Cette page décrit l'installation de A à Z d'un nouveau serveur CAS qui permet :

• l'authentification transparente des utilisateurs par la transmission de tickets Kerberos
• l'alimentation automatique d'un royaume Kerberos à partir des utilisateurs LDAP lors de leur connexion

Il est facile pour un administrateur CAs d'extraire de cette documentation les éléments nécessaires à l'adaptation d'un serveur CAS existant pour lui donner les fonctionnalités voulues.

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <parent>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server</artifactId>
    <version>3.3.5</version>
  </parent>
  <modelVersion>4.0.0</modelVersion>
    <groupId>fr.univrennes1.cas</groupId>
    <artifactId>cas-server-rennes1</artifactId>
    <version>3.3.5</version>
    <packaging>war</packaging>
    <name>University of Rennes 1 CAS webapp</name>
    <organization><project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <parent>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server</artifactId>
    <version>3.3.5</version>
  </parent>
  <modelVersion>4.0.0</modelVersion>
    <groupId>fr.univrennes1.cas</groupId>
    <artifactId>cas-server-rennes1</artifactId>
    <version>3.3.5</version>
    <packaging>war</packaging>
    <name>University of Rennes 1 CAS webapp</name>
    <organization>
        <name>University of Rennes 1</name>
        <url>http://www.univ-rennes1.fr.fr</url>
    </organization>
    <description>The University of Rennes 1 customizations to the JA-SIG CAS server.</description>
    <dependencies>
        <dependency>
<name>University of Rennes 1</name>
        <url>http://www.univ-rennes1.fr.fr</url>
    </organization>
    <description>The University of Rennes 1 customizations to the JA-SIG CAS server.</description>
    <dependencies>
        <dependency>
            <groupId>org.jasig.cas</groupId>
            <artifactId>cas-server-webapp</artifactId>
            <version>${project.version}</version>
            <type>war</type>
        </dependency>
        <dependency>
            <groupId>org.jasig.cas</groupId>
            <artifactId>cas-server-core</artifactId>
            <version>${project.version}</version>
        </dependency>
      </dependencies>
    <build>
        <finalName>cas</finalName>
        <plugins>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>RELEASE</version>
                <configuration>
                    <source>1.5</source>
                    <target>1.5</target>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <repositories>
        <repository>
            <id>jasig-repository</id>
            <name>JA-SIG Maven2 Repository</name>
            <url>http://developer.ja-sig.org/maven2</url>
        </repository>
    </repositories>
    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-changelog-plugin</artifactId>
            </plugin>
        </plugins>
    </reporting>
</project>

[root@cas-kerb ~]# cd /etc
[root@cas-kerb etc]# chown root:tomcat http.keytab
[root@cas-kerb etc]# chmod 640 http.keytab
[root@cas-kerb etc]#

Ajouter dans le fichier /etc/tomcat5/tomcat5.conf les lignes suivantes :

JAVA_OPTS="$JAVA_OPTS -Dcom.ibm.security.jgss.debug=all"
JAVA_OPTS="$JAVA_OPTS -Dsun.security.jgss.debug=true"
JAVA_OPTS="$JAVA_OPTS -Dsun.security.krb5.debug=true"
JAVA_OPTS="$JAVA_OPTS -Djava.security.debug=logincontext,policy,scl,gssloginconfig

Les logs se trouvent dans /var/log/tomcat5/catalina.out.

<decision-state id="renewRequestCheck">
  <if
    test="${externalContext.requestParameterMap['renew'] != '' &amp;&amp; externalContext.requestParameterMap['renew'] != null}"
    then="startAuthenticate"
    else="generateServiceTicket" />
</decision-state>

<bean
    id="negociateSpnego"
    

<bean id="authenticationManager" class="org.jasig.cas.authentication.AuthenticationManagerImpl">
  <property name="credentialsToPrincipalResolvers">
    <list>
      <!--  ... the others credentialsToPrincipalResolvers ... -->
      <bean class="org.jasig.cas.support.spnego.authentication.principal.SpnegoCredentialsToPrincipalResolver" />
    </list>
  </property>
  <property name="authenticationHandlers">
    <list>
      <bean class="org.jasig.cas.support.spnego.authenticationweb.handlerflow.support.JCIFSSpnegoAuthenticationHandlerSpnegoNegociateCredentialsAction" />
	<property name

<bean
    id="authenticationspnego">
	   <bean class="jcifsorg.spnego.Authentication" /jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction">
	</property>
	<property name="principalWithDomainNamecentralAuthenticationService" valueref="truecentralAuthenticationService" />
	<property name="NTLMallowed" value="false"/>
      </bean>
      <!--  ... the others authenticationHandlers... -->
    </list>
  </property>
</bean>

<bean   id="authenticationManager"
          p:httpClient-ref="httpClient" />
	<bean class="org.jasig.cas.adaptorsauthentication.ldap.FastBindLdapAuthenticationHandlerAuthenticationManagerImpl" >
          <property name="filter" value="uid=%u,ou=people,dc=univ-rennes1,dc=fr" /credentialsToPrincipalResolvers">
      <list>
    <property name="contextSource" ref="contextSource   <bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" />
        </bean> <bean class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
      </list>
    </property>
</bean>

<bean name="jcifsConfig" class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSConfig">
  <property
      name="jcifsServicePrincipal"
      value="HTTP/cas-kerb.univ-rennes1.fr" />
  <property
      name="kerberosDebug"
      value="true" />
  <property
      name="kerberosRealm"
      value="UNIV-RENNES1.FR" />
  <property
      name="kerberosKdc"
      value="kerb1.univ-rennes1.fr" />
  <property
      name="loginConf"
      value="/etc/jcifs/login.conf" />
</bean>

com.sun.security.jgss.krb5.accept {
  com.sun.security.auth.module.Krb5LoginModule
  required
  debug=true
  storeKey=true
  useKeyTab=true
  keyTab="/etc/http.keytab"
  principal="HTTP/cas-kerb.univ-rennes1.fr";
};

JAVA_OPTS="$JAVA_OPTS -Djavax.security.auth.useSubjectCredsOnly=false"

[root@cas-kerb ~]# kadmin -p root/admin
Authenticating as principal root/admin with password.
Password for root/admin@UNIV-RENNES1.FR:
kadmin:  addprinc -randkey cas/admin
WARNING: no policy specified for cas/admin@UNIV-RENNES1.FR; defaulting to no policy
Principal "cas/admin@UNIV-RENNES1.FR" created.
kadmin:  ktadd -k /etc/cas-admin.keytab

[root@cas-kerb ~]# cd /etc
[root@cas-kerb etc]# chown root:tomcat cas-admin.keytab.
Entry for principal cas/admin with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/cas-admin.keytab.
Entry for principal cas/admin with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/cas-admin.keytab.
kadmin:  exit
[root@cas-kerb etc]# chmod 640 cas-admin.keytab
[root@cas-kerb etc]#

[root@cas-kerb ~]# cd /var/log
[root@cas-kerb log]# touch kadmind.log
[root@cas-kerb log]# chown root:tomcat kadmind.log
[root@cas-kerb log]# chmod 664 kadmind.log
[root@cas-kerb ~log]#