RE: [cas-user] Re: Applying Custom Theme CAS 5.3.x

Fahmi, My guess is that you have not put the skelton_in_ID.properties file in the correct location. I believe it should be in the src/main/resources folder. Also, the setting you have for cas.messageBundle.baseNames doesn’t look right to me. The default setting is:

[cas-user] Re: Applying Custom Theme CAS 5.3.x

Hi Fahmi, Sorry I am not able to provide a solution to your problem. Mainly because there are not enough information provided. I can say for sure that 5.3.x custom theme do works (I am using 5.3.3 myself), so most likely it is not because of version problem, but is actually something in your

Re: [cas-user] Implementing a GRPC interface for CAS

You are more than welcome to contribute. Turn it into a CAS module and shoot a pull request. Some additional rants on the matter: https://apereo.github.io/2017/09/10/stop-writing-code/ --Misagh > From: "Jac Fitzgerald" > To: "CAS Community" > Sent: Thursday, September 27, 2018 2:24:15 PM

[cas-user] Implementing a GRPC interface for CAS

I would like to use CAS in our existing multi-service environment, where the default communication is through grpc. I was thinking that I could implement a grpc alternative to the existing REST Protocol (https://apereo.github.io/cas/5.0.x/protocol/REST-Protocol.html), and I can do it as an

Re: [cas-user] Re: CAS 5.3 build erro

Your issue is: No cached version of com.google.code.findbugs:annotations:2.0.0 available for offline mode. And yet you're using the --offline flag. Remove the flag and try again. --Misagh > From: "JF Poulin" > To: "CAS Community" > Sent: Thursday, September 27, 2018 2:18:37 PM > Subject:

[cas-user] Re: CAS 5.3 build error

The issue with google zxing and ANDROID_HOME seems to only happen when building on Windows. I couldn't find a solid answer as to the impact on the final build or any workarounds. I ended up moving my build environment to linux to get building working much more smoothly and without errors. On

[cas-user] CAS 5.3.3 log4j2 GelfLayout - too much information

I've been playing around sending logs to a Graylog server using the GelfLayout mechanism. It's working...too well. I discovered that the login password is being sent into the Graylog server as part of the GELF data. If I set the log level at warn, I get nothing at all, but at info, I get

[cas-user] CAS 5.3 build error

Hello, I followed the build process on CAS page, doing the build on Windows. This is my command, running from cas-server directory: gradlew build install --parallel -x test -x javadoc -x check -offline Here is the error. > Task :webapp:cas-server-webapp-eureka-server:compileJava Errors

Re: [cas-user] TARGET URL parameter associated with samlValidate can be misused to redirect to malicious sites (?)

I think Andy's right here... when I try this on my CAS server, which does *not* have the wildcard service registry entry, I get (correctly) redirected to the "Application not authorized to use SSO" page. --Dave -- DAVID A. CURRY, CISSP *DIRECTOR OF INFORMATION SECURITY* INFORMATION TECHNOLOGY

[cas-user] Re: Applying Custom Theme CAS 5.3.x

This customization is based on the link https://groups.google.com/a/apereo.org/forum/#!searchin/cas-user/themes/cas-user/k-yfoou7Zy0/BXry1PxgFAAJ. The directory structure is the same as the example you provided. But after rebuilding and try new theme, there is an error message: 2018-09-26

Re: [cas-user] TARGET URL parameter associated with samlValidate can be misused to redirect to malicious sites (?)

Hi Ganesh, There is a default service that will secretly enable all https based service called "HTTPSandIMAPS-1001.json" https://github.com/apereo/cas/blob/master/webapp/resources/services/HTTPSandIMAPS-1001.json Refer to this to how to disable such service:

[cas-user] Re: Applying Custom Theme CAS 5.3.x

Hi, it is a bit hard to look through your directory structure, so I can't really comment on that now. However, there are examples out there with successful custom theme implementation, maybe those will help you understand the directory better:

[cas-user] TARGET URL parameter associated with samlValidate can be misused to redirect to malicious sites (?)

Hi Ganesh, when I submit “/login?TARGET=https://yahoo.com” to our cas v5.2, I get an “application not authorized” error, so no redirection is happening. Maybe it’s a hole resulting from your service definitions? Regards, Arnold Von: cas-user@apereo.org

[cas-user] TARGET URL parameter associated with samlValidate can be misused to redirect to malicious sites (?)

Hi, We recently commissioned a third-party security audit of our application, and one of the findings was this: Cross-Site Redirection (Medium Impact, Moderate Difficulty in exploiting) If one pastes this string into the browser https://*cas.mydomain.com* /cas/login?TARGET=https://yahoo.com