I did get it to work by reading the log files and checking them against the objectclass definition I wound up editing following line MUST ( uid $ casServiceUrlPattern $ cn ) to MUST ( uid $ description ) I was able to edit/duplicate/create service definitions after that. I think it’s kinda “hacky” though. I believe that CAS should have auto initialized, which it didn’t. Weather it’s my fault, a bug in the code, or a lapse in documentation, I am not sure. Thanks,
Erik Mallory Server Analyst Wichita State University From: <[email protected]> on behalf of "Bergner, Arnold" <[email protected]> Reply-To: "[email protected]" <[email protected]> Date: Monday, July 3, 2017 at 2:37 AM To: "[email protected]" <[email protected]> Subject: [cas-user] LDAP Service Registry Does not auto-intalize I had a similar problem and also used “description“ for the beginning. In the end, the string size allowed (1024) was too small. Now using 64k field, which seems ok. Cheers Arnold Von: [email protected] [mailto:[email protected]] Im Auftrag von Mallory, Erik Gesendet: Freitag, 30. Juni 2017 18:54 An: CAS Community <[email protected]> Betreff: [cas-user] LDAP Service Registry Does not auto-intalize Hello, I’ve have my CAS 5.1 instance configured to use a local (same machine) LDAP server for the CAS services registry. I extended the schema with attributes delineated at the end of this email, I also tested auto-initialization after removing the cas related objectclass and attributes. Still it failed. With the schema extended by hand, I was able to manually add a service definition via LDIF so I could gain access to the cas-management application and attempt to add a service definition from the web interface, with no luck. CAS is properly connecting to the servicesRegistry LDAP server. CAS is able to read values from the servicesRegistry LDAP server. CAS does not auto initialize the two base service definitions Apereo and HTTPS/IMAPS. I am unable to add new services to the servicesRegistry. Help with the above issues would be greatly appreciated. Related question: Do I need to extend the schema of my LDAP server with the casRegisteredService objectClass and related attibiuteTypes? Below are relevant configurations, logs and the casRegisteredService LDAP objectClass and attributeTypes: Thanks! Pom.xml <dependency> <groupId>org.apereo.cas</groupId> <artifactId>cas-server-support-ldap-service-registry</artifactId> <version>${cas.version}</version> </dependency> <cas.version>5.1.1</cas.version> application.properties ## #cas ldap service registry # cas.serviceRegistry.ldap.serviceDefinitionAttribute=description cas.serviceRegistry.ldap.idAttribute=uid cas.serviceRegistry.ldap.objectClass=casRegisteredService cas.serviceRegistry.ldap.ldapUrl=ldap://apptest-523.wichita.edu:389 cas.serviceRegistry.ldap.baseDn=ou=cas-services,dc=wichita,dc=edu cas.serviceRegistry.ldap.bindDn=cn=Directory Manager cas.serviceRegistry.ldap.bindCredential=derp cas.serviceRegistry.ldap.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider cas.serviceRegistry.ldap.connectTimeout=5000 cas.serviceRegistry.ldap.minPoolSize=2 cas.serviceRegistry.ldap.maxPoolSize=10 cas.serviceRegistry.ldap.validateOnCheckout=true cas.serviceRegistry.ldap.validatePeriodically=true cas.serviceRegistry.ldap.validatePeriod=600 cas.serviceRegistry.ldap.failFast=true cas.serviceRegistry.ldap.idleTime=500 cas.serviceRegistry.ldap.prunePeriod=600 cas.serviceRegistry.ldap.blockWaitTime=5000 # cas.serviceRegistry.ldap.trustCertificates= # cas.serviceRegistry.ldap.keystore= # cas.serviceRegistry.ldap.keystorePassword= # cas.serviceRegistry.ldap.keystoreType=JKS|JCEKS|PKCS12 cas.serviceRegistry.ldap.useSsl=false cas.serviceRegistry.ldap.useStartTls=false ## #JSON Service Registry # cas.serviceRegistry.watcherEnabled=true cas.serviceRegistry.repeatInterval=120000 cas.serviceRegistry.startDelay=15000 cas.serviceRegistry.initFromJson=true Relevant Log data: CAS.log 2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection factory for [ldap://apptest-523.wichita.edu:389]> 2017-06-30 11:37:33,561 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection configuration for [ldap://apptest-523.wichita.edu:389]> 2017-06-30 11:37:33,563 DEBUG [org.apereo.cas.configuration.support.Beans] - <Transformed LDAP urls from [ldap://apptest-523.wichita.edu:389] to [ldap://apptest-523 .wichita.edu:389]> 2017-06-30 11:37:33,571 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP SSL configuration via the native JVM truststore> 2017-06-30 11:37:33,572 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP bind connection initializer via [cn=Directory Manager]> 2017-06-30 11:37:33,598 DEBUG [org.apereo.cas.configuration.support.Beans] - <Creating LDAP connection pool configuration for [ldap://apptest-523.wichita.edu:389]> 2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] - <Created [BIND] passivator for [ldap://apptest-523.wichita.edu:389]> 2017-06-30 11:37:33,633 DEBUG [org.apereo.cas.configuration.support.Beans] - <Initializing ldap connection pool for [ldap://apptest-523.wichita.edu:389] and bindDn [cn=Directory Manager]> 2017-06-30 11:37:33,867 DEBUG [org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured search filter to [(uid={0})]> 2017-06-30 11:37:33,867 DEBUG [org.apereo.cas.adaptors.ldap.services.LdapServiceRegistryDao] - <Configured load filter to [(objectClass=casRegisteredService)]> 2017-06-30 11:37:33,885 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]> 2017-06-30 11:37:33,925 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry contains [0] service definitions> 2017-06-30 11:37:33,925 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Service registry will be auto-initialized from default JSON services> 2017-06-30 11:37:34,099 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Loading JSON services are [[id=10000002,name=Apereo,description=Apereo foundat ion sample