# Table of Contents - [CAS - JWT Service Tickets · Apereo CAS Documentation](#cas-jwt-service-tickets-apereo-cas-documentation) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Hello World – Apereo Community Blog](#hello-world-apereo-community-blog) - [Defining a Product Vision – Apereo Community Blog](#defining-a-product-vision-apereo-community-blog) - [CAS EOL Policy Proposal – Apereo Community Blog](#cas-eol-policy-proposal-apereo-community-blog) - [CAS Survey Results – Apereo Community Blog](#cas-survey-results-apereo-community-blog) - [MyUW (University of Wisconsin) Build Process – Apereo Community Blog](#myuw-university-of-wisconsin-build-process-apereo-community-blog) - [CAS 5.0.0-M3 Released – Apereo Community Blog](#cas-5-0-0-m3-released-apereo-community-blog) - [Veresk Software Architecture – Apereo Community Blog](#veresk-software-architecture-apereo-community-blog) - [Hope for GitHub Pages – Apereo Community Blog](#hope-for-github-pages-apereo-community-blog) - [CAS 5.0.0-RC1 Release – Apereo Community Blog](#cas-5-0-0-rc1-release-apereo-community-blog) - [Singing "I Love Bug Reports" – Apereo Community Blog](#singing-i-love-bug-reports-apereo-community-blog) - [CAS Git Repository Maintenance – Apereo Community Blog](#cas-git-repository-maintenance-apereo-community-blog) - [CAS 5.0.0-RC3 Released – Apereo Community Blog](#cas-5-0-0-rc3-released-apereo-community-blog) - [September 2016 Apereo Newsletter – Apereo Community Blog](#september-2016-apereo-newsletter-apereo-community-blog) - [Bootiful CAS 5 Overlay – Apereo Community Blog](#bootiful-cas-5-overlay-apereo-community-blog) - [About – Apereo Community Blog](#about-apereo-community-blog) - [Search – Apereo Community Blog](#search-apereo-community-blog) - [Say Hello – Apereo Community Blog](#say-hello-apereo-community-blog) - [Thanks For Your Message – Apereo Community Blog](#thanks-for-your-message-apereo-community-blog) - [Activating MFA in CAS 5 – Apereo Community Blog](#activating-mfa-in-cas-5-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [MyUW 2016-10-25 release – Apereo Community Blog](#myuw-2016-10-25-release-apereo-community-blog) - [uPortal 2016-11-14 Webproxy Portlet caching vulnerability – Apereo Community Blog](#uportal-2016-11-14-webproxy-portlet-caching-vulnerability-apereo-community-blog) - [MyUW in 2016 – Apereo Community Blog](#myuw-in-2016-apereo-community-blog) - [Guy walks into an Auto Shop – Apereo Community Blog](#guy-walks-into-an-auto-shop-apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Design Authentication Handlers in CAS 5.1.x – Apereo Community Blog](#design-authentication-handlers-in-cas-5-1-x-apereo-community-blog) - [Intro To CAS Auto Configuration Strategy – Apereo Community Blog](#intro-to-cas-auto-configuration-strategy-apereo-community-blog) - [Design CAS-Enabled Custom Protocols – Apereo Community Blog](#design-cas-enabled-custom-protocols-apereo-community-blog) - [Apereo CAS - Managing Services via Git – Apereo Community Blog](#apereo-cas-managing-services-via-git-apereo-community-blog) - [Apereo CAS - Simple Multifactor Authentication – Apereo Community Blog](#apereo-cas-simple-multifactor-authentication-apereo-community-blog) - [Apereo CAS - Service Matching Strategies – Apereo Community Blog](#apereo-cas-service-matching-strategies-apereo-community-blog) - [Apereo CAS - Service Redirection Strategies – Apereo Community Blog](#apereo-cas-service-redirection-strategies-apereo-community-blog) - [Apereo CAS 6.2.x - Building CAS Feature Modules – Apereo Community Blog](#apereo-cas-6-2-x-building-cas-feature-modules-apereo-community-blog) - [CAS 6.2.x Deployment - WAR Overlays – Apereo Community Blog](#cas-6-2-x-deployment-war-overlays-apereo-community-blog) - [Apereo CAS - OAuth JWT Access Tokens – Apereo Community Blog](#apereo-cas-oauth-jwt-access-tokens-apereo-community-blog) - [Apereo CAS - Google reCAPTCHA Integration – Apereo Community Blog](#apereo-cas-google-recaptcha-integration-apereo-community-blog) - [Apereo CAS - Managing Configuration Metadata – Apereo Community Blog](#apereo-cas-managing-configuration-metadata-apereo-community-blog) - [Apereo CAS - SAML2 Metadata Overrides – Apereo Community Blog](#apereo-cas-saml2-metadata-overrides-apereo-community-blog) - [Apereo CAS - Authentication Handler Resolution – Apereo Community Blog](#apereo-cas-authentication-handler-resolution-apereo-community-blog) - [Checking Out Pull Requests Locally – Apereo Community Blog](#checking-out-pull-requests-locally-apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Apereo Community Blog](#apereo-community-blog) - [Busting the Myth - GA Release – Apereo Community Blog](#busting-the-myth-ga-release-apereo-community-blog) - [CAS 5 LDAP AuthN and Jasypt Configuration – Apereo Community Blog](#cas-5-ldap-authn-and-jasypt-configuration-apereo-community-blog) - [CAS 5.0.x Deployment - WAR Overlays – Apereo Community Blog](#cas-5-0-x-deployment-war-overlays-apereo-community-blog) - [CAS 5 Database Authentication Tutorial – Apereo Community Blog](#cas-5-database-authentication-tutorial-apereo-community-blog) - [On The Theory of Possibility – Apereo Community Blog](#on-the-theory-of-possibility-apereo-community-blog) - [Apereo CAS 6.1.x - Credential Caching & Proxy AuthN – Apereo Community Blog](#apereo-cas-6-1-x-credential-caching-proxy-authn-apereo-community-blog) - [CAS Release Notes Moved – Apereo Community Blog](#cas-release-notes-moved-apereo-community-blog) - [Deploying Apereo CAS Behind a Proxy – Apereo Community Blog](#deploying-apereo-cas-behind-a-proxy-apereo-community-blog) - [CAS Multifactor Authentication with Duo Security – Apereo Community Blog](#cas-multifactor-authentication-with-duo-security-apereo-community-blog) - [Apereo CAS - Attribute-based Application Authorization – Apereo Community Blog](#apereo-cas-attribute-based-application-authorization-apereo-community-blog) - [Apereo CAS - Dances with Protocols – Apereo Community Blog](#apereo-cas-dances-with-protocols-apereo-community-blog) - [Apereo CAS Best [Mal]Practice - Supercharged Overlays – Apereo Community Blog](#apereo-cas-best-mal-practice-supercharged-overlays-apereo-community-blog) - [Apereo CAS - Test-Driving Feature Modules – Apereo Community Blog](#apereo-cas-test-driving-feature-modules-apereo-community-blog) - [Apereo CAS - Linking Accounts with Delegated Authentication – Apereo Community Blog](#apereo-cas-linking-accounts-with-delegated-authentication-apereo-community-blog) - [Apereo CAS - Access Strategy External URL Redirects – Apereo Community Blog](#apereo-cas-access-strategy-external-url-redirects-apereo-community-blog) - [Apereo CAS - Handling Multiple Logout URLs – Apereo Community Blog](#apereo-cas-handling-multiple-logout-urls-apereo-community-blog) - [Apereo CAS - Customized Settings – Apereo Community Blog](#apereo-cas-customized-settings-apereo-community-blog) - [Apereo CAS - Identity Impersonation – Apereo Community Blog](#apereo-cas-identity-impersonation-apereo-community-blog) - [CAS 5.3.x Deployment - WAR Overlays – Apereo Community Blog](#cas-5-3-x-deployment-war-overlays-apereo-community-blog) - [CAS Multifactor Authentication with Google Authenticator – Apereo Community Blog](#cas-multifactor-authentication-with-google-authenticator-apereo-community-blog) - [Apereo CAS - User Interface Customizations – Apereo Community Blog](#apereo-cas-user-interface-customizations-apereo-community-blog) - [Apereo CAS - Custom Authentication & Attribute Sources – Apereo Community Blog](#apereo-cas-custom-authentication-attribute-sources-apereo-community-blog) - [Apereo CAS - Administrative Endpoints & Monitoring – Apereo Community Blog](#apereo-cas-administrative-endpoints-monitoring-apereo-community-blog) - [Apereo CAS - Extending Webflows – Apereo Community Blog](#apereo-cas-extending-webflows-apereo-community-blog) - [Apereo CAS Swag with Swagger – Apereo Community Blog](#apereo-cas-swag-with-swagger-apereo-community-blog) - [Apereo CAS Delegated Authentication with ADFS – Apereo Community Blog](#apereo-cas-delegated-authentication-with-adfs-apereo-community-blog) - [Apereo CAS - Authentication Lifecycle Phases – Apereo Community Blog](#apereo-cas-authentication-lifecycle-phases-apereo-community-blog) - [Apereo CAS - MaxMind Geo2IP ISP Integration – Apereo Community Blog](#apereo-cas-maxmind-geo2ip-isp-integration-apereo-community-blog) - [Effective Software Troubleshooting Tactics – Apereo Community Blog](#effective-software-troubleshooting-tactics-apereo-community-blog) - [Apereo CAS - Multifactor Authentication with RADIUS – Apereo Community Blog](#apereo-cas-multifactor-authentication-with-radius-apereo-community-blog) - [Apereo CAS - Fun with HashiCorp Consul – Apereo Community Blog](#apereo-cas-fun-with-hashicorp-consul-apereo-community-blog) - [Apereo CAS - Spring Boot Admin Integration – Apereo Community Blog](#apereo-cas-spring-boot-admin-integration-apereo-community-blog) - [Apereo CAS - Integration with Spring Cloud Config Server – Apereo Community Blog](#apereo-cas-integration-with-spring-cloud-config-server-apereo-community-blog) - [Apereo CAS - Integration with HashiCorp Vault – Apereo Community Blog](#apereo-cas-integration-with-hashicorp-vault-apereo-community-blog) - [Apereo CAS - Configuration Management with MongoDb – Apereo Community Blog](#apereo-cas-configuration-management-with-mongodb-apereo-community-blog) - [Apereo CAS - Slurp Configuration with Groovy – Apereo Community Blog](#apereo-cas-slurp-configuration-with-groovy-apereo-community-blog) - [Apereo CAS - SAML2 Metadata with MongoDb – Apereo Community Blog](#apereo-cas-saml2-metadata-with-mongodb-apereo-community-blog) - [Apereo CAS 6 - Administrative Endpoints & Monitoring – Apereo Community Blog](#apereo-cas-6-administrative-endpoints-monitoring-apereo-community-blog) - [Apereo CAS - Jib at CAS Docker Images – Apereo Community Blog](#apereo-cas-jib-at-cas-docker-images-apereo-community-blog) - [CAS 6.0.x Deployment - WAR Overlays – Apereo Community Blog](#cas-6-0-x-deployment-war-overlays-apereo-community-blog) - [Apereo CAS 6.0.x - Building CAS Feature Modules – Apereo Community Blog](#apereo-cas-6-0-x-building-cas-feature-modules-apereo-community-blog) - [Apereo CAS - Have you been pawned? – Apereo Community Blog](#apereo-cas-have-you-been-pawned-apereo-community-blog) - [CAS 6.1.x Deployment - WAR Overlays – Apereo Community Blog](#cas-6-1-x-deployment-war-overlays-apereo-community-blog) - [Apereo CAS - SAML2 Identity Provider Integration w/ InCommon – Apereo Community Blog](#apereo-cas-saml2-identity-provider-integration-w-incommon-apereo-community-blog) - [Apereo CAS - Keeping Healthy with Spring Boot – Apereo Community Blog](#apereo-cas-keeping-healthy-with-spring-boot-apereo-community-blog) - [Apereo CAS - Custom Login Fields w/ Dynamic Bindings – Apereo Community Blog](#apereo-cas-custom-login-fields-w-dynamic-bindings-apereo-community-blog) - [Apereo CAS - Delegated Authentication to SAML2 Identity Providers – Apereo Community Blog](#apereo-cas-delegated-authentication-to-saml2-identity-providers-apereo-community-blog) - [Apereo CAS - Riffing on Attribute Release Policies – Apereo Community Blog](#apereo-cas-riffing-on-attribute-release-policies-apereo-community-blog) - [Apereo CAS 6.1.x - Building CAS Feature Modules – Apereo Community Blog](#apereo-cas-6-1-x-building-cas-feature-modules-apereo-community-blog) - [Apereo CAS 6.1.x - Attribute Repositories w/ Person Directory – Apereo Community Blog](#apereo-cas-6-1-x-attribute-repositories-w-person-directory-apereo-community-blog) - [Apereo CAS - SAML2 Metadata Query Protocol – Apereo Community Blog](#apereo-cas-saml2-metadata-query-protocol-apereo-community-blog) - [Apereo CAS - Webflow Decorations – Apereo Community Blog](#apereo-cas-webflow-decorations-apereo-community-blog) - [Apereo CAS - Configuration Security w/ Jasypt – Apereo Community Blog](#apereo-cas-configuration-security-w-jasypt-apereo-community-blog) - [Apereo CAS - Dockerized Hazelcast Deployments – Apereo Community Blog](#apereo-cas-dockerized-hazelcast-deployments-apereo-community-blog) - [Apereo CAS - Multifactor Provider Selection – Apereo Community Blog](#apereo-cas-multifactor-provider-selection-apereo-community-blog) - [Apereo CAS - REST API Integrations – Apereo Community Blog](#apereo-cas-rest-api-integrations-apereo-community-blog) - [Apereo CAS - Are We Logged In Yet? – Apereo Community Blog](#apereo-cas-are-we-logged-in-yet-apereo-community-blog) - [Apereo CAS - Handling Authentication Webflow Errors with Grace – Apereo Community Blog](#apereo-cas-handling-authentication-webflow-errors-with-grace-apereo-community-blog) - [Apereo CAS - Passwordless Authentication – Apereo Community Blog](#apereo-cas-passwordless-authentication-apereo-community-blog) - [Apereo CAS - SMS Notifications via Twilio – Apereo Community Blog](#apereo-cas-sms-notifications-via-twilio-apereo-community-blog) - [Apereo CAS - Ticket Distribution with JMS – Apereo Community Blog](#apereo-cas-ticket-distribution-with-jms-apereo-community-blog) - [Extending CAS 5 Webflows – Apereo Community Blog](#extending-cas-5-webflows-apereo-community-blog) - [Stop Writing Code – Apereo Community Blog](#stop-writing-code-apereo-community-blog) - [JWT Of All Things With CAS – Apereo Community Blog](#jwt-of-all-things-with-cas-apereo-community-blog) - [Multitenancy With CAS – Apereo Community Blog](#multitenancy-with-cas-apereo-community-blog) - [Introduction to CAS Commandline Shell – Apereo Community Blog](#introduction-to-cas-commandline-shell-apereo-community-blog) - [Apereo CAS SAML Integration With ADFS – Apereo Community Blog](#apereo-cas-saml-integration-with-adfs-apereo-community-blog) - [Do State The Obvious – Apereo Community Blog](#do-state-the-obvious-apereo-community-blog) - [CAS 5 - Maintaining Protocol Compatibility – Apereo Community Blog](#cas-5-maintaining-protocol-compatibility-apereo-community-blog) - [CAS 5 SAML2 Delegated AuthN Tutorial – Apereo Community Blog](#cas-5-saml2-delegated-authn-tutorial-apereo-community-blog) - [CAS 5.0.x Integration w/ Apache ZooKeeper – Apereo Community Blog](#cas-5-0-x-integration-w-apache-zookeeper-apereo-community-blog) - [Interrupt CAS With Class – Apereo Community Blog](#interrupt-cas-with-class-apereo-community-blog) - [August 2017 uPortal Slack summary – Apereo Community Blog](#august-2017-uportal-slack-summary-apereo-community-blog) - [Changes to CAS Security Vulnerability Response – Apereo Community Blog](#changes-to-cas-security-vulnerability-response-apereo-community-blog) - [Easier CLA submission – Apereo Community Blog](#easier-cla-submission-apereo-community-blog) - [Why does uPortal use Apache 2 license? – Apereo Community Blog](#why-does-uportal-use-apache-2-license-apereo-community-blog) - [feat(conventional_commits): signal breaking changes in commit titles – Apereo Community Blog](#feat-conventional-commits-signal-breaking-changes-in-commit-titles-apereo-community-blog) - [Nominate awesome fits for the Apereo board – Apereo Community Blog](#nominate-awesome-fits-for-the-apereo-board-apereo-community-blog) - [One Can Only Hope in Buchistan – Apereo Community Blog](#one-can-only-hope-in-buchistan-apereo-community-blog) - [Saving Time is Time Consuming – Apereo Community Blog](#saving-time-is-time-consuming-apereo-community-blog) - [Apereo CAS - Bootiful CAS Client – Apereo Community Blog](#apereo-cas-bootiful-cas-client-apereo-community-blog) - [CAS Multifactor Authentication with U2F and Bypass – Apereo Community Blog](#cas-multifactor-authentication-with-u2f-and-bypass-apereo-community-blog) - [Apereo CAS - Contribution Guidelines – Apereo Community Blog](#apereo-cas-contribution-guidelines-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Why you should choose CAS as your SSO system – Apereo Community Blog](#why-you-should-choose-cas-as-your-sso-system-apereo-community-blog) - [Apereo CAS - VMware Identity Manager SAML2 Integration – Apereo Community Blog](#apereo-cas-vmware-identity-manager-saml2-integration-apereo-community-blog) - [Apereo CAS - HappyFox SAML2 Integration – Apereo Community Blog](#apereo-cas-happyfox-saml2-integration-apereo-community-blog) - [Apereo CAS - Cisco Webex SAML2 Integration – Apereo Community Blog](#apereo-cas-cisco-webex-saml2-integration-apereo-community-blog) - [Apereo CAS - HireTouch SAML2 Integration – Apereo Community Blog](#apereo-cas-hiretouch-saml2-integration-apereo-community-blog) - [Apereo CAS - eLumen SAML2 Integration – Apereo Community Blog](#apereo-cas-elumen-saml2-integration-apereo-community-blog) - [Apereo CAS - Rave SAML2 Integration – Apereo Community Blog](#apereo-cas-rave-saml2-integration-apereo-community-blog) - [Apereo CAS - OohLala Mobile SAML2 Integration – Apereo Community Blog](#apereo-cas-oohlala-mobile-saml2-integration-apereo-community-blog) - [Apereo CAS - Cranium Cafe SAML2 Integration – Apereo Community Blog](#apereo-cas-cranium-cafe-saml2-integration-apereo-community-blog) - [Apereo CAS as an OAuth2 Authorization Server – Apereo Community Blog](#apereo-cas-as-an-oauth2-authorization-server-apereo-community-blog) - [Apereo CAS is now on Develocity – Apereo Community Blog](#apereo-cas-is-now-on-develocity-apereo-community-blog) - [Performance improvements on the service registry – Apereo Community Blog](#performance-improvements-on-the-service-registry-apereo-community-blog) - [Summer 2017 uPortal Roadmap Update – Apereo Community Blog](#summer-2017-uportal-roadmap-update-apereo-community-blog) - [Feedback on draft Apereo strategy – Apereo Community Blog](#feedback-on-draft-apereo-strategy-apereo-community-blog) - [CAS 5.1.x Load Tests by Lafayette College – Apereo Community Blog](#cas-5-1-x-load-tests-by-lafayette-college-apereo-community-blog) - [Forced Authentication with Apereo CAS – Apereo Community Blog](#forced-authentication-with-apereo-cas-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Apereo CAS - dotCMS SAML2 Integration – Apereo Community Blog](#apereo-cas-dotcms-saml2-integration-apereo-community-blog) - [Apereo CAS - Microsoft Office 365 SAML2 Integration – Apereo Community Blog](#apereo-cas-microsoft-office-365-saml2-integration-apereo-community-blog) - [Apereo CAS - Scripting Multifactor Authentication Triggers – Apereo Community Blog](#apereo-cas-scripting-multifactor-authentication-triggers-apereo-community-blog) - [Apereo CAS Dynamic Configuration Management – Apereo Community Blog](#apereo-cas-dynamic-configuration-management-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Apereo CAS Receives NLnet Grant to Advance CAS Development – Apereo Community Blog](#apereo-cas-receives-nlnet-grant-to-advance-cas-development-apereo-community-blog) - [Better by design 2017: Integrating accessibility across design and development lifecycle – Apereo Community Blog](#better-by-design-2017-integrating-accessibility-across-design-and-development-lifecycle-apereo-community-blog) - [Let Your Docker Containers Speak – Apereo Community Blog](#let-your-docker-containers-speak-apereo-community-blog) - [July 2017 uPortal Slack summary – Apereo Community Blog](#july-2017-uportal-slack-summary-apereo-community-blog) - [uPortal annual report, June 2018 edition – Apereo Community Blog](#uportal-annual-report-june-2018-edition-apereo-community-blog) - [Publish Private CAS Releases – Apereo Community Blog](#publish-private-cas-releases-apereo-community-blog) - [Get Productive with Shell Aliases – Apereo Community Blog](#get-productive-with-shell-aliases-apereo-community-blog) - [June 2017 uPortal Slack summary – Apereo Community Blog](#june-2017-uportal-slack-summary-apereo-community-blog) - [Apereo CAS - External Identity Providers – Apereo Community Blog](#apereo-cas-external-identity-providers-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS Spring Framework RCE Vulnerability Disclosure – Apereo Community Blog](#cas-spring-framework-rce-vulnerability-disclosure-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS 5.1.x User Swap - Cause and Analysis – Apereo Community Blog](#cas-5-1-x-user-swap-cause-and-analysis-apereo-community-blog) - [Apereo CAS - REFEDS MFA Profile with shib-cas-authn3 – Apereo Community Blog](#apereo-cas-refeds-mfa-profile-with-shib-cas-authn3-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Apereo CAS - Deployment Using systemd – Apereo Community Blog](#apereo-cas-deployment-using-systemd-apereo-community-blog) - [Apereo CAS - JMeter Performance Testing – Apereo Community Blog](#apereo-cas-jmeter-performance-testing-apereo-community-blog) - [Apereo CAS - Python Locust Load Testing – Apereo Community Blog](#apereo-cas-python-locust-load-testing-apereo-community-blog) - [CAS 5 Load Tests by Lafayette College – Apereo Community Blog](#cas-5-load-tests-by-lafayette-college-apereo-community-blog) - [Notes from Better by Design 2018 – Apereo Community Blog](#notes-from-better-by-design-2018-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Groovy Vulnerability Disclosure – Apereo Community Blog](#cas-groovy-vulnerability-disclosure-apereo-community-blog) - [CAS Log4J Vulnerability Disclosure – Apereo Community Blog](#cas-log4j-vulnerability-disclosure-apereo-community-blog) - [CAS Simple Multifactor Authentication Vulnerability Disclosure – Apereo Community Blog](#cas-simple-multifactor-authentication-vulnerability-disclosure-apereo-community-blog) - [CAS OAuth/OpenID Connect & WebAuthN Vulnerability Disclosure – Apereo Community Blog](#cas-oauth-openid-connect-webauthn-vulnerability-disclosure-apereo-community-blog) - [CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-oauth-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS JWT Authentication Vulnerability Disclosure – Apereo Community Blog](#cas-jwt-authentication-vulnerability-disclosure-apereo-community-blog) - [Apereo CAS 2019 Survey Results – Apereo Community Blog](#apereo-cas-2019-survey-results-apereo-community-blog) - [Shibbolizing Apereo CAS – Apereo Community Blog](#shibbolizing-apereo-cas-apereo-community-blog) - [MyUW in 2016 - by the numbers – Apereo Community Blog](#myuw-in-2016-by-the-numbers-apereo-community-blog) - [Apereo CAS - Password Management with JDBC – Apereo Community Blog](#apereo-cas-password-management-with-jdbc-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [CAS Codebase Overview – Apereo Community Blog](#cas-codebase-overview-apereo-community-blog) - [CAS Vulnerability Disclosure – Apereo Community Blog](#cas-vulnerability-disclosure-apereo-community-blog) - [Link CAS OIDC user to existing Database user – Apereo Community Blog](#link-cas-oidc-user-to-existing-database-user-apereo-community-blog) - [Java CAS Client JWT Vulnerability Disclosure – Apereo Community Blog](#java-cas-client-jwt-vulnerability-disclosure-apereo-community-blog) - [OpenID Federation with pac4j and CAS – Apereo Community Blog](#openid-federation-with-pac4j-and-cas-apereo-community-blog) - [CAS 5.1.0 RC1 Feature Release – Apereo Community Blog](#cas-5-1-0-rc1-feature-release-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS X.509 Vulnerability Disclosure – Apereo Community Blog](#cas-x-509-vulnerability-disclosure-apereo-community-blog) - [CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-oauth-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-oauth-openid-connect-vulnerability-disclosure-apereo-community-blog) - [CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog](#cas-oauth-openid-connect-vulnerability-disclosure-apereo-community-blog) - [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP) – Apereo Community Blog](#apereo-cas-saml2-identity-provider-integration-w-gitlab-also-starting-haproxy-and-ldap-apereo-community-blog) - [CAS 6.1.0 RC6 Feature Release – Apereo Community Blog](#cas-6-1-0-rc6-feature-release-apereo-community-blog) - [CAS 6.2.0 RC1 Feature Release – Apereo Community Blog](#cas-6-2-0-rc1-feature-release-apereo-community-blog) - [CAS 6.0.0 RC3 Feature Release – Apereo Community Blog](#cas-6-0-0-rc3-feature-release-apereo-community-blog) - [CAS 6.2.0 RC5 Feature Release – Apereo Community Blog](#cas-6-2-0-rc5-feature-release-apereo-community-blog) - [CAS 6.2.0 RC3 Feature Release – Apereo Community Blog](#cas-6-2-0-rc3-feature-release-apereo-community-blog) - [CAS 6.2.0 RC4 Feature Release – Apereo Community Blog](#cas-6-2-0-rc4-feature-release-apereo-community-blog) - [CAS 6.1.0 RC2 Feature Release – Apereo Community Blog](#cas-6-1-0-rc2-feature-release-apereo-community-blog) - [CAS 6.1.0 RC4 Feature Release – Apereo Community Blog](#cas-6-1-0-rc4-feature-release-apereo-community-blog) - [CAS 6.0.0 RC2 Feature Release – Apereo Community Blog](#cas-6-0-0-rc2-feature-release-apereo-community-blog) - [CAS 6.0.0 RC4 Feature Release – Apereo Community Blog](#cas-6-0-0-rc4-feature-release-apereo-community-blog) - [CAS 6.2.0 RC2 Feature Release – Apereo Community Blog](#cas-6-2-0-rc2-feature-release-apereo-community-blog) - [CAS 5.1.0 RC2 Feature Release – Apereo Community Blog](#cas-5-1-0-rc2-feature-release-apereo-community-blog) - [CAS 6.1.0 RC1 Feature Release – Apereo Community Blog](#cas-6-1-0-rc1-feature-release-apereo-community-blog) - [CAS 5.3.0 RC3 Feature Release – Apereo Community Blog](#cas-5-3-0-rc3-feature-release-apereo-community-blog) - [CAS 5.1.0 RC4 Feature Release – Apereo Community Blog](#cas-5-1-0-rc4-feature-release-apereo-community-blog) - [CAS 6.1.0 RC3 Feature Release – Apereo Community Blog](#cas-6-1-0-rc3-feature-release-apereo-community-blog) - [CAS 6.1.0 RC5 Feature Release – Apereo Community Blog](#cas-6-1-0-rc5-feature-release-apereo-community-blog) - [CAS 5.2.0 RC2 Feature Release – Apereo Community Blog](#cas-5-2-0-rc2-feature-release-apereo-community-blog) - [CAS 5.3.0 RC4 Feature Release – Apereo Community Blog](#cas-5-3-0-rc4-feature-release-apereo-community-blog) - [CAS 5.2.x Deployment - WAR Overlays – Apereo Community Blog](#cas-5-2-x-deployment-war-overlays-apereo-community-blog) - [CAS 5.2.0 RC3 Feature Release – Apereo Community Blog](#cas-5-2-0-rc3-feature-release-apereo-community-blog) - [CAS 5.3.0 RC1 Feature Release – Apereo Community Blog](#cas-5-3-0-rc1-feature-release-apereo-community-blog) - [CAS 5.2.0 RC1 Feature Release – Apereo Community Blog](#cas-5-2-0-rc1-feature-release-apereo-community-blog) - [CAS 5.1.0 RC3 Feature Release – Apereo Community Blog](#cas-5-1-0-rc3-feature-release-apereo-community-blog) - [CAS 5.3.0 RC2 Feature Release – Apereo Community Blog](#cas-5-3-0-rc2-feature-release-apereo-community-blog) - [CAS 5.2.0 RC4 Feature Release – Apereo Community Blog](#cas-5-2-0-rc4-feature-release-apereo-community-blog) - [CAS 6.0.0 RC1 Feature Release – Apereo Community Blog](#cas-6-0-0-rc1-feature-release-apereo-community-blog) - [All Posts – Apereo Community Blog](#all-posts-apereo-community-blog) --- # CAS - JWT Service Tickets · Apereo CAS Documentation [Skip to content](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#cas-docs-container) [See this page running on localhost](http://localhost:4000/cas/development/installation/Configure-ServiceTicket-JWT.html) [Edit with GitHub](https://github.com/apereo/cas/edit/master/docs/cas-server-documentation//installation/Configure-ServiceTicket-JWT.md/) [View commit history on GitHub](https://github.com/apereo/cas/commits/master/docs/cas-server-documentation//installation/Configure-ServiceTicket-JWT.md/) [Delete with GitHub](https://github.com/apereo/cas/delete/master/docs/cas-server-documentation//installation/Configure-ServiceTicket-JWT.md/) JWT Service Tickets =================== JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. CAS may also be allowed to fully create signed/encrypted JWTs and pass them back to the application in form of service tickets. JWTs are entirely self-contained and contain the authenticated principal as well as all authorized attributes in form of JWT claims. ![:information_source:](https://github.githubassets.com/images/icons/emoji/unicode/2139.png ":information_source:") **JCE Requirement** Make sure you have the proper JCE bundle installed in your Java environment that is used by CAS, specially if you need to use specific signing/encryption algorithms and methods. Be sure to pick the right version of the JCE for your Java version. Java versions can be detected via the `java -version` command. [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#overview) Overview ------------------------------------------------------------------------------------------------------------ JWT-based service tickets are issued to application based on the same semantics defined by the [CAS Protocol](https://apereo.github.io/cas/development/protocol/CAS-Protocol.html) . CAS having received an authentication request via its `/login` endpoint will conditionally issue back `JWT` service tickets to the application in form of a `ticket` parameter via the requested http method. All JWTs are by default signed and encrypted by CAS based on keys generated and controlled during deployment. Such keys may be exchanged with client applications to unpack the JWT and access claims. [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#flow-diagram) Flow Diagram -------------------------------------------------------------------------------------------------------------------- [![CAS Web flow JWT diagram](https://apereo.github.io/cas/development/images/cas_flow_jwt_diagram.png "CAS Web flow JWT diagram")](https://apereo.github.io/cas/development/images/cas_flow_jwt_diagram.png) Note that per the above diagram, the JWT request by default internally causes CAS to generate an `ST` for the application and immediately then validate it in order to get access to the authenticated principal and attributes per policies associated with the application registration record in the CAS service registry. This response is transformed into a `JWT` that is then passed onto the client application. In other words, the responsibility of receiving a service ticket (`ST`) and validating it is all moved into and handled internally by CAS. The application only needs to learn how to decipher and unpack the final `JWT` and ensure its validity. The expiration time of the generated `JWT` is controlled by the length of the assertion returned as part of the validation event. If the assertion validity length is not specified, then the expiration time is controlled by the length of the SSO session defined as part of SSO expiration policy of the CAS server. ![:warning:](https://github.githubassets.com/images/icons/emoji/unicode/26a0.png ":warning:") **Not OpenID Connect** Remember that you are just receiving a ticket in form of a JWT, thereby removing the need from your client to validate a normal service ticket. The ticket is internally validated by CAS and you as the client are only left in charge of validating the JWT itself. Do not confuse this with OpenID Connect. While a JWT, the token itself is not an ID token, cannot be refreshed and must be obtained again once you deem it expired. If you need more, consider using the OpenID Connect protocol instead. Note that the responsibility of validating the JWT is pushed onto **the client** and NOT the CAS server itself. [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#actuator-endpoints) Actuator Endpoints -------------------------------------------------------------------------------------------------------------------------------- The following endpoints are provided by CAS: GET jwtTicketSigningPublicKey Get public key for signing operations. 1 param Parameters | Name | In | Type | Description | | --- | --- | --- | --- | | `service` | query | – | The service to look up | Response Returns `String` Produces `text/plain` Java method `fetchPublicKey(String)` Defined in `JwtTokenCipherSigningPublicKeyEndpoint` Example request[](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#actuator-jwtticketsigningpublickey-get) 1 2 3 curl -u "casuser:password" \ -H "Accept: text/plain" \ "https://sso.example.org/cas/actuator/jwtTicketSigningPublicKey?service=..." Enable & expose SecuritySettings Spring Boot settings Troubleshooting 1 Turn the endpoint on and expose it over the web. One entry covers every operation. By default only `info`, `health` and `status` are exposed. .properties YAML Env vars 1 2 management.endpoint.jwtTicketSigningPublicKey.access=UNRESTRICTED management.endpoints.web.exposure.include=jwtTicketSigningPublicKey 1 2 3 4 5 6 7 8 management: endpoint: jwtTicketSigningPublicKey: access: "UNRESTRICTED" endpoints: web: exposure: include: "jwtTicketSigningPublicKey" 1 2 MANAGEMENT_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_ACCESS=UNRESTRICTED MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=jwtTicketSigningPublicKey Endpoints may be mapped to other paths. For example, to serve `health` at `healthcheck`: 1 management.endpoints.web.path-mapping.health=healthcheck Once exposed, every call goes through [Spring Security](https://spring.io/projects/spring-security) , and CAS decides access per endpoint. Without a rule, the special `defaults` endpoint applies, which denies access. Who may call it Authenticated Role IP address Anyone .properties YAML Env vars 1 cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.access=AUTHENTICATED 1 2 3 4 5 6 cas: monitor: endpoints: endpoint: jwtTicketSigningPublicKey: access: "AUTHENTICATED" 1 CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_ACCESS=AUTHENTICATED .properties YAML Env vars 1 2 cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.access=ROLE cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.required-roles=ADMIN 1 2 3 4 5 6 7 cas: monitor: endpoints: endpoint: jwtTicketSigningPublicKey: access: "ROLE" required-roles: "ADMIN" 1 2 CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_ACCESS=ROLE CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_REQUIREDROLES=ADMIN .properties YAML Env vars 1 2 cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.access=IP_ADDRESS cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.required-ip-addresses=127.0.0.1 1 2 3 4 5 6 7 cas: monitor: endpoints: endpoint: jwtTicketSigningPublicKey: access: "IP_ADDRESS" required-ip-addresses: "127.0.0.1" 1 2 CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_ACCESS=IP_ADDRESS CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_REQUIREDIPADDRESSES=127.0.0.1 .properties YAML Env vars 1 cas.monitor.endpoints.endpoint.jwtTicketSigningPublicKey.access=PERMIT 1 2 3 4 5 6 cas: monitor: endpoints: endpoint: jwtTicketSigningPublicKey: access: "PERMIT" 1 CAS_MONITOR_ENDPOINTS_ENDPOINT_JWTTICKETSIGNINGPUBLICKEY_ACCESS=PERMIT Where credentials are checked Basic JAAS LDAP JDBC JSON A single user defined in CAS settings. If the name and password are left undefined, CAS generates them at startup. .propertiesYAMLEnv vars 3 third-party settings Copy shown as .properties Spring Security3 `spring.security.user.name`Default user name. `user` Third party Default user name. Type `String` Default `user` Defined by `SecurityProperties$User` Copy `spring.security.user.password`Password for the default user name. no default Third party Password for the default user name. Type `String` Default _none_ Defined by `SecurityProperties$User` Copy `spring.security.user.roles`Granted roles for the default user name. no default Third party Granted roles for the default user name. Type `List` Default _none_ Defined by `SecurityProperties$User` Copy No settings match this filter. .propertiesYAMLEnv vars Keys below are relative to `cas.monitor.endpoints.jaas.` Copy shown as .properties General3 `login-config`JAAS login resource file. no default JAAS login resource file. Type `Resource` Default _none_ Defined by `JaasSecurityActuatorEndpointsMonitorProperties` Copy `login-context-name`The login context name should coincide with a given index in the login config specified. no default The login context name should coincide with a given index in the login config specified. This name is used as the index to the configuration specified in the login config property. JAASTest { org.springframework.security.authentication.jaas.TestLoginModule required; }; In the above example, `JAASTest` should be set as the context name. Type `String` Default _none_ Defined by `JaasSecurityActuatorEndpointsMonitorProperties` Copy `refresh-configuration-on-startup`If set, a call to Configuration#refresh() will be made by #configureJaas(Resource) method. `true` If set, a call to `Configuration#refresh()` will be made by `#configureJaas(Resource)` method. Type `Boolean` Default `true` Defined by `JaasSecurityActuatorEndpointsMonitorProperties` Copy No settings match this filter. .propertiesYAMLEnv vars All**81**Required**6**Optional**75**Duration**7** Keys below are relative to `cas.monitor.endpoints.ldap.` Copy required as .properties General50 `base-dn`Base DN to use. no default Required Base DN to use. There may be scenarios where different parts of a single LDAP tree could be considered as base-dns. Rather than duplicating the LDAP configuration block for each individual base-dn, each entry can be specified and joined together using a special delimiter character. The user DN is retrieved using the combination of all base-dn and DN resolvers in the order defined. DN resolution should fail if multiple DNs are found. Otherwise the first DN found is returned. Usual syntax is: `subtreeA,dc=example,dc=net|subtreeC,dc=example,dc=net`. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `bind-credential`The bind credential to use when connecting to LDAP. no default Required The bind credential to use when connecting to LDAP. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `bind-dn`The bind DN to use when connecting to LDAP. no default Required The bind DN to use when connecting to LDAP. LDAP connection configuration injected into the LDAP connection pool can be initialized with the following parameters: * `bindDn/bindCredential` provided - Use the provided credentials to bind when initializing connections. * `bindDn/bindCredential` set to `*` - Use a fast-bind strategy to initialize the pool. * `bindDn/bindCredential` set to blank - Skip connection initializing; perform operations anonymously. * SASL mechanism provided - Use the given SASL mechanism to bind when initializing connections. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `ldap-url`The LDAP url to the server. no default Required The LDAP url to the server. More than one may be specified, separated by space and/or comma. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `search-filter`User filter to use for searching. no default Required User filter to use for searching. Syntax is `cn={user}` or `cn={0}`. You may also provide an external groovy script in the syntax of `file:/path/to/GroovyScript.groovy` to fully build the final filter template dynamically. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `type`The authentication type. `AUTHENTICATED` Required The authentication type. * `AD` - Users authenticate with `sAMAccountName`. * `AUTHENTICATED` - Manager bind/search type of authentication. If {@code} principalAttributePassword} is empty then a user simple bind is done to validate credentials. Otherwise the given attribute is compared with the given `principalAttributePassword` using the `SHA` encrypted value of it. * `ANONYMOUS`: Similar semantics as `AUTHENTICATED` except no `bindDn` and `bindCredential` may be specified to initialize the connection. If `principalAttributePassword` is empty then a user simple bind is done to validate credentials. Otherwise the given attribute is compared with the given `principalAttributePassword` using the `SHA` encrypted value of it. * DIRECT: Direct Bind - Compute user DN from format string and perform simple bind. This is relevant when no search is required to compute the DN needed for a bind operation. Use cases for this type are: 1) All users are under a single branch in the directory, `e.g. ou=Users,dc=example,dc=org.` 2) The username provided on the CAS login form is part of the DN, e.g. `uid=%s,ou=Users,dc=example,dc=org`. Available values are as follows: * `AD`: Active Directory. * `AUTHENTICATED`: Authenticated Search. * `DIRECT`: Direct Bind. * `ANONYMOUS`: Anonymous Search. Type `AbstractLdapAuthenticationProperties.AuthenticationTypes` Default `AUTHENTICATED` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `allow-multiple-dns`Whether search/query results are allowed to match on multiple DNs, or whether a single unique DN is expected for the result. `false` Whether search/query results are allowed to match on multiple DNs, or whether a single unique DN is expected for the result. Type `Boolean` Default `false` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `allow-multiple-entries`Set if multiple Entries are allowed. `false` Set if multiple Entries are allowed. Type `Boolean` Default `false` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `binary-attributes`Indicate the collection of attributes that are to be tagged and processed as binary attributes by the underlying search resolver. no default Indicate the collection of attributes that are to be tagged and processed as binary attributes by the underlying search resolver. Type `List` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `block-wait-time`The length of time the pool will block. `PT3S` Duration The length of time the pool will block. By default the pool will block indefinitely and there is no guarantee that waiting threads will be serviced in the order in which they made their request. This option should be used with a blocking connection pool when you need to control the exact number of connections that can be created Type `String` Default `PT3S` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `connect-timeout`Sets the maximum amount of time that connects will block. `PT5S` Duration Sets the maximum amount of time that connects will block. Type `String` Default `PT5S` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `connection-strategy`If multiple URLs are provided as the ldapURL this describes how each URL will be processed. no default If multiple URLs are provided as the ldapURL this describes how each URL will be processed. * `ACTIVE_PASSIVE` First LDAP will be used for every request unless it fails and then the next shall be used. * `ROUND_ROBIN` For each new connection the next url in the list will be used. * `RANDOM` For each new connection a random LDAP url will be selected. * `DNS_SRV` LDAP urls based on DNS SRV records of the configured/given LDAP url will be used. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `deref-aliases`Define how aliases are de-referenced. no default Define how aliases are de-referenced. Accepted values are: * `NEVER` * `SEARCHING`: dereference when searching the entries beneath the starting point but not when searching for the starting entry. * `FINDING`: dereference when searching for the starting entry but not when searching the entries beneath the starting point. * `ALWAYS`: dereference when searching for the starting entry and when searching the entries beneath the starting point. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `disable-pooling`Whether to use a pooled connection factory in components. `false` Whether to use a pooled connection factory in components. Type `Boolean` Default `false` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `dn-format`Specify the dn format accepted by the AD authenticator, etc. no default Specify the dn format accepted by the AD authenticator, etc. Example format might be `uid=%s,ou=people,dc=example,dc=org`. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `enhance-with-entry-resolver`Whether specific search entry resolvers need to be set on the authenticator, or the default should be used. `true` Whether specific search entry resolvers need to be set on the authenticator, or the default should be used. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `fail-fast`Attempt to populate the connection pool early on startup and fail quickly if something goes wrong. `true` Attempt to populate the connection pool early on startup and fail quickly if something goes wrong. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `follow-referrals`Set if search referrals should be followed. `true` Set if search referrals should be followed. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `hostname-verifier`Hostname verification options. `DEFAULT` Hostname verification options. Available values are as follows: * `DEFAULT`: Default option, forcing verification. * `ANY`: Skip hostname verification and allow all. Type `AbstractLdapProperties.LdapHostnameVerifierOptions` Default `DEFAULT` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `idle-time`Removes connections from the pool based on how long they have been idle in the available queue. `PT10M` Duration Removes connections from the pool based on how long they have been idle in the available queue. Prunes connections that have been idle for more than the indicated amount. Type `String` Default `PT10M` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `keystore`Path to the keystore used for SSL connections. no default SpEL Path to the keystore used for SSL connections. Typically contains SSL certificates for the LDAP server. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `keystore-password`Keystore password. no default SpEL Keystore password. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `keystore-type`The type of keystore. no default The type of keystore. `PKCS12` or `JKS`. If left blank, defaults to the default keystore type indicated by the underlying Java platform. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `max-pool-size`Maximum LDAP connection pool size which the pool can use to grow. `10` Maximum LDAP connection pool size which the pool can use to grow. Type `Integer` Default `10` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `min-pool-size`Minimum LDAP connection pool size. `3` Minimum LDAP connection pool size. Size the pool should be initialized to and pruned to Type `Integer` Default `3` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `name`Name of the LDAP handler. no default Name of the LDAP handler. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `page-size`Request that the server return results in batches of a specific size. `0` Request that the server return results in batches of a specific size. See [RFC 2696](http://www.ietf.org/rfc/rfc2696.txt) . This control is often used to work around server result size limits. A negative/zero value disables paged requests. Type `Integer` Default `0` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `pool-passivator`You may receive unexpected LDAP failures, when CAS is configured to authenticate using DIRECT or AUTHENTICATED types and LDAP is locked down to not allow anonymous binds/searches. `BIND` You may receive unexpected LDAP failures, when CAS is configured to authenticate using `DIRECT` or `AUTHENTICATED` types and LDAP is locked down to not allow anonymous binds/searches. Every second attempt with a given LDAP connection from the pool would fail if it was on the same connection as a failed login attempt, and the regular connection validator would similarly fail. When a connection is returned back to a pool, it still may contain the principal and credentials from the previous attempt. Before the next bind attempt using that connection, the validator tries to validate the connection again but fails because it’s no longer trying with the configured bind credentials but with whatever user DN was used in the previous step. Given the validation failure, the connection is closed and CAS would deny access by default. Passivators attempt to reconnect to LDAP with the configured bind credentials, effectively resetting the connection to what it should be after each bind request. Furthermore if you are seeing errors in the logs that resemble a 'Operation exception encountered, reopening connection' type of message, this usually is an indication that the connection pool’s validation timeout established and created by CAS is greater than the timeout configured in the LDAP server, or more likely, in the load balancer in front of the LDAP servers. You can adjust the LDAP server session’s timeout for connections, or you can teach CAS to use a validity period that is equal or less than the LDAP server session’s timeout. Accepted values are: * `NONE`: No passivation takes place. * `BIND`: The default behavior which passivates a connection by performing a bind operation on it. This option requires the availability of bind credentials when establishing connections to LDAP. Type `String` Default `BIND` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `principal-attribute-password`If principalAttributePassword is empty then a user simple bind is done to validate credentials otherwise the given attribute is compared with the given principalAttributePassword using the SHA encrypted value of it. no default If principalAttributePassword is empty then a user simple bind is done to validate credentials otherwise the given attribute is compared with the given principalAttributePassword using the SHA encrypted value of it. For the anonymous authentication type, if principalAttributePassword is empty then a user simple bind is done to validate credentials otherwise the given attribute is compared with the given principalAttributePassword using the SHA encrypted value of it. