tessl/maven-org-springframework-security--spring-security-cas

Spring Security support for Apereo's Central Authentication Service (CAS) enabling Single Sign-On authentication

—

Pending

Quality

Pending

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Pending

The risk profile of this skill

Overview

Eval results

Files

Spring Security CAS

Name: tessl/maven-org-springframework-security--spring-security-cas
Author: tessl

Spring Security CAS provides comprehensive integration with Apereo's Central Authentication Service (CAS) for Spring Security applications. This module enables Single Sign-On (SSO) authentication, allowing users to authenticate once with a CAS server and access multiple applications without re-entering credentials.

Package Information

Package Name: spring-security-cas
Package Type: Maven
Language: Java
Installation: Add Maven dependency:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-cas</artifactId>
    <version>6.5.1</version>
</dependency>

For Gradle:

implementation 'org.springframework.security:spring-security-cas:6.5.1'

Core Imports

import org.springframework.security.cas.authentication.CasAuthenticationProvider;
import org.springframework.security.cas.web.CasAuthenticationFilter;
import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
import org.springframework.security.cas.ServiceProperties;

Basic Usage

import org.springframework.security.cas.authentication.CasAuthenticationProvider;
import org.springframework.security.cas.web.CasAuthenticationFilter;
import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
import org.springframework.security.cas.ServiceProperties;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;

@Configuration
@EnableWebSecurity
public class CasSecurityConfig {

    @Bean
    public ServiceProperties serviceProperties() {
        ServiceProperties serviceProperties = new ServiceProperties();
        serviceProperties.setService("http://localhost:8080/login/cas");
        serviceProperties.setSendRenew(false);
        return serviceProperties;
    }

    @Bean
    public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {
        CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint();
        entryPoint.setLoginUrl("https://cas-server.example.com/cas/login");
        entryPoint.setServiceProperties(serviceProperties());
        return entryPoint;
    }

    @Bean
    public CasAuthenticationFilter casAuthenticationFilter() throws Exception {
        CasAuthenticationFilter filter = new CasAuthenticationFilter();
        filter.setAuthenticationManager(authenticationManager());
        filter.setServiceProperties(serviceProperties());
        return filter;
    }

    @Bean
    public CasAuthenticationProvider casAuthenticationProvider() {
        CasAuthenticationProvider provider = new CasAuthenticationProvider();
        provider.setServiceProperties(serviceProperties());
        provider.setTicketValidator(cas20ServiceTicketValidator());
        provider.setUserDetailsService(userDetailsService());
        provider.setKey("cas-authentication-provider");
        return provider;
    }
}

Architecture

Spring Security CAS integration is built around several key components:

Authentication Framework: CasAuthenticationProvider integrates with Spring Security's authentication architecture to validate CAS tickets and create authenticated principals
Web Filters: CasAuthenticationFilter processes CAS service tickets while CasAuthenticationEntryPoint redirects unauthenticated users to CAS login
Service Configuration: ServiceProperties and SamlServiceProperties define service URLs and CAS protocol parameters
Ticket Caching: StatelessTicketCache implementations provide performance optimization for stateless authentication scenarios
User Details Integration: Support for loading user details from CAS assertions via Spring Security's UserDetailsService framework
JSON Serialization: Jackson module enables session serialization in distributed environments

Capabilities

Core Configuration

Service properties and SAML configuration for defining CAS service parameters, authentication behavior, and protocol-specific settings.

public class ServiceProperties implements InitializingBean {
    public String getService();
    public void setService(String service);
    public boolean isSendRenew();
    public void setSendRenew(boolean sendRenew);
    public String getArtifactParameter();
    public void setArtifactParameter(String artifactParameter);
    public boolean isAuthenticateAllArtifacts();
    public void setAuthenticateAllArtifacts(boolean authenticateAllArtifacts);
}

public final class SamlServiceProperties extends ServiceProperties {
    public SamlServiceProperties();
}

Configuration

Authentication Provider and Tokens

CAS authentication provider and token implementations for integrating CAS ticket validation with Spring Security's authentication framework.

