I changed my ldap active directory config, removed the attribute repository
stuff and changed the type to AUTHENTICATED.
The below config seems to be working well for me while using surrogacy with
LDAPS Active Directory:
# set some properties we can re-use in authn and attributeRepository
configuration
ldap-url= ldaps://ad01.example.edu:636
ldap-binddn= cn=logon_ldap_user,ou=Application Users,ou=All_Users,dc
=example,dc=edu
ldap-bindpw= asdfasdfasdfasdfasdf
ldap-auth-type= AUTHENTICATED
ldap-basedn= ou=All_Users,dc=example,dc=edu
ldap-user-filter= (cn={user})
ldap-max-pool-size=20
ldap-tls=false
ldap-ssl=true
# configure ldap authentication
cas.authn.ldap[0].trustCertificates=file:/etc/cas/trustedexamplecert.der
cas.authn.ldap[0].base-dn=${ldap-basedn}
cas.authn.ldap[0].bind-credential=${ldap-bindpw}
cas.authn.ldap[0].bind-dn=${ldap-binddn}
cas.authn.ldap[0].ldap-url=${ldap-url}
cas.authn.ldap[0].max-pool-size=${ldap-max-pool-size}
cas.authn.ldap[0].min-pool-size=0
cas.authn.ldap[0].type=${ldap-auth-type}
cas.authn.ldap[0].searchFilter=${ldap-user-filter}
cas.authn.ldap[0].use-ssl=${ldap-ssl}
cas.authn.ldap[0].use-start-tls=${ldap-tls}
# list of attributes to be collected and mapped
cas.authn.ldap[0].principalAttributeList
=cn:commonName,sn:surname,displayName:displayName,mail:email,givenName,memberOf,samAccountName,mail:emailAddress,samAccountName
I had troubles getting surrogacy to work on previous versions with anything
put the JSON file method which works for our current purposes.
Thanks,
Robert Bond.
On Tuesday, October 8, 2019 at 11:14:06 AM UTC-5, rbon wrote:
>
> Surrogates is on my todo list. Hopefully some else with more experience
> will chime in.
>
> Ray
>
> On Tue, 2019-10-08 at 06:41 -0700, 'Robert Bond' via CAS Community wrote:
>
> No error messages on login. I do not think that is is expected behavior.
> When logging in as a surrogate it does not have duplicated values for the
> properties.
> See example below:
> cn [bansecr_bondr]
>
> The service registiries do not handle when there is duplicated values like
> the "cn [BONDR, BONDR]" that I am getting when I do not use surrogate
> access.
> I have 5 surrogates configured for my account in side the json file. When
> I disable surrogate access completely and remove the build.gradle
> dependency:
> compile "org.apereo.cas:cas-server-support-surrogate-webflow:${
> project.'cas.version'}"
> Cas then returns the attributes correctly as "cn [BONDR]"
>
> I think this is a bug. Any thoughts on how to better document and report
> it?
> Or maybe I have something wrong with my Active Directory
> LDAP attributeRepository config in cas.
>
>
> Thanks!
>
> On Monday, October 7, 2019 at 4:39:19 PM UTC-5, rbon wrote:
>
> Robert,
>
> Is log in failing? Any error messages?
>
> Could it be that the second entry is the surrogate; and if no surrogate is
> supplied in the log in form, then the same subject exists for both [that
> is, for the surrogate plugin, an array is required]?
>
> Ray
>
> On Mon, 2019-10-07 at 13:10 -0700, 'Robert Bond' via CAS Community wrote:
>
> Running into an odd doubling of attribute values when surrogate access is
> enabled.
