Multiple JAAS Realms for CAS Authentication Filter

[Burak Oguz]

Hi all,

I have been working with several different applications on a server which all are authenticating via JAAS handler over CAS. But now I need different realms for different applications. What should I do in order to do this?

I have seen that default realm is CAS.

private static final String DEFAULT_REALM = "CAS";

May I change this default realm via web.xml cas clients or http request parameters?

Thanks in advance
--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Andrew Feller]

Some javascript/style in this post has been disabled (why?)

In /WEB-INF/deployerConfigContext.xml, simply include additional authenticationHandlers of type JaasAuthenticationHandler for each JAAS realm you want to authenticate against.  Whenever someone attempts to login, CAS will try every authentication handler until one works, so I recommend ordering them by the most likely candidates first.

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm1" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm2" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm3" />
    </list>
</property>

HTH,
A-


On 7/6/09 9:53 AM, "Burak Oăuz" <burak.oguz@...> wrote:

> Hi all,
>
> I have been working with several different applications on a server which all
> are authenticating via JAAS handler over CAS. But now I need different realms
> for different applications. What should I do in order to do this?
>
> I have seen that default realm is CAS.
>
> private static final String DEFAULT_REALM = "CAS";
>
> May I change this default realm via web.xml cas clients or http request
> parameters?
>
> Thanks in advance

--
Andrew Feller, Analyst
LSU University Information Services
200 Frey Computing Services Center
Baton Rouge, LA 70803
Office: 225.578.3737
Fax: [phone]

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Burak Oguz]

Hi Andrew,

Thanks for your reply, but I wonder that may I pass some http GET parameters to CAS server from the applications that uses CAS client. I want to use different realms for my different applications. Is it possible like:

https://myserver:8181/cas/login?service=xxxxx&realm=myrealm

https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2

Thanks in advance..

On Mon, Jul 6, 2009 at 6:59 PM, Andrew Feller <[hidden email]> wrote:

In /WEB-INF/deployerConfigContext.xml, simply include additional authenticationHandlers of type JaasAuthenticationHandler for each JAAS realm you want to authenticate against.  Whenever someone attempts to login, CAS will try every authentication handler until one works, so I recommend ordering them by the most likely candidates first.

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm1" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm2" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm3" />
    </list>
</property>

HTH,
A-

On 7/6/09 9:53 AM, "Burak Oăuz" <burak.oguz@...> wrote:

> Hi all,
>
> I have been working with several different applications on a server which all
> are authenticating via JAAS handler over CAS. But now I need different realms
> for different applications. What should I do in order to do this?
>
> I have seen that default realm is CAS.
>
> private static final String DEFAULT_REALM = "CAS";
>
> May I change this default realm via web.xml cas clients or http request
> parameters?
>
> Thanks in advance

--

Andrew Feller, Analyst
LSU University Information Services
200 Frey Computing Services Center
Baton Rouge, LA 70803
Office: 225.578.3737
Fax: [phone]

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Andrew Feller]

Some javascript/style in this post has been disabled (why?)

Burak,

Hrmmm there is nothing out of the box to do that as far as I know.  However, if it is absolutely necessary, you could design a custom AuthenticationHandler based upon the JaasAuthenticationHandler that does what you want.  Unless there is an issue with App A authenticating with Realm X when it normally needs to authenticate to Realm Y, I would just setup the multiple realms and let CAS try all of them until it finds one that works.

Regards,
A-


On 7/7/09 2:00 AM, "Burak Oguz" <burak.oguz@...> wrote:

Hi Andrew,

Thanks for your reply, but I wonder that may I pass some http GET parameters to CAS server from the applications that uses CAS client. I want to use different realms for my different applications. Is it possible like:

https://myserver:8181/cas/login?service=xxxxx&realm=myrealm

https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2

Thanks in advance..

On Mon, Jul 6, 2009 at 6:59 PM, Andrew Feller <afelle1@...> wrote:

In /WEB-INF/deployerConfigContext.xml, simply include additional authenticationHandlers of type JaasAuthenticationHandler for each JAAS realm you want to authenticate against.  Whenever someone attempts to login, CAS will try every authentication handler until one works, so I recommend ordering them by the most likely candidates first.

