Hello,
I am deploying CAS 6.2.8 with WS-Federation IdP and I am kinda confused
by keystores configuration.
Official documentation
https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#ws-federation
says:
#
cas.authn.wsfed-idp.sts.signing-keystore-file=/etc/cas/config/ststrust.jks
# cas.authn.wsfed-idp.sts.signing-keystore-password=storepass
#
cas.authn.wsfed-idp.sts.encryption-keystore-file=/etc/cas/config/stsencrypt.jks
# cas.authn.wsfed-idp.sts.encryption-keystore-password=storepass
#
cas.authn.wsfed-idp.sts.realm.keystore-file=/etc/cas/config/stscasrealm.jks
# cas.authn.wsfed-idp.sts.realm.keystore-password=storepass
# cas.authn.wsfed-idp.sts.realm.keystore-alias=realmcas
# cas.authn.wsfed-idp.sts.realm.key-password=cas
# cas.authn.wsfed-idp.sts.realm.issuer=CAS
Properties should be actually written as
...wsfedIdp.sts.signingKeystoreFile, etc. but I am leaving them in the
form in which they are on the webpage.
I already looked into CAS docs and list, Fediz and CXF docs and I found
few examples like the above but no actual explanation what they are
setting up.
Can somebody please explain to me, what those keystores are for? From
what I figure:
* ...sts.signing-keystore-file / ...sts.encryption-keystore-file -
Those both are proper keystores, each containing exactly one private
key+cert; they are used in message signing (and encryption
respectively), analogically to two x509 certs used in SAML2. Is that
right?
* What is ...sts.realm.keystore-file used for?
* Why the realm keystore has explicit properties for unlocking private
key, but signing/encryption keystores do not have such thing?
* Fediz documentation even mentions STS truststore
(https://raw.githubusercontent.com/apache/cxf-fediz/master/examples/samplekeys/HowToGenerateKeysREADME.html)
but there seems to be no such thing in CAS configuration.
Thanks for the help. :)
Fiisch
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/328da0e0-8fb2-b862-7149-62ed9be8d5db%40gmail.com.