> On CAS 6.1.0 RC6
>
>
> Here is my Surrogate config, Active Directory Auth config, and Attribute
> repository:
>
> # Surrogate config
> cas.authn.surrogate.separator=+
> cas.authn.surrogate.json.location=file:/etc/cas/config/surrogates.json
>
>
> # set some properties we can re-use in authn and attributeRepository
> configuration
> ldap-url= ldaps://ad01.example.edu:636
> ldap-binddn= cn=logon_ldap_user,ou=Application Users,ou=All_Users,dc
> =example,dc=edu
> ldap-bindpw= examplePass
> ldap-auth-type= DIRECT
> ldap-basedn= ou=All_Users,dc=example,dc=edu
> ldap-dnformat= cn=%s,ou=All_Users,dc=example,dc=edu
> ldap-user-filter= (cn={user})
> ldap-max-pool-size=20
> ldap-tls=false
> ldap-ssl=true
> # configure ldap authentication
> cas.authn.ldap[0].trustCertificates=file:/etc/cas/trustedexamplecert.der
> cas.authn.ldap[0].base-dn=${ldap-basedn}
> cas.authn.ldap[0].bind-credential=${ldap-bindpw}
> cas.authn.ldap[0].bind-dn=${ldap-binddn}
> cas.authn.ldap[0].dn-format=${ldap-dnformat}
> cas.authn.ldap[0].ldap-url=${ldap-url}
> cas.authn.ldap[0].max-pool-size=${ldap-max-pool-size}
> cas.authn.ldap[0].min-pool-size=0
> cas.authn.ldap[0].subtree-search=true
> cas.authn.ldap[0].type=${ldap-auth-type}
> cas.authn.ldap[0].searchFilter=${ldap-user-filter}
> cas.authn.ldap[0].use-ssl=${ldap-ssl}
> cas.authn.ldap[0].use-start-tls=${ldap-tls}
>
> # configure ldap attribute repository
> cas.authn.attributeRepository.ldap[0].trustCertificates
> =file:/etc/cas/trustedexamplecert.der
> cas.authn.attributeRepository.ldap[0].ldapUrl=${ldap-url}
> cas.authn.attributeRepository.ldap[0].order=0
> cas.authn.attributeRepository.ldap[0].useSsl=${ldap-ssl}
> cas.authn.attributeRepository.ldap[0].useStartTls=${ldap-tls}
> cas.authn.attributeRepository.ldap[0].baseDn=${ldap-basedn}
> cas.authn.attributeRepository.ldap[0].searchFilter=${ldap-user-filter}
> cas.authn.attributeRepository.ldap[0].subtreeSearch=true
> cas.authn.attributeRepository.ldap[0].bindDn=${ldap-binddn}
> cas.authn.attributeRepository.ldap[0].bindCredential=${ldap-bindpw}
> cas.authn.attributeRepository.ldap[0].minPoolSize=0
> cas.authn.attributeRepository.ldap[0].maxPoolSize=${ldap-max-pool-size}
> cas.authn.attributeRepository.ldap[0].validateOnCheckout=true
>
> # configure validator for attribute repository
> cas.authn.attributeRepository.ldap[0].validator.type=SEARCH
> cas.authn.attributeRepository.ldap[0].validator.baseDn=${ldap-basedn}
> cas.authn.attributeRepository.ldap[0].validator.searchFilter=(objectClass
> =*)
> cas.authn.attributeRepository.ldap[0].validator.scope=OBJECT
> cas.authn.attributeRepository.ldap[0].validator.attributeName=objectClass
> cas.authn.attributeRepository.ldap[0].validator.attributeValues=top
>
> # Get AD attributes
> cas.authn.attributeRepository.ldap[0].attributes.sAMAccountName
> =samAccountName
> cas.authn.attributeRepository.ldap[0].attributes.displayName=displayName
> cas.authn.attributeRepository.ldap[0].attributes.mail=email
> cas.authn.attributeRepository.ldap[0].attributes.mail=emailAddress
> cas.authn.attributeRepository.ldap[0].attributes.givenName=givenName
> cas.authn.attributeRepository.ldap[0].attributes.sn=surname
> cas.authn.attributeRepository.ldap[0].attributes.cn=commonName
> cas.authn.attributeRepository.ldap[0].attributes.memberOf=memberOf
>
>
> When the surrogacy dependency is added to build.gradle the
> attributeRepository returns doubled values for the attributes. See the
> example attributes below"
>
> cn [BONDR, BONDR]
> displayName [Robert Bond, Robert Bond]
> distinguishedName [CN=BONDR,OU=NSU,OU=All_Users,DC=example,DC=edu,
> CN=BONDR,OU=All_Users,DC=example,DC=edu]
>
>
> Any thoughts? When I remove the surrogate dependency from build.gradle it
> returns the attributes correctly. ex: cn [BONDR]
>
>
> Thanks!
>
> --
>
>
> Ray Bon
> Programmer Analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected]
>
> I respectfully acknowledge that my place of work is located within the
> ancestral, traditional and unceded territory of the Songhees, Esquimalt and
> WSÁNEĆ Nations.
>
> --
>
> Ray Bon
> Programmer Analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected] <javascript:>
>
> I respectfully acknowledge that my place of work is located within the
> ancestral, traditional and unceded territory of the Songhees, Esquimalt and
> WSÁNEĆ Nations.
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/289b7f01-8588-49c2-98c1-48f7d980d09a%40apereo.org.