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm1" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm2" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm3" />
    </list>
</property>

HTH,
A-



On 7/6/09 9:53 AM, "Burak Oăuz" <burak.oguz@... <http://burak.oguz@...> > wrote:

> Hi all,
>
> I have been working with several different applications on a server which all
> are authenticating via JAAS handler over CAS. But now I need different realms
> for different applications. What should I do in order to do this?
>
> I have seen that default realm is CAS.
>
> private static final String DEFAULT_REALM = "CAS";
>
> May I change this default realm via web.xml cas clients or http request
> parameters?
>
> Thanks in advance

--
Andrew Feller, Analyst
LSU University Information Services
200 Frey Computing Services Center
Baton Rouge, LA 70803
Office: 225.578.3737
Fax: [phone]

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Scott Battaglia-2]

Just a note/reminder, CAS is a single sign on server that has one major assumption: you've solved the problem of multiple sets of credentials and have one universal identifier across your organization.

If you have Admin in Realm X and Admin in Realm Y and they're two distinct people, then CAS is not your solution until you solve that problem.  If you have Admin in Realm X and there is no Admin anywhere else, then you're okay.

Cheers,
Scott

On Tue, Jul 7, 2009 at 8:27 AM, Andrew Feller <[hidden email]> wrote:

Burak,

Hrmmm there is nothing out of the box to do that as far as I know.  However, if it is absolutely necessary, you could design a custom AuthenticationHandler based upon the JaasAuthenticationHandler that does what you want.  Unless there is an issue with App A authenticating with Realm X when it normally needs to authenticate to Realm Y, I would just setup the multiple realms and let CAS try all of them until it finds one that works.

Regards,
A-

On 7/7/09 2:00 AM, "Burak Oguz" <burak.oguz@...> wrote:

Hi Andrew,

Thanks for your reply, but I wonder that may I pass some http GET parameters to CAS server from the applications that uses CAS client. I want to use different realms for my different applications. Is it possible like:

https://myserver:8181/cas/login?service=xxxxx&realm=myrealm

https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2

Thanks in advance..

On Mon, Jul 6, 2009 at 6:59 PM, Andrew Feller <afelle1@...> wrote:

In /WEB-INF/deployerConfigContext.xml, simply include additional authenticationHandlers of type JaasAuthenticationHandler for each JAAS realm you want to authenticate against.  Whenever someone attempts to login, CAS will try every authentication handler until one works, so I recommend ordering them by the most likely candidates first.

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm1" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm2" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm3" />
    </list>
</property>

HTH,
A-

On 7/6/09 9:53 AM, "Burak Oăuz" <burak.oguz@... <http://burak.oguz@...> > wrote:

> Hi all,
>
> I have been working with several different applications on a server which all
> are authenticating via JAAS handler over CAS. But now I need different realms
> for different applications. What should I do in order to do this?
>
> I have seen that default realm is CAS.
>
> private static final String DEFAULT_REALM = "CAS";
>
> May I change this default realm via web.xml cas clients or http request
> parameters?
>
> Thanks in advance

--
Andrew Feller, Analyst
LSU University Information Services
200 Frey Computing Services Center
Baton Rouge, LA 70803
Office: 225.578.3737
Fax: [phone]

-- 

You are currently subscribed to [hidden email] as: [hidden email]


To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Burak Oguz]

Thanks Scott for your reminder.. I have patched cas-server 3.3 to work with different realms in runtime and you are right about your note :).

For example I have an only admin application lets say app-a with jaas realm CAS and admin and general user application app-b with jaas realm APPB. Then when I want to reach app-b I have changed client api to redirect like that:

https://myserver:8181/cas/login?service=https://myserver:8181/app-b&realm=APPB

and this auth logs me in with APPB realm. But a general user (not admin) can reach admin only area too because of SSO structure. And when I use renew=true parameter for admin only application app-a this time it loses SSO structure.

I guess it is better to make this kind of authorization inside applications after SSO is done.

Thanks again..

On Tue, Jul 7, 2009 at 3:39 PM, Scott Battaglia <[hidden email]> wrote:

Just a note/reminder, CAS is a single sign on server that has one major assumption: you've solved the problem of multiple sets of credentials and have one universal identifier across your organization.

If you have Admin in Realm X and Admin in Realm Y and they're two distinct people, then CAS is not your solution until you solve that problem.  If you have Admin in Realm X and there is no Admin anywhere else, then you're okay.

