Cette page décrit l'installation de A à Z d'un nouveau serveur CAS qui permet :

• l'authentification transparente des utilisateurs par la transmission de tickets Kerberos
• l'alimentation automatique d'un royaume Kerberos à partir des utilisateurs LDAP lors de leur connexion

Il est facile pour un administrateur CAs d'extraire de cette documentation les éléments nécessaires à l'adaptation d'un serveur CAS existant pour lui donner les fonctionnalités voulues.

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <parent>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server</artifactId>
    <version>3.3.5</version>
  </parent>
  <modelVersion>4.0.0</modelVersion>
    <groupId>fr.univrennes1.cas</groupId>
    <artifactId>cas-server-rennes1</artifactId>
    <version>3.3.5</version>
    <packaging>war</packaging>
    <name>University of Rennes 1 CAS webapp</name>
    <organization>
        <name>University of Rennes 1</name>org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <parent>
    <groupId>org.jasig.cas</groupId>
    <artifactId>cas-server</artifactId>
    <version>3.3.5</version>
  </parent>
  <modelVersion>4.0.0</modelVersion>
    <groupId>fr.univrennes1.cas</groupId>
    <artifactId>cas-server-rennes1</artifactId>
    <version>3.3.5</version>
    <packaging>war</packaging>
    <name>University of Rennes 1 CAS webapp</name>
    <organization>
        <name>University of Rennes 1</name>
        <url>http://www.univ-rennes1.fr.fr</url>
    </organization>
    <description>The University of Rennes 1 customizations to the JA-SIG CAS server.</description>
    <dependencies>
        <dependency>
            <groupId>org.jasig.cas</groupId>
            <artifactId>cas-server-webapp</artifactId>
            <version>${project.version}</version>
            <type>war</type>
        </dependency>
        <dependency>
            <groupId>org.jasig.cas</groupId><url>http://www.univ-rennes1.fr.fr</url>
    </organization>
    <description>The University of  <artifactId>cas-server-core</artifactId>
            <version>${project.version}</version>Rennes 1 customizations to the JA-SIG CAS server.</description>
      <dependencies>
  </dependency>
      </dependencies><dependency>
    <build>
        <finalName>cas</finalName><groupId>org.jasig.cas</groupId>
        <plugins>
    <artifactId>cas-server-webapp</artifactId>
        <plugin>
    <version>${project.version}</version>
            <artifactId>maven-compiler-plugin</artifactId><type>war</type>
        </dependency>
        <version>RELEASE</version><dependency>
            <groupId>org.jasig.cas</groupId>
    <configuration>
        <artifactId>cas-server-core</artifactId>
            <source>1.5</source><version>${project.version}</version>
        </dependency>
      </dependencies>
      <target>1.5</target><build>
        <finalName>cas</finalName>
        </configuration><plugins>
            </plugin><plugin>
         </plugins>
    </build>   <artifactId>maven-compiler-plugin</artifactId>
    <repositories>
        <repository>
    <version>RELEASE</version>
        <id>jasig-repository</id>
        <configuration>
      <name>JA-SIG Maven2 Repository</name>
            <url>http://developer.ja-sig.org/maven2</url>
<source>1.5</source>
            </repository>
    </repositories>
    <reporting><target>1.5</target>
        <plugins>
        </configuration>
    <plugin>
        </plugin>
        <groupId>org.apache.maven.plugins</groupId></plugins>
    </build>
    <repositories>
        <artifactId>maven-project-info-reports-plugin</artifactId><repository>
            <<id>jasig-repository</plugin>id>
            <plugin>
<name>JA-SIG Maven2 Repository</name>
              <groupId>org.apache.maven.plugins</groupId><url>http://developer.ja-sig.org/maven2</url>
        </repository>
        <artifactId>maven-javadoc-plugin</artifactId></repositories>
    <reporting>
        </plugin><plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-changelogproject-info-reports-plugin</artifactId>
            </plugin>
            <plugin>
        </plugins>
        <groupId>org.apache.maven.plugins</groupId>
                </reporting>
</project>

log4j.appender.logfile.File=/var/log/tomcat5/

log4j.appender.logfile.File=/var/log/tomcat5/cas.log

Ne pas oublier de supprimer la ligne suivante de /etc/httpd/conf/httpd.conf :