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `prune-period`Removes connections from the pool based on how long they have been idle in the available queue. `PT2H` Duration Removes connections from the pool based on how long they have been idle in the available queue. Run the pruning process at the indicated interval. Type `String` Default `PT2H` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `resolve-from-attribute`If this attribute is set, the value found in the first attribute value will be used in place of the DN. no default If this attribute is set, the value found in the first attribute value will be used in place of the DN. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `response-timeout`Duration of time to wait for responses. `PT5S` Duration Duration of time to wait for responses. Type `String` Default `PT5S` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-authorization-id`SASL authorization id. no default SASL authorization id. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-mechanism`The SASL mechanism. no default The SASL mechanism. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-mutual-auth`Whether SASL mutual authentication is enabled. no default Whether SASL mutual authentication is enabled. Type `Boolean` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-quality-of-protection`SASL quality of protected. no default SASL quality of protected. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-realm`The SASL realm. no default The SASL realm. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `sasl-security-strength`SASL security strength. no default SASL security strength. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `search-entry-handlers`Search handlers. no default Search handlers. Type `List` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `subtree-search`Whether subtree searching is allowed. `true` Whether subtree searching is allowed. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `trust-certificates`Path of the trust certificates to use for the SSL connection. no default Path of the trust certificates to use for the SSL connection. Ignores keystore-related settings when activated and used. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `trust-manager`Trust Manager options. no default Trust Manager options. Trust managers are responsible for managing the trust material that is used when making LDAP trust decisions, and for deciding whether credentials presented by a peer should be accepted. Accepted values are: * `DEFAULT`: Enable and force the default JVM trust managers. * `ANY`: Trust any client or server. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `trust-store`Path to the keystore used to determine which certificates or certificate authorities should be trusted. no default SpEL Path to the keystore used to determine which certificates or certificate authorities should be trusted. Used when connecting to an LDAP server via LDAPS or startTLS connection. If left blank, the default truststore for the Java runtime is used. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `trust-store-password`Password needed to open the truststore. no default SpEL Password needed to open the truststore. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `trust-store-type`The type of trust keystore that determines which certificates or certificate authorities are trusted. no default The type of trust keystore that determines which certificates or certificate authorities are trusted. Types depend on underlying java platform, typically `PKCS12` or `JKS`. If left blank, defaults to the default keystore type indicated by the underlying Java platform. Type `String` Default _none_ Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `use-start-tls`Whether TLS should be used and enabled when establishing the connection. `false` Whether TLS should be used and enabled when establishing the connection. Type `Boolean` Default `false` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `validate-on-checkout`Whether connections should be validated when loaned out from the pool. `true` Whether connections should be validated when loaned out from the pool. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `validate-period`Period at which pool should be validated. `PT5M` Duration Period at which pool should be validated. Type `String` Default `PT5M` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `validate-periodically`Whether connections should be validated periodically when the pool is idle. `true` Whether connections should be validated periodically when the pool is idle. Type `Boolean` Default `true` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy `validate-timeout`Period at which validation operations may time out. `PT5S` Duration Period at which validation operations may time out. Type `String` Default `PT5S` Defined by `LdapSecurityActuatorEndpointsMonitorProperties` Copy Ldap Authz9 `ldap-authz.allow-multiple-results`Indicate whether the LDAP search query is allowed to return multiple entries. `false` Indicate whether the LDAP search query is allowed to return multiple entries. Type `Boolean` Default `false` Defined by `LdapAuthorizationProperties` Copy `ldap-authz.base-dn`Base DN to start the search. no default Base DN to start the search. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy `ldap-authz.group-attribute`Attribute expected to be found on the entry resulting from the group search whose value is going to be used to construct roles. no default Attribute expected to be found on the entry resulting from the group search whose value is going to be used to construct roles. The final value is always prefixed with `#groupPrefix`. This is useful in scenarios where you wish to grant access to a resource to all users who a member of a given group. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy `ldap-authz.group-base-dn`Base DN to start the search looking for groups. no default Base DN to start the search looking for groups. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy `ldap-authz.group-filter`Search filter to begin looking for groups. no default Search filter to begin looking for groups. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy `ldap-authz.group-prefix`A prefix that is prepended to the group attribute value to construct an authorized role. no default A prefix that is prepended to the group attribute value to construct an authorized role. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy `ldap-authz.role-attribute`Attribute expected to be found on the entry whose value is going to be used to construct roles. `uugid` Attribute expected to be found on the entry whose value is going to be used to construct roles. The final value is always prefixed with `#rolePrefix`. This is useful in scenarios where you wish to grant access to a resource to all users who carry a special attribute. Type `String` Default `uugid` Defined by `LdapAuthorizationProperties` Copy `ldap-authz.role-prefix`Prefix for the role. `ROLE_` Prefix for the role. Type `String` Default `ROLE_` Defined by `LdapAuthorizationProperties` Copy `ldap-authz.search-filter`LDAP search filter to locate accounts. no default LDAP search filter to locate accounts. Type `String` Default _none_ Defined by `LdapAuthorizationProperties` Copy Search Entry Handlers15 `search-entry-handlers[0].case-change.attribute-name-case-change`The Attribute name case change. no default The Attribute name case change. Type `String` Default _none_ Defined by `CaseChangeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].case-change.attribute-names`The Attribute names. no default The Attribute names. Type `List` Default _none_ Defined by `CaseChangeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].case-change.attribute-value-case-change`The Attribute value case change. no default The Attribute value case change. Type `String` Default _none_ Defined by `CaseChangeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].case-change.dn-case-change`The Dn case change. no default The Dn case change. Type `String` Default _none_ Defined by `CaseChangeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].dn-attribute.add-if-exists`The Add if exists. no default The Add if exists. Type `boolean` Default _none_ Defined by `DnAttributeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].dn-attribute.dn-attribute-name`The Dn attribute name. `entryDN` The Dn attribute name. Type `String` Default `entryDN` Defined by `DnAttributeSearchEntryHandlersProperties` Copy `search-entry-handlers[0].merge-attribute.attribute-names`The Attribute names. no default The Attribute names. Type `List` Default _none_ Defined by `MergeAttributesSearchEntryHandlersProperties` Copy `search-entry-handlers[0].merge-attribute.merge-attribute-name`The Merge attribute name. no default The Merge attribute name. Type `String` Default _none_ Defined by `MergeAttributesSearchEntryHandlersProperties` Copy `search-entry-handlers[0].primary-group-id.base-dn`The Base dn. no default The Base dn. Type `String` Default _none_ Defined by `PrimaryGroupIdSearchEntryHandlersProperties` Copy `search-entry-handlers[0].primary-group-id.group-filter`The Group filter. `(&(objectClass=group)(objectSid={0}))` The Group filter. Type `String` Default `(&(objectClass=group)(objectSid={0}))` Defined by `PrimaryGroupIdSearchEntryHandlersProperties` Copy `search-entry-handlers[0].recursive.merge-attributes`The Merge attributes. no default The Merge attributes. Type `List` Default _none_ Defined by `RecursiveSearchEntryHandlersProperties` Copy `search-entry-handlers[0].recursive.search-attribute`The Search attribute. no default The Search attribute. Type `String` Default _none_ Defined by `RecursiveSearchEntryHandlersProperties` Copy `search-entry-handlers[0].search-referral.limit`The default referral limit. `10` The default referral limit. Type `int` Default `10` Defined by `FollowReferralSearchEntryHandlersProperties` Copy `search-entry-handlers[0].search-result.limit`The default referral limit. `10` The default referral limit. Type `int` Default `10` Defined by `FollowResultSearchEntryHandlersProperties` Copy `search-entry-handlers[0].type`The type of search entry handler to choose. no default The type of search entry handler to choose. Available values are as follows: * `FOLLOW_SEARCH_REFERRAL`: Provides handling of an ldap referral for search operations. * `FOLLOW_SEARCH_RESULT_REFERENCE`: Provides handling of an ldap continuation reference for search operations. * `ACTIVE_DIRECTORY`: Process the entry results fetched from active directory and check for account status controls for disabled/expired accounts, etc. * `OBJECT_GUID`: Object guid search entry handler. Handles the `objectGUID` attribute fetching and conversion. * `OBJECT_SID`: Object sid search entry handler. Handles the `objectSid` attribute fetching and conversion. * `CASE_CHANGE`: Case change search entry handler. Provides the ability to modify the case of search entry DNs, attribute names, and attribute values. * `DN_ATTRIBUTE_ENTRY`: DN attribute entry handler. Adds the entry DN as an attribute to the result set. Provides a client side implementation of RFC 5020. * `MERGE`: Merge search entry handler. Merges the values of one or more attributes into a single attribute. * `PRIMARY_GROUP`: Primary group search handler. Constructs the primary group SID and then searches for that group and puts it's DN in the `memberOf` attribute of the original search entry. * `RANGE_ENTRY`: Range entry search handler. Rewrites attributes returned from Active Directory to include all values by performing additional searches. * `RECURSIVE_ENTRY`: Recursive entry search handler. This recursively searches based on a supplied attribute and merges those results into the original entry. * `MERGE_ENTRIES`: Merge entries handler. Merges the values of one or more attributes in all entries into a single attribute. The merged attribute may or may not already exist on the entry. If it does exist it's existing values will remain intact. Type `LdapSearchEntryHandlersProperties.SearchEntryHandlerTypes` Default _none_ Defined by `LdapSearchEntryHandlersProperties` Copy Validator7 `validator.attribute-name`Attribute name to use for the compare validator. `objectClass` Attribute name to use for the compare validator. Type `String` Default `objectClass` Defined by `LdapValidatorProperties` Copy `validator.attribute-value`Attribute values to use for the compare validator. `top` Attribute values to use for the compare validator. Type `String` Default `top` Defined by `LdapValidatorProperties` Copy `validator.base-dn`Base DN to use for the search request of the search validator. no default Base DN to use for the search request of the search validator. Type `String` Default _none_ Defined by `LdapValidatorProperties` Copy `validator.dn`DN to compare to use for the compare validator. no default DN to compare to use for the compare validator. Type `String` Default _none_ Defined by `LdapValidatorProperties` Copy `validator.scope`Search scope to use for the search request of the search validator. `OBJECT` Search scope to use for the search request of the search validator. Type `String` Default `OBJECT` Defined by `LdapValidatorProperties` Copy `validator.search-filter`Search filter to use for the search request of the search validator. `(objectClass=*)` Search filter to use for the search request of the search validator. Type `String` Default `(objectClass=*)` Defined by `LdapValidatorProperties` Copy `validator.type`Determine the LDAP validator type. `search` Determine the LDAP validator type. The following LDAP validators can be used to test connection health status: * `search`: Validates a connection is healthy by performing a search operation. Validation is considered successful if the search result size is greater than zero. * `none`: No validation takes place. * `compare`: Validates a connection is healthy by performing a compare operation. Type `String` Default `search` Defined by `LdapValidatorProperties` Copy No settings match this filter. LDAP & Active Directory #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#ldap-scriptable-search-filter) LDAP Scriptable Search Filter LDAP search filters can point to an external Groovy script to dynamically construct the final filter template. The script itself may be designed as: 1 2 3 4 5 6 7 8 9 import org.ldaptive.* import org.springframework.context.* def run(Object[] args) { def (filter,parameters,applicationContext,logger) = args logger.info("Configuring LDAP filter") filter.setFilter("uid=something") } The following parameters are passed to the script: | Parameter | Description | | --- | --- | | `filter` | `FilterTemplate` to be updated by the script and used for the LDAP query. | | `parameters` | Map of query parameters which may be used to construct the final filter. | | `applicationContext` | Reference to the Spring `ApplicationContext` reference. | | `logger` | The object responsible for issuing log messages such as `logger.info(...)`. | To prepare CAS to support and integrate with Apache Groovy, please [review this guide](https://apereo.github.io/cas/development//integration/Apache-Groovy-Scripting.html) . .propertiesYAMLEnv vars All**41**Required**6**Optional**35**Duration**6** Keys below are relative to `cas.monitor.endpoints.jdbc.` Copy required as .properties General26 `driver-class`The JDBC driver used to connect to the database. `org.hsqldb.jdbcDriver` Required The JDBC driver used to connect to the database. Type `String` Default `org.hsqldb.jdbcDriver` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `password`The database connection password. no default Required The database connection password. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `url`The database connection URL. `jdbc:hsqldb:mem:cas-hsql-database` RequiredSpEL The database connection URL. Type `String` Default `jdbc:hsqldb:mem:cas-hsql-database` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `user`The database user. `sa` Required The database user. The database user must have sufficient permissions to be able to handle schema changes and updates, when needed. Type `String` Default `sa` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `autocommit`The default auto-commit behavior of connections in the pool. `false` The default auto-commit behavior of connections in the pool. Determined whether queries such as update/insert should be immediately executed without waiting for an underlying transaction. Type `Boolean` Default `false` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `batch-size`A non-zero value enables use of JDBC2 batch updates by Hibernate. e.g. recommended values between 5 and 30. `100` A non-zero value enables use of JDBC2 batch updates by Hibernate. e.g. recommended values between 5 and 30. Type `Integer` Default `100` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `connection-timeout`Indicates the maximum number of milliseconds that the service can wait to obtain a connection. `PT30S` Duration Indicates the maximum number of milliseconds that the service can wait to obtain a connection. Type `String` Default `PT30S` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `data-source-name`Attempts to do a JNDI data source look up for the data source name specified. no default Attempts to do a JNDI data source look up for the data source name specified. Will attempt to locate the data source object as is. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `ddl-auto`Hibernate feature to automatically validate and exports DDL to the schema. `update` Hibernate feature to automatically validate and exports DDL to the schema. By default, creates and drops the schema automatically when a session is starts and ends. Setting the value to `validate` or `none` may be more desirable for production, but any of the following options can be used: * `validate`: Validate the schema, but make no changes to the database. * `update`: Update the schema. * `create`: Create the schema, destroying previous data. * `create-drop`: Drop the schema at the end of the session. * `none`: Do nothing. Note that during a version migration where any schema has changed `create-drop` will result in the loss of all data as soon as CAS is started. For transient data like tickets this is probably not an issue, but in cases like the audit table important data could be lost. Using \`update\`, while safe for data, is confirmed to result in invalid database state. `validate` or `none` settings are likely the only safe options for production use. For more info, [see this](http://docs.spring.io/spring-framework/docs/current/javadoc-api) . Type `String` Default `update` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `default-catalog`Qualifies unqualified table names with the given catalog in generated SQL. no default Qualifies unqualified table names with the given catalog in generated SQL. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `default-schema`Qualify unqualified table names with the given schema/tablespace in generated SQL. no default Qualify unqualified table names with the given schema/tablespace in generated SQL. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `dialect`The database dialect is a configuration setting for platform independent software (JPA, Hibernate, etc) which allows such software to translate its generic SQL statements into vendor specific DDL, DML. `org.hibernate.dialect.HSQLDialect` The database dialect is a configuration setting for platform independent software (JPA, Hibernate, etc) which allows such software to translate its generic SQL statements into vendor specific DDL, DML. Type `String` Default `org.hibernate.dialect.HSQLDialect` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `fail-fast-timeout`Set the pool initialization failure timeout. `1` Set the pool initialization failure timeout. * Any value greater than zero will be treated as a timeout for pool initialization. The calling thread will be blocked from continuing until a successful connection to the database, or until the timeout is reached. If the timeout is reached, then a `PoolInitializationException` will be thrown. * A value of zero will _not_ prevent the pool from starting in the case that a connection cannot be obtained. However, upon start the pool will attempt to obtain a connection and validate that the `connectionTestQuery` and `connectionInitSql` are valid. If those validations fail, an exception will be thrown. If a connection cannot be obtained, the validation is skipped and the pool will start and continue to try to obtain connections in the background. This can mean that callers to `DataSource#getConnection()` may encounter exceptions. * A value less than zero will _not_ bypass any connection attempt and validation during startup, and therefore the pool will start immediately. The pool will continue to try to obtain connections in the background. This can mean that callers to `DataSource#getConnection()` may encounter exceptions. Note that if this timeout value is greater than or equal to zero (0), and therefore an initial connection validation is performed, this timeout does not override the `connectionTimeout` or `validationTimeout`; they will be honored before this timeout is applied. The default value is one millisecond. Type `Long` Default `1` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `fetch-size`Used to specify number of rows to be fetched in a select query. `100` Used to specify number of rows to be fetched in a select query. Type `Integer` Default `100` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `generate-statistics`Allow hibernate to generate query statistics. `false` Allow hibernate to generate query statistics. Type `Boolean` Default `false` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `health-query`The SQL query to be executed to test the validity of connections. no default The SQL query to be executed to test the validity of connections. This is for "legacy" databases that do not support the JDBC4 `Connection.isValid()` API. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `idle-timeout`Controls the maximum amount of time that a connection is allowed to sit idle in the pool. `PT10M` Duration Controls the maximum amount of time that a connection is allowed to sit idle in the pool. Type `String` Default `PT10M` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `isolate-internal-queries`This property determines whether data source isolates internal pool queries, such as the connection alive test, in their own transaction. `false` This property determines whether data source isolates internal pool queries, such as the connection alive test, in their own transaction. Since these are typically read-only queries, it is rarely necessary to encapsulate them in their own transaction. This property only applies if `#autocommit` is disabled. Type `Boolean` Default `false` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `isolation-level-name`Defines the isolation level for transactions. `ISOLATION_READ_COMMITTED` Defines the isolation level for transactions. @see org.springframework.transaction.TransactionDefinition Type `String` Default `ISOLATION_READ_COMMITTED` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `leak-threshold`Controls the amount of time that a connection can be out of the pool before a message is logged indicating a possible connection leak. `PT6S` Duration Controls the amount of time that a connection can be out of the pool before a message is logged indicating a possible connection leak. Type `String` Default `PT6S` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `physical-naming-strategy-class-name`Fully-qualified name of the class that can control the physical naming strategy of hibernate. `org.apereo.cas.hibernate.CasHibernatePhysicalNamingStrategy` Fully-qualified name of the class that can control the physical naming strategy of hibernate. Type `String` Default `org.apereo.cas.hibernate.CasHibernatePhysicalNamingStrategy` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `propagation-behavior-name`Defines the propagation behavior for transactions. `PROPAGATION_REQUIRED` Defines the propagation behavior for transactions. @see org.springframework.transaction.TransactionDefinition Type `String` Default `PROPAGATION_REQUIRED` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `properties`Additional settings provided by Hibernate (or the connection provider) in form of key-value pairs. no default Additional settings provided by Hibernate (or the connection provider) in form of key-value pairs. Type `Map` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `query`Query to execute in order to authenticate users via JDBC. no default Query to execute in order to authenticate users via JDBC. Example: `SELECT username,password,enabled FROM users WHERE username=?` Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `read-only`Configures the Connections to be added to the pool as read-only Connections. `false` Configures the Connections to be added to the pool as read-only Connections. Type `Boolean` Default `false` Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy `role-prefix`Prefix to add to the role. no default Prefix to add to the role. Type `String` Default _none_ Defined by `JdbcSecurityActuatorEndpointsMonitorProperties` Copy Password Encoder7 `password-encoder.encoding-algorithm`The encoding algorithm to use such as MD5 . no default Required The encoding algorithm to use such as `MD5`. Relevant when the type used is `DEFAULT` or `GLIBC_CRYPT`. When used with `PasswordEncoderTypes#PBKDF2`, it should be one of `PBKDF2WithHmacSHA1`, `PBKDF2WithHmacSHA256` or `PBKDF2WithHmacSHA512`. Type `String` Default _none_ Defined by `PasswordEncoderProperties` Copy `password-encoder.type`Define the password encoder type to use. `NONE` Required Define the password encoder type to use. Type may be specified as blank or `NONE` to disable password encoding. It may also refer to a fully-qualified class name that implements the Spring Security's `PasswordEncoder` interface if you wish you define your own encoder. The following types may be used: * `NONE`: No password encoding (i.e. plain-text) takes place. * `DEFAULT`: Use the `DefaultPasswordEncoder` of CAS. For message-digest algorithms via `character-encoding` and `encoding-algorithm`. * `BCRYPT`: Use the `BCryptPasswordEncoder` based on the strength provided and an optional secret. * `SCRYPT`: Use the `SCryptPasswordEncoder`. * `PBKDF2`: Use the `Pbkdf2PasswordEncoder` based on the strength provided and an optional secret. * `STANDARD`: Use the `StandardPasswordEncoder` based on the secret provided. * `SSHA`: Use the `LdapShaPasswordEncoder` supports Ldap SHA and SSHA (salted-SHA). The values are base-64 encoded and have the label {SHA} or {SSHA} prepended to the encoded hash. * `GLIBC_CRYPT`: Use the `GlibcCryptPasswordEncoder` based on the `encoding-algorithm`, strength provided and an optional secret. * `org.example.MyEncoder`: An implementation of `PasswordEncoder` of your own choosing. * `file:///path/to/script.groovy`: Path to a Groovy script charged with handling password encoding operations. Type `String` Default `NONE` Defined by `PasswordEncoderProperties` Copy `password-encoder.character-encoding`The encoding algorithm to use such as 'UTF-8'. `UTF-8` The encoding algorithm to use such as 'UTF-8'. Relevant when the type used is `DEFAULT`. Type `String` Default `UTF-8` Defined by `PasswordEncoderProperties` Copy `password-encoder.hash-length`When used by PasswordEncoderTypes#ARGON2 , it indicates the hash strength/length. `16` When used by `PasswordEncoderTypes#ARGON2`, it indicates the hash strength/length. Type `Integer` Default `16` Defined by `PasswordEncoderProperties` Copy `password-encoder.iterations`When used by PasswordEncoderTypes#PBKDF2 , it indicates the required number of iterations. `310000` When used by `PasswordEncoderTypes#PBKDF2`, it indicates the required number of iterations. Type `Integer` Default `310000` Defined by `PasswordEncoderProperties` Copy `password-encoder.secret`Secret to use with PasswordEncoderTypes#STANDARD , PasswordEncoderTypes#PBKDF2 , PasswordEncoderTypes#BCRYPT , PasswordEncoderTypes#GLIBC\_CRYPT password encoders. no default Secret to use with `PasswordEncoderTypes#STANDARD`, `PasswordEncoderTypes#PBKDF2`, `PasswordEncoderTypes#BCRYPT`, `PasswordEncoderTypes#GLIBC_CRYPT` password encoders. Secret usually is an optional setting. Type `String` Default _none_ Defined by `PasswordEncoderProperties` Copy `password-encoder.strength`Strength or number of iterations to use for password hashing. `16` Strength or number of iterations to use for password hashing. Usually relevant when dealing with `PasswordEncoderTypes#BCRYPT`, `PasswordEncoderTypes#PBKDF2` or `PasswordEncoderTypes#GLIBC_CRYPT`. When used by `PasswordEncoderTypes#ARGON2` or `PasswordEncoderTypes#PBKDF2`, it indicates the salt strength. Type `Integer` Default `16` Defined by `PasswordEncoderProperties` Copy Pool8 `pool.keep-alive-time`This property controls the keepalive interval for a connection in the pool. `0` Duration This property controls the keepalive interval for a connection in the pool. An in-use connection will never be tested by the keepalive thread, only when it is idle will it be tested. Default is zero, which disables this feature. Type `String` Default `0` Defined by `ConnectionPoolingProperties` Copy `pool.max-size`Controls the maximum number of connections to keep in the pool, including both idle and in-use connections. `18` Controls the maximum number of connections to keep in the pool, including both idle and in-use connections. Type `Integer` Default `18` Defined by `ConnectionPoolingProperties` Copy `pool.max-wait`Sets the maximum time in seconds that this data source will wait while attempting to connect to a database. `PT2S` Duration Sets the maximum time in seconds that this data source will wait while attempting to connect to a database. A value of zero specifies that the timeout is the default system timeout if there is one; otherwise, it specifies that there is no timeout. Type `String` Default `PT2S` Defined by `ConnectionPoolingProperties` Copy `pool.maximum-lifetime`This property controls the maximum lifetime of a connection in the pool. `PT10M` Duration This property controls the maximum lifetime of a connection in the pool. When a connection reaches this timeout, even if recently used, it will be retired from the pool. An in-use connection will never be retired, only when it is idle will it be removed. Type `String` Default `PT10M` Defined by `ConnectionPoolingProperties` Copy `pool.min-size`Controls the minimum size that the pool is allowed to reach, including both idle and in-use connections. `6` Controls the minimum size that the pool is allowed to reach, including both idle and in-use connections. Type `Integer` Default `6` Defined by `ConnectionPoolingProperties` Copy `pool.name`Set the name of the connection pool. no default Set the name of the connection pool. This is primarily used for the MBean to uniquely identify the pool configuration. Type `String` Default _none_ Defined by `ConnectionPoolingProperties` Copy `pool.suspension`Whether or not pool suspension is allowed. `false` Whether or not pool suspension is allowed. There is a performance impact when pool suspension is enabled. Unless you need it (for a redundancy system for example) do not enable it. Type `Boolean` Default `false` Defined by `ConnectionPoolingProperties` Copy `pool.timeout-millis`The maximum number of milliseconds that the pool will wait for a connection to be validated as alive. `1000` The maximum number of milliseconds that the pool will wait for a connection to be validated as alive. Type `Long` Default `1000` Defined by `ConnectionPoolingProperties` Copy No settings match this filter. Hibernate & JDBC Control global properties that are relevant to Hibernate, when CAS attempts to employ and utilize database resources, connections and queries. .propertiesYAMLEnv vars Keys below are relative to `cas.jdbc.` Copy shown as .properties General3 `gen-ddl`Whether to generate DDL after the EntityManagerFactory has been initialized creating/updating all relevant tables. `true` Whether to generate DDL after the EntityManagerFactory has been initialized creating/updating all relevant tables. Type `Boolean` Default `true` Defined by `DatabaseProperties` Copy `physical-table-names`Indicate a physical table name to be used by the hibernate naming strategy in case table names need to be customized for the specific type of database. no default Indicate a physical table name to be used by the hibernate naming strategy in case table names need to be customized for the specific type of database. The key here indicates the CAS-provided table name and the value is the translate physical name for the database. If a match is not found for the CAS-provided table name, then that name will be used by default. Type `Map` Default _none_ Defined by `DatabaseProperties` Copy `show-sql`Whether SQL queries should be displayed in the console/logs. `false` Whether SQL queries should be displayed in the console/logs. Type `Boolean` Default `false` Defined by `DatabaseProperties` Copy No settings match this filter. Password encoding If you need to design your own password encoding scheme where the type is specified as a fully qualified Java class name, the structure of the class would be similar to the following: 1 2 3 4 5 6 7 8 9 10 11 package org.example.cas; import org.springframework.security.crypto.codec.*; import org.springframework.security.crypto.password.*; public class MyEncoder extends AbstractPasswordEncoder { @Override protected byte[] encode(CharSequence rawPassword, byte[] salt) { return ... } } If you need to design your own password encoding scheme where the type is specified as a path to a Groovy script, the structure of the script would be similar to the following: 1 2 3 4 5 6 7 8 9 10 11 12 import java.util.* byte[] run(final Object... args) { def (rawPassword,generatedSalt,logger,applicationContext) = args logger.debug("Encoding password...") return ... } Boolean matches(final Object... args) { def (rawPassword,encodedPassword,logger,applicationContext) = args logger.debug("Does match or not ?"); return ... To prepare CAS to support and integrate with Apache Groovy, please [review this guide](https://apereo.github.io/cas/development//integration/Apache-Groovy-Scripting.html) . A static list of users, passwords and roles in a JSON file. Supported password encodings are `{sha512}`, `{sha256}`, `{bcrypt}`, `{noop}`, `{pbkdf2}`, `{scrypt}` and `{argon2}`. 1 2 3 4 5 6 7 [\ {\ "username": "casuser",\ "password": "{sha512}",\ "authorities": [ "ROLE_ADMIN" ]\ }\ ] .propertiesYAMLEnv vars 1 setting Copy required as .properties General1 `cas.monitor.endpoints.json.location`The location of the resource. no default Required The location of the resource. Resources can be URLs, or files found either on the classpath or outside somewhere in the file system. In the event the configured resource is a Groovy script, especially if the script is set to reload on changes, you may need to adjust the total number of `inotify` instances. On Linux, you may need to add the following line to `/etc/sysctl.conf`: `fs.inotify.max_user_instances = 256`. You can check the current value via `cat /proc/sys/fs/inotify/max_user_instances`. In situations and scenarios where CAS is able to automatically watch the underlying resource for changes and detect updates and modifications dynamically, you may be able to specify the following setting as either an environment variable or system property with a value of `false` to disable the resource watcher: `org.apereo.cas.util.io.PathWatcherService`. Type `Resource` Default _none_ Defined by `JsonSecurityActuatorEndpointsMonitorProperties` Copy No settings match this filter. .propertiesYAMLEnv vars Keys below are relative to `cas.monitor.endpoints.` Copy shown as .properties General1 `form-login-enabled`Control whether access to endpoints can be controlled via form-based login over the web via a special admin login endpoint. `false` Control whether access to endpoints can be controlled via form-based login over the web via a special admin login endpoint. Type `Boolean` Default `false` Defined by `ActuatorEndpointsMonitorProperties` Copy Endpoint4 `endpoint.jwtTicketSigningPublicKey.access`Define the security access level of the endpoint. `DENY` Define the security access level of the endpoint. Available values are as follows: * `PERMIT`: Allow open access to the endpoint. * `ANONYMOUS`: Allow anonymous access to the endpoint. * `DENY`: Block access to the endpoint. * `AUTHENTICATED`: Require authenticated access to the endpoint. * `ROLE`: Require authenticated access to the endpoint along with a role requirement. * `AUTHORITY`: Require authenticated access to the endpoint along with an authority requirement. * `IP_ADDRESS`: Require authenticated access to the endpoint using a collection of IP addresses. Type `ActuatorEndpointProperties.EndpointAccessLevel` Default `DENY` Defined by `ActuatorEndpointProperties` Copy `endpoint.jwtTicketSigningPublicKey.required-authorities`Required user authorities. no default Required user authorities. Type `List` Default _none_ Defined by `ActuatorEndpointProperties` Copy `endpoint.jwtTicketSigningPublicKey.required-ip-addresses`Required IP addresses. no default Regex Required IP addresses. CIDR ranges are accepted. Type `List` Default _none_ Defined by `ActuatorEndpointProperties` Copy `endpoint.jwtTicketSigningPublicKey.required-roles`Required user roles. no default Required user roles. Type `List` Default _none_ Defined by `ActuatorEndpointProperties` Copy No settings match this filter. .propertiesYAMLEnv vars All**57**Deprecated**6** 57 third-party settings Copy shown as .properties Management Endpoint12 `management.endpoint.health.access`Permitted level of access for the health endpoint. `unrestricted` Third party Permitted level of access for the health endpoint. Type `Access` Default `unrestricted` Defined by `HealthEndpoint` Copy `management.endpoint.health.cache.time-to-live`Maximum time that a response can be cached. `0ms` Third party Maximum time that a response can be cached. Type `Duration` Default `0ms` Defined by `HealthEndpoint` Copy `management.endpoint.health.group`Health endpoint groups. no default Third party Health endpoint groups. Type `Map` Default _none_ Defined by `HealthEndpointProperties` Copy `management.endpoint.health.logging.slow-indicator-threshold`Threshold after which a warning will be logged for slow health indicators. `10s` Third party Threshold after which a warning will be logged for slow health indicators. Type `Duration` Default `10s` Defined by `HealthEndpointProperties$Logging` Copy `management.endpoint.health.probes.add-additional-paths`Whether to make the liveness and readiness health groups available on the main server port. `false` Third party Whether to make the liveness and readiness health groups available on the main server port. Type `Boolean` Default `false` Copy `management.endpoint.health.probes.enabled`Whether to enable liveness and readiness probes. `true` Third party Whether to enable liveness and readiness probes. Type `Boolean` Default `true` Copy `management.endpoint.health.roles`Roles used to determine whether a user is authorized to be shown details. no default Third party Roles used to determine whether a user is authorized to be shown details. When empty, all authenticated users are authorized. Type `Set` Default _none_ Defined by `HealthEndpointProperties` Copy `management.endpoint.health.show-components`When to show components. no default Third party When to show components. If not specified the 'show-details' setting will be used. Type `Show` Default _none_ Defined by `HealthEndpointProperties` Copy `management.endpoint.health.show-details`When to show full health details. `never` Third party When to show full health details. Type `Show` Default `never` Defined by `HealthEndpointProperties` Copy `management.endpoint.health.status.http-mapping`Mapping of health statuses to HTTP status codes. no default Third party Mapping of health statuses to HTTP status codes. By default, registered health statuses map to sensible defaults (for example, UP maps to 200). Type `Map` Default _none_ Defined by `HealthProperties$Status` Copy `management.endpoint.health.status.order`List of health statuses in order of severity. `["DOWN", "OUT_OF_SERVICE", "UP", "UNKNOWN"]` Third party List of health statuses in order of severity. Type `List` Default `["DOWN", "OUT_OF_SERVICE", "UP", "UNKNOWN"]` Defined by `HealthProperties$Status` Copy `management.endpoint.health.validate-group-membership`Whether to validate health group membership on startup. `true` Third party Whether to validate health group membership on startup. Validation fails if a group includes or excludes a health contributor that does not exist. Type `Boolean` Default `true` Copy Management Endpoints23 `management.endpoints.access.default`Default access level for all endpoints. no default Third party Default access level for all endpoints. Type `Access` Default _none_ Copy `management.endpoints.access.max-permitted`Maximum level of endpoint access that is permitted. `unrestricted` Third party Maximum level of endpoint access that is permitted. Caps an endpoint's individual access level (management.endpoint..access) and the default access (management.endpoints.access.default).' Default `unrestricted` Copy `management.endpoints.enabled-by-default`Whether to enable or disable all endpoints by default. no default Third partyDeprecated Whether to enable or disable all endpoints by default. Type `Boolean` Default _none_ Deprecation `WARNING`, replaced by `management.endpoints.access.default` Copy `management.endpoints.jackson.isolated-json-mapper`Whether to use an isolated JsonMapper to serialize endpoint JSON. `true` Third party Whether to use an isolated JsonMapper to serialize endpoint JSON. Type `Boolean` Default `true` Copy `management.endpoints.jackson2.isolated-object-mapper`Whether to use an isolated object mapper to serialize endpoint JSON. `true` Third partyDeprecated Whether to use an isolated object mapper to serialize endpoint JSON. Type `Boolean` Default `true` Deprecation `WARNING`, no replacement Copy `management.endpoints.jmx.domain`Endpoints JMX domain name. `org.springframework.boot` Third party Endpoints JMX domain name. Fallback to 'spring.jmx.default-domain' if set. Type `String` Default `org.springframework.boot` Defined by `JmxEndpointProperties` Copy `management.endpoints.jmx.exposure.exclude`Endpoint IDs that should be excluded or '\*' for all. no default Third party Endpoint IDs that should be excluded or '\*' for all. Type `Set` Default _none_ Defined by `JmxEndpointProperties$Exposure` Copy `management.endpoints.jmx.exposure.include`Endpoint IDs that should be included or '\*' for all. `health` Third party Endpoint IDs that should be included or '\*' for all. Type `Set` Default `health` Defined by `JmxEndpointProperties$Exposure` Copy `management.endpoints.jmx.static-names`Additional static properties to append to all ObjectNames of MBeans representing Endpoints. no default Third party Additional static properties to append to all ObjectNames of MBeans representing Endpoints. Type `Properties` Default _none_ Defined by `JmxEndpointProperties` Copy `management.endpoints.jmx.unique-names`Whether unique runtime object names should be ensured. no default Third partyDeprecated Whether unique runtime object names should be ensured. Type `Boolean` Default _none_ Deprecation `ERROR`, replaced by `spring.jmx.unique-names` Copy `management.endpoints.migrate-legacy-ids`Whether to transparently migrate legacy endpoint IDs. `false` Third party Whether to transparently migrate legacy endpoint IDs. Type `Boolean` Default `false` Copy `management.endpoints.web.base-path`Base path for Web endpoints. `/actuator` Third party Base path for Web endpoints. Relative to the servlet context path (server.servlet.context-path) or WebFlux base path (spring.webflux.base-path) when the management server is sharing the main server port. Relative to the management server base path (management.server.base-path) when a separate management server port (management.server.port) is configured. Type `String` Default `/actuator` Defined by `WebEndpointProperties` Copy `management.endpoints.web.cors.allow-credentials`Whether credentials are supported. no default Third party Whether credentials are supported. When not set, credentials are not supported. Type `Boolean` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.allowed-headers`List of headers to allow in a request. '\*' allows all headers. no default Third party List of headers to allow in a request. '\*' allows all headers. Type `List` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.allowed-methods`List of methods to allow. '\*' allows all methods. no default Third party List of methods to allow. '\*' allows all methods. When not set, defaults to GET. Type `List` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.allowed-origin-patterns`List of origin patterns to allow. no default Third party List of origin patterns to allow. Unlike allowed origins which only supports '\*', origin patterns are more flexible (for example 'https://\*.example.com') and can be used when credentials are allowed. When no allowed origin patterns or allowed origins are set, CORS support is disabled. Type `List` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.allowed-origins`List of origins to allow. '\*' allows all origins. no default Third party List of origins to allow. '\*' allows all origins. When credentials are allowed, '\*' cannot be used and origin patterns should be configured instead. When no allowed origins or allowed origin patterns are set, CORS support is disabled. Type `List` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.exposed-headers`List of headers to include in a response. no default Third party List of headers to include in a response. Type `List` Default _none_ Defined by `CorsEndpointProperties` Copy `management.endpoints.web.cors.max-age`How long the response from a pre-flight request can be cached by clients. `1800s` Third party How long the response from a pre-flight request can be cached by clients. If a duration suffix is not specified, seconds will be used. Type `Duration` Default `1800s` Defined by `CorsEndpointProperties` Copy `management.endpoints.web.discovery.enabled`Whether the discovery page is enabled. `true` Third party Whether the discovery page is enabled. Type `Boolean` Default `true` Defined by `WebEndpointProperties$Discovery` Copy `management.endpoints.web.exposure.exclude`Endpoint IDs that should be excluded or '\*' for all. no default Third party Endpoint IDs that should be excluded or '\*' for all. Type `Set` Default _none_ Defined by `WebEndpointProperties$Exposure` Copy `management.endpoints.web.exposure.include`Endpoint IDs that should be included or '\*' for all. `["health"]` Third party Endpoint IDs that should be included or '\*' for all. Type `Set` Default `["health"]` Defined by `WebEndpointProperties$Exposure` Copy `management.endpoints.web.path-mapping`Mapping between endpoint IDs and the path that should expose them. no default Third party Mapping between endpoint IDs and the path that should expose them. Type `Map` Default _none_ Defined by `WebEndpointProperties` Copy Management Health22 `management.health.binders.enabled`Allows to enable/disable binder's' health indicators. `true` Third party Allows to enable/disable binder's' health indicators. If you want to disable health indicator completely, then set it to \`false\`. Type `Boolean` Default `true` Copy `management.health.db.enabled`Whether to enable database health check. `true` Third party Whether to enable database health check. Type `Boolean` Default `true` Copy `management.health.db.ignore-routing-data-sources`Whether to ignore AbstractRoutingDataSources when creating database health indicators. `false` Third party Whether to ignore AbstractRoutingDataSources when creating database health indicators. Type `Boolean` Default `false` Defined by `DataSourceHealthIndicatorProperties` Copy `management.health.defaults.enabled`Whether to enable default health indicators. `true` Third party Whether to enable default health indicators. Type `Boolean` Default `true` Copy `management.health.diskspace.enabled`Whether to enable disk space health check. `true` Third party Whether to enable disk space health check. Type `Boolean` Default `true` Copy `management.health.diskspace.path`Path used to compute the available disk space. no default Third party Path used to compute the available disk space. Type `File` Default _none_ Defined by `DiskSpaceHealthIndicatorProperties` Copy `management.health.diskspace.threshold`Minimum disk space that should be available. `10MB` Third party Minimum disk space that should be available. Type `DataSize` Default `10MB` Defined by `DiskSpaceHealthIndicatorProperties` Copy `management.health.influxdb.enabled` no default Third partyDeprecated Type `Boolean` Default _none_ Deprecation `ERROR`, no replacement Copy `management.health.livenessstate.enabled`Whether to enable liveness state health check. `false` Third party Whether to enable liveness state health check. Type `Boolean` Default `false` Copy `management.health.mail.enabled`Whether to enable Mail health check. `true` Third party Whether to enable Mail health check. Type `Boolean` Default `true` Copy `management.health.mongo.enabled` no default Third partyDeprecated Default _none_ Deprecation `ERROR`, replaced by `management.health.mongodb.enabled` Copy `management.health.mongodb.enabled`Whether to enable MongoDB health check. `true` Third party Whether to enable MongoDB health check. Type `Boolean` Default `true` Copy `management.health.ping.enabled`Whether to enable ping health check. `true` Third party Whether to enable ping health check. Type `Boolean` Default `true` Copy `management.health.probes.enabled`Whether to enable liveness and readiness probes. `false` Third partyDeprecated Whether to enable liveness and readiness probes. Type `Boolean` Default `false` Deprecation `ERROR`, replaced by `management.endpoint.health.probes.enabled` Copy `management.health.pubsub.enabled`Whether to enable the Pub/Sub health indicator when used with Spring Boot Actuator. `true` Third party Whether to enable the Pub/Sub health indicator when used with Spring Boot Actuator. Type `Boolean` Default `true` Copy `management.health.rabbit.enabled`Whether to enable RabbitMQ health check. `true` Third party Whether to enable RabbitMQ health check. Type `Boolean` Default `true` Copy `management.health.readinessstate.enabled`Whether to enable readiness state health check. `false` Third party Whether to enable readiness state health check. Type `Boolean` Default `false` Copy `management.health.redis.enabled`Whether to enable Redis health check. `true` Third party Whether to enable Redis health check. Type `Boolean` Default `true` Copy `management.health.refresh.enabled`Enable the health endpoint for the refresh scope. `true` Third party Enable the health endpoint for the refresh scope. Type `Boolean` Default `true` Copy `management.health.ssl.certificate-validity-warning-threshold`If an SSL Certificate will be invalid within the time span defined by this threshold, it should trigger a warning. `14d` Third party If an SSL Certificate will be invalid within the time span defined by this threshold, it should trigger a warning. Type `Duration` Default `14d` Defined by `SslHealthIndicatorProperties` Copy `management.health.ssl.enabled`Whether to enable SSL certificate health check. `true` Third party Whether to enable SSL certificate health check. Type `Boolean` Default `true` Copy `management.health.zookeeper.enabled`Enable the health endpoint for zookeeper. `true` Third party Enable the health endpoint for zookeeper. Type `Boolean` Default `true` Copy No settings match this filter. * `404`: the endpoint is not enabled or not exposed; check the _Enable & expose_ tab. * `401` or `403`: the access rule or the credentials rejected the call; check the _Security_ tab. For more detail, raise these log levels in the log4j configuration: 1 2 3 4 5 6 7 8 [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#configuration) Configuration ---------------------------------------------------------------------------------------------------------------------- JWT support is enabled by including the following dependency in the WAR overlay: * [Apache Maven](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#mavenorgapereocascasserversupporttokentickets) * [Gradle](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#gradleorgapereocascasserversupporttokentickets) * [BOM - Spring](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#bomorgapereocascasserversupporttokentickets) * [BOM - Gradle](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#bomGradleorgapereocascasserversupporttokentickets) * [Resources](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#) [Show in CAS Initializr ↗ (opens in a new tab)](https://getcas.apereo.org/ui?dependencies=webapp-tomcat,support-token-tickets) [Generate CAS Server WAR Overlay](javascript:generateOverlay('cas-server-support-token-tickets',%20'cas-overlay');) 1 2 3 4 5 org.apereo.cas cas-server-support-token-tickets ${cas.version} 1 implementation "org.apereo.cas:cas-server-support-token-tickets:${project.'cas.version'}" 1 2 3 4 5 6 7 8 9 dependencyManagement { imports { mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}" } } dependencies { implementation "org.apereo.cas:cas-server-support-token-tickets" } 1 2 3 4 5 6 7 8 9 10 dependencies { /* The following platform references are included automatically and are listed for reference only. implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}") implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES) */ implementation "org.apereo.cas:cas-server-support-token-tickets" } The following settings and properties are available from the CAS configuration catalog: .propertiesYAMLEnv vars All**16**Required**2**Optional**14** Keys below are relative to `cas.authn.token.