Tim, Your regex is looking for dashboard at the end of the string or followed by / and some optional characters. Your service has dashboard followed by ,original... You could try this (\\z|/?.*) to make the / optional.
Ray On Tue, 2017-12-19 at 15:42 -0600, Tim Tyler wrote: Dave, others, Ok, I think I am getting closer but I am getting the error shown below. I should note that there was no etc/cas/services directory so I had to create the service directory manually before creating the etc/cas/services/CASAdminDashboard-123456789.json file. I included the port :8443 with the hostname. I assume I need it. I should also point out that I am using the equal sign format for variables in cas.properties. I am not sure how the colon format works or if it is even appropriate for cas.properties. I got this warning when starting up: <No registered service is found to match [org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl@514d45fe[id=https://cas.beloit.edu:8443/cas/status/dashboard,originalUrl=https://cas.beloit.edu:8443/cas/status/dashboard,artifactId=<null>,principal=<null>,loggedOutAlready=false,format=XML]] or service access is disallowed. Using default theme [cas-theme-default]> This is how the json entry for service looks: { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https://cas.beloit.edu:8443/cas/status/dashboard(\\z|/.*)", "name" : "CAS Admin Dashboard", "id" : 123456789, "description" : "CAS dashboard and administrative endpoints", "evaluationOrder" : 5000 } [cid:[email protected]] Tim From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of David Curry Sent: Tuesday, December 19, 2017 7:26 AM To: [email protected]<mailto:[email protected]> Subject: Re: [cas-user] how to access admin or management page? Here is one way to do it. It's not the only way, since CAS gives you so many options, but it should be enough to get you started. 1. Set these to enable the dashboard (these settings enable all of the endpoints; you can also pick and choose): cas.adminPagesSecurity.actuatorEndpointsEnabled: true cas.monitor.endpoints.enabled: true endpoints.enabled: true 2. Set this to a regular expression that matches the IP address(es) you want to allow access from: cas.adminPagesSecurity.ip: ^192\\.168\\.(50\\.[0-9]{1,3}|1\\.[12]0)$ (This example matches 192.168.50.*, 192.168.1.10, and 192.168.1.20; the intention is that the first pattern is the "IT subnet" where the administrators live, and the other two IPs are the internal IPs of the load balancers, which will be using the /status endpoint to check that the server is up and running.) 3. Set these to enable CAS authentication (as opposed to Spring Security) authentication: cas.monitor.endpoints.sensitive: false endpoints.sensitive: false The CAS documentation explains other alternatives, if you want to use Spring Security instead of CAS. 4. Configure CAS to perform the authentication: cas.adminPagesSecurity.loginUrl: ${cas.server.prefix}/login cas.adminPagesSecurity.service: ${cas.server.prefix}/status/dashboard cas.adminPagesSecurity.users: file:/etc/cas/config/admusers.properties cas.adminPagesSecurity.adminRoles[0]: ROLE_ADMIN 5. Create an admusers.properties file (use whatever name you gave it in the property above). List one user per line and give them whatever role you defined above. This files does NOT create new users, it just lists the usernames (which exist in LDAP or AD or whatever) who can access the dashboard. Their password is whatever they use when authenticating to the CAS server. In this case, it's a user named "gnarls": # This file lists the users who are allowed access to the CAS /status/* # endpoints ("adminpages"). # # The syntax for each line is: # # username=password,grantedAuthority[,grantedAuthority][,enabled|disabled] # gnarls=passwordnotused,ROLE_ADMIN 6. Create a service registry entry for the dashboard (in /etc/cas/services/CASAdminDashboard-123456789.json or wherever): { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https://casserver.your.dom.ain/cas/status/dashboard(\\z|/.*)<https://casserver.your.dom.ain/cas/status/dashboard(/z|/.*)>", "name" : "CAS Admin Dashboard", "id" : 123456789, "description" : "CAS dashboard and administrative endpoints", "evaluationOrder" : 5000 } Restart the server, point your web browser at https://casserver.your.dom.ain/cas/staus/dashboard, and log in as the user(s) you listed in the admusers.properties file. For a more detailed description (same steps, but more explanation behind them), see https://dacurry-tns.github.io/deploying-apereo-cas/building_server_dashboard_overview.html. --Dave -- DAVID A. CURRY, CISSP DIRECTOR OF INFORMATION SECURITY INFORMATION TECHNOLOGY 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003 +1 212 229-5300 x4728 • [email protected]<mailto:[email protected]> [The New School] On Mon, Dec 18, 2017 at 4:44 PM, Tim Tyler <[email protected]<mailto:[email protected]>> wrote: I am running CAS 5.2 and have configured ldap for authentication. But I still have not figured out how to access the admin or management page. What do I need to configure to login to the management page? Do I need to define an admin account? Do I need to define the Admin Status Endpoints per https://apereo.github.io/cas/5.0.x/installation/Configuration-Properties.html ? Do I need to create an adminusers.properties file? Can I define an existing ldap user as an admin to access the management page(s)? Tim Tyler Network Engineer Beloit College -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/357545e0243806517d1dac6eed8c06ee%40mail.gmail.com<https://groups.google.com/a/apereo.org/d/msgid/cas-user/357545e0243806517d1dac6eed8c06ee%40mail.gmail.com?utm_medium=email&utm_source=footer>. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CA%2Bd9XAON5qRK1A8U-3vgufMYby%2BOMQi_VsknpScpF2zbSHsqEQ%40mail.gmail.com<https://groups.google.com/a/apereo.org/d/msgid/cas-user/CA%2Bd9XAON5qRK1A8U-3vgufMYby%2BOMQi_VsknpScpF2zbSHsqEQ%40mail.gmail.com?utm_medium=email&utm_source=footer>. -- Ray Bon Programmer analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected] -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1513722264.1789.42.camel%40uvic.ca.