Listen 80

[root@cas-kerb ~]# kadmin
Authenticating as principal rootifsic/admin@UNIV-RENNES1.FR with password.
kadmin: Client not found in Kerberos database while initializing kadmin interface
[rootifsic@cas-kerb ~]# kadmin -p root/admin
Authenticating as principal root/admin with password.
Password for root/admin@UNIV-RENNES1.FR:
kadmin:  addprinc -randkey HTTP/cas-kerb.univ-rennes1.fr
WARNING: no policy specified for HTTP/cas-kerb.univ-rennes1.fr@UNIV-RENNES1.FR; defaulting to no policy
Principal "HTTP/cas-kerb.univ-rennes1.fr@UNIV-RENNES1.FR" created.
kadmin:  ktadd -k /etc/http.keytab HTTP/cas-kerb.univ-rennes1.fr
Entry for principal HTTP/cas-kerb.univ-rennes1.fr with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/cas-kerb.univ-rennes1.fr with kvno 3, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/cas-kerb.univ-rennes1.fr with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/http.keytab.
Entry for principal HTTP/cas-kerb.univ-rennes1.fr with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/http.keytab.
kadmin:  exit
[root@cas-kerb ~]#

[root@cas-kerb ~]# cd /etc
[root@cas-kerb etc]# chown root:tomcat http.keytab
[root@cas-kerb etc]# chmod 640 http.keytab
[root@cas-kerb etc]#

Ajouter dans le fichier /etc/tomcat5/tomcat5.conf les lignes suivantes :

JAVA_OPTS="$JAVA_OPTS -Dcom.ibm.security.jgss.debug=all"
JAVA_OPTS="$JAVA_OPTS -Dsun.security.jgss.debug=true"
JAVA_OPTS="$JAVA_OPTS -Dsun.security.krb5.debug=true"
JAVA_OPTS="$JAVA_OPTS -Djava.security.debug=logincontext,policy,scl,gssloginconfig

Les logs se trouvent dans /var/log/tomcat5/catalina.out.

<decision-state id="gatewayRequestCheck">
  <if
      <bean classtest="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler">
	<property name="authentication">
	  <bean class="jcifs.spnego.Authentication${externalContext.requestParameterMap['gateway'] != '' &amp;&amp; externalContext.requestParameterMap['gateway'] != null &amp;&amp; flowScope.service != null}"
    then="redirect"
    else="startAuthenticate" />
	</property>
	<property name="principalWithDomainName" value="true" />
	<property name="NTLMallowed" value="false"/>
      </bean>
      <!--  ... the others authenticationHandlers... -->
    </list>
  </property>
</bean>decision-state>

<decision-state id="renewRequestCheck">
  <if
    test="${externalContext.requestParameterMap['renew'] != '' &amp;&amp; externalContext.requestParameterMap['renew'] != null}"
    then="startAuthenticate"
    else="generateServiceTicket" />
</decision-state>

<bean id="authenticationManager"        <bean class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
        <bean class="org.jasig.cas.support.spnego.authentication.principal.SpnegoCredentialsToPrincipalResolverAuthenticationManagerImpl" />
  <property name="credentialsToPrincipalResolvers">
    <list>
      </list>!--  ... the others credentialsToPrincipalResolvers ... -->
      <bean class="org.jasig.cas.support.spnego.authentication.principal.SpnegoCredentialsToPrincipalResolver" />
    </property>list>
  </property>
  <property name="authenticationHandlers">
      <list>
        <bean class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler">
	  <property name="authentication">
	    <bean class="jcifs.spnego.Authentication" />
	  </property>
	  <property name="principalWithDomainName" value="truefalse" />
	  <property name="NTLMallowed" value="false"/>
      </bean>
      <!-- <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler". the others authenticationHandlers... -->
    </list>
  </property>
</bean>

<bean   id="authenticationManager"
      p:httpClient-ref="httpClient" />
	<bean class="org.jasig.cas.adaptorsauthentication.ldap.FastBindLdapAuthenticationHandlerAuthenticationManagerImpl" >
          <property name="filtercredentialsToPrincipalResolvers" value="uid=%u,ou=people,dc=univ-rennes1,dc=fr" />
>
      <list>
       <property name="contextSource" ref="contextSource<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" />
        </bean><bean class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
      </list>
    </property>
</bean>