` Copy required as .properties General5 `credential-criteria`A number of authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase. no default Regex A number of authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase. The credential criteria may be one of the following options: * 1) A regular expression pattern that is tested against the credential identifier. * 2) A fully qualified class name of your own design that implements `Predicate`. * 3) Path to an external Groovy script that implements the same interface. Type `String` Default _none_ Defined by `TokenAuthenticationProperties` Copy `name`Name of the authentication handler. no default Name of the authentication handler. Type `String` Default _none_ Defined by `TokenAuthenticationProperties` Copy `order`Order of the authentication handler in the chain. no default Order of the authentication handler in the chain. Type `Integer` Default _none_ Defined by `TokenAuthenticationProperties` Copy `sso-token-enabled`When set to true, will generate a token and store it as an authentication attribute into the single sign-on session. `false` When set to true, will generate a token and store it as an authentication attribute into the single sign-on session. This token can be used later on for token-based authentication attempts, and should allow SSO access to the server. Type `Boolean` Default `false` Defined by `TokenAuthenticationProperties` Copy `state`Define the scope and state of this authentication handler and the lifecycle in which it can be invoked or activated. `active` Define the scope and state of this authentication handler and the lifecycle in which it can be invoked or activated. Available values are as follows: * `ACTIVE`: Active authentication handler, and is invoked by default automatically to verify credentials globally. * `STANDBY`: Authentication handler is in a semi-enabled state, waiting to be called only on-demand when explicitly asked for. Type `AuthenticationHandlerStates` Default `active` Defined by `TokenAuthenticationProperties` Copy Crypto9 `crypto.encryption.key`The encryption key is a string whose length is defined by the encryption key size setting. no default RequiredSpEL The encryption key is a string whose length is defined by the encryption key size setting. Type `String` Default _none_ Defined by `EncryptionJwtCryptoProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `crypto.signing.key`The signing key is a string whose length is defined by the signing key size setting. no default RequiredSpEL The signing key is a string whose length is defined by the signing key size setting. Type `String` Default _none_ Defined by `SigningJwtCryptoProperties` Supports [Spring Expression Language](https://apereo.github.io/cas/development/configuration/Configuration-Spring-Expressions.html) Copy `crypto.alg`The signing/encryption algorithm to use. no default The signing/encryption algorithm to use. Type `String` Default _none_ Defined by `EncryptionOptionalSigningOptionalJwtCryptographyProperties` Copy `crypto.enabled`Whether crypto operations are enabled. `true` Whether crypto operations are enabled. Type `Boolean` Default `true` Defined by `EncryptionOptionalSigningOptionalJwtCryptographyProperties` Copy `crypto.encryption-enabled`Whether crypto encryption operations are enabled. `true` Whether crypto encryption operations are enabled. Type `Boolean` Default `true` Defined by `EncryptionOptionalSigningOptionalJwtCryptographyProperties` Copy `crypto.encryption.key-size`The encryption key size. `512` The encryption key size. Type `Integer` Default `512` Defined by `EncryptionJwtCryptoProperties` Copy `crypto.signing-enabled`Whether crypto signing operations are enabled. `true` Whether crypto signing operations are enabled. Type `Boolean` Default `true` Defined by `EncryptionOptionalSigningOptionalJwtCryptographyProperties` Copy `crypto.signing.key-size`The signing key size. `512` The signing key size. Type `Integer` Default `512` Defined by `SigningJwtCryptoProperties` Copy `crypto.strategy-type`Control the cipher sequence of operations. `ENCRYPT_AND_SIGN` Control the cipher sequence of operations. The accepted values are: * `ENCRYPT_AND_SIGN`: Encrypt the value first, and then sign. * `SIGN_AND_ENCRYPT`: Sign the value first, and then encrypt. Type `String` Default `ENCRYPT_AND_SIGN` Defined by `EncryptionOptionalSigningOptionalJwtCryptographyProperties` Copy Webflow2 `webflow.enabled`Whether webflow auto-configuration should be enabled. `true` Whether webflow auto-configuration should be enabled. Type `Boolean` Default `true` Defined by `WebflowAutoConfigurationProperties` Copy `webflow.order`The order in which the webflow is configured. `0` The order in which the webflow is configured. Type `Integer` Default `0` Defined by `WebflowAutoConfigurationProperties` Copy No settings match this filter. **Required** settings may be needed to activate or affect the feature; review them even when they have a default. **Optional** settings only need to be set to change a default or to turn on the behavior they control. **Third party** settings belong to libraries such as Spring Boot that CAS builds on; their own documentation may have more detail. Signing & encryption This CAS feature is able to accept signing and encryption crypto keys. In most scenarios if keys are not provided, CAS will auto-generate them. The following instructions apply if you wish to manually and beforehand create the signing and encryption keys. Note that if you are asked to create a [JWK](https://tools.ietf.org/html/rfc7517) of a certain size for the key, you are to use the following set of commands to generate the token: 1 2 wget https://raw.githubusercontent.com/apereo/cas/master/etc/jwk-gen.jar java -jar jwk-gen.jar -t oct -s [size] The outcome would be similar to: 1 2 3 4 5 { "kty": "oct", "kid": "...", "k": "..." } The generated value for `k` needs to be assigned to the relevant CAS settings. Note that keys generated via the above algorithm are processed by CAS using the Advanced Encryption Standard (`AES`) algorithm which is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#rsa-keys) RSA Keys Certain CAS features such as the ability to produce JWTs as CAS tickets may allow you to use the `RSA` algorithm with public/private keypairs for signing and encryption. This behavior may prove useful generally in cases where the consumer of the CAS-encoded payload is an outsider and a client application that need not have access to the signing secrets directly and visibly and may only be given a half truth vis-a-vis a public key to verify the payload authenticity and decode it. This particular option makes little sense in situations where CAS itself is both a producer and a consumer of the payload. ![:information_source:](https://github.githubassets.com/images/icons/emoji/unicode/2139.png ":information_source:") **Remember** Signing and encryption options are not mutually exclusive. While it would be rather nonsensical, it is entirely possible for CAS to use `AES` keys for signing and `RSA` keys for encryption, or vice versa. In order to enable RSA functionality for signing payloads, you will need to generate a private/public keypair via the following sample commands: 1 2 openssl genrsa -out private.key 2048 openssl rsa -pubout -in private.key -out public.key -inform PEM -outform DER The private key path (i.e. `file:///path/to/private.key`) needs to be configured for the signing key in CAS properties for the relevant feature. The public key needs to be shared with client applications and consumers of the payload in order to validate the payload signature. ![:information_source:](https://github.githubassets.com/images/icons/emoji/unicode/2139.png ":information_source:") **Key Size** Remember that RSA key sizes are required to be at least `2048` and above. Smaller key sizes are not accepted by CAS and will cause runtime errors. Choose wisely. In order to enable RSA functionality for encrypting payloads, you will need to essentially execute the reverse of the above operations. The client application will provide you with a public key which will be used to encrypt the payload and whose path (i.e. `file:///path/to/public.key`) needs to be configured for the encryption key in CAS properties for the relevant feature. Once the payload is submitted, the client should use its own private key to decode the payload and unpack it. * * * Authentication Certain authentication handlers are allowed to determine whether they can operate on the provided credential and as such lend themselves to be tried and tested during the authentication handler selection phase. The credential criteria may be one of the following options: * A regular expression pattern that is tested against the credential identifier. * A fully qualified class name of your own design that looks similar to the below example: 1 2 3 4 5 6 7 8 9 import java.util.function.Predicate; import org.apereo.cas.authentication.Credential; public class PredicateExample implements Predicate { @Override public boolean test(final Credential credential) { // Examine the credential and return true/false } } * Path to an external Groovy script that looks similar to the below example: 1 2 3 4 5 6 7 8 9 import org.apereo.cas.authentication.Credential import java.util.function.Predicate class PredicateExample implements Predicate { @Override boolean test(final Credential credential) { // test and return result } } To prepare CAS to support and integrate with Apache Groovy, please [review this guide](https://apereo.github.io/cas/development//integration/Apache-Groovy-Scripting.html) . Notes on configuration #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#configuration-metadata) Configuration Metadata The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#be-selective) Be Selective This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#yagni) YAGNI Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#naming-convention) Naming Convention Property names can be specified in very relaxed terms. For instance `cas.someProperty`, `cas.some-property`, `cas.some_property` are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc. ![:information_source:](https://github.githubassets.com/images/icons/emoji/unicode/2139.png ":information_source:") **Note** When possible, properties should be stored in lower-case kebab format, such as `cas.property-name=value`. The only possible exception to this rule is when naming actuator endpoints; The name of the actuator endpoints (i.e. `ssoSessions`) **MUST** remain in camelCase mode. Settings and properties that are controlled by the CAS platform directly always begin with the prefix `cas`. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#validation) Validation Configuration properties are automatically validated on CAS startup to report issues with configuration binding, especially if defined CAS settings cannot be recognized or validated by the configuration schema. Additional validation processes are also handled via [Configuration Metadata](https://apereo.github.io/cas/development/configuration/Configuration-Metadata-Repository.html) and property migrations applied automatically on startup by Spring Boot and family. #### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#indexed-settings) Indexed Settings CAS settings able to accept multiple values are typically documented with an index, such as `cas.some.setting[0]=value`. The index `[0]` is meant to be incremented by the adopter to allow for distinct multiple configuration blocks. ### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#register-clients) Register Clients Signal the relevant application in CAS service registry to produce JWTs for service tickets: 1 2 3 4 5 6 7 8 9 10 11 12 13 { "@class" : "org.apereo.cas.services.CasRegisteredService", "serviceId" : "^https://.*", "name" : "Sample", "id" : 10, "properties" : { "@class" : "java.util.HashMap", "jwtAsServiceTicket" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty", "values" : [ "java.util.HashSet", [ "true" ] ] } } } ### [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#configure-keys-per-service) Configure Keys Per Service By default, the signing and encryption keys used to encode the JWT are global to the CAS server and can be defined via CAS settings. It is also possible to override the global keys on a per-service basis, allowing each application to use its own set of signing and encryption keys. To do so, configure the service definition in the registry to match the following: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 { "@class" : "org.apereo.cas.services.CasRegisteredService", "serviceId" : "^https://.*", "name" : "Sample", "id" : 10, "properties" : { "@class" : "java.util.HashMap", "jwtAsServiceTicket" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty", "values" : [ "java.util.HashSet", [ "true" ] ] }, "jwtAsServiceTicketSigningKey" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty", "values" : [ "java.util.HashSet", [ "..." ] ] }, "jwtAsServiceTicketEncryptionKey" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty", "values" : [ "java.util.HashSet", [ "..." ] ] }, "jwtAsServiceTicketCipherStrategyType" : { "@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty", "values" : [ "java.util.HashSet", [ "ENCRYPT_AND_SIGN" ] ] } } } The following cipher strategy types are available: | Type | Description | | --- | --- | | `ENCRYPT_AND_SIGN` | Default strategy; encrypt values, and then sign. | | `SIGN_AND_ENCRYPT` | Sign values, and then encrypt. | The following properties are available and recognized by CAS for various modules and features: Show 510152550 entries Search: Processing... | Name | Default Value | Type | Group | | --- | --- | --- | --- | | `jwtAsServiceTicket` | `false` | `BOOLEAN` | `JWT_SERVICE_TICKETS` | | `jwtAsServiceTicketCipherStrategyType` | `ENCRYPT_AND_SIGN` | `STRING` | `JWT_SERVICE_TICKETS` | | `jwtAsServiceTicketEncryptionAlg` | | `STRING` | `JWT_SERVICE_TICKETS` | | `jwtAsServiceTicketEncryptionEnabled` | `true` | `BOOLEAN` | `JWT_SERVICE_TICKETS` | | `jwtAsServiceTicketEncryptionKey` | | `STRING` | `JWT_SERVICE_TICKETS` | Showing 1 to 5 of 7 entries Previous12Next [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#jwt-validation---aes) JWT Validation - AES ------------------------------------------------------------------------------------------------------------------------------------ The following _example_ code snippet demonstrates how one might go about validating and parsing the CAS-produced JWT that is created using shared secrets via `AES`: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 import org.apache.commons.codec.binary.Base64; import org.jose4j.jwe.JsonWebEncryption; import org.jose4j.jwk.JsonWebKey; import org.jose4j.jws.JsonWebSignature; import org.jose4j.keys.AesKey; import java.nio.charset.StandardCharsets; import java.security.Key; ... var signingKey = "..."; var encryptionKey = "..."; var key = new AesKey(signingKey.getBytes(StandardCharsets.UTF_8)); var jws = new JsonWebSignature(); jws.setCompactSerialization(secureJwt); jws.setKey(key); if (!jws.verifySignature()) { throw new Exception("JWT verification failed"); } var decodedBytes = Base64.decodeBase64(jws.getEncodedPayload().getBytes(StandardCharsets.UTF_8)); var decodedPayload = new String(decodedBytes, StandardCharsets.UTF_8); var jwe = new JsonWebEncryption(); var jsonWebKey = JsonWebKey.Factory .newJwk("\n" + "{\"kty\":\"oct\",\n" + " \"k\":\"" + encryptionKey + "\"\n" + "}"); jwe.setCompactSerialization(decodedPayload); jwe.setKey(new AesKey(jsonWebKey.getKey().getEncoded())); IO.println(jwe.getPlaintextString()); CAS ![]() [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html) [](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Friday, Apr 8, 2016 10 minute read Remember ======== This post is **NOT** new. I am just collecting it here so it’s publicly available. This was originally published as a secret gist on Github in April 2016. Overview ======== This is an Apereo CAS project vulnerability disclosure, describing an issue in CAS’s attempts to deserialize objects via the Apache Commons Collections library. Affected Deployments ==================== The attack vector specifically applies to all deployments of CAS `v4.1.x` and `v4.2.x` deployments where the out-of-the-box default configuration of CAS is used for managing object serialization, encryption and signing of data. You are **NOT** affected by this issue, if: * You have deployed a different CAS version, lower than `v4.1.0`. * You have deployed CAS `v4.1.x` or `v4.2.x`, **BUT** you have removed the default CAS configuration for encryption/signing and have regenerated the appropriate settings for your own deployment. Exploiting the vulnerability hinges on getting the JVM to de-serialize Java objects from arbitrary serialized data. If the above conditions describe your deployment, we **STRONGLY** recommend that you take necessary action to patch your deployment based on the below instructions. Severity ======== This is a very serious issue where successfully exercising this vulnerability allows the adversary to inject arbitrary code. This disclosure is about a specific exploit path involving a bugged version of Apache Commons Collections. This exploit path is only an instance of a larger JVM Java object deserialization security concern. Patching ======== Patch releases are now available to address CAS `v4.1.x` and `v4.2.x` deployments. Upgrades to the next patch version for each release should be a drop-in replacement, with some effort to appropriately reconfigure CAS encryption/signing settings via the `cas.properties` file. CAS 4.1.x --------- ### Overlay Modify your CAS overlay to point to version `4.1.7`. A snippet of a `pom.xml` for a CAS overlay follows: ... org.jasig.cas cas-server-webapp ${cas.version} war runtime 4.1.7 ... ### TGC Settings Locate your `cas.properties` file and find the `tgc.*` settings. * If your CAS deployment is **NOT** using the default encryption/signing keys provided by CAS and you have regenerated new keys and have replaced the default, you can safely ignore this step and leave your key configuration of signing/encryption in place without any further changes. * If your CAS deployment **IS** using the default encryption/signing keys provided by CAS and you have **NOT** regenerated new keys to replace the default, you **MUST** take action to regenerate the keys. You can choose one of the two approaches described below to handle key regeneration. #### 1) Let CAS Generate Keys Blank/comment out the following `tgc` settings: # tgc.encryption.key= # tgc.signing.key= Build and deploy your CAS deployment once. Upon startup, CAS will notice that no keys are defined, and it will appropriately generate keys for you automatically. Your CAS logs will then show the following snippet: WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: tgc.encryption.key=ABC tgc.signing.key=XYZ #### 2) Manually Generate Keys Using a `git` client, clone and build the following project: git clone https://github.com/mitreid-connect/json-web-key-generator.git cd json-web-key-generator mvn clean package cd target # Encryption Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 256 # # Full key: # { # "kty": "oct", # "k": "ABC" # } # # Signing Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 512 # Full key: # { # "kty": "oct", # "k": "XYZ" # } You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: tgc.encryption.key=ABC tgc.signing.key=XYZ ### Webflow Settings Locate your `cas.properties` file and find the `webflow.*` settings. If you do not see them in your configuration, go ahead and define them: # webflow.encryption.key= # webflow.signing.key= You can choose one of the two approaches described below to handle key regeneration. #### 1) Let CAS Generate Keys Blank/comment out the following `webflow` settings: # webflow.encryption.key= # webflow.signing.key= Build and deploy your CAS deployment once. Upon startup, CAS will notice that no keys are defined, and it will appropriately generate keys for you automatically. Your CAS logs will then show the following snippet: WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: webflow.encryption.key=ABC webflow.signing.key=XYZ #### 2) Manually Generate Keys Using a `git` client, clone and build the following project: git clone https://github.com/mitreid-connect/json-web-key-generator.git cd json-web-key-generator mvn clean package cd target # Encryption Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 96 # # Full key: # { # "kty": "oct", # "k": "ABC" # } # # Signing Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 512 # Full key: # { # "kty": "oct", # "k": "XYZ" # } You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: webflow.encryption.key=ABC webflow.signing.key=XYZ ### XML Configuration If you have manually overridden the `cas-servlet.xml` file, you will need to make sure the following blocks are present in the configuration: Note that the Person Directory project requires the following configuration in CAS overlays: ```xml Note that the Person Directory project requires the following configuration in CAS overlays: ```xml Re-adjust the beans accordingly, and remove the built-in keystore. ### Finally Rebuild and redeploy your CAS overlay. CAS 4.2.x --------- Modify your CAS overlay to point to version `4.2.1`. A snippet of a `pom.xml` for a CAS overlay follows: ... org.jasig.cas cas-server-webapp ${cas.version} war runtime 4.2.1 ... ### TGC Settings Locate your `cas.properties` file and find the `tgc.*` settings. * If your CAS deployment is **NOT** using the default encryption/signing keys provided by CAS and you have regenerated new keys and have replaced the default, you can safely ignore this step and leave your key configuration of signing/encryption in place without any further changes. * If your CAS deployment **IS** using the default encryption/signing keys provided by CAS and you have **NOT** regenerated new keys to replace the default, you **MUST** take action to regenerate the keys. You can choose one of the two approaches described below to handle key regeneration. #### 1) Let CAS Generate Keys Blank/comment out the following `tgc` settings: # tgc.encryption.key= # tgc.signing.key= Build and deploy your CAS deployment. Upon startup, CAS will notice that no keys are defined, and it will appropriately generate keys for you automatically. Your CAS logs will then show the following snippet: WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - WARN [org.jasig.cas.util.BaseStringCipherExecutor] - You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: tgc.encryption.key=ABC tgc.signing.key=XYZ Rebuild and redeploy your CAS overlay. #### 2) Manually Generate Keys Using a `git` client, clone and build the following project: git clone https://github.com/mitreid-connect/json-web-key-generator.git cd json-web-key-generator mvn clean package cd target # Encryption Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 256 # # Full key: # { # "kty": "oct", # "k": "ABC" # } # # Signing Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 512 # Full key: # { # "kty": "oct", # "k": "XYZ" # } You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: tgc.encryption.key=ABC tgc.signing.key=XYZ ### Webflow Settings Locate your `cas.properties` file and find the `webflow.*` settings. If you do not see them in your configuration, go ahead and define them: # webflow.encryption.key= # webflow.signing.key= You can choose one of the two approaches described below to handle key regeneration. #### 1) Let CAS Generate Keys Blank/comment out the following `webflow` settings: # webflow.encryption.key= # webflow.signing.key= Build and deploy your CAS deployment once. Upon startup, CAS will notice that no keys are defined, and it will appropriately generate keys for you automatically. Your CAS logs will then show the following snippet: WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - WARN [org.jasig.cas.util.BinaryCipherExecutor] - You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: webflow.encryption.key=ABC webflow.signing.key=XYZ #### 2) Manually Generate Keys Using a `git` client, clone and build the following project: git clone https://github.com/mitreid-connect/json-web-key-generator.git cd json-web-key-generator mvn clean package cd target # Encryption Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 96 # # Full key: # { # "kty": "oct", # "k": "ABC" # } # # Signing Key java -jar json-web-key-generator-0.3-SNAPSHOT-jar-with-dependencies.jar -t oct -s 512 # Full key: # { # "kty": "oct", # "k": "XYZ" # } You should then grab each generated key for encryption and signing, and put them inside your `cas.properties` file for each now-enabled setting: webflow.encryption.key=ABC webflow.signing.key=XYZ ### Finally Rebuild and redeploy your CAS overlay. Clustered CAS Deployments ========================= If you are running a cluster of CAS nodes, please be advised that the newly generated keys for all settings (regardless of the method of generation, whether CAS or you) **MUST** be shared with all CAS nodes in form of either a centralized or replicated/shared `cas.properties` file. Failure to do so will completely break CAS functionality. If you only have a single-node CAS deployment, there is nothing further for you to do. Support ======= If you have questions on the details this vulnerability and how it might be reproduced, please contact `security@apereo.org` or `cas-appsec-public@apereo.org`. Resources ========= * [Apache Commons statement to widespread Java object de-serialisation vulnerability](https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread) * [Apache Commons Collections security reports](https://commons.apache.org/proper/commons-collections/security-reports.html) [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F04%2F08%2Fcommonsvulndisc%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Hello World – Apereo Community Blog Hello World =========== Saturday, Jun 25, 2016 1 minute read This is [me](https://apereo.github.io/about) trying out Github Pages as a blog. Echo. Echo. Echo. Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Hello+World&url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&title=Hello+World "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&title=Hello+World "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&name=Hello+World "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&title=Hello+World "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&title=Hello+World "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F25%2Ffirst-post%2F&t=Hello+World "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Defining a Product Vision – Apereo Community Blog Defining a Product Vision ========================= Wednesday, Aug 24, 2016 1 minute read This post is relocated to [here](https://fawnoos.com/2016/08/24/soft-evolution/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Defining+a+Product+Vision&url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&title=Defining+a+Product+Vision "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&title=Defining+a+Product+Vision "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&name=Defining+a+Product+Vision "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&title=Defining+a+Product+Vision "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&title=Defining+a+Product+Vision "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F24%2Fsoft-evolution%2F&t=Defining+a+Product+Vision "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS EOL Policy Proposal – Apereo Community Blog CAS EOL Policy Proposal ======================= Monday, Aug 8, 2016 2 minute read The CAS project management committee has been reviewing a proposal on CAS release policies, maintenance and lifetime. In particular, this proposal attempts to provide answers to the following questions: * How long should a CAS release be maintained? * What is the appropriate scope for release maintenance once a release is retired? Today ----- The project has been handling release management and maintenance in a semi-official capacity. Today’s release practices typically are: * Patch releases, once every 30 days. * Minor releases, once every 3-4 months. * Major releases, where appropriate based on community demand and technical landscape. * Security patches, whenever needed and preferably as soon as humanly possible. There is no official policy to indicate the lifespan of a CAS release. Maintaining multiple release lines in an adhoc fashion is a very time-consuming and difficult process where the development team has to ensure patches across releases are ported backward or forward correctly and that changesets are properly cherry-picked into the target release, tested, documented and made available. This process is simply not sustainable. Proposal -------- To mitigate some of this pain, the following proposal and a decidedly simple one at that is in the making: * CAS adopters **MAY EXPECT** a CAS release to be maintained for one calendar year, starting from [the original release date](https://github.com/apereo/cas/milestones) . * Maintenance during this year includes bug fixes, security patches and general upkeep of the release. * Once the year is passed, maintenance of the release is **STRICTLY** limited to security patches and fixing vulnerabilities for another calendar year. * The lifespan of a release **MAY** be extended beyond a single year, to be decided by the CAS PMC and the community at large when and where reasonable. By “CAS Release”, we mean anything that is a minor release and above. (i.e. `4.1.x`, `4.2.x`, `5.0.0`, `5.1.0`, etc). What does this mean? -------------------- The above policy, once in effect, implies that the following CAS releases will transition into a security-patch mode (SPM) only and will be EOLed at the indicated dates. | Release | SPM Starting Date | Full EOL | | --- | --- | --- | | `4.0.x` | October 31st, 2016 | October 31st, 2017 | | `4.1.x` | January 31st, 2017 | January 31st, 2018 | | `4.2.x` | January 31st, 2017 | January 31st, 2018 | | `5.0.x` | September 30th, 2017 | September 30th, 2018 | All past releases that are absent in the above table are considered EOLed. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+EOL+Policy+Proposal&url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&title=CAS+EOL+Policy+Proposal "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&title=CAS+EOL+Policy+Proposal "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&name=CAS+EOL+Policy+Proposal "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&title=CAS+EOL+Policy+Proposal "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&title=CAS+EOL+Policy+Proposal "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F08%2Feol-policy-proposal%2F&t=CAS+EOL+Policy+Proposal "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Survey Results – Apereo Community Blog CAS Survey Results ================== Sunday, Jun 26, 2016 11 minute read A [while ago](https://groups.google.com/a/apereo.org/forum/#!searchin/cas-user/survey/cas-user/vQr3eBdHNg8/eKm9gkpxIwAJ) the CAS project management committee prepared a [survey](http://goo.gl/forms/rF9EeCN6GH) to help plan the future roadmap of the project. The primary objectives of the survey were to gain a better understanding of the current configuration pain points from a deployer point of view and learn what additional features and enhancements should have to be prioritized for development. In this post, I intend to provide a summarized view of the survey results and discuss what has or will be done to address the feedback. Results ======= There were about 200 responses to the survey from both individuals and institutions. Some responses were submitted by consulting firms who provide CAS commercial services for their clients which indicates the actual number of deployers may be larger than the reported 200. Participants of the survey indicated that on average, they have been running CAS for more than 10 years in a variety of industry sectors such as Government, Higher-Ed, Insurance, Finance, Travel and Health. More than 50% of the results indicated a CAS server deployment size of more than 10K users which is considered a rather large deployment of the platform. The table below demonstrates what percentage of the community has chosen a given form of primary authentication: | Method | Adoption | | --- | --- | | LDAP/AD | 82% | | RDBMS | 8% | | Other | 10% | The “Other” category being: NoSQL, X509, Rest, Social AuthN and many other forms of authentication supported by CAS. CAS Version ----------- The table below shows what percentage of the community is using a given CAS server version. | Version | Adoption | | --- | --- | | 3.x | 53% | | 4.0.x | 22% | | 4.1.x | 14% | | 4.2.x | 4% | | Other | 7% | It’s important to note that CAS 3.x has been EOLed for almost 2 years. What this means is that CAS 3.x will no longer be maintained, fixed or (in case of security vulnerabilities) patched by the development team. Therefor, it is strongly recommended that those deployments switch and upgrade to a more recent and stable version of the platform, which at the time of this writing is CAS 4.2.x. Features -------- Survey participants were also asked to vote on a number of proposed features on a 1-5 scale with 5 being most desirable. The following table shows an aggregated view of the results for each given feature where the adoption percentage is a summary of category 4 and 5 response types, indicating development should strongly focus on the completion or improvement of the proposed item. | Feature | Vote | | --- | --- | | Admin UIs | 60% | | SAML2 | 60% | | MFA | 52% | | Surrogate AuthN | 43% | | Adaptive AuthN | 42% | | Rest APIs | 40% | | GUI Wizard | 33% | | Front-Channel SLO | 33% | | WS-Fed | 31% | | OIDC | 29% | | OAuth2 | 28% | | FIDO | 16% | | Dynamic Registration | 11% | Additional Feedback ------------------- The following items were also reported by the community as areas that require improvement and clarification: ### Better Documentation The current CAS documentation assumes a high degree of familiarity with deployment tools such as Maven, Tomcat/Jetty, etc. The adopter also at times has to deal with multiple XML configuration files for enabling features such as LDAP authentication. This presents varying degrees of difficulty for a novice deployer to quickly get started with a CAS deployment. Step-by-step installation instructions, more samples and clarity in the documentation when it comes to dealing with specific CAS modules and features would be strongly desirable. A non-Maven deployment strategy could also be devised to relieve some of that pain when it comes to managing dependencies and CAS artifacts. ### Easier Upgrades The current CAS deployment strategy consists of [constructing a Maven overlay](https://github.com/apereo/cas-overlay-template) in order to combine and merge local customizations with the original CAS distribution. This at times can morph into a complicated CAS upgrade process, specially if local customizations end up at odd conflicts with the new CAS distribution. Adopters are invariably forced to compare locally overlaid artifacts with their original version and fill in the gaps where necessary. Needless to say, this process for a novice deployer is less than obvious to understand and utilize. ### Other Features A number of other features were requested by participants that were not part of proposed scope. These included: 1. JWT authentication 2. Integrated Password Management 3. Tracking and Geo-profiling authentication requests. 4. Other registry types for managing CAS tickets and service definitions, such as YAML, Redis, ZeroMQ, etc. Response ======== The CAS development team has been working on the next major release of the platform, that is 5.0.0. Taking into account the community survey and feedback, here are a few notes to help clarify how CAS 5 attempts to address some of the reported issues. Before we get started, it should be pointed out that [early milestone releases of CAS 5 are available](https://github.com/apereo/cas-overlay-template/tree/5.0) . Deployers are more than welcome to try out the milestone releases and share feedback. The current in-development documentation of CAS 5 is also [available here](https://apereo.github.io/cas/development/index.html) . Features -------- ### Core CAS 5 will have built-in support for: * [MFA](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html) based on Duo Security, Google Authenticator and more. * [SAML2 authentication](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) , acting as an identity provider consuming and producing SAML metadata. * [OpenID Connect](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) , acting as an OP producing claims for RPs. * A YAML-based service registry. * Delegating authentication to a remote REST endpoint. * Recording and Geotracking authentication events. Since CAS 4.2.x, the platform has supported: * [JWT authentication](https://apereo.github.io/cas/4.2.x/installation/JWT-Authentication.html) . * [Delegating authentication](https://apereo.github.io/cas/4.2.x/integration/Delegate-Authentication.html) to [ADFS](https://apereo.github.io/cas/4.2.x/integration/ADFS-Integration.html) , CAS, SAML2 IdPs and a large variety of social authentication providers such as Facebook, Twitter and more. * Ticket registry implementations based on [Redis and Apache Cassandra](https://apereo.github.io/cas/4.2.x/installation/Infinispan-Ticket-Registry.html) . ### Auto Configuration Loudly pointed out by the survey, a much-needed overhaul of the CAS documentation is needed to enable configuration of CAS features in a more intuitive and sustainable way. To address this issue, CAS 5 takes an orthogonal approach where most if not all CAS features are **automatically configured** by CAS itself, given deployer’s consent, relieving the deployer from having to deal with XML configuration. This is a model we refer to as **Intention-driven configuration**. In the past in order to turn on a particular CAS feature, the adopter had to: * Find and declare the module as a dependency * Fiddle with a variety of XML configuration files to declare components * Touch a few properties and settings supplying the appropriate values for those components. * Repackage and redeploy. This process was much prone to errors and at times had to be repeated over and over again until the final works was in place. It also was extremely dependent on an accurate and reasonably detailed and clear documentation. It goes without saying that sustaining this model of development and configuration presents a high degree of difficulty for maintainers of the project and adopters of the platform. To remove some of this pain, CAS 5 presents the following approach to the deployer: * Find and declare the feature module as a dependency, thus **announcing your intention** of enabling a particular feature in CAS. * **Optionally**, configure the module by supplying settings via a simple `.properties` file. At deployment time, CAS will auto-determine every single change that is required for the functionality of declared modules and will auto-configure it all in order to remove the extra XML configuration pain. This is a strategy that is put into place for nearly **ALL** modules and features. This strategy helps with the documentation noise as well to a large degree because there is no longer a need to document every single XML configuration file and change required for each module for a given needed feature. The CAS 5 platform starts to have very low expectations of the adopter in terms of learning its internals and different configuration mechanics. Simply declaring an intention and optionally configuring it should be more than sufficient. This strategy also greatly assists with future upgrades because there would be very few, if any, local configuration files lying around in a deployment environment. The adopter should mostly care about the appropriate settings and values supplied to CAS that describe the core intended business functionality desired. As an example, in order to configure LDAP authentication, all an adopter has to do is **declare his/her intention**: org.apereo.cas cas-server-support-ldap ${cas.version} …and **declare the relevant settings**: ... # cas.authn.ldap[0].ldap-url=ldaps://ldap1.example.edu,... # cas.authn.ldap[0].baseDn=dc=example,dc=org # cas.authn.ldap[0].userFilter=cn={user} # cas.authn.ldap[0].bindDn=cn=Directory Manager,dc=example,dc=org # cas.authn.ldap[0].bindCredential=Password ... That’s all. There is no other change required. This model would not have been possible without CAS taking full advantage of [Spring Boot](http://projects.spring.io/spring-boot/) . Note that auto configuration of modules not only takes into account core what-used-to-be XML configuration but also any additions that may be required for the CAS webflows. Note that CAS 5 does not remove one’s ability to declare relevant changes and customizations in an XML file. There will be a `deployerConfigContext.xml` file, much like the old days, for those who feel more comfortable with an XML-friendly explicit form of configuration. However, for most if not ALL changes this strategy is completely unnecessary. ### Managing Configuration Previously, adopters had to repackage and redeploy the CAS web application if a configuration property (i.e. LDAP URL) had to be changed. This will no longer be true in CAS 5 where **most if not ALL** CAS components become reloadable. What this means is, specific endpoints (and administrative UIs) are exposed to adopters which can receive a reload request (permissions granting) and auto-configure the running CAS application context with the new state of the world WITHOUT the need to repackage and/or deploy the CAS software. This model would not have been possible without CAS taking full advantage of [Spring Cloud](http://projects.spring.io/spring-cloud/) . To learn more about how CAS manages the deployer configuration, particularly in a clustered environment, please [review this page](http://unicon.github.io/cas/development/installation/Configuration-Management.html) . ### Deployment Once packaged, adopters previously had to grab the final CAS web application and deploy it into a servlet container of choice such as Tomcat or Jetty. While this model is and will be supported, CAS 5 takes this one step further and ships with a built-in Tomcat container that can simply launch the CAS application directly from the command line. The recipe is as simple as: ... mvn clean package java -jar target/cas.war ... __ ____ _ ____ __ / / / ___| / \ / ___| \ \ | | | | / _ \ \___ \ | | | | | |___ / ___ \ ___) | | | | | \____|/_/ \_\|____/ | | \_\ /_/ CAS Version: 5.0.0.M3-SNAPSHOT Build Date/Time: 2016-06-26T20:55:15.345Z Java Home: C:\Program Files\Java\jdk1.8.0_92\jre Java Vendor: Oracle Corporation Java Version: 1.8.0_92 OS Architecture: amd64 OS Name: Windows 10 OS Version: 10.0 ... Every attempt has been made to ensure every aspect of the built-in Tomcat container (such as SSL, context path, etc) is configurable via the same `.properties` file that houses all other CAS configuration. Built-in containers are also available, optionally, for Jetty and Undertow. ### User Interfaces CAS 5 starts use to use [Thymeleaf](http://www.thymeleaf.org/) as a rendering engine for its user interfaces. Thymeleaf’s main goal is to bring elegant natural templates to your development workflow — HTML that can be correctly displayed in browsers. The old JSP model required adopters to test out UI-related changes directly inside a running servlet container such as Tomcat. Thymeleaf allows CAS to present HTML-native pages that can easily be viewed in the browser without requiring an underlying container engine. CAS 5 also attempts to improve the user experience for the administrator in a cloud-friendly manner. There are many administrative control panels that expose insight into the running CAS software. The screens report back on the health of the running CAS server, various configuration options and status of