Apereo CAS Jasypt - Mister PKI

This article will demonstrate how to in Apereo CAS use Jasypt for encryption and decryption operations with CAS properties and secrets.

Apereo CAS is an open source IDP (Identity Provider) that supports various authentication protocols including CAS, SAML, and OIDC.

Jasypt is a java library which supports cryptographic functions for basic configuration properties.

It should be noted that secrets in code should always be encrypted to prevent eavesdroppers from viewing secrets as well as mitigate against inadvertent access to code secrets. If access was determined to be open and the secrets were encrypted, while it may still be a best practice to rotate those secrets, it isn’t always required.

As of this writing we are using Apereo CAS v7.x and Jasypt 1.9.3.

Jasypt with the CAS command-line shell

In our environment we have been unable to get the CAS command-line shell working in Linux. For the encryption and decryption functions in the shell we resorted to using Windows. If using Windows, these instructions should work for you. If using Linux, consider having a separate Windows box to run the shell from. You will need to install the correct Java version in Windows.

These instructions will work using both standalone cas.properties or using the slurp feature with a cas.groovy file. In the root of your cas-overlay project run these commands.

Download the CAS command-line shell.

.\gradlew.bat downloadShell runShell

The output should look similar to this.

Starting a Gradle Daemon (subsequent builds will be faster)
Configuration on demand is an incubating feature.
> Task :runShell
Run the following command to launch the shell:
        java -jar build/libs/cas-server-support-shell-7.0.3-SNAPSHOT.jar
Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.
You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.
For more on this, please refer to https://docs.gradle.org/8.4/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.
BUILD SUCCESSFUL in 30s
2 actionable tasks: 1 executed, 1 up-to-date

Run the CAS Command-line shell

java -jar build/libs/cas-server-support-shell-<version>-SNAPSHOT.jar

Encrypt a secret with the built in jasypt functionality.

encrypt-value --value "<secret>" --alg "PBEWithMD5AndTripleDES" --password "<encryption key>" --iterations 1000

As an example:

cas>encrypt-value --value "secret" --alg "PBEWithMD5AndTripleDES" --password "encpass" --iterations 1000
==== Encrypted Value ====
{cas-cipher}jFS33Fj9ZPhBdSyNA+5sSA==

Explore the various encryption algorithms and iterations for the best security your environment will support. The output will be

Decrypt the secret

decrypt-value --value <encrypted secret> --alg "PBEWithMD5AndTripleDES" --password "<encryption key>" --iterations 1000

As an example:

cas>decrypt-value --value {cas-cipher}jFS33Fj9ZPhBdSyNA+5sSA== --alg "PBEWithMD5AndTripleDES" --password encpass --iterations 1000
==== Decrypted Value ====
[secret]

Setting encrypted properties

Now that you have learned how to use the cas shell to encrypt and decrypt secrets with jasypt, simply run those commands for each of your secret properties. Your properties files will look similar to the following.

cas.properties

cas.example={cas-cipher}jFS33Fj9ZPhBdSyNA+5sSA==

cas.groovy

cas.example={cas-cipher}jFS33Fj9ZPhBdSyNA+5sSA==

In this example there is no difference between the two properties files. On deployment, CAS will know how to decrypt the values based on input you provide.

The following properties must be passed to CAS at runtime. This can be done on the command line, with environment variables, or system properties.

cas.standalone.configuration-security.alg=PBEWithMD5AndTripleDES
cas.standalone.configuration-security.iterations=1000
cas.standalone.configuration-security.psw=encpass

CAS shell help

To view more jasypt related command on the CAS Command-line shell use the help command.

cas>help

Jasypt command line tools

If the CAS command-line shell is problematic to use you can also use the Jasypt distribution directly.

First, download the jasypt binary distribution.

wget https://github.com/jasypt/jasypt/releases/download/jasypt-1.9.3/jasypt-1.9.3-dist.zip

Then unzip and change to the bin directory.

unzip jasypt-1.9.3-dist.zip; cd jasypt-1.9.3/

If running on Linux, make the .sh files executable. For example, to make the encrypt.sh file executable:

chmod +x encrypt.sh

Jasypt List Algorithms

./listAlgorithms.sh

DIGEST ALGORITHMS:   [MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, SHA3-512]
PBE ALGORITHMS:      [PBEWITHHMACSHA1ANDAES_128, PBEWITHHMACSHA1ANDAES_256, PBEWITHHMACSHA224ANDAES_128, PBEWITHHMACSHA224ANDAES_256, PBEWITHHMACSHA256ANDAES_128, PBEWITHHMACSHA256ANDAES_256, PBEWITHHMACSHA384ANDAES_128, PBEWITHHMACSHA384ANDAES_256, PBEWITHHMACSHA512/224ANDAES_128, PBEWITHHMACSHA512/224ANDAES_256, PBEWITHHMACSHA512/256ANDAES_128, PBEWITHHMACSHA512/256ANDAES_256, PBEWITHHMACSHA512ANDAES_128, PBEWITHHMACSHA512ANDAES_256, PBEWITHMD5ANDDES, PBEWITHMD5ANDTRIPLEDES, PBEWITHSHA1ANDDESEDE, PBEWITHSHA1ANDRC2_128, PBEWITHSHA1ANDRC2_40, PBEWITHSHA1ANDRC4_128, PBEWITHSHA1ANDRC4_40]

Jasypt Encrypt

./encrypt.sh input="secret" password="password123$" algorithm="PBEWITHMD5ANDTRIPLEDES" keyObtentionIterations="10000"

----ENVIRONMENT-----------------
Runtime: Amazon.com Inc. OpenJDK 64-Bit Server VM 21.0.1+12-LTS

----ARGUMENTS-------------------
input: secret
password: password123$
keyObtentionIterations: 10000
algorithm: PBEWITHMD5ANDTRIPLEDES

----OUTPUT----------------------
/A2Ky+3Wb8BVpW7jfv+d8Q==

Jasypt Decrypt

./decrypt.sh input="/A2Ky+3Wb8BVpW7jfv+d8Q==" password="password123$" algorit
hm="PBEWITHMD5ANDTRIPLEDES" keyObtentionIterations="10000"

----ENVIRONMENT-----------------
Runtime: Amazon.com Inc. OpenJDK 64-Bit Server VM 21.0.1+12-LTS

----ARGUMENTS-------------------
input: /A2Ky+3Wb8BVpW7jfv+d8Q==
password: password123$
keyObtentionIterations: 10000
algorithm: PBEWITHMD5ANDTRIPLEDES

----OUTPUT----------------------
secret

Conclusion – Apereo CAS Jasypt

This article has demonstrated how to in Apereo CAS use Jasypt for encryption and decryption operations for properties and secrets. Let us know in the comments if you have any questions or would like to see more examples of Jasypt in CAS. If you found this article helpful, check out more of our content on Apereo CAS.