As an administrator of the Apereo CAS IDP (Identity Provider) you may find it useful to terminate user sessions for any number of reasons. Let’s say the underlying authentication platform is LDAP, either Active Directory or OpenLdap and you do not wish to disable the account but only terminate the user’s session in CAS. This article will demonstrate just how to do that.
Enable Actuator Endpoints
First, you must have the actuator endpoint for user sessions enabled. This example uses the Slurp configuration with Groovy, making it easier to use one config file for multiple environments. If you are not using the cas.groovy file, use the property type for your environment.
/* ssoSessions specific */
management.endpoint.ssoSessions.enabled="true"
cas.monitor.endpoints.endpoint.ssoSessions.access="AUTHENTICATED"
management.endpoints.web.exposure.include="ssoSessions"
/* Spring security basic auth */
spring.security.user.name="username"
spring.security.user.password="password"In the above properties, the ssoSessions endpoint is enabled, access set to require authentication, and endpoint exposed. The spring security config will be used to authenticate to the endpoint.
GET SSO Sessions
Get all SSO Sessions
Using curl, get the sso sessions.
curl -k https://login.example.com/cas/actuator/ssoSessionsGet SSO Sessions for a single user
curl -k https://login.example.com/cas/actuator/ssoSessions/users/<username>Where username is the username for the user you are getting all sso sessions for.
Delete single SSO session for a user
curl -k -X DELETE https://login.example.com/cas/actuator/ssoSessions/TGT-2-.....Where TGT-2-….. is the TGT found in one of the previous GET requests. Note that the path in this delete does not include the username. It is simply deleting a session by TGT.
Delete all SSO sessions for a user
curl -k -X DELETE https://login.example.com/cas/actuator/ssoSessions/users/<username>Where <username> is the username you are deleting all sessions for.
Delete all SSO sessions
In the event you want to delete all active SSO sessions you have a few different options depending on your ticket registry.
Default in memory registry – Restart your CAS server
Redis Ticket Registry – Run this in your redis instance – redis-cli FLUSHDB
Conclusion – Apereo CAS – Terminate User sessions
This article has demonstrated how to view and delete sso sessions in Apereo CAS using the actuator endpoints. Let us know in the comments if you have any questions or would like to see more examples on how to administer Apereo CAS.
Leave a Reply