active SSO sessions, etc. There is also additional upcoming work to further improve these control panels, allowing the adopter to monitor and configure logs, adjust CAS settings and manage SSO sessions more effectively without resorting access to the native command-line. Of course if you wish, you can always resort back to the command-line if you wish to manually hand-massage the configuration. Here are a few screenshots of the new CAS 5 user interfaces: > [View post on imgur.com](https://imgur.com/a/6uq4s) What’s Next? ============ The development team is working hard to make sure the CAS 5 release is right on [schedule](https://github.com/apereo/cas/milestones) . For the time being, CAS 4.1.x and 4.2.x release lines will be maintained by the development team. However, the primary development focus and time will be dedicated to CAS 5, addressing bugs and extending the platform to be a more comfortable experience specially for some of the brand new features presented in this release. How can you help? ================= * Start your early [CAS 5 deployment](https://github.com/apereo/cas-overlay-template/tree/5.0) today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. Das Ende ======== I would like to thank all survey participants. None of this would have been possible without your engagement and involvement in a vibrant community. Thank you for sharing. Thank you very much for all the kind words. On behalf of the CAS project, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Survey+Results&url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&title=CAS+Survey+Results "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&title=CAS+Survey+Results "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&name=CAS+Survey+Results "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&title=CAS+Survey+Results "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&title=CAS+Survey+Results "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F06%2F26%2Fsurvey-results%2F&t=CAS+Survey+Results "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # MyUW (University of Wisconsin) Build Process – Apereo Community Blog MyUW (University of Wisconsin) Build Process ============================================ Thursday, Sep 15, 2016 5 minute read During the most recent uPortal development meeting we were discussing how uPortal building and deployment currently works and ought to work. It came up that other campuses are checking out the project on each server, building the ear, and shipping it to Tomcat. UW does not take that approach and we thought it may be helpful to articulate what we do to maybe help steer the next generation uPortal project (aka uPortal 5). Edits: * adjusted to reflect the new name `uPortal app framework` and new repository location for what was previously known as `uw-frame` * adjusted to reflect the new name `uPortal home` and new repository location for what was previously known as `AngularJS-portal` The Now ------- There are many pieces of technology that the UW uses. Here are the components and some other definitions that will be used in this technical document: * CI : Continuous integration * [Jenkins](https://jenkins.io/) : A platform to build and deliver projects * [Maven Repository](https://www.jfrog.com/artifactory/) : A storage application to place and retrieve built Java artifacts * [Gitlab](https://about.gitlab.com/) : A git repository GUI (UW has an on-prem instance running in Docker, very easy) * [Maven Overlay](http://maven.apache.org/plugins/maven-war-plugin/overlays.html) : A process in maven where you can overlay files on top of a project to change things such as configuration. * [Docker](https://www.docker.com/) : shipping containers with a single process\* running in a encapsulated environment. * [Token Crypt](https://github.com/UW-Madison-DoIT/token-crypt) : A project that can encrypt/decrypt tokens and files using public/private key pairs. We use Jenkins for two different reasons. First we build the project and deploy the snapshot to our maven repository. We also use Jenkins for CI. For example, let’s say that someone makes a change to our fork of uPortal. When we merge the merge request from Gitlab into `master`, we push out a post merge web hook to Jenkins. Then we have a Jenkins job that runs `mvn deploy` which packages all the artifacts for uPortal and deploys it to the snapshot maven repository. It is important to note that the artifact we ship to maven has no passwords or configuration files in it. These are environment agnostic artifacts. After the environment agnostic war has been shipped to the maven repository, we trigger a test uPortal war build. This build is just an overlay. It takes the environment agnostic war, unwraps it, injects in the configuration files for test, and wraps it back up. It is then stored in our server’s local `.m2/repository`. During this process we decrypt the tokens that are passwords using Token Crypt’s maven plugin. Since it has passwords at this point, it’s important to keep it local and not push it anywhere. At this point the ear job for test is triggered. This ear job is just a `pom.xml` that pulls in the artifacts from all the overlay projects for that given environment. You can see an example of said `pom.xml` [here](https://github.com/UW-MultiEnvironment-Build/dev-ear) . All that happens is we run a `mvn package` and then ship the ear (exploded) to a directory on the build server. Do note that none of this is happening on a server that will run uPortal. So now we have a test version of our deliverable that we want to ship to our test instances. We use Docker for our servers, running on Linux VMs. We have a Docker container that has a preconfigured Java and Tomcat with an empty webapps directory. After the ear build runs with the test ear, we then can deliver it to test. We have a docker jenkins job that does this task. It does the following: * Docker pull our latest container that has java/tomcat configured * Copy the wars from the build directory to the running directory (versioned so we can always rollback) * Take an instance offline and delete the container (e.g.: `docker stop test1 && docker rm test1` ) * Do a docker run (e.g.: `docker run myuw/tomcat7-java7:latest -v /runner/810/webapp:/home/of/tomcat/webapp`) * Water test the node to make sure tomcat started correctly * Then trigger that instance back into the cluster, and rinse/repeat for other nodes Looking ahead to where we would like to go ------------------------------------------ We like our current setup but we would like to improve on a few things. Here is our wish list. First we would love to stop having to fork uPortal to get our own skin and configuration (using the alternative `uPortal home` front end). If we could do a Docker overlay process that could be nice. We would also like to have it possible to ship the content of the webapp directory instead of depending on a volume mount from the host. In order to accomplish that we need to get rid of the hard coded passwords in the configuration files. We are looking toward using [VaultProject](https://www.vaultproject.io/) for that. This would have the sided bonus of removing the complexity of maven overlays. During startup vault could go fetch the configuration for that given environment. It could also be interesting to be able to download a docker artifact containing a configured uPortal from docker hub. The only downside is we would like to be able to control the versions of Java and Tomcat. However, if we updated this often we could be alright with relieving that control. A single Docker container running a big JVM can be painful to scale. We would like to look into splitting out our webapps into many docker containers so we can scale only the things that need scaling. A great example of that is the wave of students who need to get to our campus course guide (which is currently a portlet). If we wanted to increase the bandwidth of that one portlet, we would need to stand up another 6GB JVM. We are migrating that application to a normal webapp so this is possible. It will still have a MyUW presence, but just through widgets and links. It will have the added bonus to look like it is part of the MyUW experience using shared angular components from [uPortal app framework](https://github.com/uPortal-project/uportal-app-framework) . We are also looking toward running on AWS, but this is in the very early stages. More Resources -------------- * [Github overlay sample project](https://github.com/orgs/UW-MultiEnvironment-Build/dashboard) [Tim Levett](https://twitter.com/timtim192) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=MyUW+%28University+of+Wisconsin%29+Build+Process&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&title=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&title=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&name=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&title=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&title=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F15%2Fmyuw-build-now-and-future%2F&t=MyUW+%28University+of+Wisconsin%29+Build+Process "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.0.0-M3 Released – Apereo Community Blog CAS 5.0.0-M3 Released ===================== Saturday, Jul 23, 2016 4 minute read Based on the [CAS project release schedule](https://github.com/apereo/cas/milestones) , today we are excited to announce the 3rd milestone release in the CAS 5 series. There are a [few significant enhancements](https://github.com/apereo/cas/releases/tag/v5.0.0.M3) packed into this release that are worthy to publicize. So here it goes. Before we get started, it should be pointed out that [such milestone releases of CAS 5 are available to adopters to try](https://github.com/apereo/cas-overlay-template/tree/5.0) . Deployers are more than welcome to try out the milestone releases and share feedback. The current in-development documentation of CAS 5 is also [available here](https://apereo.github.io/cas/development/index.html) . Type-safe Properties ==================== The [entire collection of CAS settings](https://apereo.github.io/cas/development/installation/Configuration-Properties.html) are now redesigned to take advantage of [Spring Boot’s typesafe properties](http://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html#boot-features-external-config-typesafe-configuration-properties) . These settings are safely mapped to a corresponding `SomeCasComonentProperties` Java class at runtime, support lists, sets and maps and can easily be refactored to contain more than one batch of settings. As an example, to define LDAP authentication handlers: ... cas.authn.ldap[0].ldap-url=ldaps://ldap1.example.edu,... cas.authn.ldap[0].baseDn=dc=example,dc=org cas.authn.ldap[0].userFilter=cn={user} cas.authn.ldap[0].bindDn=cn=Directory Manager,dc=example,dc=org cas.authn.ldap[0].bindCredential=Password ... Additional handlers can be defined by simply incrementing that `0` index. Furthermore, this release takes on a super comprehensive approach into allowing the adopter to control all aspects of authentication handlers via such typesafe properties. You can now define individual password encoders, principal transformers and password policy settings for a given handler all via the same collection set. No need to resort to any sort of XML configuration file. Note all that sensitive CAS settings [can be encrypted and secured](https://apereo.github.io/cas/development/installation/Configuration-Properties-Security.html) . At runtime, CAS will auto-decrypt settings, making the configuration that much easier to be shared centrally in a central repository of some sort. There are many other small little enhancements packed into this particular area that remove the need for **explicit** XML configuration. Things such as attribute resolution, PersonDirectory configuration, and more. As you observe, **ALL** CAS properties are now collected inside a single page on the documentation site; they are no longer spread around here and there. This makes it easier for project developers to maintain them, and for you as deployers to find them all in one spot. Bootiful Management Webapp ========================== The CAS management webapp is now bootified. It also boasts support for a few other additinal UI panes and sections that deal with MFA, OIDC, SAML, and more. Work continues to make sure all properties of a given CAS registered service can be configured and controlled via the UI. :cas-management-webapp:bootRun Listening for transport dt_socket at address: 5000 ____ _ ____ __ __ _ / ___| / \ / ___| | \/ | __ _ _ __ __ _ __ _ ___ _ __ ___ ___ _ __ | |_ | | / _ \ \___ \ | |\/| | / _` || '_ \ / _` | / _` | / _ \| '_ ` _ \ / _ \| '_ \ | __| | |___ / ___ \ ___) | | | | || (_| || | | || (_| || (_| || __/| | | | | || __/| | | || |_ \____|/_/ \_\|____/ |_| |_| \__,_||_| |_| \__,_| \__, | \___||_| |_| |_| \___||_| |_| \__| |___/ Dependency Upgrades =================== This milestone builds on top of some significant dependency upgrades that include: * Spring Boot 1.4 \* * Ldaptive 1.2 \* * Pac4j 1.9.1 (\*) These components are today in `RC` or `SNAPSHOT` mode, and will be switched to their appropriate `GA` release prior to the official CAS 5 release. I am most excited about Pac4j 1.9.1, which allows CAS easier support for delegated social authentication to: * Github * Dropbox * Yahoo! * FourSquare * Windows Live * Google Plus Digest AuthN ============ Taking advantage of Pac4j 1.9, CAS now presents support for [Digest authentication](https://apereo.github.io/cas/development/installation/Digest-Authentication.html) as another form of non-interactive authentication. WS-Fed Encrypted Assertions =========================== In this milestone, the WS-FED CAS module starts to support encrypted assertions issued by ADFS. This change is also ported to the `4.2.x` release line. Authy OTP MFA ============= Finally, CAS adds [Authy](https://www.authy.com/) to its collection of supported MFA providers. At this time, support is limited to [Authy’s OTP REST API](https://apereo.github.io/cas/development/installation/AuthyAuthenticator-Authentication.html) . Given community demand and interest, support for Authy’s OneTouch API may be worked out in the future. What’s Next? ============ The development team is working hard to make sure the CAS 5 release is right on [schedule](https://github.com/apereo/cas/milestones) . This is likely the last milestone for v5. As the milestones schedule shows, the project will be preparing for its first release candidate in about a month. Please keep an eye out for further announcements. How can you help? ================= * Start your early [CAS 5 deployment](https://github.com/apereo/cas-overlay-template/tree/5.0) today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende ======== A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.0.0-M3+Released&url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&title=CAS+5.0.0-M3+Released "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&title=CAS+5.0.0-M3+Released "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&name=CAS+5.0.0-M3+Released "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&title=CAS+5.0.0-M3+Released "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&title=CAS+5.0.0-M3+Released "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F07%2F23%2Fm3-release%2F&t=CAS+5.0.0-M3+Released "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Veresk Software Architecture – Apereo Community Blog Veresk Software Architecture ============================ Saturday, Sep 17, 2016 1 minute read This post is relocated to [here](https://fawnoos.com/2016/09/17/practical-soft-arch/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Veresk+Software+Architecture&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&title=Veresk+Software+Architecture "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&title=Veresk+Software+Architecture "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&name=Veresk+Software+Architecture "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&title=Veresk+Software+Architecture "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&title=Veresk+Software+Architecture "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F17%2Fpractical-soft-arch%2F&t=Veresk+Software+Architecture "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Hope for GitHub Pages – Apereo Community Blog Hope for GitHub Pages ===================== Friday, Sep 16, 2016 5 minute read Short version ============= * “+1” for Apereo adoption of [GitHub Pages](https://pages.github.com/) for this website. * I’m hopeful for applying this approach beyond blogging. * Static site generators have lots of advantages. Those advantages align with Apereo values and realities. * Call to action to use [GitHub Pages](https://pages.github.com/) more and better and thereby make Apereo websites better. +1 == I’m really excited and supportive about Apereo’s adopting [GitHub Pages](https://pages.github.com/) for this website, and I’m hopeful about using it for more than just a blog. Not only do I concur that this is a good idea, (Which is to say, “+1”, in Apache parlance.) Advantages of static site generator websites ============================================ [Jekyll](https://jekyllrb.com/) \-driven [GitHub Pages](https://pages.github.com/) has tremendous advantages aligned with Apereo values and operations. * Driving the website by [a public Git repository](https://github.com/apereo/apereo.github.io) improves **transparency**. It means anyone can inspect the content and [history](https://github.com/apereo/apereo.github.io/commits/master) of the site to understand just what is being said and the history of saying it. And anyone can inspect the program that generates the site from the content files. Not just the open source technology used in the abstract - the [specific configuration](https://github.com/apereo/apereo.github.io/tree/master/_layouts) , instantiation of that automation. * Driving the website by a public GitHub repository improves **openness**. It means [anyone can propose a change](https://help.github.com/articles/creating-a-pull-request/) . Anyone can even [edit through the GitHub UI in a Web browser](https://help.github.com/articles/editing-files-in-another-user-s-repository/) if working with text files locally is off-putting. * Driving the website by a public GitHub repository improves **meritocracy**. It means when anyone proposes a change, that proposed change can be publicly evaluated on its merits. GitHub Pull Requests and their [review features](https://help.github.com/articles/reviewing-changes-in-pull-requests/) are a beautiful thing. * Driving the website by a public GitHub repository improves **collaboration**. It means anyone can collaborate with anyone in any branches they need, in public or private forks if need be. * Modeling the website content as text files in a public GitHub repository better enables (much) **better tools for working on the content**. Programmers edit text files. A website that is fundamentally text files as content is more amenable to programmers and technically minded people doing great things efficiently. `grep` and its kin are beautiful and powerful. As is your text editor of choice. * Driving the website by an open and openly configured static site generator enables (much) **better tools for working on the website framework**. To the extent necessary, programmers can collaborate not just on the content but also on the “program” that generates the website from the content – the CSS, the templating, all the way through [the free and open source static site generator framework itself](https://jekyllrb.com/) . * GitHub Pages is much better aligned with affordable and sustainable Apereo operations practices. Apereo runs very thin on infrastructure and even thinner on staff and volunteer bandwidth to wrangle infrastructure. GitHub Pages **adds zero to Apereo’s server and database footprint**. * GitHub Pages websites are also **free as in cheapness**, which lines up well with Apereo funding levels. Apereo maybe should pay someone to develop awesome website content (arguable). Apereo definitely shouldn’t be paying anyone to host a website, operate its database, keep WordPress patched. Accept free-as-in-cheapness infrastructure for commodity website hosting and repurpose scarce resources for something more higher-ed-open-source-IT-aligned. * Static site generators enable higher quality results. It’s easier for web developers to collaborate on making a website much sharper, much snappier, much better when using sharper tools. * Using [Jekyll](https://jekyllrb.com/) \-driven [GitHub Pages](https://pages.github.com/) **eases future migrations**. While GitHub Pages operates with panache, [Jekyll](https://jekyllrb.com/) is open source and generates a static website that can be served up from just about anywhere on just about any technology stack. Using GitHub Pages _doesn’t_ entail vendor lock-in. * Using [Jekyll](https://jekyllrb.com/) \-driven [GitHub Pages](https://pages.github.com/) eases future migrations. If Apereo ever wants to port this content to a different website management platform, well, all the content is just text files. It’s hard to beat that as a friendly starting point for laying hands on this content and importing it into something else. (These are advantages of open source public-git-repository-driven static site generators more generally. Jekyll-driven GitHub Pages is a particularly nice implementation of an approach that can be achieved with more hassle using other specific technologies.) Examples of use of GitHub Pages, outside and within Apereo ========================================================== Okay, so [GitHub Pages](https://pages.github.com/) in particular, and static site generators more generally, are technically awesome. You might reasonably ask, why is this website nonetheless so very ugly? I want to assure that GitHub Pages sites can be beautiful, usable, arbitrarily comprehensive, etc. GitHub has a [showcase of GitHub Pages examples](https://github.com/showcases/github-pages-examples) . These are some of the more website-flavored examples: * [Electron](http://electron.atom.io/community/) * [react](https://facebook.github.io/react/) * [developer.github](https://developer.github.com/) We need not look so far afield to find examples of using GitHub Pages to make websites happen: there are usages within Apereo already. * [CAS](https://apereo.github.io/cas/) * [OpenDashboard](http://apereo-learning-analytics-initiative.github.io/OpenDashboard/) * [OAE](http://oaeproject.org/) (note this demonstrates that GitHub Pages sites can have arbitrary hostnames, don’t have to be .github.io branded.) * [Tsugi](https://csev.github.io/tsugi/) Next steps ========== Better is better. Make things better, and then make things better again. Repeat. I believe that static site generator approaches are better than database-backed-web-application approaches (WordPress, Drupal, even my beloved Ghost) for web sites, more often than not. GitHub Pages-driven [oaeproject.org](http://oaeproject.org/) feels more awesome, more beautiful, more full of potential to me than does [its equivalent pages within apereo.org](https://www.apereo.org/projects/apereo-oae) . The next step is to do more of that. To keep making Apereo content better using better tools. And then to repeat. I hope these steps will add up to a walk will be a walk out of database-backed website solutions and into static site generator solutions, for the better productivity, quality, openness, transparency, and sustainability of Apereo website delivery. Disclaimer ========== Opinions expressed are my own and are not necessarily those of Apereo, of my employer, of the uPortal project, or of other projects and organizations with which I am involved. [Andrew Petro](https://twitter.com/awpetro) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Hope+for+GitHub+Pages&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&title=Hope+for+GitHub+Pages "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&title=Hope+for+GitHub+Pages "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&name=Hope+for+GitHub+Pages "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&title=Hope+for+GitHub+Pages "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&title=Hope+for+GitHub+Pages "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F16%2Fhope-for-gh-pages%2F&t=Hope+for+GitHub+Pages "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.0.0-RC1 Release – Apereo Community Blog CAS 5.0.0-RC1 Release ===================== Friday, Aug 26, 2016 8 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Based on the [CAS project release schedule](https://github.com/apereo/cas/milestones) , today we are excited to announce the first release candidate in the CAS 5 series. There are a [few enhancements](https://github.com/apereo/cas/releases/tag/v5.0.0.RC1) packed into this release that are worthy to publicize. So here it goes. Before we get started, it should be pointed out that [releases of CAS 5 are available to adopters to try](https://github.com/apereo/cas-overlay-template/tree/5.0) . Deployers are more than welcome to try these out and share feedback. The current documentation of CAS 5 is also [available here](https://apereo.github.io/cas/development/index.html) . OpenID Connect ============== OIDC support in CAS gets a number of improvements and bug fixes thanks to [Jérôme](https://github.com/leleuj) . Google reCAPTCHA ================ Over the years, there have been several requests on the mailing list asking for guidance to enable a CAS integration with Google’s reCAPTCHA. While [a recipe](https://wiki.jasig.org/display/CASUM/Integrating+reCaptcha+with+CAS) existed for enabling this feature for older CAS versions, over time it’d gotten rusty. In this release, CAS starts to support [Google’s reCAPTCHA](https://apereo.github.io/cas/development/integration/Configuring-Google-reCAPTCHA.html) natively. Just like with all other features, there will be no need to modify the CAS login webflow or any other configuration file. Include the relevant module, and provide your settings for reCAPTCHA. > [](https://imgur.com/DBIcr) [This article](http://news.softpedia.com/news/google-recaptcha-cracked-in-new-automated-attack-502677.shtml) may be of further interest to you. Default Redirect URL ==================== What happens when users accidentally and incorrectly bookmark the `https://sso.example.org/cas/login` url? They get to the CAS login page, authenticate and then are greeted with a warm welcoming message that redirects them to nowhere important. Phone calls and support tickets flood IT services reporting that CAS or this/that application are broken. That’s no fun. So to accommodate this briefly, CAS starts to support a default redirect URL to which you can redirect your audience if no target application is specified upon authentication. The URL can be just about anywhere, as long as you have authorized and registered it correctly. In most cases, it’s a redirect to some sort of portal page that lists all services integrated with CAS. Case Insensitive Attribute Release ================================== So you have set up CAS to retrieve attributes from your LDAP server and decided to retrieve the attribute `givenName`. You then register a few services and design them such that they would be allowed to receive `givenName`, yet nothing is released. Your logs show `givenName` is found and your LDAP queries and browsers all show that attribute has a valid value and all the right permissions are set. What’s happening? Is CAS secretly biased against that attribute? Some LDAP servers seem to change the case of the attribute name when they pass it back to the requesting application. CAS may submit `givenName`, yet it receives `givenname`. When the application asks for attributes CAS looks at the associated attribute policy and finds that it’s authorized to release `givenName`, yet the actual principal has no such attribute! It only has `givenname`. As a result, the application gets nothing. To accommodate this scenario, CAS starts to treat attributes that are specified in attribute release policies in a case insensitive manner. With this change, CAS may ask for `givenName` and the LDAP server is free to return `givenname`, `GIVENNAME` or a hyper-emo version of it, `gIvEnNaMe`. At release time, since case no longer matters the application will correctly receive `givenName`. If it matters that much, note that you can always control the exact case of the attribute released as well and override the CAS behavior. Also note that this behavior is applicable to all sources from which you retrieve attributes. It’s not limited to LDAP though the issue described most commonly affects LDAP. Geoprofiling Authentication Requests ==================================== How do you block what you may consider a suspicious authentication attempt? For instance, you may wish to disallow requests from certain locations or IP addresses or even fancier, you may want those requests to pass through multifactor authentication for extra security. As a variant of [adaptive authentication](https://apereo.github.io/cas/development/installation/Configuring-Adaptive-Authentication.html) and starting with this release candidate CAS allows you to geoprofile authentication requests and then based on your devised rules, reject those or force them through a particular multifactor provider. Geoprofiling can be achieved via Maxmind or GoogleMaps, both of which are services that **require a paid subscription** for full API usage. Groovy, maaan! ============== Furthermore, CAS starts to support [attribute release](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html#groovy-script) via the Groovy programming language. In short, you can specify a groovy script that is executed upon attribute resolution and/or release to dynamically and programmatically decide which application should receive a selection of attributes. Note that attribute resolution could always be done via Groovy. This bit is not new. We have just made the configuration of it a whole easier. Also note that in CAS, attribute resolution is a separate process from attribute release. You can mix and match options that are available for both. Needless to say, the script is all Groovy and and is capable of executing any kind of operation the Groovy language itself is able to support. Spring Cloud: Vault & MongoDb ============================= CAS adds support for [Vault](https://www.vaultproject.io/) and MongoDb, as options that may be used to house [CAS configuration](https://apereo.github.io/cas/development/installation/Configuration-Management.html) . DuoSecurity WebSDK 2.3 ====================== Thanks to contributions from DuoSecurity, the Duo WebSDK module is now bumped to `2.3`. Front Channel SLO ================= While it has been and still is somewhat of an experimental feature, this release candidate improves the CAS front-channel single logout functionality. CAS attempts to collect applications that are defined to use front-channel logout and will use a bit of fancy javascript to contact each endpoint to pass along the logout notification request. The payload and syntax of the request is identical to the current back-channel logout, and status of each request is tracked and displayed in the user interface. SAML2 SP Integrations ===================== Now that CAS 5 starts to support the SAML2 protocol, you gotta ask: what if we could extend the auto-configuration strategy to provide built-in SP integrations? That is, much like anything else, you should be able to declare what your SP metadata is, what attributes it requires and so on in a simple `.properties` file. CAS should auto-register the SP and take care of all the other technical details. Right? Right! With this release, CAS starts to support the following [SP Integrations](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) out of the box: * Dropbox * Box * Salesforce * SAManage * ServiceNow * PowerFAIDS Net Partner * Workday * WebEx * Office365 These are generally SPs for which the SAML2 integration recipe is quite simple. As we progress forward, we hope to start collecting more and more of such SPs, specially those that are more visible and used by the wider community often, such that we can **configure once, run everywhere** rather than document it repeatedly, maintain it separately and repeat it for every deployment forever. If you have SP suggestions, please feel free to share. Audit Log ========= In certain cases and depending on the nature of the request, CAS would produce an `audit:unknown` in the audit log. Thanks to [Dima](https://github.com/dima767) , this behavior is corrected to ensure the audit log can produce a valid user id for all cases. Logging Dashboard ================= CAS starts to allow its administrators, permissions granting, to observe logging configuration and view log outputs in real time. This is done via the magic of Web Sockets, where CAS and the browser establish a light-weight TCP connection to stream log data. Here are a few screenshots: > [](https://imgur.com/a2vUk) Custom Error Pages ================== Thanks to the magic of Spring Boot, CAS starts to present customized error pages based on http error codes. You can for instance design a simple `401.html` to explain the error to your users better. Error pages can be defined in form of series as well, such as `5xx.html`. Here are a few screenshots: > [](https://imgur.com/jGMeo) Password Management =================== Starting with this release, CAS provides very modest [password management capabilities](https://apereo.github.io/cas/development/installation/Password-Policy-Enforcement.html) . This is an optional feature which allows users to change their password in-place when CAS detects an authentication failure due to a rejected password. LDAP is supported as a backend option for managing the account password, though you could always extend CAS to provide your own implementations of password management services for various backends. Note that this feature is off by default and without it, you simply get today’s CAS experience which is a link redirecting to your own password management tool. Here are a few screenshots: > [](https://imgur.com/RMC7j) What’s Next? ============ The development team is working to make sure the CAS 5 release is on [schedule](https://github.com/apereo/cas/milestones) . At this point, all new development has been frozen and project is solely focusing on testing the release candidate and applying bug fixes based on community reports. There will likely be other release candidates but short of any major incidents or changes, the CAS 5 GA release should be available right on schedule. How can you help? ================= * Start your early [CAS 5 deployment](https://github.com/apereo/cas-overlay-template/tree/5.0) today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende ======== A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.0.0-RC1+Release&url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&title=CAS+5.0.0-RC1+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&title=CAS+5.0.0-RC1+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&name=CAS+5.0.0-RC1+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&title=CAS+5.0.0-RC1+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&title=CAS+5.0.0-RC1+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F08%2F26%2Frc1-release%2F&t=CAS+5.0.0-RC1+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Singing "I Love Bug Reports" – Apereo Community Blog Singing "I Love Bug Reports" ============================ Monday, Sep 26, 2016 4 minute read Having been involved in the open-source space for some time, I have noticed that various communities and software engineers react differently to bug reports and issue submissions. Some tend to discuss issues and shortcomings of the software _in private_ as developers may consider those defects cause for embarrassment and failure! Some tend to disregard issues and close the conversation loop immediately, routing the user to other _appropriate_ channels and reemphasizing a _this is not a bug_ mentality without any sort of user education or guidance. Some welcome bug reports in all shapes and sizes and consider those an acknowledgement and positive feedback even when/if the underlying reported problem turns out to be moot. Here is my personal recipe. If you are about to submit a bug -------------------------------- ### Data, Data, Data Always ensure you have enough diagnostics data in your report. Are you reporting the exact version numbers that exhibit the seemingly-faulty behavior? Have you described your deployment/development environment in enough detail? Have you included error logs, screenshots and other useful snippets of your configuration to demonstrate the issue? Have you included steps to explain how one might duplicate the problem? Unit tests to recreate the issue? Put another way; readers of your case aren’t necessarily housed in your head! They don’t know what you know. Help them out. Would you want to respond to your own report? Think about that before you press submit. ### Is this a bug? Research the issue and be sure to do your due diligence. Have you scanned the web archives for similar cases? Have you looked at the project’s documentation to find better explanations? Have you reviewed the project’s mailing lists, chatrooms and other facilities to find possible solutions? ### Should I submit? Some projects consider their issue tracking system as a placeholder to track genuine traceable issues and tasks. If you have a general question about the workings of the software, or if you’re unsure how something is supposed to work and are in need of an analysis and further discussion, consider choosing alternative vessels for contact. Use mailing lists, chatrooms, Stackoverflow and other similar tools to engage with the project owners. When the dust has settled and you have arrived at a legitimate theory to explain the root cause of the problem, file a submission. ### Be part of the solution If you can, always volunteer to post a patch and work up a solution. Be prepared to follow up to test the produced patch in your environment and always try to provide a confirmation. Simply complaining about something and letting it sit in the issue tracker for someone else to handle isn’t going to get you much. If you find something that you deem worth someone else’s time to fix for you, be sure to demonstrate the issue is first and foremost worth your own time as well. “It ain’t a problem for me if it ain’t a problem for you”, sort of thing. If you are responding to a bug ------------------------------ ### Collaborate Bugs are an opportunity for collaboration. They allow you to engage with the community and start a conversation. It’s a two-way street. After all, that’s why you’re involved in open-source, right? ### Marketing Bug reports are the perfect opportunity for marketing. It’s free data! You get to learn which entities and companies from which industry sectors use the software. And how. The more you get involved, the more advertising and marketing is going to flood your way and that might radically change the way you think about the original platform requirements. ### Learn Bug reports are fun; you learn how people are actually using the software in ways you had never imagined, which may influence you more on a technical level to rethink design, implementation and learn about new integration prospects and partners. ### Be nice This is perhaps **the most important bit of all**. Do NOT ever create an atmosphere where the user community feels like they are being treated as buffoons with severe visual impairments who are dispossessed of the ability to read your perfect documentation and walkthroughs. As far as you should be concerned, \[albeit a tad too extreme perhaps\], if someone can’t figure out how to use the solution in reasonable time, then the bug is on you. Resist the urge to call out folks on their “stupid mistakes” and don’t be inclined to respond to every single “foolish” post. Eat something sweet. The feeling will pass, I promise you. Be nice. Welcome bug reports with open arms. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Singing+%22I+Love+Bug+Reports%22&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&title=Singing+%22I+Love+Bug+Reports%22 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&title=Singing+%22I+Love+Bug+Reports%22 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&name=Singing+%22I+Love+Bug+Reports%22 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&title=Singing+%22I+Love+Bug+Reports%22 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&title=Singing+%22I+Love+Bug+Reports%22 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F26%2Flove-thy-bugs%2F&t=Singing+%22I+Love+Bug+Reports%22 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Git Repository Maintenance – Apereo Community Blog CAS Git Repository Maintenance ============================== Wednesday, Sep 21, 2016 2 minute read If you have managed to clone the [CAS Github repository](https://github.com/apereo/cas) recently, you would notice that the repository is obscenely large; 1.2GB large that is. Depending on your connection bandwidth, the initial `git clone` operation could take a very long time specially time that could otherwise be spent wisely to catch Pokémon. Over the years, the CAS development has collected a lot of history in the git commit log. Given the [upcoming CAS 5 release](https://github.com/apereo/cas/milestones) , we feel this is a good time to do a little bit of housekeeping to compress the repository and leave it in a functional efficient state. Here are the details. What does this mean to adopters? -------------------------------- If you are a CAS deployer and have started your CAS deployment using a [WAR overlay method](https://apereo.github.io/cas/development/installation/Maven-Overlay-Installation.html) , this will have **absolutely NO IMPACT** on your deployment and future upgrades. None whatsoever. Keep building, patching and upgrading. If you are a CAS deployer and have started your CAS deployment via building directly from source, you **MIGHT** be in trouble. We certainly recommend all CAS deployments start with the official and suggested deployment strategy, but if you wish to stick to your own ways, read on. What does this mean to developers? ---------------------------------- Well, we are simply creating history here. Here is the [issue](https://github.com/apereo/cas/issues/1814) tracking this particular task. One of the caveats of cleanup process is that the commit log is massaged to rewrite the project history. This means that all project activity remains in place along with commit messages, authors and dates yet SHAs will be replaced and regenerated. This also implies that anyone else with a local clone or fork of the CAS repository will need to either use `git rebase` or create a fresh clone. If you fail to do so and manage to `push` again, old history is going to get pushed along with it and the repository will be reset to the state it was in before! So nuke your existing clones and forks and start again. Note that the cleanup process affects not just `master` but all CAS repository branches, and there are quite a few. This means that before you start over with a fresh clone, you will need to make sure lingering branches in your local fork of the CAS repository are either: * Safely backed up and stored somewhere else, so they can be reworked later into the fresh clone. * Merged into the canonical CAS repository prior to the cleanup effort. How do we do this? ------------------ We plan to follow [this guide](http://stevelorek.com/how-to-shrink-a-git-repository.html) . Initial experiments seem to demonstrate that repository size would shrink down to about 500MB, which is quite an improvement. Prior to the cleanup process, we plan to store the existing CAS repository in a separate git repository for safekeeping as a backup. When do we do this? ------------------- The cleanup process takes a while to complete, somewhere between 2-4 hours. Announcements will follow on the [CAS mailing lists](https://apereo.github.io/cas/Mailing-Lists.html) to give developers a headsup on the individual milestones within the cleanup task. Keep an eye out. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Git+Repository+Maintenance&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&title=CAS+Git+Repository+Maintenance "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&title=CAS+Git+Repository+Maintenance "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&name=CAS+Git+Repository+Maintenance "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&title=CAS+Git+Repository+Maintenance "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&title=CAS+Git+Repository+Maintenance "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F21%2Fgitrepo-maint%2F&t=CAS+Git+Repository+Maintenance "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.0.0-RC3 Released – Apereo Community Blog CAS 5.0.0-RC3 Released ====================== Saturday, Oct 1, 2016 3 minute read We are excited to announce the 3rd release candidate in the CAS 5 series. There are a [few items](https://github.com/apereo/cas/releases/tag/v5.0.0.RC3) packed into this release that are worthy to publicize. So here it goes. Before we get started, it should be pointed out that [releases of CAS 5 are available to adopters to try](https://github.com/apereo/cas-overlay-template/tree/5.0) . Deployers are more than welcome to try out the milestone releases and share feedback. The current in-development documentation of CAS 5 is also [available here](https://apereo.github.io/cas/development/index.html) . MFA === A series of patches have been applied to address issues related to multi-factor authentication: * Activating MFA based on multi-valued principal attributes * Activating MFA for non-interactive authentication flows such as SPNEGO Password Management =================== The CAS self-service password management functionality is patched to better report back password policy requirements on the screen, and changes have gone in to ensure password updates can successfully be executed against Active Directory. Delegated AuthN =============== Summary of fixes are: * Better reporting of authentication failures in case a provider (i.e. Facebook) denies user access. * Better management of locating resources through CAS properties, specially when dealing with delegated SAML AuthN. Admin UIs ========= Some adjustments have been made to the way admin user interfaces are protected via CAS itself. A few additional screens have also been worked into the interface to display the CAS audit log as well as a list of trusted devices/browsers registered for MFA bypass. CAS Attributes ============== Additional validation checks are now in place to ensure CAS attributes are properly formatted, encoded and named in the final validation response. For instance, CAS is now able to detect the proper syntax if it’s configured to release an attribute that is `system:people:admins:something`. Groovy-based Attributes ======================= When it comes to mapping attributes conditionally at release time, CAS is now able to correctly and more accurately support groovy-based attribute definitions, whether inline or as a full standalone groovy script file. JWT AuthN ========= Thanks to Pac4J, a number of fixes have gone in to ensure JWTs can successfully be validated based on customizable encryption and signing algorithms, which can now be specified for a given CAS service definition. Additional checks are also in place to report on the validity of the JWT itself and its required fields such as the `sub`. Dependency Upgrades =================== We have taken a pass at the core CAS dependencies to ensure we are running on the latest stable component releases, some of which include: * Spring Core * Spring Boot * Spring Cloud * Thymeleaf * Pac4J * Tomcat * Hazelcast …and plenty more. What’s Next? ============ Short of a few more last rounds to ensure everything is tested as much as possible, we should be gearing up for the official GA release shortly. The release schedule will likely be adjusted to note the correct final release date, and when all is said and done, there will be planning sessions to discuss the project roadmap for the next upcoming release. Yes, there is plenty of more work left to do! How can you help? ================= Do NOT wait for the final GA release to begin your deployment. If you do discover a problem after the GA is out, it may be a while for you to receive the next upgrade with the fix in place. Now is the best time to start trying out the release candidates and report back findings. The software is only as stable and bug-free as it is reported back to the community. So: * Start your early [CAS 5 deployment](https://github.com/apereo/cas-overlay-template/tree/5.0) today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende ======== A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.0.0-RC3+Released&url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&title=CAS+5.0.0-RC3+Released "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&title=CAS+5.0.0-RC3+Released "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&name=CAS+5.0.0-RC3+Released "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&title=CAS+5.0.0-RC3+Released "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&title=CAS+5.0.0-RC3+Released "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F01%2Fcas5rc3-release%2F&t=CAS+5.0.0-RC3+Released "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # September 2016 Apereo Newsletter – Apereo Community Blog September 2016 Apereo Newsletter ================================ Monday, Sep 19, 2016 22 minute read This newsletter, dated September 15th, was [published](https://groups.google.com/a/apereo.org/forum/#!topic/announcements/y1c-AErU0co) to [the Apereo Announcements Google Group](https://groups.google.com/a/apereo.org/forum/#!forum/announcements) . It is re-published here as an experiment in publishing using Jekyll / Markdown. This content is lightly edited and hyperlink-enhanced to take advantage of this publishing medium. _Upcoming Events_ 1) UCLA and Unicon Webinar on Identity & Access Management, Hosted by Internet2 2) Virtual Sakai Conference: Wednesday, November 2 3) Request for Volunteers: Open Apereo 2017 Conference Planning Group 4) Apereo Africa 2017 _Announcements_ 5) uPortal Announces Supporting Subscription Model 6) Ra11y Plan for Sakai Accessibility Phase 1 Complete Project News & Releases 7) News from the Opencast Community 8) Karuta Portfolio Ready To Replace OSP in Sakai 11 9) uPortal 5 Roadmap 10) Xerte Online Toolkits v3.3: Expanded SCORM Tracking! 