I believe this is the detail that is missing. I was following the https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties-Common.html#signing--encryption documentation. Didn't see the line at webflow about "The encryption key must be randomly-generated string of size f16. The signing key is a JWK <https://apereo.github.io/cas/5.3.x/installation/Configuration-Properties-Common.html#signing--encryption> of size 512."
openssl rand -base64 16 > webflow-enc.txt I had the -s, but lost it in the translation to google groups. On Thursday, September 13, 2018 at 4:12:26 PM UTC-4, David Curry wrote: > > The encryption key for Spring Webflow (cas.webflow.crypto.encryption.key) > is not a JSON Web Key. It's a randomly-generated string of 16 octets, > Base64-encoded. You can generate it with OpenSSL: > > openssl rand -base64 16 > webflow-enc.txt > > > Also, I believe you need a '-s' in front of the size argument for the > other three: > > java -jar jwk-gen.jar -t oct *-s* 256 -o tgc-enc.jwks > java -jar jwk-gen.jar -t oct *-s* 512 -o tgc-sig.jwks > java -jar jwk-gen.jar -t oct *-s* 512 -o webflow-sig.jwks > > > --Dave > > P.S. - I'm guessing on the '-s' issue; I used the web-based version of > the key generator rather than the jar file. > > -- > > DAVID A. CURRY, CISSP > *DIRECTOR OF INFORMATION SECURITY* > INFORMATION TECHNOLOGY > > 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003 > +1 212 229-5300 x4728 • [email protected] <javascript:> > > [image: The New School] > > > On Thu, Sep 13, 2018 at 4:01 PM Curtis Ruck <[email protected] > <javascript:>> wrote: > >> The problem is due to the chicken and egg issue. I need to prepopulate >> the cas.properties, so the service can start up and work (without human >> intervention). I'm trying my best to avoid having to start a service, >> parse the logs, and modify config, then restart the service. The >> documentation seems very light on these keys. >> >> On Thursday, September 13, 2018 at 10:03:02 AM UTC-4, William E. wrote: >>> >>> +1 >>> >>> I ended up grabbing values from the cas startup logs and setting in my >>> cas.properties. Seems to work. >>> >>> >>> On Wednesday, September 12, 2018 at 3:34:32 PM UTC-5, Curtis Ruck wrote: >>>> >>>> So i'm trying to automate the generation and persistence of the >>>> cas.tgc.crypto and cas.webflow.crypto encryption and signing keys. >>>> >>>> I'm using the jwk-gen.jar, and when i store the key in cas.properties, >>>> i end up with "Invalid AES key length: 43 bytes" when trying to access the >>>> login page. >>>> >>>> >>>> If I let CAS generate a key, its the same exact string length (43 >>>> bytes). What is different between my key versus cas's generated keys? Then >>>> i'm extracting the k value from the json, and inserting it into my >>>> cas.properties. >>>> >>>> java -jar jwk-gen.jar -t oct 256 -o tgc-enc.jwks >>>> java -jar jwk-gen.jar -t oct 512 -o tgc-sig.jwks >>>> java -jar jwk-gen.jar -t oct 256 -o webflow-enc.jwks >>>> java -jar jwk-gen.jar -t oct 512 -o webflow-sig.jwks >>>> >>> -- >> - Website: https://apereo.github.io/cas >> - Gitter Chatroom: https://gitter.im/apereo/cas >> - List Guidelines: https://goo.gl/1VRrw7 >> - Contributions: https://goo.gl/mh7qDG >> --- >> You received this message because you are subscribed to the Google Groups >> "CAS Community" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/a/apereo.org/d/msgid/cas-user/16619ee4-f77f-4436-9237-5a0e812bd17f%40apereo.org >> >> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/16619ee4-f77f-4436-9237-5a0e812bd17f%40apereo.org?utm_medium=email&utm_source=footer> >> . >> > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/b47cc34d-f6f6-46a1-8534-6f1c697c16b9%40apereo.org.
