I have my Groovy authentication policy code being executed but I may be missing
something.
The script is only passed the authenticated principal from the authentication
context in GroovyScriptAuthenticationPolicy.java
cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java
private Optional<Exception> getScriptExecutionResult(final Authentication
auth) {
val args = CollectionUtils.wrap("principal", auth.getPrincipal(),
"logger", LOGGER);
executableScript.setBinding(args);
return executableScript.execute(args.values().toArray(),
Optional.class);
}
How would I evaluate the authentication handler results from a Groovy script if
I only have the principal?
I was able to create a workaround by applying the NotPreventedException policy
and using a Groovy password policy script to throw a Prevented Exception on
certain conditions.
It mostly works but it isn’t perfect and it seems like the authentication
policy is the root issue so I’d like to create a new one either through a
Groovy script or Java, if necessary.
Thanks,
Tom
From: 'Tom O'Neill' via CAS Community <[email protected]>
Sent: Tuesday, January 5, 2021 3:24 PM
To: [email protected]
Subject: [cas-user] Authentication Policy with Multiple Directories
CAUTION: This email originated from outside of SIG. Exercise caution when
opening attachments or clicking links, especially from unknown senders.
Hi All,
I re-read my message and realized immediately where the issue was.
Whenever properties “aren’t being read” it’s always because I’m missing a
dependency.
Since the password policy was covered by ‘cas-server-support-ldap’ I wasn’t
thinking when I switched to testing the authentication policy.
I added the following dependency and I see the log entries:
cas-server-support-generic
I’m going to see if I can use this approach to accomplish my goal.
Still open to suggestions.
Thanks,
Tom
From: 'Tom O'Neill' via CAS Community
<[email protected]<mailto:[email protected]>>
Sent: Tuesday, January 5, 2021 12:08 PM
To: [email protected]<mailto:[email protected]>
Subject: RE: [EXT] [cas-user] Authentication Policy with Multiple Directories
CAUTION: This email originated from outside of SIG. Exercise caution when
opening attachments or clicking links, especially from unknown senders.
Hi All,
I’ve done some additional digging and it seems like the easiest solution would
be to use a Groovy script for the authentication policy.
https://apereo.github.io/cas/6.3.x/installation/Configuring-Authentication-Components.html#authentication-policy
I may be missing something but I don’t see to be able to get CAS to execute the
a Groovy script.
I’ve tried setting the following property in my CAS config:
cas.authn.policy.groovy[0].script=file:/etc/cas/config/account.groovy
I modified the example so that it would output a message to the log and then
return NULL – just wanted to see it get invoked.
import java.util.*
import org.apereo.cas.authentication.exceptions.*
import javax.security.auth.login.*
def Exception run(final Object... args) {
def principal = args[0]
def logger = args[1]
logger.error(“***** Groovy Account Policy”)
return null;
}
The code doesn’t seem to get hit at all – no messages output in the log and the
default account policies are applied.
Any suggestions or guidance would be greatly appreciated.
I tried a Groovy password policy script and while it executed, it didn’t stop
the authentication chain from processing the second LDAP after authentication
fails on the first.
Thanks,
Tom
From: 'Tom O'Neill' via CAS Community
<[email protected]<mailto:[email protected]>>
Sent: Friday, January 1, 2021 3:51 PM
To: [email protected]<mailto:[email protected]>
Subject: [EXT] [cas-user] Authentication Policy with Multiple Directories
CAUTION: This email originated from outside of SIG. Exercise caution when
opening attachments or clicking links, especially from unknown senders.
[EXT-STAMP-ADDED]
Hi All,
I am working on a CAS 6.3 deployment where we need to configure multiple
directories for authentication using LDAP.
I have both LDAP sources configured and working with LPPE enabled but I need to
change the authentication behavior slightly.
If the user is found in the first directory and authentication fails, I need
the authentication process to stop.
The second directory should not be queried if the first has a user record with
a different password than what the user entered.
If no record is found for the user in the first directory, the authentication
process should continue on through the chain.
I thought I’d be able to use an existing Authentication Policy but I don’t see
any that match my goal.
https://apereo.github.io/cas/6.3.x/configuration/Configuration-Properties.html#authentication-policy
I don’t want it to allow ‘any’ and I don’t want to specify one or the other as
required.
LLPE doesn’t process the exception since there is no entry in the errorMap
object for ‘LOGON_FAILURE’.
After processing the first result CAS moves on to check the next ‘GENERIC’
directory:
2021-01-01 19:21:32,215 DEBUG
[org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] -
<Handling LDAP account state error [LOGON_FAILURE]>
2021-01-01 19:21:32,215 DEBUG
[org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] - <No
LDAP error mapping defined for [LOGON_FAILURE]>
2021-01-01 19:21:32,215 DEBUG
[org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] -
<Handling account state warning [null]>
2021-01-01 19:21:32,215 DEBUG
[org.apereo.cas.authentication.support.DefaultLdapAccountStateHandler] -
<Account state warning not defined>
2021-01-01 19:21:32,216 INFO
[org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <[AD]
exception details: [Invalid credentials].>
2021-01-01 19:21:32,216 DEBUG
[org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler]
- <Examining credential [UsernamePasswordCredential(username=testaccount,
source=null, customFields={})] eligibility for authentication handler [GENERIC]>
With so many configurable options, it seems like there should be a way to
accomplish this without writing code.
Right now I’m looking at modifying the DefaultAccountStateHandler to include a
mapping in errorMap for ‘LOGIN_FAILURE’.
I’m not 100% sure that will work the way I need it to but it seems like a
fairly straightforward option and modification.
Thanks!!
Tom
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected]<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB665506502F74EA8261B96008CBD50%40MN2PR02MB6655.namprd02.prod.outlook.com<https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB665506502F74EA8261B96008CBD50%40MN2PR02MB6655.namprd02.prod.outlook.com?utm_medium=email&utm_source=footer>.
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected]<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB66557E32B215C05438565D62CBD10%40MN2PR02MB6655.namprd02.prod.outlook.com<https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB66557E32B215C05438565D62CBD10%40MN2PR02MB6655.namprd02.prod.outlook.com?utm_medium=email&utm_source=footer>.
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected]<mailto:[email protected]>.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB665518378974CCA61E934818CBD10%40MN2PR02MB6655.namprd02.prod.outlook.com<https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB665518378974CCA61E934818CBD10%40MN2PR02MB6655.namprd02.prod.outlook.com?utm_medium=email&utm_source=footer>.
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/MN2PR02MB6655A2679440544F9BC39F68CBAE0%40MN2PR02MB6655.namprd02.prod.outlook.com.