11) CAS 5 Available by Late September _Case Studies: Early Sakai 11 Implementation at Three Institutions_ 12) MCI’s roadmap to an early Sakai 11 update 13) Migrating to Sakai 11 at HEC Montréal 14) Sakai 11 Early Adopter: Notes from the Trenches at Marist College * * * From the Editor: ================ A new semester is underway, bringing with it releases, project news, and new opportunities to collaborate and share. Remember that the Apereo newsletter provides an important opportunity for communicating within and across the many projects in our community. This is your vehicle to share what you’re doing and invite others to join. Our newsletter is also an important place for sharing strategies and success stories for pursuing an open source philosophy in educational technology. We are looking for contributions of all kinds – examples might include (but are not limited to) articles, video clips, screencasts, graphics, or short announcements on: * How you’re using software produced by an Apereo community at your institution * Major releases or minor tweaks * Ideas for new projects you’d like to get feedback on or gauge interest in * Important discussions of general educational technology issues that emerge on community email lists Contributions of all lengths, from snippet to think pieces, are welcome. Send your submissions (and any questions!) to `newsletter@apereo.org`. The newsletter will publish on or about the 15th of the month, with items due by the 10th. – Lucy Appert, Newsletter Editor * * * Upcoming Events =============== 1) UCLA and Unicon Webinar on Identity & Access Management, Hosted by Internet2 ------------------------------------------------------------------------------- September 21, 2016 – 2 p.m. EST http://bit.ly/2cd4SwN Join UCLA and Unicon for an interactive webinar, hosted by Internet2, to discover how open source Grouper and Shibboleth are meeting UCLA’s identity and access management needs. This webinar will also give an update on open source project customizations for Grouper and Shibboleth (completed by Unicon for its clients) that have been donated back to the open source community. – Lisa Di Pietro * * * 2) Virtual Sakai Conference: Wednesday, November 2 -------------------------------------------------- Make plans now to attend the Sakai Virtual Conference on Wednesday, November 2nd from 9AM to 5PM EDT (-4 GMT). The conference will be held entirely online, and will have an emphasis on pedagogy and best practices. Join us for a faculty-friendly day of learning, sharing, and community building with your fellow Sakai users around the globe, all without the need to travel! For more details, visit [the conference website](http://virtconf.apereo.org/) . – Neal Caidin, Sakai Community Coordinator, Apereo Foundation – Wilma Hodges, Sakai Virtual Conference 2016 Planning Committee Chair – Ian Dolphin, Executive Director, Apereo Foundation * * * 3) Request for Volunteers: Open Apereo 2017 Conference Planning Group --------------------------------------------------------------------- The Open Apereo Conference will be held between the 4th and 8th of June 2017, in sunny Philadelphia. As with every Apereo conference, community engagement is the key to a successful event. Key to this engagement are community volunteers who serve on the conference planning group. Please consider volunteering. The planning group meets for around an hour every two weeks, and consists of volunteers, Foundation staff, and our conference planners, Concentra. Joining the group is a great way to get involved, and work with other community members to shape the conference program and social activities. If you’re interested, contact me directly at `ian.dolphin@apereo.org` . – Ian Dolphin * * * 4) Apereo Africa 2017 --------------------- Mark your calendars! Apereo Africa 2017 conference will be held in Cape Town next year on the 9th and 10th of May Contact details: `tshego@opencollab.co.za` or `elsabe@opencollab.co.za`. Kind regards Elsabe Botha * * * Announcements ============= 5) uPortal Announces Supporting Subscription Model -------------------------------------------------- The new Apereo membership model consists of two elements. The first is a Core Foundation Subscription, paid by all members. This covers key services Apereo provides for all its software communities – technical infrastructure, legal and licensing support, community coordination, events, and outreach. The second is a Supporting Subscription for specific Apereo Projects. This is an important way that organizations can substantively and collectively support projects they use and depend on. External to Apereo, organizations may also subscribe to commercial support offerings which address local support and targeted development. All three of these mechanisms address different but important needs. The uPortal Steering Committee is responsible for determining how subscription funds will be used. Our primary use is in support of securing a uPortal Community Liaison and Release Lead. This person would focus on: * Coordination and engineering of releases * Testing * Bug fixing * Fit and finish of code and documentation pull requests * Welcoming and bootstrapping new developers and community participants The uPortal Steering Committee has developed a tiered rate for uPortal Supporting Subscriptions that gives institutions flexibility to determine what level of financial support they would like to demonstrate for uPortal. Supporting subscriptions are annual, on top of the standard Apereo Member/Affiliate rates. uPortal Supporting Subscription Rates: * $1,000 bronze, uPortal Friend * $5,000 silver, uPortal Booster * $10,000 gold, uPortal Sustainer * $20,000 platinum, uPortal Champion All uPortal Supporting Subscribers are entitled to: * Vote for a uPortal Supporting Subscriber representative on the uPortal Steering Committee * Being recognized as a uPortal Supporting Subscriber on the project web site * The gratitude from the uPortal Community for their valuable support By becoming a uPortal Supporting Subscriber, you can help support continued improvements to the uPortal project such as releases that are more frequent, more complete, more stable, and better documented. Your support also helps make possible additional contributions from the community as potential contributors feel more welcome and encouraged. By coming together as a community through uPortal Supporting Subscriptions we can collectively ensure that uPortal better meets the needs of higher education organizations and beyond. We encourage you to consider becoming an Apereo Member/Affiliate organization and a uPortal Supporting Subscriber. – Jim Helwig * * * 6) Ra11y Plan for Sakai Accessibility Phase 1 Complete ------------------------------------------------------ Dear Community, Thanks to you, [Phase 1 of the Ra11y plan](https://confluence.sakaiproject.org/display/2ACC/rA11y+Plan) is complete! What does this mean? It means that we completed a substantive review of the accessibility of the Sakai system by contracting out the assessment to a reputable 3rd party, [SSB Bart](http://www.ssbbartgroup.com/) . Improving Sakai’s accessibility means making it easier for people of all abilities to use our system. Our aim, as it always has been, is to make the system genuinely as accessible as possible, which directly impacts students, instructors, and other users in a positive way with a better user experience. We also wish to achieve WCAG 2 certification, which validates the community’s hard work in this area. A double win! The good news is that Sakai, as it stands now, is assessed at 74% compliant, which is not a bad starting point. Also we have gone painstakingly through the 453 identified issues and consolidated them into [51 Jiras](https://jira.sakaiproject.org/issues/?filter=15821) . We are off to a great start and we don’t want to lose the momentum! ### Deadline Now we are in phase 2 and we have a deadline to complete the work to address issues identified by January 28, 2017. ### Contributions Please consider contributing to [this FARM project](https://sites.google.com/a/apereo.org/farm/home/current-projects/in-progress/sakai-ra11y) either with a cash contribution, resources to fix bugs, or QA resources to help test Accessibility fixes. At the moment, resources for fixing bugs is the most urgent. We would like to target Sakai 11.2 or Sakai 11.3 maintenance release to complete this project, though we realize this might be ambitious. ### Why Contribute? * Accessibility reflects our values as a community; probably reflects your institutional values; and I am guessing that for most of us, reflects our personal values too. * Accessibility is becoming a must-have requirement for institutions looking to adopt a learning management system. Many institutions will not consider a learning management system that is not accessible. * Legal compliance in many countries * Accessibility is the right thing to do. * Accessibility in most cases, if not all, benefits ALL users of our system. ### Consequences of not meeting the end of year date If we don’t meet our goal of 100% compliance by the January 2017 deadline then we can still get a conditional certification based on the percentage of completion we do make. But then if we want the full WCAG2 certification and don’t meet the deadline , we will have to start the process over, which will be more time-consuming, will require another round of funding, and will mean the overall cost to complete might as much as double. ### Approach Collaborating with developers and with SSB Bart, the Accessibility team aims to identify the best way to fix certain types of accessibility issues, and to document these approaches to make it as easy as possible for our developer community to participate and help fix bugs. The documentation will be in our community wiki, Confluence. More details to come. ### Invitation Every little bit helps. If you think your institution might be able to contribute in any way, please contact our Accessibility chair, Matt Clare, for more information, `matt.clare@brocku.ca`. Thanks for your attention, The Sakai Accessibility WG * * * Project News & Releases ======================= 7) News from the Opencast Community ----------------------------------- * On September 26-27, the annual meeting of the German speaking Opencast community will take place. This time, the conference is hosted by the University of Stuttgart. More details will be released soon. * The annual Opencast community summit will take place March 1-3 2017 at Universitat Politécnica de Valencia. This event will coincide with a meeting of the Spanish/European Sakai/Apereo community. Expect to hear more over the next couple of months. * Opencast 2.2.2 is expected to be released on Monday, September 12th,2016 * Bruno Seoane (Teltek) and Lars Kiesow (ELAN e.V.) have been elected as Opencast 2.3 release managers. Feature freeze is set to October 1st and the final release is expected on December 13th. – Lars Kiesow * * * 8) Karuta Portfolio Ready To Replace OSP in Sakai 11 ---------------------------------------------------- The Karuta Open Source Portfolio 2.0 stands ready to replace (and upgrade!) your OSP implementation – now that OSP is not included in Sakai 11. From the Resources page on [the Karuta website](http://karutaproject.org/) , you can access our sandbox instance, try out a customization involving the AAC&U Value Rubrics, download our two designer workbooks to help you build your own customization, and/or download the Karuta 2.0 code. You can also access demos of Karuta * [Karuta YouTube channel](https://www.youtube.com/channel/UCA4hSOqMqVk3ufvR37fHppQ) * [Sakai Showcase Webinar Series: Karuta Open Source Portfoloio For LTI Integration with Sakai](https://www.youtube.com/watch?v=oh14bi3IoP8) * [2015-11-04 15:20 Karuta 1.1 - A Complete Portfolio Solution LTI Integrated with Sakai](https://www.youtube.com/watch?v=Xkx7kIehs3A) * [Karuta Open Source Portfolio: a flexible architecture for assessment, accreditation and much more](https://www.youtube.com/watch?v=o53beS5C6RI) * [(French language) Screencast ePortfolio IUT2 KARUTA 2015](https://www.youtube.com/watch?v=32k7B9w7wdY) The Karuta Project under the umbrella of the Apereo Foundation also offers online demos for groups at your institution. Please let us know if you are interested in checking out Karuta! – Janice A. Smith * * * 9) uPortal 5 Roadmap -------------------- The uPortal Steering Committee, project committers, and uPortal adopters met virtually in early September to discuss the uPortal roadmap and [plans for uPortal 5](https://wiki.jasig.org/x/GYBfB) . The overall theme for this next version is to make the project more “modern” for today’s IT professionals. It includes an overhaul of the way the uPortal project sources are organized and how the project is built and deployed. Our high level goals are to: * Shift the customary deployment paradigm away from building on each portal server * Allow multiple adopters to deploy the same, Apereo-provided binaries * Move uPortal toward “cloud native” * Make uPortal easier to work with for developers, especially new developers – uPortal Steering Committee * * * 10) Xerte Online Toolkits v3.3: Expanded SCORM Tracking! -------------------------------------------------------- On behalf of the wonderful people of the Xerte developer community, we are pleased to announce that the latest version of Xerte Online Toolkits, v3.3 is now available. The most significant aspect of this release provides support for SCORM tracking for a much wider range of interactions. The following page types can now all be tracked: * Dictation * Matching pairs / Timeline * Matching text * Interactive Text * Media lesson * Gap fill * Sortable Grid * Drag & Drop * Quiz * MCQ Additional New Features * A new interactive page type, Word Search has been added to the ‘Games’ category. * Display of learning objects has been improved for iPhone. * Pages can now be hidden from view until you are ready to publish them into the learning object. * You can now add JavaScript to a learning object for custom functionality. * The card graphics in Memory Game can now be customised. * When exporting zip packages, the filename now reflects the project exported. * Workspace has been enhanced to make the best use of the available screen resolution. * New features added to Decision Tree. * MathJax is now usable in Decision Tree. * Interface enhancements to the Bootstrap pages to better handle projects with many pages. This release contains a large number of other fixes and enhancements. Upgrading is highly recommended. – Julian Tenney * * * 11) CAS 5 Available by Late September ------------------------------------- The CAS development team is marching towards a major release – CAS 5. [The first release candidate](https://mmoayyed.github.io/cas/2016/08/26/cas5-rc1-release/) has been available for some time and the project intends to officially make the release available by late September. Adopters are encouraged to try the release candidate and report back issues as early as possible. The CAS 4.2.x release line is also actively maintained and 4.2.5 is the current and most recent version that is recommended for production deployments. Also the CAS PMC recently approved of [the CAS maintenance and EOL policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) that describes how CAS releases are generally maintained. It’s important for adopters to understand how long their particular deployment is set to receive patches and attention from the developer community. – Misagh Moayyed * * * Case Studies: Early Sakai 11 Implementation at Three Institutions ================================================================= 12) MCI’s roadmap to an early Sakai 11 update --------------------------------------------- At MCI (MCI Management Center Innsbruck) we are proud to be among the very first institutions having upgraded to Sakai 11 - including a new Morpheus compatible skin for a responsive UI and MCI-specific adaptations and processes. Our user feedback has been great so far! We really would like to thank the Apereo Foundation, the Sakai community, and the developers who did a terrific job and made this possible! For this update, the available time frame at MCI was smaller than usual – less than 5 months, of course with maintaining the 10.6 instance alongside. Changes in development and the community processes of Sakai 11 made it possible to keep a tighter schedule than ever before! We do believe that the change to GIT source code management was one of the most important factors making more timely local releases including adaptations possible. Up to Sakai 10 we used a local subversion repository with a vendor-branch approach for keeping our source code in sync with the official Sakai versions. Importing the new community source code was an error-prone and tedious process and as a consequence was done only few times a year. Important security patches were integrated manually, bigger updates are only implemented twice a year. The time cost of the workflow enforced a sequential workflow that meant that we always had to wait for a Sakai release to have gold release status before we started work on source code integration and adaptation. With GIT we were able to start adaptation, testing and integration _in parallel_ to community development. In order to be up-to-date, we regularly rebased our changes on the 11.x-code instead of the tags. Implementing it this way, we already finalized our local adaptations when Sakai 11 was released officially. ### Timeline: Summer 2015 * First local tests of Morpheus February 2016 * Last update Sakai 10 (10.6) March 2016 * Download 11.x, still without local GIT workflow * Change of development environment to Tomcat 8 and Java 8 * First local instance of Sakai 11.x * Risk assessment for planned update in summer April/May 2016 * Introduction of GIT repositories for development at MCI * Concept for removal of previous adaptations (especially for navigation, UI) * Final strategic decision for summer update to Sakai 11 June/July2016 * Local Git-Rebase workflow and documentation created, based on remote 11.x upstream and local multi-developer git repository * Morpheus skin adaptations (mixture of scss-config and injection of a custom.css which contains our skin code not configurable with the existing scss-variables) July 22, 2016 * Integration of latest blocker bugfixes and last git-rebase to 11.x before update. July 23, 2016 * Official Apereo Sakai 11 release July 25, 2016 * Update of sakai.mci4me.at to Sakai 11 (we didn’t really plan to be that close to the official release date, we decided to use 25/7 about 1 month before :-) ) The update started at 13:00 CEST and was finished at about 15:00 CEST. Administrative tasks during the update process were: * Backup (filesystem snapshot, fast) * update of required environment (Java, …, fast) * uploading new configuration files (sakai.properties and init scripts, debugging necessary, took most of the time) * Deployment of new Sakai build (fast) * configuring and resetting user workspaces with a webservice-script (debugging necessary, took some time) * repairing the Favorite Sites of every user with the conversion script: `java -cp "lib/*" -Dtomcat.dir="$PWD" org.sakaiproject.user.util.ConvertUserFavoriteSitesSakai11` (easy and fast) The contrib-tools we are using are the following: * Dashboard (using that one since summer 2013): Still not a core tool, but it just works fine for our needs, is placed on every users starting page and is everybodys favorite timesaver. Lots of trouble, but lots of benefit. * YAFT: Still in triage (so no real user feedback), but it seems to work with Sakai 11. * CLOG: Introduced that with Sakai 11, so no conversion experience. * Contentreview/TII: We highly customized this one in Sakai 10, and simply kept that for 11, since the switch to the LTI-tool is coming soon (we guess). Thank you once again & best wishes from the Alps! IT-Services team @ MCI If there is further interest in particular aspects of our update-roadmap, feel free to send a request to our developers: * `Thomas.Lampert@mci.edu` * `Wolfgang.Rohregger@mci.edu` In cases of organizational questions, you can also contact our IT-Lead: `Peter.Mirski@mci.edu` * * * 13) Migrating to Sakai 11 at HEC Montréal ----------------------------------------- HEC Montréal went live with Sakai 11 on August 10th. Our migration from a Sakai 2.9/10 hybrid went smoothly. We took the decision in April to forge ahead with our migration process without knowing the release date of Sakai 11. We were confident that the community would put tremendous effort to get the release out before the fall semester and we were not disappointed! It was very important for HEC to migrate to Sakai 11 this summer since we plan to use 2017 summer to release a new course outline tool to our users. This new Sakai tool called ‘TenJin’ is currently under development at HEC and we plan to make it available to the Apereo Community as an open source project. – Philippe Rancourt * * * 14) Sakai 11 – Early Adopter: Notes from the Trenches at Marist College ----------------------------------------------------------------------- We didn’t think we would go first. In fact, we were hoping to be somewhere in the middle of the pack, a bit out towards the front. It had been several years since Marist College had a major Sakai upgrade and it was critical we move as quickly as possible off of Sakai 2.9.4 to a new version. Pressure had been mounting since student and faculty feedback indicated the system seems “dated” and “clunky” and of course, it didn’t work on mobile devices. Sakai 11 included “must have” features like “Lessons”, GradebookNG, and a pleasant, user-centric, responsive design. To assure success, we partnered with Longsight, who worked with us in preparation for the upgrade and who was instrumental on the day of our upgrade. With our deadline looming, we charged on. As a result we learned from our successes as well as our failures. Here’s are some of the lessons we learned. ### Prepare, if you can. In 2015, we knew we would be upgrading at some point and changed our old 2.9.4 skin to be reflective of Sakai 11 in an effort to prepare faculty and students for the change to the User Interface (UI). We made a copy of our production database and ran the Sakai 10 and 11 upgrade scripts against it. This gave us a chance to see, in advance, if we would have any data issues as part of the upgrade. We actually ran into an issue with the Job Scheduler tables; this issue was fixed as a Community Jira, saving others from running into the same problem. Lesson learned: Give yourself a bit more time than you think you need to get your existing skin(s) into Morpheus. It does take some trial and error to get buttons and some other features set the way you want. You will also need to go through all the tools to make sure that they are themed the way you want. We ended up with a few buttons that had the text color the same as the button color. This was not the best user experience. The more skins you have, the more time you will need to dedicate to the Morpheus conversion especially if your skins are heavily customized. ### Be aware of deprecated tools. We started a bit late out of the gate in locating a solution for our faculty to migrate their Melete content into the Lessons tool. However, once a process was in place, we took initiative to reach out to our faculty, especially to those who teach fully online courses and were the heaviest users of these tools. Communication took the form of announcements, email, newsletters, and workshops. We also created pages dedicated to the upgrade on our website. We directed all customers there for the latest information related to the upgrade. ### Timing is everything. An important question arose: do we allow faculty to begin creating their fall courses prior to the upgrade? This meant jumping through some hoops to make sure that tools available to faculty building courses in 2.9.4 would be supported in Sakai 11. We switched from Gradebook 2 to Gradebook 1 as it was supported in both versions. After the upgrade we ran a script against the database to convert all the courses with Gradebook 1 to GradebookNG. This was only possible because the database tables were the same between the two tools. This method eased the impact on faculty and students for courses running during the upgrade. ### Recommendations * Create an inventory of tools with in both course and project sites. Identify outliers (tools that may be deprecated such as Clog or LTI tools). These are the issues we received the most critical calls about. We even had to bring back up a copy of Sakai 2.9.4 so that one instructor could grade the Clog content in his summer course. * It may sound redundant, but prepare the faculty for what is about to change within each of the tools they use in various formats, such as documentation, outreach, and supplemental information. The jump from 2.9.4 to Sakai 11 turned out to be overwhelming for some faculty because of the changes in interface, tool behavior, and new tools coupled with impacts on course and content development and delivery. * Don’t forget about the Adjunct Faculty. Many who teach once or twice a year may be completely unaware of the upgrade. * Keep the Help Desk in the loop and make sure they have “how to clear your browser cache” documents handy, along with the extensive documentation regarding new features. * Join the Sakai QA community and maintain continuous engagement. Participation offers the best opportunity to experience the latest version and prepare for new tool behavior and functional changes. * Last but not least, keep up with the latest software. In other words, upgrade regularly. Although we had issues and missteps, the overall the feedback we have received has been quite positive and many of our initial concerns were able to be quickly addressed. We were not planning on being an early adopter, yet with the lessons we have learned from this successful upgrade, the idea may not be unusual in the future. – Dede Hourican Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=September+2016+Apereo+Newsletter&url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&title=September+2016+Apereo+Newsletter "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&title=September+2016+Apereo+Newsletter "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&name=September+2016+Apereo+Newsletter "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&title=September+2016+Apereo+Newsletter "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&title=September+2016+Apereo+Newsletter "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F09%2F19%2Fnewsletter%2F&t=September+2016+Apereo+Newsletter "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Bootiful CAS 5 Overlay – Apereo Community Blog Bootiful CAS 5 Overlay ====================== Tuesday, Oct 4, 2016 1 minute read Overview ======== As you may know, the recommended strategy to start a CAS deployment today is via the [WAR Overlay Installation Method](https://apereo.github.io/cas/development/installation/Maven-Overlay-Installation.html) . The idea is that a deployment gets to keep only local customizations and _inherits_ everything else from a pre-built pre-configured instance. Not only this allows one to keep track of intentional changes, but also makes it easier to upgrade the software in place by simply bumping the CAS version in the overlay script. CAS 5 itself is entirely based on Spring Boot. Today, CAS 5 overlays for both [Maven](https://github.com/apereo/cas-overlay-template/tree/5.0) and [Gradle](https://github.com/apereo/cas-gradle-overlay-template/tree/5.0) too are modified to accommodate easier deployment options via Spring Boot. Here’s how. Bootiful Overlay ================ Today, adopters are given 3 choices to deploy an overlay: 1. Run the CAS web application as an executable WAR via a `java -jar ` type of command. 2. Deploy the `` into an external container of choice, such as Apache Tomcat. 3. \[**NEW**\] Run the CAS web application as an executable WAR via the Spring Boot’s Maven/Gradle plugin, though you may be interested in [this issue](https://github.com/apereo/cas/issues/2334) . The 3rd option is similar to the native `java -jar ...` command with the main difference that the Spring Boot plugin is able to recognize the presence of Spring Boot’s `devtools` that is shipped with CAS by default and allows for ad-hoc live monitoring of CAS resources. This is specially helpful perhaps during UI design; such that you could keep modifying `html`, `css`, and `js` resources and CAS will auto-detect changes and allows you to see them via a simple refresh of your browser. Lots quicker! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Bootiful+CAS+5+Overlay&url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&title=Bootiful+CAS+5+Overlay "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&title=Bootiful+CAS+5+Overlay "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&name=Bootiful+CAS+5+Overlay "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&title=Bootiful+CAS+5+Overlay "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&title=Bootiful+CAS+5+Overlay "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F04%2Fcasbootoverlay%2F&t=Bootiful+CAS+5+Overlay "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # About – Apereo Community Blog Formed in 2012, the [Apereo Foundation](https://www.apereo.org/) is a vibrant and value-driven organization. Apereo has a noteworthy history celebrating two strong organizations, the Sakai Foundation and Jasig. Apereo is a community built around openness, inclusivity, collaboration and innovation. The mission of Apereo is to help educational organizations “collaborate to foster, develop, and sustain open technologies and innovation to support learning, teaching, and research.” Apereo projects are 100% open. ### About Blog This is a blog managed and edited by the Apereo project participants and community members. It is typically used to post project updates, announce news, etc. ### Disclaimer Unless otherwise noted, all authors post here wearing their individual Apereo participant [hats](https://www.apache.org/foundation/how-it-works.html#hats) . Opinions, statements, and comments expressed via this blog do not necessarily reflect those of the Apereo Foundation. --- # Search – Apereo Community Blog ![](https://apereo.github.io/assets/tipuesearch/search.png) --- # Say Hello – Apereo Community Blog The Apereo Foundation can be reached via this [website](https://www.apereo.org/) . --- # Thanks For Your Message – Apereo Community Blog Thanks for contacting us. We will reply as soon as possible. --- # Activating MFA in CAS 5 – Apereo Community Blog Activating MFA in CAS 5 ======================= Wednesday, Oct 19, 2016 3 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Perhaps one of the more attractive features of [CAS 5](https://apereo.github.io/cas/development) is the ability to support [multifactor authentication](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html) via a number of providers/vendors that can be triggered in many ways. While support for triggers may seem extensive, there is always that edge use case that would have you trigger MFA based on a special set of requirements. Here is what you can do. Audience ======== This post is intended for java developers with a basic-to-medium familiarity with Spring, Spring Boot and Spring Webflow. This is **NOT** a tutorial to be used verbatim via copy/paste. It is instead a recipe for developers to extend CAS based on specialized requirements. Stop Coding =========== > Hearken to the reed flute, how it complains, lamenting its banishment from its home: “Ever since they tore me from my osier bed, my plaintive notes have moved men and women to tears. I burst my breast, striving to give vent to sighs, and to express the pangs of my yearning for my home. He who abides far away from his home is ever longing for the day he shall return. > > \[The Reed Flute’s Song, Rumi, 1207-1273\] Before diving into code, I **MUST** emphasize that developing custom extensions/addons, while certainly keeewl and exciting, would eventually lead to long-term maintenance/upgrade burdens. Consider direct contributions to the project if/when feasible and solve the problem where it needs solving. If you are going to write code, you might as well write it where it belongs. Requirements ============ You will need to have compile-time access to the following modules: * `org.apereo.cas:cas-server-core-webflow` * `org.apereo.cas:cas-server-core-web` These are modules that ship with CAS by default and thou shall mark them with a `compile` or `provided` scope in your build configuration. Create MFA Triggers =================== You should create an event resolver that houses and implements your special requirements for MFA. A typical example might be: _Activate MFA provider `mfa-duo` if the request client IP address matches the pattern `123.+`_ package org.apereo.cas.custom.mfa; public class CustomWebflowEventResolver extends AbstractCasWebflowEventResolver { @Autowired private CasConfigurationProperties casProperties; @Override protected Set resolveInternal(final RequestContext context) { final RegisteredService service = WebUtils.getRegisteredService(context); final Authentication authentication = WebUtils.getAuthentication(context); final HttpServletRequest request = WebUtils.getHttpServletRequest(context); final Map providerMap = WebUtils.getAllMultifactorAuthenticationProviders(this.applicationContext); // Somehow, select a provider based on the above map... final MultifactorAuthenticationProvider provider = ... if (areWeDoingMfa()) { final Event event = validateEventIdForMatchingTransitionInContext(provider.getId(), context, buildEventAttributeMap(authentication.getPrincipal(), service, provider))); return ImmutableSet.of(event); } logger.warn("Not doing MFA, sorry."); return null; } } Note that you have full access to the resolved CAS authentication, the principal associated with it, the service requesting authentication as well as the original web request. You also have access to the full body of CAS configuration settings, should you need to externalize values. Register MFA Triggers ===================== Your trigger then needs to be registered. We do this via CAS’ native auto-configuration strategy, which scans the application context for relevant annotations inside `org.apereo.cas` sub-packages. If you change package names, you **MUST** account for the custom context scan too. package org.apereo.cas.custom.config; @Configuration("SomethingConfiguration") public class SomethingConfiguration { @Autowired @Qualifier("initialAuthenticationAttemptWebflowEventResolver") private CasDelegatingWebflowEventResolver initialEventResolver; @RefreshScope @Bean public CasWebflowEventResolver customWebflowEventResolver() { return new CustomWebflowEventResolver(); } @PostConstruct public void initialize() { initialEventResolver.addDelegate(customWebflowEventResolver()); } } We simply register our trigger as a Spring `@Bean` and add it to the chain of event resolvers that kick into action as part of CAS authentication machinery. So… === Note that: * You are really not doing anything _custom_. All CAS triggers behave in the same exact way when they attempt to resolve the next event. * The API is completely oblivious to multifactor authentication; all it cares about is finding the next event in the chain in a very generic way. Our custom implementation of course makes the next event be concerned about MFA but in theory we could have resolved the next event to be `hello-world` and CAS would not have cared. Happy Coding! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Activating+MFA+in+CAS+5&url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&title=Activating+MFA+in+CAS+5 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&title=Activating+MFA+in+CAS+5 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&name=Activating+MFA+in+CAS+5 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&title=Activating+MFA+in+CAS+5 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&title=Activating+MFA+in+CAS+5 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F19%2Fmfacas5-extcfg%2F&t=Activating+MFA+in+CAS+5 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Monday, Oct 24, 2016 1 minute read Overview ======== This is the public version of an [Apereo CAS project vulnerability disclosure](https://groups.google.com/a/apereo.org/d/msg/cas-announce/Xt-quYhBV7w/oCpvF0caCAAJatom) , describing an issue in CAS where an adversary may be able to bypass certain administrative endpoints, in spite of CAS access rule in place. The following administrative endpoints are exposed and vulnerable to this attack: * `/statistics/ping` * `/statistics/threads` * `/statistics/metrics` * `/statistics/healthcheck` * `/statistics/ssosessions` and all sub endpoints Affected Deployments ==================== The attack vector specifically applies to all deployments of CAS `v4.2.x` deployments. If you have deployed **any version** of CAS 4.2.x, you **MUST** take action to upgrade. If you have deployed any **other** versions of CAS, disregard this announcement. Severity ======== This is a serious issue where successfully exercising this vulnerability allows the adversary gain insight into the running CAS software, collect running threads, DOS the server repeatedly via `ping`s and potentially observe the collection of active SSO sessions and meddle with user single sign-on activity. Patching ======== Patch releases are available to address CAS `v4.2.x` deployments. Upgrades to the next patch version for each release should be a drop-in replacement. The patch simply ensures that the exposed endpoints honor the CAS access rules, and otherwise block attempts. When you have applied the patch, please double check all endpoints and ensure access is appropriately controlled. Timeline -------- The issue was originally reported to the CAS application security team on September 27, 2016. Upon confirmation, CAS was patched on September 28, 2016 and released. The original release announcement is [available here](https://groups.google.com/a/apereo.org/d/msg/cas-announce/Xt-quYhBV7w/oCpvF0caCAAJ) . Procedure --------- Modify your CAS overlay to point to version `4.2.6`. A snippet of a `pom.xml` for a CAS overlay follows: org.jasig.cas cas-server-webapp ${cas.version} war runtime 4.2.6 Double check your `cas.properties` file for the following setting: # cas.securityContext.adminpages.ip=127\.0\.0\.1 Make sure the correct IP pattern is authorized to access admin pages. Alternatives ------------ If you are unable to apply the patch, it’s then best to ensure the outlined endpoints are blocked completely via load balancers, proxies, firewalls, etc. Support ======= If you have questions on the details this vulnerability and how it might be reproduced, please contact `security@apereo.org` or `cas-appsec-public@apereo.org`. Resources ========= * [Original Announcement](https://groups.google.com/a/apereo.org/d/msg/cas-announce/Xt-quYhBV7w/oCpvF0caCAAJ) * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F24%2Fservlvulndisc%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # MyUW 2016-10-25 release – Apereo Community Blog MyUW 2016-10-25 release ======================= Tuesday, Oct 25, 2016 2 minute read Today MyUW promoted a new release to production. This post highlights some aspects of this. Edits: * Updated to reflect new name `uPortal home` and new git repository location for what was once called `AngularJS-portal` This release ------------ [This release](https://kb.wisc.edu/myuw/page.php?id=68015) upgraded MyUW to `uPortal home` [v5.4.1](https://github.com/uPortal-project/uportal-home/releases/tag/angularjs-portal-parent-5.4.1) from [v5.2.4](https://github.com/uPortal-project/uportal-home/releases/tag/angularjs-portal-parent-5.2.4) . Highlights for Apereo community ------------------------------- * Continued implementation of [Material Design](https://material.google.com/) . Piggybacking on Google’s Material Design in higher education web applications is an opportunity to raise the baseline for design and consistency without having to invent and maintain that design guidance using scarce higher education resources. To the extent feasible, we’re trying to use MyUW design resources on unique-to-MyUW design problems rather than on web-application-general design problems. Also, Material Design theming is rocking the skinning problem, supporting different color treatments across the many Wisconsin system campuses MyUW serves. * Continued development of lightweight notifications technology. Notifications now have optional associated actions and more options for priority treatment and end-user option to dismiss unneeded notifications. ### Lessons to learn * Semantic versioning is important. We had a hiccup in this release because a `rest-proxy` change wasn’t backwards-compatible as regards `endpoints.properties`. In retrospect, the properties file configuring this product _is_ its API so breaking changes would be better signaled with a `MAJOR` version change (and avoided when not strictly necessary). * Deep linking is important, enabling better communication about and leverage of content in your portal. This release fixed support for deep links into `uPortal home` content. Calls to action --------------- ### Talk about what you are doing. It is only possible to discover opportunities to collaborate, to share code, to compare notes on the practices of portals in higher education if we talk about what we are doing. ### Adopt and collaborate on microservices. You don’t have to adopt everything MyUW has adopted to find something that would add value to your local projects. * [KeyValueStore](https://github.com/UW-Madison-DoIT/KeyValueStore) * [rest-proxy](https://github.com/UW-Madison-DoIT/rest-proxy) * [Token Crypt](https://github.com/UW-Madison-DoIT/token-crypt) : A project that can encrypt/decrypt tokens and files using public/private key pairs. Likewise, maybe you’ve got some microservice projects and products we could be collaborating on if we knew about them. ### Adopt `uPortal home`. [uPortal home](https://github.com/uPortal-project/uportal-home) is a modern user experience layer to plop down in front of your uPortal. * You don’t have to adopt it all at once, for everyone, for every user experience in your portal. MyUW variously implemented it as opt-in, opt-out, at certain hostnames, for certain identities, for certain experiences within MyUW. It’s been a long walk using the new technology for more and more experiences, and we’re still using the traditional uPortal rendering pipeline to render some maximized portlet user experiences. `uPortal home` is engineered to be flexible because it had to be. * You don’t have to stay stuck on AngularJS 1. We too want to migrate forward to AngularJS2, when time and technology allow. [Andrew Petro](http://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=MyUW+2016-10-25+release&url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&title=MyUW+2016-10-25+release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&title=MyUW+2016-10-25+release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&name=MyUW+2016-10-25+release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&title=MyUW+2016-10-25+release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&title=MyUW+2016-10-25+release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F10%2F25%2Fmyuw-release%2F&t=MyUW+2016-10-25+release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # uPortal 2016-11-14 Webproxy Portlet caching vulnerability – Apereo Community Blog uPortal 2016-11-14 Webproxy Portlet caching vulnerability ========================================================= Monday, Nov 14, 2016 1 minute read This is a **public disclosure of a security vulnerability**, near the tail end of applying [the uPortal Security Incident Response Plan](https://docs.google.com/document/d/1s-xvqbeHS_EjU6EKlv8ftXgQ-R56CU0tAjuQE3SSH4s/edit) to [this issue](https://issues.jasig.org/browse/WPP-101) . Affected software products: * Webproxy Portlet , versions `2.0.0` through `2.2.1` . [`2.2.2`](https://github.com/Jasig/WebproxyPortlet/releases/tag/WebProxyPortlet-2.2.2) includes a fix. Recent uPortal versions ship with bugged Webproxy Portlet versions. Problem: ======== Affected versions * By default, cache proxied content, and * Require a source code edit to turn off this default behavior, and * Improperly compute the cache keys such that in some cases too little information is considered in computing cache keys. Consequence: ------------ * Most adopters will not have locally turned off this caching strategy even if it is inappropriate for local usages, and * Usages where different users proxy the same backing URL may yield improper cross-user cache hits, with user B seeing content proxied for user A. Saving graces: -------------- * For security purposes, this only matters if the proxies are interesting, providing personalized content. * Usages with unique URLs, such as where user attributes are conveyed as request parameters in the URL or the initial request in a typical Proxy CAS integration, will not yield improper cache hits. Solutions: ========== * Upgrade to Webproxy Portlet version `2.2.2` or later. * Locally modify your Webproxy Portlet 2 implementation to turn off caching, [by](https://github.com/Jasig/WebproxyPortlet/pull/24) de-activating or removing `CachingHttpContentServiceImpl` and instead activating `HttpContentServiceImpl`. \-[Andrew](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability&url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&title=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&title=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&name=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&title=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&title=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F11%2F14%2Fweb-proxy-overcaching%2F&t=uPortal+2016-11-14+Webproxy+Portlet+caching+vulnerability "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # MyUW in 2016 – Apereo Community Blog MyUW in 2016 ============ Thursday, Jan 19, 2017 2 minute read MyUW had a great 2016. This post summarizes some highlights. Edits: * adjusted to reflect the new name `uPortal app framework` and new repository location for what was previously known as `uw-frame` * adjusted to reflect the new name `uPortal home` and new repository location for what was previously known as `AngularJS-portal` Open source software products ----------------------------- MyUW develops several free and open source products in the course of delivering MyUW. ### [uPortal home](https://github.com/uPortal-project/uportal-home) [MyUW](https://it.wisc.edu/services/myuw/) shipped 20 [releases of uPortal home](https://github.com/uPortal-project/uportal-home/releases) in 2016. [uPortal home](https://github.com/uPortal-project/uportal-home) is an alternative front end for uPortal. Progress included: * fixed accessibility bugs * proved out multi-tenant support (as implemented in MyUW, this software serves each of the University of Wisconsin campuses) * proved out unauthenticated experience support (this software delivers the public.my.wisc.edu experience) * adopted [Material Design](https://material.google.com/) * redesigned search and header * enhanced notifications and announcements * detected and proactively handled expired sessions * added more and better widget templates (search with links, RSS) * eased adoption via overlay * documented ### uPortal app framework MyUW shipped 22 [releases of uPortal app framework](https://github.com/uPortal-project/uportal-app-framework/releases) in 2016, from version 2.0.1 to 3.0.3. [uPortal app framework](https://github.com/uPortal-project/uportal-app-framework) is the framework in which we develop uPortal home. uPortal app framework is also the framework in which we and other groups in the University of Wisconsin develop applications for inclusion in the portal. Writing a frame-based app is conceptually an alternative to writing a Java Portlet. * adopted [Material Design](https://material.google.com/) * improved theme support * handled session timeouts proactively * cleaned up the way uPortal app framework is adopted in frame-based apps * sourced dependencies from CDNs ### microservices The MyUW team shipped eight releases of a growing slate of supporting microservices in 2016. * [KeyValueStore](https://github.com/UW-Madison-DoIT/KeyValueStore) * [lti-proxy](https://github.com/UW-Madison-DoIT/lti-proxy) * [rest-proxy](https://github.com/UW-Madison-DoIT/rest-proxy) * [rssToJson](https://github.com/UW-Madison-DoIT/rssToJson) * [token-crypt](https://github.com/UW-Madison-DoIT/token-crypt) We also participated directly in the development or release engineering of four [Apereo WebProxy Portlet](https://github.com/Jasig/WebproxyPortlet) releases in 2016. MyUW services ------------- We develop these and other software products in order to operate them in [the MyUW portal](https://it.wisc.edu/services/myuw/) . MyUW delivered around 10,000,000 user sessions in the course of serving UW-Madison and the entire University of Wisconsin system in 2016. MyUW eases discovery of and navigation to other systems. In 2016, users followed a link in MyUW out to something outside MyUW more than 8,000,000 times. Besides helping users navigate to other applications, MyUW helps users understand what they need to do and where they might need to navigate. MyUW presented its full notifications experience (not just the indicator that the user has a notification) around 100,000 times in 2016. Not all MyUW content relevant to all users can fit on default home pages, so MyUW supports users searching and browsing the available content. MyUW presented the directory of applications around 100,000 times and provided search results in around 100,000 user sessions in 2016. Once you’ve searched or browsed to something interesting, you can add it to your home page. Users modified their home pages almost one hundred thousand times in 2016, including adding the new Wiscard Balance widget almost 6,000 times. Looking forward --------------- Let’s do more to serve the portal needs of higher education and the University of Wisconsin in 2017. [Andrew Petro](http://apetro.ghost.io/) PS: Other ways to consume this content: * [on Apereo website](https://www.apereo.org/content/case-study-myuw-university-wisconsin-2016-review) (Alas, no hyperlinks). * [in January 2017 newsletter as posted to announcements email list](https://groups.google.com/a/apereo.org/d/msg/announcements/gEubp0iejn4/IMyt-AfjBQAJ) (Alas, no hyperlinks). * [in January 2017 newsletter as posted in a Word doc](https://www.apereo.org/sites/default/files/Newsletters/Images%20for%20Newsletter%20Articles/January2017Apereo%20NL.pdf) (Alas, no hyperlinks). Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=MyUW+in+2016&url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&title=MyUW+in+2016 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&title=MyUW+in+2016 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&name=MyUW+in+2016 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&title=MyUW+in+2016 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&title=MyUW+in+2016 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F19%2Fmyuw-2016%2F&t=MyUW+in+2016 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Guy walks into an Auto Shop – Apereo Community Blog Guy walks into an Auto Shop =========================== Friday, Jan 20, 2017 1 minute read > _A true story inspired by real events. Seriously. Bryan Cranston has been approached for the role of the “Guy”._ A guy walks into an auto shop, calls over a mechanic and says: * Hey there! I have been trying to use my car for the past 3 days. It doesn’t work. Drives very badly. I remember taking it to a car wash and then a friend drove it around for a while. After that, it stopped working. Can you help? * Sure. Do you have your car with you? * I am afraid I don’t. * No problem. Do you know the model and the year of the car? * I am not sure I do. My attorney handles all of that. * OK. What symptoms does it show? * I guess it just makes this weird noise when I honk the horn. * When was the last time you took it to the shop? Any previous diagnostics, issues, history of failures? * It was a while ago. My son asked me to get it checked out years ago. I suppose he worries too much. Do you think his worrying might have anything to do with the car sluggish performance? * No. * OK. Well, I really appreciate any suggestions you might have. What are your thoughts? * My thoughts? * Yes. * Well, I think [The Piano Guys](https://thepianoguys.com/) are terrific. You should check them out. * Pardon me? Mechanic walks away. Camera slowly fades away into the horizon with smooth piano music playing in the background. ![c54650b7278f88a3eeaa7aa7d5fce4f7](https://cloud.githubusercontent.com/assets/1205228/22529773/00372422-e8d9-11e6-868f-5a70e27f5074.jpg) [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Guy+walks+into+an+Auto+Shop&url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&title=Guy+walks+into+an+Auto+Shop "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&title=Guy+walks+into+an+Auto+Shop "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&name=Guy+walks+into+an+Auto+Shop "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&title=Guy+walks+into+an+Auto+Shop "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&title=Guy+walks+into+an+Auto+Shop "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F01%2F20%2Ftheart-of-mechanics%2F&t=Guy+walks+into+an+Auto+Shop "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo Community Blog Tuesday, Sep 8, 2026 [### CAS Vulnerability Disclosure](https://apereo.github.io/2026/09/08/vuln/) Disclosure of a series of security issues with the Apereo CAS software. Tuesday, Sep 1, 2026 [### OpenID Federation with pac4j and CAS](https://apereo.github.io/2026/09/01/openidfederation/) Learn how to use CAS as a trust anchor and a federated OP with a pac4j client Tuesday, Aug 25, 2026 [### CAS Vulnerability Disclosure](https://apereo.github.io/2026/08/25/vuln/) Disclosure of a series of security issues with the Apereo CAS software. Tuesday, Aug 18, 2026 [### CAS Vulnerability Disclosure](https://apereo.github.io/2026/08/18/vuln/) Disclosure of a series of security issues with the Apereo CAS software. Tuesday, Jun 23, 2026 [### Changes to CAS Security Vulnerability Response](https://apereo.github.io/2026/06/23/sec-grace-window/) Apereo CAS is shortening the security disclosure grace window. Thursday, Jun 18, 2026 [### CAS Vulnerability Disclosure](https://apereo.github.io/2026/06/18/vuln/) Disclosure of a series of security issues with the Apereo CAS software. Saturday, Jun 6, 2026 [### CAS Vulnerability Disclosure](https://apereo.github.io/2026/06/06/vuln/) Disclosure of a series of security issues with the Apereo CAS software. Wednesday, May 27, 2026 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2026/05/27/oidc-vuln/) Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider. Newer [Older](https://apereo.github.io/page2) Page 1 of 28 --- # Design Authentication Handlers in CAS 5.1.x – Apereo Community Blog Design Authentication Handlers in CAS 5.1.x =========================================== Thursday, Feb 2, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/02/02/cas51-authn-handlers/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Design+Authentication+Handlers+in+CAS+5.1.x&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&title=Design+Authentication+Handlers+in+CAS+5.1.x "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&title=Design+Authentication+Handlers+in+CAS+5.1.x "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&name=Design+Authentication+Handlers+in+CAS+5.1.x "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&title=Design+Authentication+Handlers+in+CAS+5.1.x "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&title=Design+Authentication+Handlers+in+CAS+5.1.x "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F02%2Fcas51-authn-handlers%2F&t=Design+Authentication+Handlers+in+CAS+5.1.x "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Intro To CAS Auto Configuration Strategy – Apereo Community Blog Intro To CAS Auto Configuration Strategy ======================================== Tuesday, Feb 21, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/02/21/cas-autocfg-strategy/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Intro+To+CAS+Auto+Configuration+Strategy&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&title=Intro+To+CAS+Auto+Configuration+Strategy "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&title=Intro+To+CAS+Auto+Configuration+Strategy "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&name=Intro+To+CAS+Auto+Configuration+Strategy "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&title=Intro+To+CAS+Auto+Configuration+Strategy "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&title=Intro+To+CAS+Auto+Configuration+Strategy "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F21%2Fcas-autocfg-strategy%2F&t=Intro+To+CAS+Auto+Configuration+Strategy "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Design CAS-Enabled Custom Protocols – Apereo Community Blog Design CAS-Enabled Custom Protocols =================================== Friday, Feb 17, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/02/17/cas-custom-protocols/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Design+CAS-Enabled+Custom+Protocols&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&title=Design+CAS-Enabled+Custom+Protocols "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&title=Design+CAS-Enabled+Custom+Protocols "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&name=Design+CAS-Enabled+Custom+Protocols "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&title=Design+CAS-Enabled+Custom+Protocols "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&title=Design+CAS-Enabled+Custom+Protocols "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F17%2Fcas-custom-protocols%2F&t=Design+CAS-Enabled+Custom+Protocols "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Managing Services via Git – Apereo Community Blog Apereo CAS - Managing Services via Git ====================================== Thursday, Oct 3, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/10/03/cas61x-git-service-registry/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Managing+Services+via+Git&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&title=Apereo+CAS+-+Managing+Services+via+Git "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&title=Apereo+CAS+-+Managing+Services+via+Git "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&name=Apereo+CAS+-+Managing+Services+via+Git "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&title=Apereo+CAS+-+Managing+Services+via+Git "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&title=Apereo+CAS+-+Managing+Services+via+Git "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F03%2Fcas61x-git-service-registry%2F&t=Apereo+CAS+-+Managing+Services+via+Git "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Simple Multifactor Authentication – Apereo Community Blog Apereo CAS - Simple Multifactor Authentication ============================================== Monday, Oct 14, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/10/14/cas61x-simple-mfa-provider/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Simple+Multifactor+Authentication&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&title=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&title=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&name=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&title=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&title=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F14%2Fcas61x-simple-mfa-provider%2F&t=Apereo+CAS+-+Simple+Multifactor+Authentication "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Service Matching Strategies – Apereo Community Blog Apereo CAS - Service Matching Strategies ======================================== Monday, Oct 28, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/10/28/cas61x-service-matching-strategy/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Service+Matching+Strategies&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&title=Apereo+CAS+-+Service+Matching+Strategies "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&title=Apereo+CAS+-+Service+Matching+Strategies "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&name=Apereo+CAS+-+Service+Matching+Strategies "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&title=Apereo+CAS+-+Service+Matching+Strategies "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&title=Apereo+CAS+-+Service+Matching+Strategies "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F28%2Fcas61x-service-matching-strategy%2F&t=Apereo+CAS+-+Service+Matching+Strategies "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Service Redirection Strategies – Apereo Community Blog Apereo CAS - Service Redirection Strategies =========================================== Thursday, Oct 31, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/10/31/cas62x-service-redirect-strategy/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Service+Redirection+Strategies&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&title=Apereo+CAS+-+Service+Redirection+Strategies "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&title=Apereo+CAS+-+Service+Redirection+Strategies "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&name=Apereo+CAS+-+Service+Redirection+Strategies "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&title=Apereo+CAS+-+Service+Redirection+Strategies "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&title=Apereo+CAS+-+Service+Redirection+Strategies "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F31%2Fcas62x-service-redirect-strategy%2F&t=Apereo+CAS+-+Service+Redirection+Strategies "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6.2.x - Building CAS Feature Modules – Apereo Community Blog Apereo CAS 6.2.x - Building CAS Feature Modules =============================================== Friday, Nov 1, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/11/01/cas62x-codebase-feature-build/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&title=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&title=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&name=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&title=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&title=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F01%2Fcas62x-codebase-feature-build%2F&t=Apereo+CAS+6.2.x+-+Building+CAS+Feature+Modules "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.x Deployment - WAR Overlays – Apereo Community Blog CAS 6.2.x Deployment - WAR Overlays =================================== Sunday, Nov 3, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/11/03/cas62-gettingstarted-overlay/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&title=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&title=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&name=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&title=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&title=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F03%2Fcas62-gettingstarted-overlay%2F&t=CAS+6.2.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - OAuth JWT Access Tokens – Apereo Community Blog Apereo CAS - OAuth JWT Access Tokens ==================================== Monday, Nov 4, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/11/04/cas62x-oauth-jwt-access-token/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+OAuth+JWT+Access+Tokens&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&title=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&title=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&name=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&title=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&title=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F04%2Fcas62x-oauth-jwt-access-token%2F&t=Apereo+CAS+-+OAuth+JWT+Access+Tokens "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Google reCAPTCHA Integration – Apereo Community Blog Apereo CAS - Google reCAPTCHA Integration ========================================= Friday, Nov 8, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/11/08/cas62x-google-recaptcha/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Google+reCAPTCHA+Integration&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&title=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&title=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&name=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&title=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&title=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas62x-google-recaptcha%2F&t=Apereo+CAS+-+Google+reCAPTCHA+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Managing Configuration Metadata – Apereo Community Blog Apereo CAS - Managing Configuration Metadata ============================================ Sunday, Dec 15, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/12/15/cas62x-config-metadata/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Managing+Configuration+Metadata&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&title=Apereo+CAS+-+Managing+Configuration+Metadata "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&title=Apereo+CAS+-+Managing+Configuration+Metadata "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&name=Apereo+CAS+-+Managing+Configuration+Metadata "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&title=Apereo+CAS+-+Managing+Configuration+Metadata "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&title=Apereo+CAS+-+Managing+Configuration+Metadata "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F15%2Fcas62x-config-metadata%2F&t=Apereo+CAS+-+Managing+Configuration+Metadata "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SAML2 Metadata Overrides – Apereo Community Blog Apereo CAS - SAML2 Metadata Overrides ===================================== Monday, Dec 16, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/12/16/cas62x-saml2-metadata-service/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SAML2+Metadata+Overrides&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&title=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&title=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&name=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&title=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&title=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F16%2Fcas62x-saml2-metadata-service%2F&t=Apereo+CAS+-+SAML2+Metadata+Overrides "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Authentication Handler Resolution – Apereo Community Blog Apereo CAS - Authentication Handler Resolution ============================================== Monday, Dec 23, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/12/23/cas62x-authn-handler-resolution/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Authentication+Handler+Resolution&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&title=Apereo+CAS+-+Authentication+Handler+Resolution "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&title=Apereo+CAS+-+Authentication+Handler+Resolution "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&name=Apereo+CAS+-+Authentication+Handler+Resolution "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&title=Apereo+CAS+-+Authentication+Handler+Resolution "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&title=Apereo+CAS+-+Authentication+Handler+Resolution "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F23%2Fcas62x-authn-handler-resolution%2F&t=Apereo+CAS+-+Authentication+Handler+Resolution "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Checking Out Pull Requests Locally – Apereo Community Blog Checking Out Pull Requests Locally ================================== Tuesday, Dec 31, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/12/31/github-pr-as-branch/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Checking+Out+Pull+Requests+Locally&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&title=Checking+Out+Pull+Requests+Locally "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&title=Checking+Out+Pull+Requests+Locally "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&name=Checking+Out+Pull+Requests+Locally "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&title=Checking+Out+Pull+Requests+Locally "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&title=Checking+Out+Pull+Requests+Locally "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F31%2Fgithub-pr-as-branch%2F&t=Checking+Out+Pull+Requests+Locally "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo Community Blog Wednesday, May 20, 2026 [### Java CAS Client JWT Vulnerability Disclosure](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) Disclosure of a security issue with the Java CAS Client validating JWTs. Saturday, Apr 25, 2026 [### Apereo CAS - External Identity Providers](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts. Friday, Mar 6, 2026 [### CAS JWT Authentication Vulnerability Disclosure](https://apereo.github.io/2026/03/06/jwt-vuln/) Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication. Monday, Feb 9, 2026 [### Performance improvements on the service registry](https://apereo.github.io/2026/02/09/performance-improvements-service-registry/) An overview of the work done on performance. Saturday, Feb 7, 2026 [### Apereo CAS Dynamic Configuration Management](https://apereo.github.io/2026/02/07/cas-dynamic-configuration-management/) An overview of Apereo CAS' ability to handle dynamic configuration updates. Sunday, Feb 1, 2026 [### Apereo CAS Receives NLnet Grant to Advance CAS Development](https://apereo.github.io/2026/02/01/cas-nlnet/) We’re excited to share that the Apereo CAS project has been awarded funding from NLnet to support the development of the CAS project. Thursday, Sep 25, 2025 [### CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2025/09/25/oauth-oidc-vuln/) Disclosure of a security issue with the Apereo CAS software acting itself as an OAuth/OpenID Connect provider. Tuesday, Aug 19, 2025 [### CAS Simple Multifactor Authentication Vulnerability Disclosure](https://apereo.github.io/2025/08/19/simplemfa-vuln/) Disclosure of a security issue with the Apereo CAS software acting itself as an MFA provider. [Newer](https://apereo.github.io/) [Older](https://apereo.github.io/page3) Page 2 of 28 --- # Apereo Community Blog Friday, Apr 11, 2025 [### CAS OAuth/OpenID Connect & WebAuthN Vulnerability Disclosure](https://apereo.github.io/2025/04/11/oidc-webauthn-vuln/) Disclosure of a security issue with the Apereo CAS software acting as an OAuth/OpenID Connect provider, or as a multifactor authentication provider utilizing FIDO2/WebAuthN. Wednesday, Jun 26, 2024 [### CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2024/06/26/oidc-vuln/) Disclosure of a security issue with the Apereo CAS software acting as an OAuth/OpenID Connect provider. Saturday, May 18, 2024 [### CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2024/05/18/oauth-vuln/) Disclosure of a security issue with the Apereo CAS software acting as an OAuth/OpenID Connect provider. Saturday, Mar 9, 2024 [### Apereo CAS is now on Develocity](https://apereo.github.io/2024/03/09/develocity/) An overview of how Apereo CAS is using Gradle and Develocity to improve its build and test execution cycle. Thursday, Sep 14, 2023 [### CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2023/09/14/oauth-vuln/) Disclosure of a security issue with the Apereo CAS software acting as an OAuth/OpenID Connect provider. Wednesday, Aug 30, 2023 [### CAS Groovy Vulnerability Disclosure](https://apereo.github.io/2023/08/30/groovy-vuln/) Disclosure of a security issue with the Apereo CAS software when using Groovy. Friday, Jul 21, 2023 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2023/07/21/oidc-vuln/) Disclosure of a security issue with the Apereo CAS software acting as an OpenID Connect Provider. Monday, Feb 20, 2023 [### CAS X.509 Vulnerability Disclosure](https://apereo.github.io/2023/02/20/x509-vuln/) Disclosure of a security issue with the CAS software and its X.509 features. [Newer](https://apereo.github.io/page2) [Older](https://apereo.github.io/page4) Page 3 of 28 --- # Apereo Community Blog Wednesday, Aug 3, 2022 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/08/03/oidc-vuln/) Disclosure of a security issue with the CAS software acting as an OpenID Connect Provider. Friday, Jul 1, 2022 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/07/01/oidc-vuln/) Disclosure of a security issue with the CAS software acting as an OpenID Connect Provider. Thursday, Jun 23, 2022 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/06/23/oidc-vuln/) Disclosure of a security issue with the CAS software acting as an OpenID Connect Provider. Thursday, Mar 31, 2022 [### CAS Spring Framework RCE Vulnerability Disclosure](https://apereo.github.io/2022/03/31/spring-vuln/) Disclosure of the Spring framework RCE security issue with the Apereo CAS software. Sunday, Mar 6, 2022 [### CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/03/06/oidc-vuln/) Disclosure of a security issue with the CAS software acting as an OpenID Connect Provider. Saturday, Dec 11, 2021 [### CAS Log4J Vulnerability Disclosure](https://apereo.github.io/2021/12/11/log4j-vuln/) Disclosure of a security issue with the CAS software as a consumer of the Log4j logging framework. Monday, Oct 18, 2021 [### CAS Vulnerability Disclosure](https://apereo.github.io/2021/10/18/restvuln/) Disclosure of a security issue with the CAS software. Saturday, Jul 17, 2021 [### Publish Private CAS Releases](https://apereo.github.io/2021/07/17/publish-private-release/) GitHub Actions workflows allow publishing to private repositories. [Newer](https://apereo.github.io/page3) [Older](https://apereo.github.io/page5) Page 4 of 28 --- # Apereo Community Blog Saturday, Feb 13, 2021 [### CAS Vulnerability Disclosure](https://apereo.github.io/2021/02/13/gauthvuln/) Disclosure of a security issue with the CAS software. Wednesday, Oct 14, 2020 [### CAS Vulnerability Disclosure](https://apereo.github.io/2020/10/14/gauthvuln/) Disclosure of a security issue with the CAS software. Tuesday, Oct 6, 2020 [### CAS Multifactor Authentication with U2F and Bypass](https://apereo.github.io/2020/10/06/configure-ldap-u2f-and-bypass/) A short walkthrough to demonstrate how one might turn on multifactor authentication with CAS using U2F and default bypass rule. Friday, Jul 24, 2020 [### CAS Vulnerability Disclosure](https://apereo.github.io/2020/07/24/credvuln/) Disclosure of a security issue with the CAS software. Thursday, Jul 2, 2020 [### CAS Release Notes Moved](https://apereo.github.io/2020/07/02/cas-release-notes/) CAS Release Notes are moved to the CAS site. Friday, May 29, 2020 [### CAS 6.2.0 RC5 Feature Release](https://apereo.github.io/2020/05/29/620rc5-release/) ...in which I present an overview of CAS 6.2.0 RC5 release. Friday, Apr 17, 2020 [### CAS 6.2.0 RC4 Feature Release](https://apereo.github.io/2020/04/17/620rc4-release/) ...in which I present an overview of CAS 6.2.0 RC4 release. Tuesday, Mar 3, 2020 [### CAS 6.2.0 RC3 Feature Release](https://apereo.github.io/2020/03/03/620rc3-release/) ...in which I present an overview of CAS 6.2.0 RC3 release. [Newer](https://apereo.github.io/page4) [Older](https://apereo.github.io/page6) Page 5 of 28 --- # Apereo Community Blog Wednesday, Feb 26, 2020 [### Apereo CAS - Bootiful CAS Client](https://apereo.github.io/2020/02/26/cas-bootiful-client/) Easy to use CAS Client Saturday, Feb 8, 2020 [### CAS Vulnerability Disclosure](https://apereo.github.io/2020/02/08/webflowcrypto/) Disclosure of a security issue with the CAS software. Tuesday, Dec 31, 2019 [### Checking Out Pull Requests Locally](https://apereo.github.io/2019/12/31/github-pr-as-branch/) Check out GitHub pull requests as local branches using a simple bash function. Friday, Dec 27, 2019 [### CAS 6.2.0 RC2 Feature Release](https://apereo.github.io/2019/12/27/620rc2-release/) ...in which I present an overview of CAS 6.2.0 RC2 release. Monday, Dec 23, 2019 [### Apereo CAS - Authentication Handler Resolution](https://apereo.github.io/2019/12/23/cas62x-authn-handler-resolution/) Learn how to resolve and select authentication handlers based on configurable and flexible filtering criteria. Friday, Dec 20, 2019 [### CAS Vulnerability Disclosure](https://apereo.github.io/2019/12/20/surrogatevuln/) Disclosure of a security issue with the CAS software. Monday, Dec 16, 2019 [### Apereo CAS - SAML2 Metadata Overrides](https://apereo.github.io/2019/12/16/cas62x-saml2-metadata-service/) Learn how to manage SAML2 service provider registrations in CAS and override metadata artifacts on a per-application basis. Sunday, Dec 15, 2019 [### Apereo CAS - Managing Configuration Metadata](https://apereo.github.io/2019/12/15/cas62x-config-metadata/) Learn how to manage CAS configuration and properties using Spring Boot Configuration metadata. [Newer](https://apereo.github.io/page5) [Older](https://apereo.github.io/page7) Page 6 of 28 --- # Apereo Community Blog Friday, Nov 29, 2019 [### CAS 6.2.0 RC1 Feature Release](https://apereo.github.io/2019/11/29/620rc1-release/) ...in which I present an overview of CAS 6.2.0 RC1 release. Thursday, Nov 28, 2019 [### Apereo CAS - Deployment Using systemd](https://apereo.github.io/2019/11/28/cas61x-systemd-deployment/) Fabio Martelli of Tirasa S.r.l reviews the setup required to deploy Apereo CAS as a system service using systemd. Wednesday, Nov 27, 2019 [### Apereo CAS - Python Locust Load Testing](https://apereo.github.io/2019/11/27/cas62x-locust-load-testing/) Learn to Performance Test Apereo CAS with Python Locust. Sunday, Nov 24, 2019 [### CAS Vulnerability Disclosure](https://apereo.github.io/2019/11/24/smfavuln/) Disclosure of a security issue with the CAS software. Friday, Nov 8, 2019 [### Apereo CAS - Google reCAPTCHA Integration](https://apereo.github.io/2019/11/08/cas62x-google-recaptcha/) Learn to set up an integration between Apereo CAS and Google reCAPTCHA. Friday, Nov 8, 2019 [### Apereo CAS - JMeter Performance Testing](https://apereo.github.io/2019/11/08/cas61x-jmeter-load-testing/) Learn to Performance Test Apereo CAS. Monday, Nov 4, 2019 [### Apereo CAS - OAuth JWT Access Tokens](https://apereo.github.io/2019/11/04/cas62x-oauth-jwt-access-token/) Learn to customize Apereo CAS to issue OAuth Access Tokens as JWTs. Sunday, Nov 3, 2019 [### CAS 6.2.x Deployment - WAR Overlays](https://apereo.github.io/2019/11/03/cas62-gettingstarted-overlay/) Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps. [Newer](https://apereo.github.io/page6) [Older](https://apereo.github.io/page8) Page 7 of 28 --- # Apereo Community Blog Friday, Nov 1, 2019 [### Apereo CAS 6.2.x - Building CAS Feature Modules](https://apereo.github.io/2019/11/01/cas62x-codebase-feature-build/) An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc. Thursday, Oct 31, 2019 [### Apereo CAS - Service Redirection Strategies](https://apereo.github.io/2019/10/31/cas62x-service-redirect-strategy/) Learn to customize Apereo CAS to modify the default strategy used for redirecting the authentication flow back to relying parties. Monday, Oct 28, 2019 [### Apereo CAS - Service Matching Strategies](https://apereo.github.io/2019/10/28/cas61x-service-matching-strategy/) Learn to customize Apereo CAS to modify the default strategy used for matching services. Friday, Oct 25, 2019 [### Apereo CAS - Password Management with JDBC](https://apereo.github.io/2019/10/25/cas61x-password-management-jdbc/) Learn use the Password Management features in Apereo CAS. Monday, Oct 14, 2019 [### Apereo CAS - Simple Multifactor Authentication](https://apereo.github.io/2019/10/14/cas61x-simple-mfa-provider/) Learn to configure Apereo CAS to act as a simple multifactor provider itself. Wednesday, Oct 9, 2019 [### Apereo CAS 2019 Survey Results](https://apereo.github.io/2019/10/09/cas-survey-results2019/) ...in which I present a summarized view of the latest CAS community survey. Friday, Oct 4, 2019 [### CAS 6.1.0 RC6 Feature Release](https://apereo.github.io/2019/10/04/610rc6-release/) ...in which I present an overview of CAS 6.1.0 RC6 release. Thursday, Oct 3, 2019 [### Apereo CAS - Managing Services via Git](https://apereo.github.io/2019/10/03/cas61x-git-service-registry/) Learn to configure Apereo CAS to fetch application policy files and service records for its service registry from remote git repositories. [Newer](https://apereo.github.io/page7) [Older](https://apereo.github.io/page9) Page 8 of 28 --- # Apereo Community Blog Monday, Sep 30, 2019 [### Apereo CAS - Ticket Distribution with JMS](https://apereo.github.io/2019/09/30/cas61x-jms-activemq-ticketing/) Learn to configure Apereo CAS to JMS and messages queues to broadcast tickets and tokens across a deployment cluster. Friday, Sep 27, 2019 [### CAS Vulnerability Disclosure](https://apereo.github.io/2019/09/27/numvulndisc/) Disclosure of a security issue with the CAS software. Friday, Sep 20, 2019 [### Apereo CAS - SMS Notifications via Twilio](https://apereo.github.io/2019/09/20/cas61x-smsconfig-twilio/) Learn to configure Apereo CAS for SMS notifications via Twilio. Monday, Sep 2, 2019 [### CAS 6.1.0 RC5 Feature Release](https://apereo.github.io/2019/09/02/610rc5-release/) ...in which I present an overview of CAS 6.1.0 RC5 release. Thursday, Jul 18, 2019 [### Apereo CAS - Passwordless Authentication](https://apereo.github.io/2019/07/18/cas61x-passwordless-authn/) Learn how to modify Apereo CAS to allow users to login without the need to remember a password. Tuesday, Jul 2, 2019 [### Apereo CAS - Handling Authentication Webflow Errors with Grace](https://apereo.github.io/2019/07/02/cas61x-error-handling/) Learn how to modify Apereo CAS to customize exception handling and produce localized error messages for your deployment. Friday, Jun 14, 2019 [### Apereo CAS - Are We Logged In Yet?](https://apereo.github.io/2019/06/14/cas53x-userlogin-ssostatus/) Learn how to modify and extend a CAS deployment to determine whether an SSO session is still valid and tied to a user authentication session. Wednesday, Jun 12, 2019 [### Apereo CAS - REST API Integrations](https://apereo.github.io/2019/06/12/cas61x-rest-api/) Learn how to integrate with CAS using its REST API to authenticate, exchange tickets and get access to user profiles and attributes. [Newer](https://apereo.github.io/page8) [Older](https://apereo.github.io/page10) Page 9 of 28 --- # Apereo Community Blog Friday, Jun 7, 2019 [### CAS 6.1.0 RC4 Feature Release](https://apereo.github.io/2019/06/07/610rc4-release/) ...in which I present an overview of CAS 6.1.0 RC4 release. Monday, May 13, 2019 [### Apereo CAS - Multifactor Provider Selection](https://apereo.github.io/2019/05/13/cas61x-mfa-selection-strategies/) Learn how to configure CAS to integrate with and use multiple multifactor providers at the same time. This post also reveals a few super secret and yet open-source strategies one may use to select appropriate providers for authentication attempts, whether automatically or based on a menu. Monday, May 13, 2019 [### Apereo CAS - Dockerized Hazelcast Deployments](https://apereo.github.io/2019/05/13/cas61x-docker-hazelcast-mgmtcenter/) Learn how to run CAS backed by a Hazelcast cluster in Docker containers and take advantage of the Hazelcast management center to monitor and observer cluster members. Wednesday, May 8, 2019 [### Apereo CAS - Configuration Security w/ Jasypt](https://apereo.github.io/2019/05/08/cas61x-jasypt-encryption/) Learn how to secure CAS configuration settings and properties with Jasypt. Monday, Apr 29, 2019 [### CAS 6.1.0 RC3 Feature Release](https://apereo.github.io/2019/04/29/610rc3-release/) ...in which I present an overview of CAS 6.1.0 RC3 release. Thursday, Apr 25, 2019 [### Apereo CAS - Webflow Decorations](https://apereo.github.io/2019/04/25/cas61x-webflow-decorations/) Learn how you may decorate the Apereo CAS login webflow to inject data pieces and objects into the processing engine for display purposes, peace on earth and prosperity of all mankind, etc. Mainly, etc. Friday, Apr 12, 2019 [### Apereo CAS - SAML2 Metadata Query Protocol](https://apereo.github.io/2019/04/12/cas61x-saml-idp-mdq/) Learn how you may configure Apereo CAS to fetch and validate SAML2 metadata for service providers from InCommon's MDQ server using the metadata query protocol. Friday, Mar 29, 2019 [### Saving Time is Time Consuming](https://apereo.github.io/2019/03/29/startup-times/) May you live in the best of times. May you live in the startup times. [Newer](https://apereo.github.io/page9) [Older](https://apereo.github.io/page11) Page 10 of 28 --- # Apereo Community Blog Monday, Mar 25, 2019 [### Apereo CAS 6.1.x - Credential Caching & Proxy AuthN](https://apereo.github.io/2019/03/25/cas61x-clearpass-pgt-attributes/) Learn how you may configure Apereo CAS to capture and cache the credential's password and the proxy-granting ticket in proxy authentication scenarios, pass them along to applications as regular attributes/claims. We will also be reviewing a handful of attribute release strategies that specifically affect authentication attributes, conveying metadata about the authentication event itself. Friday, Mar 15, 2019 [### Apereo CAS 6.1.x - Attribute Repositories w/ Person Directory](https://apereo.github.io/2019/03/15/cas61x-attribute-repositories/) An overview of CAS attribute repositories and strategies on how to fetch attributes from a variety of sources in addition to the authentication source, merge and combine attributes from said sources to ultimately release them to applications with a fair bit of caching. Tuesday, Mar 12, 2019 [### Apereo CAS 6.1.x - Building CAS Feature Modules](https://apereo.github.io/2019/03/12/cas61x-codebase-feature-build/) An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc. Friday, Mar 1, 2019 [### CAS 6.1.0 RC2 Feature Release](https://apereo.github.io/2019/03/01/610rc2-release/) ...in which I present an overview of CAS 6.1.0 RC2 release. Wednesday, Feb 27, 2019 [### Apereo CAS - Riffing on Attribute Release Policies](https://apereo.github.io/2019/02/27/cas61-attribute-release-policies/) Learn how to release the kraken of attributes to CAS clients, relying parties and service providers using a variety of attribute release policies and authentication protocols, sampled and collected here to fun and profit. Monday, Feb 25, 2019 [### Apereo CAS - Delegated Authentication to SAML2 Identity Providers](https://apereo.github.io/2019/02/25/cas61-delegate-authn-saml2-idp/) Learn how your Apereo CAS deployment may be configured to delegate authentication to an external SAML2 identity provider. Monday, Feb 25, 2019 [### Apereo CAS - Custom Login Fields w/ Dynamic Bindings](https://apereo.github.io/2019/02/25/cas61-custom-login-fields/) Learn how to extend the Spring Webflow model to add custom fields to the CAS login form and the authentication process and take advantage of the additional user-provided data in customized authentication handlers. Tuesday, Feb 19, 2019 [### Apereo CAS as an OAuth2 Authorization Server](https://apereo.github.io/2019/02/19/cas61-as-oauth-authz-server/) Learn how to configure CAS as an OAuth2 Authorization Server and configure Spring Boot client app to work with it [Newer](https://apereo.github.io/page10) [Older](https://apereo.github.io/page12) Page 11 of 28 --- # Apereo Community Blog Monday, Feb 18, 2019 [### Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) Learn how Apereo CAS may act as a SAML2 identity provider for Gitlab and run everything locally on a workstation with Docker and Java. Thursday, Feb 7, 2019 [### Apereo CAS - Keeping Healthy with Spring Boot](https://apereo.github.io/2019/02/07/cas61-healthstatus-springboot/) Learn how you may keep your Apereo CAS deployment healthy, monitoring its status using Spring Boot actuator endpoints and health indicators. Friday, Feb 1, 2019 [### CAS 6.1.0 RC1 Feature Release](https://apereo.github.io/2019/02/01/610rc1-release/) ...in which I present an overview of CAS 6.1.0 RC1 release. Friday, Jan 18, 2019 [### Apereo CAS - SAML2 Identity Provider Integration w/ InCommon](https://apereo.github.io/2019/01/18/cas61-saml2-idp-incommon/) Learn how Apereo CAS may act as a SAML2 identity provider to integrate with service providers from metadata aggregates such as InCommon with various attribute release policies for research and scholarship, etc. Monday, Jan 7, 2019 [### CAS 6.1.x Deployment - WAR Overlays](https://apereo.github.io/2019/01/07/cas61-gettingstarted-overlay/) Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps. Sunday, Jan 6, 2019 [### Apereo CAS - Have you been pawned?](https://apereo.github.io/2019/01/06/cas61-groovy-haveibeenpawned/) Learn how Apereo CAS may be configured to check for pawned passwords and warn the user, using the haveibeenpawned.com service Monday, Dec 24, 2018 [### Apereo CAS - OohLala Mobile SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oohlalamobile-saml2-integration/) Learn how to integrate OohLala Mobile with Apereo CAS running as a SAML2 identity provider. Monday, Dec 24, 2018 [### Apereo CAS - Cranium Cafe SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oclc-saml2-integration/) Learn how to integrate Cranium Cafe with Apereo CAS running as a SAML2 identity provider. [Newer](https://apereo.github.io/page11) [Older](https://apereo.github.io/page13) Page 12 of 28 --- # Apereo Community Blog Monday, Dec 24, 2018 [### Apereo CAS - eLumen SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-elumen-saml2-integration/) Learn how to integrate eLumen with Apereo CAS running as a SAML2 identity provider. Sunday, Dec 23, 2018 [### Apereo CAS - Rave SAML2 Integration](https://apereo.github.io/2018/12/23/cas53-getrave-saml2-integration/) Learn how to integrate Rave with Apereo CAS running as a SAML2 identity provider. Saturday, Dec 22, 2018 [### Apereo CAS - HireTouch SAML2 Integration](https://apereo.github.io/2018/12/22/cas53-hiretouch-saml2-integration/) Learn how to integrate HireTouch with Apereo CAS running as a SAML2 identity provider. Thursday, Dec 6, 2018 [### Apereo CAS - Microsoft Office 365 SAML2 Integration](https://apereo.github.io/2018/12/06/cas53-office365-saml2-integration/) Learn how to integrate Microsoft Office 365 with Apereo CAS running as a SAML2 identity provider. Tuesday, Dec 4, 2018 [### Apereo CAS - HappyFox SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-happyfox-saml2-integration/) Learn how to integrate HappyFox with Apereo CAS running as a SAML2 identity provider. Tuesday, Dec 4, 2018 [### Apereo CAS - Cisco Webex SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-cisco-webex-saml2-integration/) Learn how to integrate Cisco Webex with Apereo CAS running as a SAML2 identity provider. Monday, Dec 3, 2018 [### Apereo CAS - VMware Identity Manager SAML2 Integration](https://apereo.github.io/2018/12/03/cas53-vmwareidentitymgr-saml2-integration/) Learn how to integrate VMware Identity Manager with Apereo CAS running as a SAML2 identity provider. Friday, Nov 30, 2018 [### CAS 6.0.0 RC4 Feature Release](https://apereo.github.io/2018/11/30/600rc4-release/) ...in which I present an overview of CAS 6.0.0 RC4 release. [Newer](https://apereo.github.io/page12) [Older](https://apereo.github.io/page14) Page 13 of 28 --- # Apereo Community Blog Thursday, Nov 22, 2018 [### Apereo CAS - Scripting Multifactor Authentication Triggers](https://apereo.github.io/2018/11/22/cas5-groovy-mfa/) Learn how Apereo CAS may be configured to trigger multifactor authentication using Groovy conditionally decide whether MFA should be triggered for internal vs. external access, taking into account IP ranges, LDAP groups, etc. Tuesday, Nov 20, 2018 [### Apereo CAS 6.0.x - Building CAS Feature Modules](https://apereo.github.io/2018/11/20/cas60x-codebase-feature-build/) An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc. Friday, Nov 16, 2018 [### CAS 6.0.x Deployment - WAR Overlays](https://apereo.github.io/2018/11/16/cas60-gettingstarted-overlay/) Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps. Friday, Nov 9, 2018 [### Apereo CAS - Jib at CAS Docker Images](https://apereo.github.io/2018/11/09/cas6-docker-jib/) Learn how you may use Jib, an open-source Java containerizer from Google, and its Gradle plugin to build CAS docker images seamlessly without stepping too deep into scripting Dockerfile commands. Tuesday, Nov 6, 2018 [### Apereo CAS 6 - Administrative Endpoints & Monitoring](https://apereo.github.io/2018/11/06/cas6-admin-endpoints-security/) Gain insight into your running Apereo CAS 6 deployment in production. Learn how to monitor and manage the server by using HTTP endpoints and gather metrics to diagnose issues and improve performance. Saturday, Nov 3, 2018 [### Apereo CAS - SAML2 Metadata with MongoDb](https://apereo.github.io/2018/11/03/cas6-saml2-metadata-mongodb/) CAS distributed SAML2 metadata management using MongoDB, where you learn how to store metadata documents inside MongoDB for CAS as a SAML2 identity provider and all other registered SAML2 service providers. Friday, Nov 2, 2018 [### Apereo CAS - Slurp Configuration with Groovy](https://apereo.github.io/2018/11/02/cas6-groovy-config-slurper/) Learn how CAS configuration may be consumed via Groovy to simplify and consolidate settings for multiple deployment environments and profiles. Wednesday, Oct 31, 2018 [### Apereo CAS - Configuration Management with MongoDb](https://apereo.github.io/2018/10/31/cas6-configuration-mongodb/) CAS distributed configuration management using MongoDb, where you learn how to store and secure CAS configuration settings and properties inside MongoDb. [Newer](https://apereo.github.io/page13) [Older](https://apereo.github.io/page15) Page 14 of 28 --- # Apereo Community Blog Tuesday, Oct 30, 2018 [### Apereo CAS - Integration with HashiCorp Vault](https://apereo.github.io/2018/10/30/cas6-configuration-vault/) CAS distributed configuration management using HashCorp Vault, where you learn how to store and secure CAS configuration settings and properties inside Vault. Friday, Oct 26, 2018 [### CAS 6.0.0 RC3 Feature Release](https://apereo.github.io/2018/10/26/600rc3-release/) ...in which I present an overview of CAS 6.0.0 RC3 release. Thursday, Oct 25, 2018 [### Why you should choose CAS as your SSO system](https://apereo.github.io/2018/10/25/why-you-should-choose-cas-as-your-sso-system/) Discover the true reasons to use CAS Thursday, Oct 25, 2018 [### Apereo CAS - Integration with Spring Cloud Config Server](https://apereo.github.io/2018/10/25/cas6-cloud-config-server/) CAS distributed configuration management using Spring Cloud Server for fun and profit. Learn how to centralize and setup configuration and property sources as part of the Cloud Config server and how to connect your Apereo CAS deployment to the Cloud Config server to receive real-time configuration updates per environment and deployment tier. Monday, Oct 22, 2018 [### Apereo CAS - Spring Boot Admin Integration](https://apereo.github.io/2018/10/22/cas6-springboot-admin-server/) Learn to manage and monitor your Apereo CAS deployment using the Spring Boot Admin server and Spring Boot Actuator endpoints. Monday, Oct 22, 2018 [### Apereo CAS - Fun with HashiCorp Consul](https://apereo.github.io/2018/10/22/cas6-consul-discovery/) Integrate HashiCorp Consul with CAS for service discovery and distributed configuration management. Thursday, Oct 18, 2018 [### Apereo CAS - Multifactor Authentication with RADIUS](https://apereo.github.io/2018/10/18/cas5-radius-mfa-authn/) Learn how Apereo CAS may be configured to trigger multifactor authentication using a RADIUS server and its support for the Access-Challenge response type. Wednesday, Sep 26, 2018 [### CAS Vulnerability Disclosure](https://apereo.github.io/2018/09/26/mfavulndisc/) Disclosure of a security issue with the MFA features. [Newer](https://apereo.github.io/page14) [Older](https://apereo.github.io/page16) Page 15 of 28 --- # Apereo Community Blog Friday, Sep 14, 2018 [### CAS 6.0.0 RC2 Feature Release](https://apereo.github.io/2018/09/14/600rc2-release/) ...in