authn.ldap["0"].passwordPolicy.strategy="GROOVY"
cas.authn.ldap["0"].passwordPolicy.groovy.location="file:/etc/cas/config/groovy/password-policy.groovy"

With this configuration, the authentication handler will execute for every configured service in your registry. If you wish to only have it active for execution when needed, use this property.

cas.authn.ldap["0"].state=STANDBY

Now the authentication handler will only executed when called specifically by a registered service.

JSON Service

In /etc/cas/services, create a new service. Take note of the authenticationPolicy that specifies the name of the authentication handler to use.

{
  "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService",
  "serviceId": "https://service.example.com",
  "name": "example",
  "environments": [
    "java.util.HashSet",
    [
      "prod"
    ]
  ],
  "id": 1,
  "authenticationPolicy": {
    "@class": "org.apereo.cas.services.DefaultRegisteredServiceAuthenticationPolicy",
    "requiredAuthenticationHandlers": [
      "java.util.TreeSet",
      [
        "handler0"
      ]
    ],
    "criteria": {
      "@class": "org.apereo.cas.services.AllowedAuthenticationHandlersRegisteredServiceAuthenticationPolicyCriteria"
    }
  },
  "metadataLocation": "https://service.example.com/metadata",
  "evaluationOrder": 1,
  "requiredNameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
  "usernameAttributeProvider": {
    "@class": "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider",
    "usernameAttribute": "samAccountName"
  },
  "attributeReleasePolicy": {
    "@class": "org.apereo.cas.services.DenyAllAttributeReleasePolicy"
  }
}

Conclusion – Apereo CAS Authentication Handler

This article has demonstrated how to specify a specific authentication handler in a given json service. Let us know in the comments if you have any questions or would like to see more Apereo CAS examples.