I am wondering if the following is expected behavior. I am using CAS 5.1.2 and my cas.properties file includesthe following lines:
... cas.monitor.endpoints.enabled=true cas.monitor.endpoints.sensitive=false cas.adminPagesSecurity.ip=^11\.22\.33\.44$ ... cas.adminPagesSecurity.service=https://ssopre.taylor.edu/cas/status/dashboard cas.adminPagesSecurity.users=file:/etc/cas/config/adminusers.properties cas.adminPagesSecurity.adminRoles[0]=ROLE_ADMIN cas.adminPagesSecurity.actuatorEndpointsEnabled=true ... When using a workstation that does not have the IP address above, and pointing my browser to https://my_cas_server.here.edu/cas/status, I receive the expected HTTP 401 (Unauthorized) status code ("You did not say the magic word..."). However, if I point my browser to https://my_cas_server.here.edu/cas/status/dashboard, https://my_cas_server.here.edu/cas/status/ssosessions, or any other monitoring page under /cas/status/, I am able to see the status information (after authenticating with my ROLE_ADMIN credentials). Is this expected behavior? I would expect to receive the HTTP 401 status code for all of these unless my IP address matched the regex specified by cas.adminPagesSecurity.ip value. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/b5b98e79-3d07-4e3f-83ca-918dbe64a29b%40apereo.org.