which I present an overview of CAS 6.0.0 RC2 release. Thursday, Sep 6, 2018 [### Apereo CAS - dotCMS SAML2 Integration](https://apereo.github.io/2018/09/06/cas53-dotcms-saml2-integration/) Learn how to integrate dotCMS, a Content Management System and Headless CMS, with Apereo CAS running as a SAML2 identity provider. Wednesday, Sep 5, 2018 [### Effective Software Troubleshooting Tactics](https://apereo.github.io/2018/09/05/effective-diagnostics/) A collection of what hopefully are obvious troubleshooting tactics when it comes to diagnosing software deployment issues and configuration problems. Monday, Aug 27, 2018 [### Apereo CAS - MaxMind Geo2IP ISP Integration](https://apereo.github.io/2018/08/27/cas5-maxmind-isp-interrupt-integration/) Learn how you may determine the Internet Service Provider, organization name, and autonomous system organization and number associated with the user's IP address in CAS using MaxMind services and present warnings in the authentication flow for the end-user if an IP address is matched. Friday, Aug 24, 2018 [### Notes from Better by Design 2018](https://apereo.github.io/2018/08/24/better-by-design-2018/) Be interested in humans and human success. Thursday, Aug 23, 2018 [### Apereo CAS - Authentication Lifecycle Phases](https://apereo.github.io/2018/08/23/cas5-authn-lifecycle-extensions/) Tap into the Apereo CAS authentication engine from outside, and design extensions that prevent an unsuccessful authentication attempt or warn the user after-the-fact based on specific policies of your choosing. Friday, Aug 3, 2018 [### CAS 6.0.0 RC1 Feature Release](https://apereo.github.io/2018/08/03/600rc1-release/) ...in which I present an overview of CAS 6.0.0 RC1 release. Tuesday, Jul 31, 2018 [### Apereo CAS Delegated Authentication with ADFS](https://apereo.github.io/2018/07/31/cas6-delegated-authn-adfs/) Learn how your Apereo CAS deployment may be configured to delegate authentication to Microsoft ADFS. [Newer](https://apereo.github.io/page15) [Older](https://apereo.github.io/page17) Page 16 of 28 --- # Apereo Community Blog Tuesday, Jul 24, 2018 [### Apereo CAS Swag with Swagger](https://apereo.github.io/2018/07/24/cas-apis-swagger/) Enable Swagger integration with your Apereo CAS APIs. Saturday, Jul 14, 2018 [### Get Productive with Shell Aliases](https://apereo.github.io/2018/07/14/shell-aliases-collection/) A collection of useful shell aliases, gathered over the years to help increase one's productivity and developer happiness. Saturday, Jul 7, 2018 [### feat(conventional\_commits): signal breaking changes in commit titles](https://apereo.github.io/2018/07/07/indicate-breaks-in-conventional-commit-titles/) In which I suggest Conventional Commits should be enhanced to reflect the breakingness of commits in their commit message titles. Monday, Jun 25, 2018 [### uPortal annual report, June 2018 edition](https://apereo.github.io/2018/06/25/up-annual-report/) Ecoysystem. Releases. Community. Fiscal responsibility. Friday, Jun 22, 2018 [### One Can Only Hope in Buchistan](https://apereo.github.io/2018/06/22/united-nations-buchistan/) A true story inspired by real events. Seriously. Bryan Cranston has been approached for the role of "Some". Tuesday, Jun 19, 2018 [### Apereo CAS - Extending Webflows](https://apereo.github.io/2018/06/19/cas53webflow-extensions/) Learn and master extending CAS 5 Spring Webflow definitions. Friday, Jun 15, 2018 [### Apereo CAS - Administrative Endpoints & Monitoring](https://apereo.github.io/2018/06/15/cas53-admin-endpoints-security/) Gain insight into your running Apereo CAS deployment in production. Learn how to monitor and manage the server by using HTTP endpoints and gather metrics to diagnose issues and improve performance. Tuesday, Jun 12, 2018 [### Apereo CAS - Custom Authentication & Attribute Sources](https://apereo.github.io/2018/06/12/cas53-authn-handlers/) Master writing custom authentication handlers/schemes in CAS and learn how to design custom data sources that can produce user claims and attributes. [Newer](https://apereo.github.io/page16) [Older](https://apereo.github.io/page18) Page 17 of 28 --- # Apereo Community Blog Sunday, Jun 10, 2018 [### Apereo CAS - User Interface Customizations](https://apereo.github.io/2018/06/10/cas-userinterface-customizations/) A short tutorial on Apereo CAS user interface customizations, including themes, localization and dynamic views for all those who enjoy front-end development and suffer from instant gratification. Sunday, Jun 10, 2018 [### CAS Multifactor Authentication with Google Authenticator](https://apereo.github.io/2018/06/10/cas-mfa-google-authenticator/) A short walkthrough to demonstrate how one might turn on multifactor authentication with CAS using Google Authenticator, leveraging a variety of triggers. Saturday, Jun 9, 2018 [### CAS 5.3.x Deployment - WAR Overlays](https://apereo.github.io/2018/06/09/cas53-gettingstarted-overlay/) Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps. Friday, May 25, 2018 [### CAS 5.3.0 RC4 Feature Release](https://apereo.github.io/2018/05/25/530rc4-release/) ...in which I present an overview of CAS 5.3.0 RC4 release. Monday, May 7, 2018 [### Apereo CAS - Identity Impersonation](https://apereo.github.io/2018/05/07/cas-impersonation-authn/) You do not always have to be you. Allow the Apereo CAS server to allow you to pretend to be another person for fun and profit. Friday, May 4, 2018 [### Apereo CAS - Customized Settings](https://apereo.github.io/2018/05/04/cas-custom-properties/) Extend the Apereo CAS server to allow custom configuration properties and settings. Tuesday, Apr 24, 2018 [### Apereo CAS - Handling Multiple Logout URLs](https://apereo.github.io/2018/04/24/cas-multiple-logout-urls/) Extend the Apereo CAS server to allow for multiple logout URLs during SLO operations. Monday, Apr 23, 2018 [### Apereo CAS - Access Strategy External URL Redirects](https://apereo.github.io/2018/04/23/cas-access-strategy-url-redirects/) A quick use case walkthrough where the authentication flow in CAS is to be redirected to a customized external URL if service access is denied. [Newer](https://apereo.github.io/page17) [Older](https://apereo.github.io/page19) Page 18 of 28 --- # Apereo Community Blog Friday, Apr 20, 2018 [### Apereo CAS - Linking Accounts with Delegated Authentication](https://apereo.github.io/2018/04/20/cas-delegated-authn-account-linking/) A quick use case walkthrough where profiles provided by external identity providers to CAS need to be looked up by an identifier in internal databases before CAS can successfully establish an authenticated subject. Friday, Apr 20, 2018 [### Nominate awesome fits for the Apereo board](https://apereo.github.io/2018/04/20/nominate-to-board/) Provoking thoughts about who might serve well on Apereo board. Thursday, Apr 5, 2018 [### Apereo CAS - Test-Driving Feature Modules](https://apereo.github.io/2018/04/05/cas-codebase-feature-build/) An overview of how various CAS features modules today can be changed and tested from the perspective of a CAS contributor working on the codebase itself to handle a feature request, bug fix, etc. Wednesday, Apr 4, 2018 [### Feedback on draft Apereo strategy](https://apereo.github.io/2018/04/04/apereo-strategy/) Focus on revenue to achieve sustainability. Defer everything else. Sunday, Apr 1, 2018 [### Apereo CAS Best \[Mal\]Practice - Supercharged Overlays](https://apereo.github.io/2018/04/01/cas-overlays-supercharged/) An overview of how a CAS overlay prepped for deployment can tap into internal components, altering logic and behavior for good and evil...but mostly evil. Friday, Mar 30, 2018 [### CAS 5.3.0 RC3 Feature Release](https://apereo.github.io/2018/03/30/530rc3-release/) ...in which I present an overview of CAS 5.3.0 RC3 release. Monday, Feb 26, 2018 [### Apereo CAS - REFEDS MFA Profile with shib-cas-authn3](https://apereo.github.io/2018/02/26/shibcasauthn-duomfa-refeds/) An overview of the shib-cas-authn3 project and its support for the REFEDS MFA profile with both the Shibboleth Identity Provider and Apereo CAS lending a hand. Monday, Feb 26, 2018 [### Forced Authentication with Apereo CAS](https://apereo.github.io/2018/02/26/forcedauth-modauth-cas/) Discourse on supporting forced authentication with the Apereo CAS server from the perspective of an application protected with mod-auth-cas, the Apache httpd module for CAS. [Newer](https://apereo.github.io/page18) [Older](https://apereo.github.io/page20) Page 19 of 28 --- # Apereo Community Blog Monday, Feb 26, 2018 [### Apereo CAS - Dances with Protocols](https://apereo.github.io/2018/02/26/cas-delegation-protocols/) A short overview of how Apereo CAS may support multiple authentication protocols simultaneously while acting as both the primary identity provider or proxying another. Two Socks could not be reached for comments. Tuesday, Feb 20, 2018 [### Why does uPortal use Apache 2 license?](https://apereo.github.io/2018/02/20/apache2-chose-uportal/) Apache2 chose uPortal. Tuesday, Feb 20, 2018 [### Apereo CAS - Attribute-based Application Authorization](https://apereo.github.io/2018/02/20/cas-service-rbac-attributeresolution/) A walkthrough to demonstrate how one might fetch attributes from a number of data sources, turning them into roles that could then be used to enforce application access and authorization. Friday, Feb 9, 2018 [### CAS 5.3.0 RC2 Feature Release](https://apereo.github.io/2018/02/09/530rc2-release/) ...in which I present an overview of CAS 5.3.0 RC2 release. Tuesday, Feb 6, 2018 [### CAS 5.2.x Deployment - WAR Overlays](https://apereo.github.io/2018/02/06/cas52-gettingstarted-overlay/) Learn how to configure and build your own CAS deployment via the WAR overlay method, get rich quickly, stay healthy indefinitely and respect family and friends in a few very easy steps. Friday, Feb 2, 2018 [### Link CAS OIDC user to existing Database user](https://apereo.github.io/2018/02/02/OIDC-link-account/) In which we show to link OIDC id to LDAP database user. Monday, Jan 8, 2018 [### CAS Multifactor Authentication with Duo Security](https://apereo.github.io/2018/01/08/cas-mfa-duosecurity/) A short walkthrough to demonstrate how one might turn on multifactor authentication with CAS using Duo Security, leveraging a variety of triggers. Friday, Jan 5, 2018 [### Deploying Apereo CAS Behind a Proxy](https://apereo.github.io/2018/01/05/cas-deployment-with-proxy/) A short tutorial on how to get Apereo CAS deployed behind proxies and load balancers that aim to terminate SSL. [Newer](https://apereo.github.io/page19) [Older](https://apereo.github.io/page21) Page 20 of 28 --- # Busting the Myth - GA Release – Apereo Community Blog Busting the Myth - GA Release ============================= Wednesday, Mar 8, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/03/08/the-myth-of-ga-rel/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Busting+the+Myth+-+GA+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&title=Busting+the+Myth+-+GA+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&title=Busting+the+Myth+-+GA+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&name=Busting+the+Myth+-+GA+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&title=Busting+the+Myth+-+GA+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&title=Busting+the+Myth+-+GA+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F08%2Fthe-myth-of-ga-rel%2F&t=Busting+the+Myth+-+GA+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5 LDAP AuthN and Jasypt Configuration – Apereo Community Blog CAS 5 LDAP AuthN and Jasypt Configuration ========================================= Friday, Mar 24, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/03/24/cas51-ldapauthnjasypt-tutorial/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5+LDAP+AuthN+and+Jasypt+Configuration&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&title=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&title=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&name=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&title=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&title=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F24%2Fcas51-ldapauthnjasypt-tutorial%2F&t=CAS+5+LDAP+AuthN+and+Jasypt+Configuration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.0.x Deployment - WAR Overlays – Apereo Community Blog CAS 5.0.x Deployment - WAR Overlays =================================== Tuesday, Mar 28, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/03/28/cas5-gettingstarted-overlay/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.0.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&title=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&title=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&name=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&title=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&title=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F28%2Fcas5-gettingstarted-overlay%2F&t=CAS+5.0.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5 Database Authentication Tutorial – Apereo Community Blog CAS 5 Database Authentication Tutorial ====================================== Wednesday, Feb 22, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/02/22/cas51-dbauthn-tutorial/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5+Database+Authentication+Tutorial&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&title=CAS+5+Database+Authentication+Tutorial "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&title=CAS+5+Database+Authentication+Tutorial "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&name=CAS+5+Database+Authentication+Tutorial "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&title=CAS+5+Database+Authentication+Tutorial "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&title=CAS+5+Database+Authentication+Tutorial "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F22%2Fcas51-dbauthn-tutorial%2F&t=CAS+5+Database+Authentication+Tutorial "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # On The Theory of Possibility – Apereo Community Blog On The Theory of Possibility ============================ Saturday, Feb 18, 2017 1 minute read If you are a member of an open source community and have been developing, designing and maintaining open source code for some time, it is very likely that from time to time you may encounter requests, comments and questions such as this: > We are starting with our deployment of \[insert-name\]. One of our major requirements is that once the user logs into the application, a request via our own very special protocol is submitted to his/her automobile to schedule a job with the vehicle’s IOT system to start up the A/C in 8 hours. When the user finishes work in a typical 8-hour work day, he/she can very comfortably get back into the car that is prepped with an exact and very personalized degree of temperature for all seasons. We’d also like the timespan to be configurable. Oh, we also use Active Directory. So far, very cool. Exciting, rather. I wonder if we could also automatically submit an order to Pizza Hut to deliver a large Hawaiian pizza to the user’s residence. That would be sweet. The post follows: > Is it possible? > > If not, are there plans to support this? I don’t know about you, dear reader, but I posit that there is virtually nothing in life that is impossible. My half serious reaction, in my head, usually is something along the lines of the following: > Dear \[insert-name\], > > All things are possible in open source. > > 4000 hours. > > Regards, Some things, however, are improbable \[1\]. [Misagh Moayyed](https://fawnoos.com/) _\[1\]There is no such thing as a ‘plan’. Just a pending pull request._ Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=On+The+Theory+of+Possibility&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&title=On+The+Theory+of+Possibility "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&title=On+The+Theory+of+Possibility "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&name=On+The+Theory+of+Possibility "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&title=On+The+Theory+of+Possibility "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&title=On+The+Theory+of+Possibility "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F18%2Fonthe-theoryof-possibility%2F&t=On+The+Theory+of+Possibility "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6.1.x - Credential Caching & Proxy AuthN – Apereo Community Blog Apereo CAS 6.1.x - Credential Caching & Proxy AuthN =================================================== Monday, Mar 25, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/03/25/cas61x-clearpass-pgt-attributes/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN&url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&title=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&title=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&name=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&title=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&title=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F25%2Fcas61x-clearpass-pgt-attributes%2F&t=Apereo+CAS+6.1.x+-+Credential+Caching+%26+Proxy+AuthN "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Release Notes Moved – Apereo Community Blog CAS Release Notes Moved ======================= Thursday, Jul 2, 2020 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Apereo CAS release notes will no longer be published on this blog. Instead, they have moved over to the CAS official site and will be available at [https://apereo.github.io/cas/development/release\_notes](https://apereo.github.io/cas/development/release_notes/Overview.html) . This change will be effective for CAS `6.3.x` and all other upcoming versions. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Release+Notes+Moved&url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&title=CAS+Release+Notes+Moved "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&title=CAS+Release+Notes+Moved "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&name=CAS+Release+Notes+Moved "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&title=CAS+Release+Notes+Moved "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&title=CAS+Release+Notes+Moved "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F02%2Fcas-release-notes%2F&t=CAS+Release+Notes+Moved "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Deploying Apereo CAS Behind a Proxy – Apereo Community Blog Deploying Apereo CAS Behind a Proxy =================================== Friday, Jan 5, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/01/05/cas-deployment-with-proxy/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Deploying+Apereo+CAS+Behind+a+Proxy&url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&title=Deploying+Apereo+CAS+Behind+a+Proxy "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&title=Deploying+Apereo+CAS+Behind+a+Proxy "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&name=Deploying+Apereo+CAS+Behind+a+Proxy "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&title=Deploying+Apereo+CAS+Behind+a+Proxy "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&title=Deploying+Apereo+CAS+Behind+a+Proxy "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F05%2Fcas-deployment-with-proxy%2F&t=Deploying+Apereo+CAS+Behind+a+Proxy "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Multifactor Authentication with Duo Security – Apereo Community Blog CAS Multifactor Authentication with Duo Security ================================================ Monday, Jan 8, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/01/08/cas-mfa-duosecurity/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Multifactor+Authentication+with++Duo+Security&url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&title=CAS+Multifactor+Authentication+with++Duo+Security "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&title=CAS+Multifactor+Authentication+with++Duo+Security "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&name=CAS+Multifactor+Authentication+with++Duo+Security "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&title=CAS+Multifactor+Authentication+with++Duo+Security "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&title=CAS+Multifactor+Authentication+with++Duo+Security "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F01%2F08%2Fcas-mfa-duosecurity%2F&t=CAS+Multifactor+Authentication+with++Duo+Security "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Attribute-based Application Authorization – Apereo Community Blog Apereo CAS - Attribute-based Application Authorization ====================================================== Tuesday, Feb 20, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/02/20/cas-service-rbac-attributeresolution/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Attribute-based+Application+Authorization&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&title=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&title=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&name=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&title=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&title=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fcas-service-rbac-attributeresolution%2F&t=Apereo+CAS+-+Attribute-based+Application+Authorization "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Dances with Protocols – Apereo Community Blog Apereo CAS - Dances with Protocols ================================== Monday, Feb 26, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/02/26/cas-delegation-protocols/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Dances+with+Protocols&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&title=Apereo+CAS+-+Dances+with+Protocols "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&title=Apereo+CAS+-+Dances+with+Protocols "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&name=Apereo+CAS+-+Dances+with+Protocols "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&title=Apereo+CAS+-+Dances+with+Protocols "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&title=Apereo+CAS+-+Dances+with+Protocols "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fcas-delegation-protocols%2F&t=Apereo+CAS+-+Dances+with+Protocols "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS Best [Mal]Practice - Supercharged Overlays – Apereo Community Blog Apereo CAS Best \[Mal\]Practice - Supercharged Overlays ======================================================= Sunday, Apr 1, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/04/01/cas-overlays-supercharged/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&title=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&title=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&name=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&title=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&title=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F01%2Fcas-overlays-supercharged%2F&t=Apereo+CAS+Best+%5BMal%5DPractice+-+Supercharged+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Test-Driving Feature Modules – Apereo Community Blog Apereo CAS - Test-Driving Feature Modules ========================================= Thursday, Apr 5, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/04/05/cas-codebase-feature-build/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Test-Driving+Feature+Modules&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&title=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&title=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&name=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&title=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&title=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F05%2Fcas-codebase-feature-build%2F&t=Apereo+CAS+-+Test-Driving+Feature+Modules "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Linking Accounts with Delegated Authentication – Apereo Community Blog Apereo CAS - Linking Accounts with Delegated Authentication =========================================================== Friday, Apr 20, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/04/20/cas-delegated-authn-account-linking/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&title=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&title=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&name=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&title=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&title=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fcas-delegated-authn-account-linking%2F&t=Apereo+CAS+-+Linking+Accounts+with+Delegated+Authentication "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Access Strategy External URL Redirects – Apereo Community Blog Apereo CAS - Access Strategy External URL Redirects =================================================== Monday, Apr 23, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/04/23/cas-access-strategy-url-redirects/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Access+Strategy+External+URL+Redirects&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&title=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&title=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&name=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&title=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&title=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F23%2Fcas-access-strategy-url-redirects%2F&t=Apereo+CAS+-+Access+Strategy+External+URL+Redirects "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Handling Multiple Logout URLs – Apereo Community Blog Apereo CAS - Handling Multiple Logout URLs ========================================== Tuesday, Apr 24, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/04/24/cas-multiple-logout-urls/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Handling+Multiple+Logout+URLs&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&title=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&title=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&name=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&title=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&title=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F24%2Fcas-multiple-logout-urls%2F&t=Apereo+CAS+-+Handling+Multiple+Logout+URLs "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Customized Settings – Apereo Community Blog Apereo CAS - Customized Settings ================================ Friday, May 4, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/05/04/cas-custom-properties/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Customized+Settings&url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&title=Apereo+CAS+-+Customized+Settings "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&title=Apereo+CAS+-+Customized+Settings "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&name=Apereo+CAS+-+Customized+Settings "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&title=Apereo+CAS+-+Customized+Settings "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&title=Apereo+CAS+-+Customized+Settings "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F04%2Fcas-custom-properties%2F&t=Apereo+CAS+-+Customized+Settings "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Identity Impersonation – Apereo Community Blog Apereo CAS - Identity Impersonation =================================== Monday, May 7, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/05/07/cas-impersonation-authn/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Identity+Impersonation&url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&title=Apereo+CAS+-+Identity+Impersonation "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&title=Apereo+CAS+-+Identity+Impersonation "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&name=Apereo+CAS+-+Identity+Impersonation "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&title=Apereo+CAS+-+Identity+Impersonation "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&title=Apereo+CAS+-+Identity+Impersonation "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F07%2Fcas-impersonation-authn%2F&t=Apereo+CAS+-+Identity+Impersonation "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.3.x Deployment - WAR Overlays – Apereo Community Blog CAS 5.3.x Deployment - WAR Overlays =================================== Saturday, Jun 9, 2018 1 minute read This post is relocated to [here](https://fawnoos.com/2018/06/09/cas53-gettingstarted-overlay/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.3.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&title=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&title=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&name=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&title=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&title=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F09%2Fcas53-gettingstarted-overlay%2F&t=CAS+5.3.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Multifactor Authentication with Google Authenticator – Apereo Community Blog CAS Multifactor Authentication with Google Authenticator ======================================================== Sunday, Jun 10, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/10/cas-mfa-google-authenticator/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Multifactor+Authentication+with+Google+Authenticator&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&title=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&title=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&name=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&title=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&title=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-mfa-google-authenticator%2F&t=CAS+Multifactor+Authentication+with+Google+Authenticator "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - User Interface Customizations – Apereo Community Blog Apereo CAS - User Interface Customizations ========================================== Sunday, Jun 10, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/10/cas-userinterface-customizations/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+User+Interface+Customizations&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&title=Apereo+CAS+-+User+Interface+Customizations "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&title=Apereo+CAS+-+User+Interface+Customizations "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&name=Apereo+CAS+-+User+Interface+Customizations "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&title=Apereo+CAS+-+User+Interface+Customizations "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&title=Apereo+CAS+-+User+Interface+Customizations "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F10%2Fcas-userinterface-customizations%2F&t=Apereo+CAS+-+User+Interface+Customizations "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Custom Authentication & Attribute Sources – Apereo Community Blog Apereo CAS - Custom Authentication & Attribute Sources ====================================================== Tuesday, Jun 12, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/12/cas53-authn-handlers/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&title=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&title=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&name=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&title=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&title=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F12%2Fcas53-authn-handlers%2F&t=Apereo+CAS+-+Custom+Authentication+%26+Attribute+Sources "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Administrative Endpoints & Monitoring – Apereo Community Blog Apereo CAS - Administrative Endpoints & Monitoring ================================================== Friday, Jun 15, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/15/cas53-admin-endpoints-security/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&title=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&title=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&name=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&title=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&title=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F15%2Fcas53-admin-endpoints-security%2F&t=Apereo+CAS+-+Administrative+Endpoints+%26+Monitoring "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Extending Webflows – Apereo Community Blog Apereo CAS - Extending Webflows =============================== Tuesday, Jun 19, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/19/cas53webflow-extensions/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Extending+Webflows&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&title=Apereo+CAS+-+Extending+Webflows "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&title=Apereo+CAS+-+Extending+Webflows "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&name=Apereo+CAS+-+Extending+Webflows "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&title=Apereo+CAS+-+Extending+Webflows "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&title=Apereo+CAS+-+Extending+Webflows "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F19%2Fcas53webflow-extensions%2F&t=Apereo+CAS+-+Extending+Webflows "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS Swag with Swagger – Apereo Community Blog Apereo CAS Swag with Swagger ============================ Tuesday, Jul 24, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/07/24/cas-apis-swagger/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+Swag+with+Swagger&url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&title=Apereo+CAS+Swag+with+Swagger "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&title=Apereo+CAS+Swag+with+Swagger "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&name=Apereo+CAS+Swag+with+Swagger "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&title=Apereo+CAS+Swag+with+Swagger "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&title=Apereo+CAS+Swag+with+Swagger "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F24%2Fcas-apis-swagger%2F&t=Apereo+CAS+Swag+with+Swagger "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS Delegated Authentication with ADFS – Apereo Community Blog Apereo CAS Delegated Authentication with ADFS ============================================= Tuesday, Jul 31, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/07/31/cas6-delegated-authn-adfs/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+Delegated+Authentication+with+ADFS&url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&title=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&title=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&name=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&title=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&title=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F31%2Fcas6-delegated-authn-adfs%2F&t=Apereo+CAS+Delegated+Authentication+with+ADFS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Authentication Lifecycle Phases – Apereo Community Blog Apereo CAS - Authentication Lifecycle Phases ============================================ Thursday, Aug 23, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/08/23/cas5-authn-lifecycle-extensions/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Authentication+Lifecycle+Phases&url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&title=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&title=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&name=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&title=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&title=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F23%2Fcas5-authn-lifecycle-extensions%2F&t=Apereo+CAS+-+Authentication+Lifecycle+Phases "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - MaxMind Geo2IP ISP Integration – Apereo Community Blog Apereo CAS - MaxMind Geo2IP ISP Integration =========================================== Monday, Aug 27, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/08/27/cas5-maxmind-isp-interrupt-integration/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&title=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&title=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&name=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&title=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&title=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F27%2Fcas5-maxmind-isp-interrupt-integration%2F&t=Apereo+CAS+-+MaxMind+Geo2IP+ISP+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Effective Software Troubleshooting Tactics – Apereo Community Blog Effective Software Troubleshooting Tactics ========================================== Wednesday, Sep 5, 2018 1 minute read This post is relocated to [here](https://fawnoos.com/2018/09/05/effective-diagnostics/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Effective+Software+Troubleshooting+Tactics&url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&title=Effective+Software+Troubleshooting+Tactics "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&title=Effective+Software+Troubleshooting+Tactics "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&name=Effective+Software+Troubleshooting+Tactics "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&title=Effective+Software+Troubleshooting+Tactics "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&title=Effective+Software+Troubleshooting+Tactics "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F05%2Feffective-diagnostics%2F&t=Effective+Software+Troubleshooting+Tactics "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Multifactor Authentication with RADIUS – Apereo Community Blog Apereo CAS - Multifactor Authentication with RADIUS =================================================== Thursday, Oct 18, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/18/cas5-radius-mfa-authn/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&title=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&title=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&name=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&title=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&title=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F18%2Fcas5-radius-mfa-authn%2F&t=Apereo+CAS+-+Multifactor+Authentication+with+RADIUS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Fun with HashiCorp Consul – Apereo Community Blog Apereo CAS - Fun with HashiCorp Consul ====================================== Monday, Oct 22, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/22/cas6-consul-discovery/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Fun+with+HashiCorp+Consul&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&title=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&title=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&name=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&title=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&title=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-consul-discovery%2F&t=Apereo+CAS+-+Fun+with+HashiCorp+Consul "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Spring Boot Admin Integration – Apereo Community Blog Apereo CAS - Spring Boot Admin Integration ========================================== Monday, Oct 22, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/22/cas6-springboot-admin-server/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Spring+Boot+Admin+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&title=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&title=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&name=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&title=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&title=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F22%2Fcas6-springboot-admin-server%2F&t=Apereo+CAS+-+Spring+Boot+Admin+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Integration with Spring Cloud Config Server – Apereo Community Blog Apereo CAS - Integration with Spring Cloud Config Server ======================================================== Thursday, Oct 25, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/25/cas6-cloud-config-server/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&title=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&title=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&name=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&title=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&title=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fcas6-cloud-config-server%2F&t=Apereo+CAS+-+Integration+with+Spring+Cloud+Config+Server "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Integration with HashiCorp Vault – Apereo Community Blog Apereo CAS - Integration with HashiCorp Vault ============================================= Tuesday, Oct 30, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/30/cas6-configuration-vault/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Integration+with+HashiCorp+Vault&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&title=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&title=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&name=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&title=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&title=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F30%2Fcas6-configuration-vault%2F&t=Apereo+CAS+-+Integration+with+HashiCorp+Vault "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Configuration Management with MongoDb – Apereo Community Blog Apereo CAS - Configuration Management with MongoDb ================================================== Wednesday, Oct 31, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/10/31/cas6-configuration-mongodb/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Configuration+Management+with+MongoDb&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&title=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&title=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&name=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&title=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&title=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F31%2Fcas6-configuration-mongodb%2F&t=Apereo+CAS+-+Configuration+Management+with+MongoDb "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Slurp Configuration with Groovy – Apereo Community Blog Apereo CAS - Slurp Configuration with Groovy ============================================ Friday, Nov 2, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/11/02/cas6-groovy-config-slurper/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Slurp+Configuration+with+Groovy&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&title=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&title=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&name=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&title=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&title=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F02%2Fcas6-groovy-config-slurper%2F&t=Apereo+CAS+-+Slurp+Configuration+with+Groovy "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SAML2 Metadata with MongoDb – Apereo Community Blog Apereo CAS - SAML2 Metadata with MongoDb ======================================== Saturday, Nov 3, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/11/03/cas6-saml2-metadata-mongodb/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SAML2+Metadata+with+MongoDb&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&title=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&title=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&name=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&title=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&title=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F03%2Fcas6-saml2-metadata-mongodb%2F&t=Apereo+CAS+-+SAML2+Metadata+with+MongoDb "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6 - Administrative Endpoints & Monitoring – Apereo Community Blog Apereo CAS 6 - Administrative Endpoints & Monitoring ==================================================== Tuesday, Nov 6, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/11/06/cas6-admin-endpoints-security/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&title=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&title=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&name=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&title=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&title=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F06%2Fcas6-admin-endpoints-security%2F&t=Apereo+CAS+6+-+Administrative+Endpoints+%26+Monitoring "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Jib at CAS Docker Images – Apereo Community Blog Apereo CAS - Jib at CAS Docker Images ===================================== Friday, Nov 9, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/11/09/cas6-docker-jib/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Jib+at+CAS+Docker+Images&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&title=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&title=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&name=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&title=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&title=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F09%2Fcas6-docker-jib%2F&t=Apereo+CAS+-+Jib+at+CAS+Docker+Images "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.0.x Deployment - WAR Overlays – Apereo Community Blog CAS 6.0.x Deployment - WAR Overlays =================================== Friday, Nov 16, 2018 1 minute read This post is relocated to [here](https://fawnoos.com/2018/11/16/cas60-gettingstarted-overlay/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.0.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&title=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&title=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&name=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&title=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&title=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F16%2Fcas60-gettingstarted-overlay%2F&t=CAS+6.0.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6.0.x - Building CAS Feature Modules – Apereo Community Blog Apereo CAS 6.0.x - Building CAS Feature Modules =============================================== Tuesday, Nov 20, 2018 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/11/20/cas60x-codebase-feature-build/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&title=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&title=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&name=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&title=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&title=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F20%2Fcas60x-codebase-feature-build%2F&t=Apereo+CAS+6.0.x+-+Building+CAS+Feature+Modules "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Have you been pawned? – Apereo Community Blog Apereo CAS - Have you been pawned? ================================== Sunday, Jan 6, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/01/06/cas61-groovy-haveibeenpawned/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Have+you+been+pawned%3F&url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&title=Apereo+CAS+-+Have+you+been+pawned%3F "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&title=Apereo+CAS+-+Have+you+been+pawned%3F "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&name=Apereo+CAS+-+Have+you+been+pawned%3F "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&title=Apereo+CAS+-+Have+you+been+pawned%3F "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&title=Apereo+CAS+-+Have+you+been+pawned%3F "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F06%2Fcas61-groovy-haveibeenpawned%2F&t=Apereo+CAS+-+Have+you+been+pawned%3F "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.x Deployment - WAR Overlays – Apereo Community Blog CAS 6.1.x Deployment - WAR Overlays =================================== Monday, Jan 7, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/01/07/cas61-gettingstarted-overlay/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&title=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&title=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&name=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&title=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&title=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F07%2Fcas61-gettingstarted-overlay%2F&t=CAS+6.1.