<bean name="jcifsConfig" class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSConfig">
  <property
      name="jcifsServicePrincipal"
      value="HTTP/cas-kerb.univ-rennes1.fr" />
  <property
      name="kerberosDebug"
      value="true" />
  <property
      name="kerberosRealm"
      value="UNIV-RENNES1.FR" />
  <property
      name="kerberosKdc"
      value="kerb1.univ-rennes1.fr" />
  <property
      name="loginConf"
      value="/etc/jcifs/login.conf" />
</bean>

com.sun.security.jgss.krb5.accept {
  com.sun.security.auth.module.Krb5LoginModule
  required
  debug=true
  storeKey=true
  useKeyTab=true
  keyTab="/etc/http.keytab"
  principal="HTTP/cas-kerb.univ-rennes1.fr";
};

JAVA_OPTS="$JAVA_OPTS -Djavax.security.auth.useSubjectCredsOnly=false"

[root@cas-kerb ~]# kadmin -p root/admin
Authenticating as principal root/admin with password.
Password for root/admin@UNIV-RENNES1.FR:
kadmin:  addprinc -randkey cas/admin
WARNING: no policy specified for cas/admin@UNIV-RENNES1.FR; defaulting to no policy
Principal "cas/admin@UNIV-RENNES1.FR" created.
kadmin:  ktadd -k /etc/cas-admin.keytab cas/admin
Entry for principal cas/admin with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/cas-admin.keytab.
Entry for principal cas/admin with kvno 3, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/cas-admin.keytab.
Entry for principal cas/admin with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/cas-admin.keytab.
Entry for principal cas/admin with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/cas-admin.keytab.
kadmin:  exit
[root@cas-kerb ~]#

[root@cas-kerb ~]# cd /etc
[root@cas-kerb etc]# chown root:tomcat cas-admin.keytab
[root@cas-kerb etc]# chmod 640 cas-admin.keytab
[root@cas-kerb etc]#

[root@cas-kerb ~]# cd /var/log
[root@cas-kerb log]# touch kadmind.log
[root@cas-kerb log]# chown root:tomcat kadmind.log
[root@cas-kerb log]# chmod 664 kadmind.log
[root@cas-kerb log]#

<dependency>
  <groupId>org.jasig.cas</groupId>
  <artifactId>cas-server-integration-kerberosfeed</artifactId>
  <version>${project.version}</version>
</dependency>

<bean class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
  <property name="filter" value="uid=%u,ou=people,dc=univ-rennes1,dc=fr" />
  <property name="contextSource" ref="contextSource" />
</bean>

<bean class="org.esupportail.cas.adaptors.kerberosfeed.KerberosFeedAuthenticationHandlerWrapper" >
  <property name="authenticationHandler">
    <bean class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
      <property name="filter" value="uid=%u,ou=people,dc=univ-rennes1,dc=fr" />
      <property name="contextSource" ref="contextSource" />
    </bean>
  </property>
  <property name="config" ref="kerberosFeedConfig" />
  <property name="registry" ref="kerberosFeedRegistry" />
</bean>

<bean
    id="kerberosFeedConfig"
    class="org.esupportail.cas.adaptors.kerberosfeed.KerberosFeedConfig">
  <property name="kadminPath" value="/usr/kerberos/bin/kadmin" />
  <property name="realm" value="UNIV-RENNES1.FR" />
  <property name="principal" value="cas/admin" />
  <property name="useKeytab" value="true" />
  <property name="keytab" value="/etc/cas-admin.keytab" />
  <!-- property name="password" value="secret" /-->
  <property name="passwordAllowedChars"
    value="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789&amp;~#{([-|`\\_^@)]=+}$%*!:/;.,?&gt;&lt;" />
</bean>

<bean
    id="kerberosFeedRegistry"
    class="org.esupportail.cas.adaptors.kerberosfeed.registry.BerkeleyDbRegistryImpl">
  <property name="dbPath" value="/tmp" />
</bean>