Cheers,
Scott

On Tue, Jul 7, 2009 at 8:27 AM, Andrew Feller <[hidden email]> wrote:

Burak,

Hrmmm there is nothing out of the box to do that as far as I know.  However, if it is absolutely necessary, you could design a custom AuthenticationHandler based upon the JaasAuthenticationHandler that does what you want.  Unless there is an issue with App A authenticating with Realm X when it normally needs to authenticate to Realm Y, I would just setup the multiple realms and let CAS try all of them until it finds one that works.

Regards,
A-

On 7/7/09 2:00 AM, "Burak Oguz" <burak.oguz@...> wrote:

Hi Andrew,

Thanks for your reply, but I wonder that may I pass some http GET parameters to CAS server from the applications that uses CAS client. I want to use different realms for my different applications. Is it possible like:

https://myserver:8181/cas/login?service=xxxxx&realm=myrealm

https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2

Thanks in advance..

On Mon, Jul 6, 2009 at 6:59 PM, Andrew Feller <afelle1@...> wrote:

In /WEB-INF/deployerConfigContext.xml, simply include additional authenticationHandlers of type JaasAuthenticationHandler for each JAAS realm you want to authenticate against.  Whenever someone attempts to login, CAS will try every authentication handler until one works, so I recommend ordering them by the most likely candidates first.

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm1" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm2" />
        <bean id="kerberosActiveDirectory" class="org.jasig.cas.authentication.handler.support.JaasAuthenticationHandler" p:realm="realm3" />
    </list>
</property>

HTH,
A-

On 7/6/09 9:53 AM, "Burak Oăuz" <burak.oguz@... <http://burak.oguz@...> > wrote:

> Hi all,
>
> I have been working with several different applications on a server which all
> are authenticating via JAAS handler over CAS. But now I need different realms
> for different applications. What should I do in order to do this?
>
> I have seen that default realm is CAS.
>
> private static final String DEFAULT_REALM = "CAS";
>
> May I change this default realm via web.xml cas clients or http request
> parameters?
>
> Thanks in advance

--
Andrew Feller, Analyst
LSU University Information Services
200 Frey Computing Services Center
Baton Rouge, LA 70803
Office: 225.578.3737
Fax: [phone]

-- 

You are currently subscribed to [hidden email] as: [hidden email]




To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Michael Ströder]

If the requirement is that CAS clients access the CAS server with two
different URLs like

https://myserver:8181/cas/login?service=xxxxx&realm=myrealm

https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2

then one could also simply set up two CAS server instances with
different realm configurations in deployerConfigContext.xml and access
them from different CAS clients via

https://myserver:8181/casmyrealm/login?service=xxxxx

https://myserver:8181/casmyrealm2/login?service=yyyyy

Maybe I missed something though...

Ciao, Michael.


Scott Battaglia wrote:

> Just a note/reminder, CAS is a single sign on server that has one major
> assumption: you've solved the problem of multiple sets of credentials
> and have one universal identifier across your organization.
>
> If you have Admin in Realm X and Admin in Realm Y and they're two
> distinct people, then CAS is not your solution until you solve that
> problem.  If you have Admin in Realm X and there is no Admin anywhere
> else, then you're okay.
>
> Cheers,
> Scott
>
> On Tue, Jul 7, 2009 at 8:27 AM, Andrew Feller <[hidden email]
> <mailto:[hidden email]>> wrote:
>
>     Burak,
>
>     Hrmmm there is nothing out of the box to do that as far as I know.
>      However, if it is absolutely necessary, you could design a custom
>     AuthenticationHandler based upon the JaasAuthenticationHandler that
>     does what you want.  Unless there is an issue with App A
>     authenticating with Realm X when it normally needs to authenticate
>     to Realm Y, I would just setup the multiple realms and let CAS try
>     all of them until it finds one that works.
>
>     Regards,
>     A-
>
>     On 7/7/09 2:00 AM, "Burak Oguz" <[hidden email]
>     <http://burak.oguz@...>> wrote:
>
>         Hi Andrew,
>
>         Thanks for your reply, but I wonder that may I pass some http
>         GET parameters to CAS server from the applications that uses CAS
>         client. I want to use different realms for my different
>         applications. Is it possible like:
>
>         https://myserver:8181/cas/login?service=xxxxx&realm=myrealm
>         <https://myserver:8181/cas/login?service=xxxxx&realm=myrealm>
>
>         https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2
>         <https://myserver:8181/cas/login?service=yyyyy&realm=myrealm2>
>
>         Thanks in advance..

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user