public class CasAuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
    public Authentication authenticate(Authentication authentication) throws AuthenticationException;
    public boolean supports(Class<?> authentication);
    public void setServiceProperties(ServiceProperties serviceProperties);
    public void setTicketValidator(TicketValidator ticketValidator);
    public void setUserDetailsService(UserDetailsService userDetailsService);
    public void setKey(String key);
}

public class CasAuthenticationToken extends AbstractAuthenticationToken implements Serializable {
    public CasAuthenticationToken(String key, Object principal, Object credentials, 
                                  Collection<? extends GrantedAuthority> authorities, 
                                  UserDetails userDetails, Assertion assertion);
    public Assertion getAssertion();
    public UserDetails getUserDetails();
    public int getKeyHash();
}

Authentication

Web Integration

Web filters and entry points for processing CAS authentication flows, handling service ticket validation, and managing gateway authentication.

public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    public CasAuthenticationFilter();
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) 
        throws AuthenticationException, IOException;
    public void setServiceProperties(ServiceProperties serviceProperties);
    public void setProxyReceptorUrl(String proxyReceptorUrl);
}

public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, InitializingBean {
    public void commence(HttpServletRequest servletRequest, HttpServletResponse response, 
                        AuthenticationException authenticationException) throws IOException;
    public void setLoginUrl(String loginUrl);
    public void setServiceProperties(ServiceProperties serviceProperties);
}

Web Integration

User Details Services

Specialized user details services for extracting user information and authorities from CAS assertions.

public abstract class AbstractCasAssertionUserDetailsService 
    implements AuthenticationUserDetailsService<CasAssertionAuthenticationToken> {
    public final UserDetails loadUserDetails(CasAssertionAuthenticationToken token);
    protected abstract UserDetails loadUserDetails(Assertion assertion);
}

public final class GrantedAuthorityFromAssertionAttributesUserDetailsService 
    extends AbstractCasAssertionUserDetailsService {
    public GrantedAuthorityFromAssertionAttributesUserDetailsService(String[] attributes);
    public void setConvertToUpperCase(boolean convertToUpperCase);
}

User Details

Ticket Caching

Stateless ticket caching implementations for performance optimization in clustered and stateless authentication scenarios.

public interface StatelessTicketCache {
    CasAuthenticationToken getByTicketId(String serviceTicket);
    void putTicketInCache(CasAuthenticationToken token);
    void removeTicketFromCache(CasAuthenticationToken token);
    void removeTicketFromCache(String serviceTicket);
}

public final class NullStatelessTicketCache implements StatelessTicketCache;
public class SpringCacheBasedTicketCache implements StatelessTicketCache {
    public SpringCacheBasedTicketCache(Cache cache);
}

Ticket Caching

JSON Serialization

Jackson module for serializing CAS authentication tokens and related objects in distributed session scenarios.

public class CasJackson2Module extends SimpleModule {
    public CasJackson2Module();
    public void setupModule(SetupContext context);
}

JSON Serialization

Common Exception Types

AuthenticationException - Base exception for authentication failures
BadCredentialsException - Invalid or expired CAS tickets
TicketValidationException - CAS server ticket validation failures
IllegalArgumentException - Configuration errors and invalid parameters

Dependencies

This module requires:

Spring Security Core (6.5.1+)
Spring Framework (6.0+)
CAS Client for Java (org.jasig.cas.client)
Jackson Core (for JSON serialization support)

Integration Notes

Configure CAS server URL in CasAuthenticationEntryPoint
Set service URL in ServiceProperties to match your application's callback URL
Implement or configure UserDetailsService for loading user authorities
Consider ticket caching for high-traffic stateless applications
Use CasGatewayAuthenticationRedirectFilter for optional SSO scenarios

Workspace: tessl
Visibility: Public
Created: 6 months ago
Last updated: about 2 months ago
Describes: pkg:maven/org.springframework.security/spring-security-cas@6.5.x
Publish Source: CLI
Badge