service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>, id=10000001,name=HTTPS and IMAPS,description=This service definition authorized all application urls that support HTTPS and IMAPS protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>]]> 2017-06-30 11:37:34,099 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]> 2017-06-30 11:37:34,109 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000002)]> 2017-06-30 11:37:34,119 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service registry with the [id=10000002,name=Apereo,description=Apereo foundation sample service,serviceId=^https://www.apereo.org,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=apereo,evaluationOrder=1,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@3d0b9084[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@4e2c8ed7[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@65a0eb14[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@3da32be3,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@76bd7aca[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>] JSON service definition...> 2017-06-30 11:37:34,119 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000002)]> 2017-06-30 11:37:34,124 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(objectClass=casRegisteredService)]> 2017-06-30 11:37:34,126 DEBUG [org.apereo.cas.configuration.support.Beans] - <Constructed LDAP search filter [(uid=10000001)]> 2017-06-30 11:37:34,134 DEBUG [org.apereo.cas.services.ServiceRegistryInitializer] - <Initializing service registry with the [id=10000001,name=HTTPS and IMAPS,description=This service definition authorized all application urls that support HTTPS and IMAPS protocols.,serviceId=^(https|imaps)://.*,usernameAttributeProvider=org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider@d,theme=<null>,evaluationOrder=10000,logoutType=BACK_CHANNEL,attributeReleasePolicy=org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy@14a7d742[attributeFilter=<null>,principalAttributesRepository=org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository@30096ac1[],authorizedToReleaseCredentialPassword=false,authorizedToReleaseProxyGrantingTicket=false,excludeDefaultAttributes=false,principalIdAttribute=<null>,allowedAttributes=[]],accessStrategy=org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy@49dc16f[enabled=true,ssoEnabled=true,requireAllAttributes=true,requiredAttributes={},unauthorizedRedirectUrl=<null>,caseInsensitive=false,rejectedAttributes={}],publicKey=<null>,proxyPolicy=org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy@19eb86dd,logo=<null>,logoutUrl=<null>,requiredHandlers=[],properties={},multifactorPolicy=org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy@33dc59a4[multifactorAuthenticationProviders=[],failureMode=CLOSED,principalAttributeNameTrigger=<null>,principalAttributeValueToMatch=<null>,bypassEnabled=false],informationUrl=<null>,privacyUrl=<null>,<null>] JSON service definition...> dirsrv-access.log shows search only. attributeTypes: ( 1.3.6.1.4.1.6760.6.1.1 NAME 'casServiceUrlPattern' DESC 'Service URL pattern.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.2 NAME 'casServiceEnabled' DESC 'Service enabled flag.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.3 NAME 'casServiceSsoEnabled' DESC 'TRUE to participate in SSO, FALSE to force authentication.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.4 NAME 'casServiceAnonymousAccess' DESC 'TRUE to use opaque, anonymous identifier for NetID, FALSE otherwise.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.5 NAME 'casServiceAllowedToProxy' DESC 'TRUE to enable proxy authentication support, FALSE otherwise.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.6 NAME 'casServiceTheme' DESC 'Spring theme name to use for service.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.7 NAME 'casUsernameAttribute' DESC 'Attribute name whose value should be used for service-specific NetID.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.8 NAME 'casAllowedAttributes' DESC 'Names of attributes to be released to service. Facilitates service-specific attribute release.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.9 NAME 'casIgnoreAttributes' DESC 'TRUE to disable service-specific attribute release, FALSE otherwise. Supersedes casAllowedAttributes.' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.10 NAME 'casEvaluationOrder' DESC 'Numerical evaluation order of this service.' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.6760.6.1.11 NAME 'casRequiredHandlers' DESC 'Names of authentication handlers that must succeed to gain access to this service. Part of MFA support.' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) ######################################################## # Objectclasses below # ######################################################## objectClasses: ( 1.3.6.1.4.1.6760.6.2.1 SUP top STRUCTURAL NAME 'casRegisteredService' DESC 'CAS registered service.' MUST ( uid $ casServiceUrlPattern $ cn ) MAY ( description $ casServiceEnabled $ casServiceSsoEnabled $ casServiceAnonymousAccess $ casServiceAllowedToProxy $ casServiceTheme $ casUsernameAttribute $ casAllowedAttributes $ casIgnoreAttributes $ casEvaluationOrder $ casRequiredHandlers )) Erik Mallory Server Analyst Wichita State University -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7B902700-C2D6-48D8-909C-1D458B9BBA08%40wichita.edu<https://groups.google.com/a/apereo.org/d/msgid/cas-user/7B902700-C2D6-48D8-909C-1D458B9BBA08%40wichita.edu?utm_medium=email&utm_source=footer>. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/57427e4f2611471e8542f6211664fc3a%40hrz.tu-darmstadt.de<https://groups.google.com/a/apereo.org/d/msgid/cas-user/57427e4f2611471e8542f6211664fc3a%40hrz.tu-darmstadt.de?utm_medium=email&utm_source=footer>. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/D4111DE6-5360-4A10-A894-AEEDD15E2944%40wichita.edu.