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SAML2 Identity Provider Integration w/ InCommon – Apereo Community Blog Apereo CAS - SAML2 Identity Provider Integration w/ InCommon ============================================================ Friday, Jan 18, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/01/18/cas61-saml2-idp-incommon/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon&url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&name=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F01%2F18%2Fcas61-saml2-idp-incommon%2F&t=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+InCommon "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Keeping Healthy with Spring Boot – Apereo Community Blog Apereo CAS - Keeping Healthy with Spring Boot ============================================= Thursday, Feb 7, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/02/07/cas61-healthstatus-springboot/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&title=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&title=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&name=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&title=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&title=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F07%2Fcas61-healthstatus-springboot%2F&t=Apereo+CAS+-+Keeping+Healthy+with+Spring+Boot "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Custom Login Fields w/ Dynamic Bindings – Apereo Community Blog Apereo CAS - Custom Login Fields w/ Dynamic Bindings ==================================================== Monday, Feb 25, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/02/25/cas61-custom-login-fields/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&title=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&title=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&name=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&title=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&title=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-custom-login-fields%2F&t=Apereo+CAS+-+Custom+Login+Fields+w%2F+Dynamic+Bindings "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Delegated Authentication to SAML2 Identity Providers – Apereo Community Blog Apereo CAS - Delegated Authentication to SAML2 Identity Providers ================================================================= Monday, Feb 25, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/02/25/cas61-delegate-authn-saml2-idp/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&title=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&title=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&name=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&title=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&title=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F25%2Fcas61-delegate-authn-saml2-idp%2F&t=Apereo+CAS+-+Delegated+Authentication+to+SAML2+Identity+Providers "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Riffing on Attribute Release Policies – Apereo Community Blog Apereo CAS - Riffing on Attribute Release Policies ================================================== Wednesday, Feb 27, 2019 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/02/27/cas61-attribute-release-policies/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&title=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&title=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&name=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&title=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&title=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F27%2Fcas61-attribute-release-policies%2F&t=Apereo+CAS+-+Riffing+on+Attribute+Release+Policies "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6.1.x - Building CAS Feature Modules – Apereo Community Blog Apereo CAS 6.1.x - Building CAS Feature Modules =============================================== Tuesday, Mar 12, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/03/12/cas61x-codebase-feature-build/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules&url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&title=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&title=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&name=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&title=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&title=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F12%2Fcas61x-codebase-feature-build%2F&t=Apereo+CAS+6.1.x+-+Building+CAS+Feature+Modules "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 6.1.x - Attribute Repositories w/ Person Directory – Apereo Community Blog Apereo CAS 6.1.x - Attribute Repositories w/ Person Directory ============================================================= Friday, Mar 15, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/03/15/cas61x-attribute-repositories/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory&url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&title=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&title=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&name=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&title=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&title=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F15%2Fcas61x-attribute-repositories%2F&t=Apereo+CAS+6.1.x+-+Attribute+Repositories+w%2F+Person+Directory "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SAML2 Metadata Query Protocol – Apereo Community Blog Apereo CAS - SAML2 Metadata Query Protocol ========================================== Friday, Apr 12, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/04/12/cas61x-saml-idp-mdq/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SAML2+Metadata+Query+Protocol&url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&title=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&title=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&name=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&title=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&title=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F12%2Fcas61x-saml-idp-mdq%2F&t=Apereo+CAS+-+SAML2+Metadata+Query+Protocol "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Webflow Decorations – Apereo Community Blog Apereo CAS - Webflow Decorations ================================ Thursday, Apr 25, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/04/25/cas61x-webflow-decorations/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Webflow+Decorations&url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&title=Apereo+CAS+-+Webflow+Decorations "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&title=Apereo+CAS+-+Webflow+Decorations "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&name=Apereo+CAS+-+Webflow+Decorations "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&title=Apereo+CAS+-+Webflow+Decorations "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&title=Apereo+CAS+-+Webflow+Decorations "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F25%2Fcas61x-webflow-decorations%2F&t=Apereo+CAS+-+Webflow+Decorations "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Configuration Security w/ Jasypt – Apereo Community Blog Apereo CAS - Configuration Security w/ Jasypt ============================================= Wednesday, May 8, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/05/08/cas61x-jasypt-encryption/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt&url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&title=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&title=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&name=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&title=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&title=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F08%2Fcas61x-jasypt-encryption%2F&t=Apereo+CAS+-+Configuration+Security+w%2F+Jasypt "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Dockerized Hazelcast Deployments – Apereo Community Blog Apereo CAS - Dockerized Hazelcast Deployments ============================================= Monday, May 13, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/05/13/cas61x-docker-hazelcast-mgmtcenter/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Dockerized+Hazelcast+Deployments&url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&title=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&title=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&name=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&title=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&title=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-docker-hazelcast-mgmtcenter%2F&t=Apereo+CAS+-+Dockerized+Hazelcast+Deployments "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Multifactor Provider Selection – Apereo Community Blog Apereo CAS - Multifactor Provider Selection =========================================== Monday, May 13, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/05/13/cas61x-mfa-selection-strategies/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Multifactor+Provider+Selection&url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&title=Apereo+CAS+-+Multifactor+Provider+Selection "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&title=Apereo+CAS+-+Multifactor+Provider+Selection "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&name=Apereo+CAS+-+Multifactor+Provider+Selection "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&title=Apereo+CAS+-+Multifactor+Provider+Selection "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&title=Apereo+CAS+-+Multifactor+Provider+Selection "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F05%2F13%2Fcas61x-mfa-selection-strategies%2F&t=Apereo+CAS+-+Multifactor+Provider+Selection "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - REST API Integrations – Apereo Community Blog Apereo CAS - REST API Integrations ================================== Wednesday, Jun 12, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/06/12/cas61x-rest-api/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+REST+API+Integrations&url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&title=Apereo+CAS+-+REST+API+Integrations "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&title=Apereo+CAS+-+REST+API+Integrations "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&name=Apereo+CAS+-+REST+API+Integrations "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&title=Apereo+CAS+-+REST+API+Integrations "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&title=Apereo+CAS+-+REST+API+Integrations "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F12%2Fcas61x-rest-api%2F&t=Apereo+CAS+-+REST+API+Integrations "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Are We Logged In Yet? – Apereo Community Blog Apereo CAS - Are We Logged In Yet? ================================== Friday, Jun 14, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/06/14/cas53x-userlogin-ssostatus/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Are+We+Logged+In+Yet%3F&url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&title=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&title=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&name=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&title=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&title=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F14%2Fcas53x-userlogin-ssostatus%2F&t=Apereo+CAS+-+Are+We+Logged+In+Yet%3F "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Handling Authentication Webflow Errors with Grace – Apereo Community Blog Apereo CAS - Handling Authentication Webflow Errors with Grace ============================================================== Tuesday, Jul 2, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/07/02/cas61x-error-handling/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace&url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&title=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&title=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&name=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&title=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&title=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F02%2Fcas61x-error-handling%2F&t=Apereo+CAS+-+Handling+Authentication+Webflow+Errors+with+Grace "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Passwordless Authentication – Apereo Community Blog Apereo CAS - Passwordless Authentication ======================================== Thursday, Jul 18, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/07/18/cas61x-passwordless-authn/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Passwordless+Authentication&url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&title=Apereo+CAS+-+Passwordless+Authentication "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&title=Apereo+CAS+-+Passwordless+Authentication "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&name=Apereo+CAS+-+Passwordless+Authentication "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&title=Apereo+CAS+-+Passwordless+Authentication "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&title=Apereo+CAS+-+Passwordless+Authentication "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F07%2F18%2Fcas61x-passwordless-authn%2F&t=Apereo+CAS+-+Passwordless+Authentication "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SMS Notifications via Twilio – Apereo Community Blog Apereo CAS - SMS Notifications via Twilio ========================================= Friday, Sep 20, 2019 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2019/09/20/cas61x-smsconfig-twilio/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SMS+Notifications+via+Twilio&url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&title=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&title=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&name=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&title=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&title=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F20%2Fcas61x-smsconfig-twilio%2F&t=Apereo+CAS+-+SMS+Notifications+via+Twilio "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Ticket Distribution with JMS – Apereo Community Blog Apereo CAS - Ticket Distribution with JMS ========================================= Monday, Sep 30, 2019 1 minute read This post is relocated to [here](https://fawnoos.com/2019/09/30/cas61x-jms-activemq-ticketing/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Ticket+Distribution+with+JMS&url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&title=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&title=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&name=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&title=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&title=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F30%2Fcas61x-jms-activemq-ticketing%2F&t=Apereo+CAS+-+Ticket+Distribution+with+JMS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Extending CAS 5 Webflows – Apereo Community Blog Extending CAS 5 Webflows ======================== Saturday, Oct 7, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2018/06/19/cas53webflow-extensions/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Extending+CAS+5+Webflows&url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&title=Extending+CAS+5+Webflows "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&title=Extending+CAS+5+Webflows "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&name=Extending+CAS+5+Webflows "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&title=Extending+CAS+5+Webflows "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&title=Extending+CAS+5+Webflows "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F07%2Fwebflow-extcfg%2F&t=Extending+CAS+5+Webflows "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Stop Writing Code – Apereo Community Blog Stop Writing Code ================= Sunday, Sep 10, 2017 1 minute read This post is relocated to [here](https://fawnoos.com/2017/09/10/stop-writing-code/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Stop+Writing+Code&url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&title=Stop+Writing+Code "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&title=Stop+Writing+Code "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&name=Stop+Writing+Code "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&title=Stop+Writing+Code "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&title=Stop+Writing+Code "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F10%2Fstop-writing-code%2F&t=Stop+Writing+Code "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # JWT Of All Things With CAS – Apereo Community Blog JWT Of All Things With CAS ========================== Tuesday, Oct 17, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/10/17/cas-jwt-authn-with-duo/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=JWT+Of+All+Things+With+CAS&url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&title=JWT+Of+All+Things+With+CAS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&title=JWT+Of+All+Things+With+CAS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&name=JWT+Of+All+Things+With+CAS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&title=JWT+Of+All+Things+With+CAS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&title=JWT+Of+All+Things+With+CAS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F17%2Fcas-jwt-authn-with-duo%2F&t=JWT+Of+All+Things+With+CAS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Multitenancy With CAS – Apereo Community Blog Multitenancy With CAS ===================== Monday, Oct 23, 2017 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/10/23/cas-multitenancy/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Multitenancy+With+CAS&url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&title=Multitenancy+With+CAS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&title=Multitenancy+With+CAS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&name=Multitenancy+With+CAS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&title=Multitenancy+With+CAS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&title=Multitenancy+With+CAS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F23%2Fcas-multitenancy%2F&t=Multitenancy+With+CAS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Introduction to CAS Commandline Shell – Apereo Community Blog Introduction to CAS Commandline Shell ===================================== Monday, Oct 30, 2017 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/10/30/intro-cas-cli-shell/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Introduction+to+CAS+Commandline+Shell&url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&title=Introduction+to+CAS+Commandline+Shell "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&title=Introduction+to+CAS+Commandline+Shell "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&name=Introduction+to+CAS+Commandline+Shell "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&title=Introduction+to+CAS+Commandline+Shell "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&title=Introduction+to+CAS+Commandline+Shell "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F30%2Fintro-cas-cli-shell%2F&t=Introduction+to+CAS+Commandline+Shell "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS SAML Integration With ADFS – Apereo Community Blog Apereo CAS SAML Integration With ADFS ===================================== Wednesday, Nov 22, 2017 1 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/11/22/cas-saml-integration-adfs/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+SAML+Integration+With+ADFS&url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&title=Apereo+CAS+SAML+Integration+With+ADFS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&title=Apereo+CAS+SAML+Integration+With+ADFS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&name=Apereo+CAS+SAML+Integration+With+ADFS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&title=Apereo+CAS+SAML+Integration+With+ADFS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&title=Apereo+CAS+SAML+Integration+With+ADFS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F11%2F22%2Fcas-saml-integration-adfs%2F&t=Apereo+CAS+SAML+Integration+With+ADFS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Do State The Obvious – Apereo Community Blog Do State The Obvious ==================== Wednesday, Sep 13, 2017 1 minute read ![](http://assets.amuniversal.com/2d9dac40554801363c91005056a9545d) If you are into open source and a bit of a neophiliac when it comes to discovering new software, chances are you have read something akin to the following statements etched proudly at the top of some project’s README on GitHub: > Yo! X helps you write applications that behave consistently, run in different environments, and are easy to test. It is fast, simple, reliable with zero-overhead production readiness and nada ceremony. You know why? Because sometimes people wake up in the morning and ask themselves: “What shall I do today? Oh, I know! I shall design a framework that forces applications to behave terribly inconsistent and of course, they must all run in the same exact environment down to the kilobyte level. Not only the application must be crap to test but it must be slow, Lost-The-TV-Show-level convoluted with so much overhead that once you’re done with production, you will yourself wholeheartedly finance a “Thank the Gods for we are forever done with this junk” ceremony. Yes. Yes. That happens, which is why projects need to explicitly state the obvious opposite. Seriously\[?\], [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Do+State+The+Obvious&url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&title=Do+State+The+Obvious "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&title=Do+State+The+Obvious "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&name=Do+State+The+Obvious "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&title=Do+State+The+Obvious "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&title=Do+State+The+Obvious "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F13%2Fefficient-marketing-intech%2F&t=Do+State+The+Obvious "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5 - Maintaining Protocol Compatibility – Apereo Community Blog CAS 5 - Maintaining Protocol Compatibility ========================================== Friday, Jun 23, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/06/23/cas-protocol-compatibility/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5+-+Maintaining+Protocol+Compatibility&url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&title=CAS+5+-+Maintaining+Protocol+Compatibility "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&title=CAS+5+-+Maintaining+Protocol+Compatibility "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&name=CAS+5+-+Maintaining+Protocol+Compatibility "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&title=CAS+5+-+Maintaining+Protocol+Compatibility "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&title=CAS+5+-+Maintaining+Protocol+Compatibility "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F23%2Fcas-protocol-compatibility%2F&t=CAS+5+-+Maintaining+Protocol+Compatibility "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5 SAML2 Delegated AuthN Tutorial – Apereo Community Blog CAS 5 SAML2 Delegated AuthN Tutorial ==================================== Wednesday, Mar 22, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/03/22/cas51-delauthn-tutorial/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5+SAML2+Delegated+AuthN+Tutorial&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&title=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&title=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&name=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&title=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&title=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F22%2Fcas51-delauthn-tutorial%2F&t=CAS+5+SAML2+Delegated+AuthN+Tutorial "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.0.x Integration w/ Apache ZooKeeper – Apereo Community Blog CAS 5.0.x Integration w/ Apache ZooKeeper ========================================= Sunday, Apr 30, 2017 1 minute read **Contributed Content** Giovanni Morelli (Email: giannimorell at gmail.com, Github: @GiovanniMorelli) was kind enough to share this guide. I have created a `cas-server-core-configuration-cloud-zookeeper` module for CAS `5.0.4` based on `cas-server-core-configuration-cloud-mongo` When CAS is started, it reads all properties under zookeeper’s path: `/cas/config/cas` without the need to configure `cas.properties`. The project source code is [available here](https://drive.google.com/file/d/0B984z5r9uFKgR3dNa3JIbm1lRnM/view) . Configuration ============= * Add parameter `cas.spring.cloud.zookeeper.uri=localhost:2181` in `bootstrap.properties` * Add configurations on Zookeeper. Example: `cas.server.name: https://localhost:9327` * Start CAS. Build ===== Download the codebase for CAS `5.0.4` first and add the project source code into the `core` directory. Make the following changes: * `settings.gradle` (Root project) * Add `include "core:cas-server-core-configuration-cloud-zookeeper"` * `gradle.properties` (Root project) * Update version zookeeper : `zookeeperVersion=3.4.10` * Add `springCloudZookeeperVersion=1.0.4.RELEASE` * `build.gradle` (into project `cas-server-core-configuration-cloud-zookeeper`) description = "Apereo CAS Core Configuration - Zookeeper" dependencies { compile libraries.springboot compile libraries.spring compile libraries.springcloud compile libraries.zookeeper } Classes used in the ZooKeeper project: /cas-server-core-configuration-cloud-zookeeper/src/main/java/org/apereo/cas/ZookeeperPropertySource.java /cas-server-core-configuration-cloud-zookeeper/src/main/java/org/apereo/cas/ZookeeperPropertySourceLocator.java /cas-server-core-configuration-cloud-zookeeper/src/main/java/org/apereo/cas/config/ZookeeperCloudConfigBootstrapConfiguration.java Build the codebase with `gradlew clean build --parallel -x test -x javadoc -x check`. Overlay ======= Add this configuration in `pom.xml`: org.apereo.cas cas-server-core-configuration-cloud-zookeeper ${cas.version} TODO ==== * When you add a new configuration to Zookeeper, reload the configuration property automatically in CAS. Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper&url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&title=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&title=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&name=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&title=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&title=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F30%2Fcas50-zookeepercfg%2F&t=CAS+5.0.x+Integration+w%2F+Apache+ZooKeeper "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Interrupt CAS With Class – Apereo Community Blog Interrupt CAS With Class ======================== Wednesday, Aug 30, 2017 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post is relocated to [here](https://fawnoos.com/2017/08/30/cas-loginflow-interrupt/) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Interrupt+CAS+With+Class&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&title=Interrupt+CAS+With+Class "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&title=Interrupt+CAS+With+Class "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&name=Interrupt+CAS+With+Class "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&title=Interrupt+CAS+With+Class "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&title=Interrupt+CAS+With+Class "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fcas-loginflow-interrupt%2F&t=Interrupt+CAS+With+Class "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # August 2017 uPortal Slack summary – Apereo Community Blog August 2017 uPortal Slack summary ================================= Tuesday, Sep 26, 2017 1 minute read In August 2017, 2 people participated substantially in conversation in the [slack.apereo.org #uportal channel](https://apereo.slack.com/messages/C0MNUQDN3/) . (This is around one fifth as many participants as in June.) * Andrew Petro * Christian Murphy Conversation highlights include: * Raising awareness of an initial pass at implementing GitLocalize for internationalizing uPortal documentation c.f. [uportal-dev@ thread](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/Jh5emWPXnHA/discussion) . * Raising awareness of a branch freeze for the uPortal 4.3.2 release c.f. [uportal-dev@ thread](https://groups.google.com/a/apereo.org/d/msg/uportal-dev/ivPu41wyBJU/Cw0ANuOgBQAJ) . * Raising awareness of [a new GitHub feature for embedding code snippets](https://github.com/blog/2415-introducing-embedded-code-snippets) . * Raising awareness of a one liner for re-building and re-deploying skins in uPortal 5 ( `./gradlew tomcatStop overlays:uPortal:clean overlays:uPortal:tomcatDeploy tomcatStart` ) * Raising awareness of [a tool for trying whether WIP code will pass Travis CI](https://github.com/SethMichaelLarson/trytravis) without needing to push. On Slack -------- I have [concerns about the openness properties of Slack as implemented by Apereo](https://groups.google.com/a/apereo.org/d/msg/open/cbk9NLb43LQ/btRpD_09AwAJ) . * You can’t access it anonymously. * It’s not Google search indexed. * Older messages aren’t available even if you log in. Summarizing the conversations here on `apereo.github.io` in this anonymously, publicly accessible, and Google-indexable context somewhat mitigates these problems. But not necessarily other problems that make [email list communications preferable in open source projects](https://dave.cheney.net/2017/04/11/why-slack-is-inappropriate-for-open-source-communications) . Arguably, all of the conversations held in the `#uportal` Slack channel could have been held via email on `uportal-dev@` or `uportal-user@` email lists additionally or instead. Some relevant email list threads are linked above. For myself, I’m convinced that we just shouldn’t use Slack in the Apereo uPortal project. Use the email lists. Possibly look to implementing Discourse for better discussion forums / “email lists”. See also -------- * [June 2017 uPortal Slack summary](https://apereo.github.io/2017/07/05/uportal-slack-summary/) (~11 participants) * [July 2017 uPortal Slack summary](https://apereo.github.io/2017/08/02/july-2017-uportal-slack-summary/) (~5 participants) \-[Andrew](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=August+2017+uPortal+Slack+summary&url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&title=August+2017+uPortal+Slack+summary "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&title=August+2017+uPortal+Slack+summary "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&name=August+2017+uPortal+Slack+summary "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&title=August+2017+uPortal+Slack+summary "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&title=August+2017+uPortal+Slack+summary "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F26%2FAugust-2017-uportal-slack-summary%2F&t=August+2017+uPortal+Slack+summary "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Changes to CAS Security Vulnerability Response – Apereo Community Blog Changes to CAS Security Vulnerability Response ============================================== Tuesday, Jun 23, 2026 2 minute read TL;DR ===== The Apereo CAS project has approved a proposal to shorten our security grace window from **four weeks** to **two weeks**. Going forward, security fixes will follow a two-week grace period before broader public disclosure and announcement. This change reflects both the current pace of software delivery and the evolving security landscape in which fixes, diffs, source artifacts, and public hints can be analyzed far more quickly than in the past. Why the Change? =============== The previous four-week window was established at a time when many organizations still relied heavily on manual build, release, and deployment processes. It was intended to give adopters a reasonable amount of time to upgrade before security issues were more widely announced. That environment has changed significantly. Today, automated builds, dependency management tools, CI/CD pipelines, containerized deployments, and release automation are far more common. At the same time, security reports are arriving more frequently, and AI-assisted analysis has shortened the time between a fix being published and the underlying vulnerability being understood. In practice, this means the effective secrecy window around a security fix is much shorter than it used to be. Once a fix is available, motivated observers can often infer the nature of the issue without a lot of hassle. Given that reality, maintaining a four-week delay before wider disclosure no longer provides the same level of protection it once did. What Is Changing? ================= For future security fixes, the grace window will be shortened from 4 weeks to 2 weeks. This means adopters will have two weeks after a security fix is published before broader public disclosure and announcement. The project documentation has been updated to reflect the new two-week security grace window. What Is Not Changing? ===================== This change does not affect security fixes that have already been published. Any security fix already operating under the previous four-week window will continue to follow that original timeline. The new two-week window applies only to future security fixes. Expectations for Adopters ========================= We recognize that this change means organizations will need to respond more quickly to security releases. However, this is also an intentional nudge toward more automated, repeatable, and reliable upgrade processes. Projects and organizations that still depend on manual upgrade and deployment steps should use this change as an opportunity to review their release workflows, dependency management practices, and deployment automation. Today, the ability to apply security updates quickly is no longer just operationally convenient. It is part of maintaining a responsible security posture. The goal is to strike a better balance between giving adopters time to upgrade and ensuring the wider community receives timely information about security issues. We appreciate the community’s continued attention to responsible disclosure, timely upgrades, and the ongoing security of the ecosystem. On behalf of the CAS Project, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Changes+to+CAS+Security+Vulnerability+Response&url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&title=Changes+to+CAS+Security+Vulnerability+Response "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&title=Changes+to+CAS+Security+Vulnerability+Response "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&name=Changes+to+CAS+Security+Vulnerability+Response "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&title=Changes+to+CAS+Security+Vulnerability+Response "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&title=Changes+to+CAS+Security+Vulnerability+Response "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F23%2Fsec-grace-window%2F&t=Changes+to+CAS+Security+Vulnerability+Response "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # Easier CLA submission – Apereo Community Blog Easier CLA submission ===================== Friday, May 5, 2017 1 minute read Now it is easier to submit a contributor licensing agreement (CLA) to Apereo, with online forms, one for each type of agreement, linked from [the licensing page](https://www.apereo.org/licensing) . Contributor agreements allow Apereo to sublicense your contributions to others under flexible terms, including under the open source licenses adopted by the Apereo projects. The Apereo Foundation collects and maintains licensing agreements and grant assignments at the institutional and individual level and [publishes the results publicly](http://licensing.apereo.org/) . With thanks especially to John Lewis and Neal Caidin for the JotForm implementation of these online forms. \-[Andrew Petro](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Easier+CLA+submission&url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&title=Easier+CLA+submission "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&title=Easier+CLA+submission "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&name=Easier+CLA+submission "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&title=Easier+CLA+submission "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&title=Easier+CLA+submission "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F05%2Fjotform-clas%2F&t=Easier+CLA+submission "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Why does uPortal use Apache 2 license? – Apereo Community Blog Why does uPortal use Apache 2 license? ====================================== Tuesday, Feb 20, 2018 2 minute read > [I’d be interested to hear what licenses other projects were using, and why?](https://groups.google.com/a/apereo.org/d/msg/licensing-discuss/kac2gzuHf6E/2Y9OzdRjBQAJ) What license does uPortal use? ------------------------------ The easy part of the question: uPortal is using [Apache License 2.0](https://choosealicense.com/licenses/apache-2.0/) . Why did uPortal license away from New BSD, its original license? ---------------------------------------------------------------- The hard part of the question: why? In the beginning (in the JA-SIG, or JASIG, or Jasig days), uPortal used the [BSD 3-Clause aka New BSD license](https://choosealicense.com/licenses/bsd-3-clause/) . In the run up to merging with the Sakai Foundation to become the Apereo Foundation, Jasig adopted the position that New BSD is not good enough, which is now [Apereo’s documented position](https://www.apereo.org/licensing) . > This license simply does not provide enough protection for either contributors or adopters to really understand the terms under which the software is being shared. (I don’t agree with this statement. New BSD meets the [Open Source Definition](https://opensource.org/osd) , and it thoroughly disclaims warranties and liabilities. Good enough is good enough. I’d have no qualms about contributing to or adopting a New BSD licensed software product.) [GNU says this about 3-clause BSD](https://www.gnu.org/licenses/license-list.en.html#ModifiedBSD) : > The modified BSD license is not bad, as lax permissive licenses go, though the Apache 2.0 license is preferable. … the Apache 2.0 license is better for substantial programs, since it prevents patent treachery. Maybe how badly you want to re-license away from New BSD hinges on how worried you are about patent treachery. Some people worried. So Jasig required uPortal to re-license. So that’s why not New BSD. Why did uPortal re-license to Apache2, its current license? ----------------------------------------------------------- I don’t recall just how Apache2 was selected, who did the selecting, what alternatives were considered. I don’t even recall if this is something I once knew and have forgotten. A 2008 document in the Jasig wiki, [Open Source Licensing](https://wiki.jasig.org/download/attachments/25002436/open-source-licensing-paper.pdf?version=1&modificationDate=1236022038650&api=v2) , (by Unicon / John Lewis) recommends Apache2 for the non-copyleft case and might have been influential. Guessing at what might have happened: Do what the Apache Software Foundation does. Apache2 is widely adopted, widely understood, well documented, the practices around it are well documented and honed by the Apache Software Foundation. It’s not just a viable license, it’s a viable license ecosystem. Nobody has to apologize for adopting Apache2, it’s one of those default, acceptable, generally recognized as safe licenses? [ECLv2](https://choosealicense.com/licenses/ecl-2.0/) would also be fine, it’s just less mainstream. uPortal’s adopters and communities weren’t already worked up about Apache2’s patent language so there wasn’t enough reason to start getting worked up about that. \- Andrew Petro wearing individual contributor [hat](https://www.apache.org/foundation/how-it-works.html#hats) . The views expressed herein are not necessarily those of Apereo, nor of uPortal, nor of my employer, nor of… Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Why+does+uPortal+use+Apache+2+license%3F&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&title=Why+does+uPortal+use+Apache+2+license%3F "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&title=Why+does+uPortal+use+Apache+2+license%3F "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&name=Why+does+uPortal+use+Apache+2+license%3F "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&title=Why+does+uPortal+use+Apache+2+license%3F "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&title=Why+does+uPortal+use+Apache+2+license%3F "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F20%2Fapache2-chose-uportal%2F&t=Why+does+uPortal+use+Apache+2+license%3F "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # feat(conventional_commits): signal breaking changes in commit titles – Apereo Community Blog feat(conventional\_commits): signal breaking changes in commit titles ===================================================================== Saturday, Jul 7, 2018 5 minute read Short version ------------- * I like [Conventional Commits](https://conventionalcommits.org/) . * Conventional Commits miss an important opportunity to signal the breakingness of change in the _title_ rather than just the _body_ of a commit message. * Introducing a [“BREAK: “ prefix](https://github.com/conventional-changelog/conventionalcommits.org/pull/64) might be a good way to do this. There are other ideas. * Call to action: help make Conventional Commits better in this and other respects Status quo: feat: split `ROLE_VIEW_ABSENCE_HISTORIES` (Is this a breaking change? You’ll have to read the exciting commit message body and footer to find out…) Better: [`BREAK: feat: split ROLE_VIEW_ABSENCE_HISTORIES`](https://github.com/conventional-changelog/conventionalcommits.org/pull/64) or [`!feat: split ROLE_VIEW_ABSENCE_HISTORIES`](https://github.com/conventional-changelog/conventionalcommits.org/issues/43) or [`FEAT: split ROLE_VIEW_ABSENCE_HISTORIES`](https://github.com/conventional-changelog/conventionalcommits.org/pull/63) Conventional Commits -------------------- I like [Conventional Commits](https://conventionalcommits.org/) . Conventional Commits are a commit message format specification. Much of the value of Conventional Commits is in encouraging _semantic commits_ that thoughtfully express carefully crafted units of meaning. [Like Jeremy Mack](https://seesparkbox.com/foundry/semantic_commit_messages) , I think that taking care to compose single-thought semantic commits makes me a better programmer. Conventional Commits look like this: feat: turbocharge the whatsit That token at the front is the _type_, followed on the line by a super-brief _description_. This first line altogether is the _title_ of the commit message. Conventional Commit messages have an optional body fix: correct the twinkle The twinkle was not previously astronomically correct; this fix corrects to a precision of six decimal places. Fixes #14 Conventional Commits thinks of the last part of the body as an optional _footer_. Conventional Commits can also express a _scope_, an area of the project where the change type is being applied. docs(song): note that carbon stars are sort-of diamonds in the sky ### Characterizing breaking changes in the body or footer Conventional Commits are meant to help with \[Semantic Versioning\]\[\]. A release containing only backwards-compatible fixes like fix: tighten the goober would be a _patch_ release (like 2.4.1). A _minor_ release (like 2.5) introducing new features would include commits like feat: expose HRS URLs in the JSON API at /api/urls One is meant to be able to take a look at the commit log and thereby figure out what sort of Semantic Versioning bump is in order. An adopter faced with a major release is meant to be able to look at the commit history to inspect the breaking changes. Conventional commits of any type can be API-breaking changes. These changes occasion a _major_ version change (5 to 6, say) in Semantic Versioning. An author notes the breakingness of a change (and advice for how clients of the library might adapt to the breaking change) in the _body_ or _footer_ of a Conventional Commit. So, fix: correct spelling of referrer in header BREAKING CHANGE: Rather than using misspelled "Referer" as name of header, instead use correct spelling "Referrer". Clients expecting "Referer" will no longer receive that header and will presumably not honor the new "Referrer" until updated to support this new name for this header. Improving Conventional Commits: signal the breakingness in the commit title --------------------------------------------------------------------------- There are contexts in which only the _title_ and not the _body_ of commit messages display, e.g. in GitHub’s presentation of a branch’s history or in some Git command line tooling. Which of these are breaking changes? fix: correct spelling of referrer in header fix: correct spelling of referrer in label fix: tighten the wingnut feat: bolt on the blender You can’t tell from the commit title. You’d have to look at the body of the message for each one to realize that e.g. the header spelling fix is a breaking change. I think Conventional Commits should be improved to reliably reflect the breakingness of change in the _title_ of the commit rather than just in the _body_. There are a few ideas on how to do this: ### The [sigil idea](https://github.com/conventional-changelog/conventionalcommits.org/issues/43) !fix: correct spelling of referrer in header A sigil is delightfully succinct. However, it might not be immediately apparent to a naive reader what meaning that `!` is trying to convey. Question: how would a screen reader or other accessibility tool treat that sigil? ### The [ALL-CAPS idea](https://github.com/conventional-changelog/conventionalcommits.org/pull/63) FIX: correct spelling of referrer in header This solution consumes zero characters. It’s also relatable in that ALL-CAPS ON THE INTERNET IS SHOUTING and that’s just the idea, to shout out the most important changes so that adopters can more readily identify the changes that are breaking their usages. I think it’s likely as readable and self-evident as a sigil, and it’s elegant that it consumes zero characters. However, Conventional Commits has not to date specified the capitalization of _type_. Some have argued for specifying the capitalization, or specifying that the capitalization is unspecified. In any case it’s the kind of thing developers might be inconsistent about. Any inadvertent ALL-CAPS commit messages will be false positives for this signal. Question: how well would a screen reader or other accessibility tool present the fact that the _type_ is ALL-CAPS rather than lowercase? ### The [prefix idea](https://github.com/conventional-changelog/conventionalcommits.org/pull/64) BREAK: fix: correct spelling of referrer in header I like this solution best. It consumes 7 characters, but it’s also more self-documenting, more readily apparent even to someone unfamiliar with Conventional Commits what it’s trying to say. Which commits are the breaking changes? Oh yeah, the ones that are shouting at me “BREAK”. Call to action -------------- I think that some (required!) way of indicating the breakingness of change in Conventional Commit titles should be specified. What is often the most important thing to say about a breaking-change commit shouldn’t be only in the body of the message. Maybe you have other ideas for how to convey breakingness in Conventional Commit commit titles. Maybe you have some expertise to offer about how screen readers and other accessibility tools would present the title under the different options under consideration. Maybe you like one of these ideas. Maybe you too don’t know which solution should be adopted but really wish Conventional Commits would go ahead and accept _some solution_ so that identifying breaking changes in repositories using Conventional Commits will get easier sooner. Maybe you like the status quo just fine and don’t want to see Conventional Commit titles change for this. However you think this ought to play out, engage [in GitHub](https://github.com/conventional-changelog/conventionalcommits.org) to help make it happen. References and learn more ------------------------- * [Bookmarks about Conventional Commits](https://pinboard.in/u:microcline/t:conventional_commits/) Author: [Andrew Petro](https://twitter.com/awpetro) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles&url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&title=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&title=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&name=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&title=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&title=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F07%2Findicate-breaks-in-conventional-commit-titles%2F&t=feat%28conventional_commits%29%3A+signal+breaking+changes+in+commit+titles "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Nominate awesome fits for the Apereo board – Apereo Community Blog Nominate awesome fits for the Apereo board ========================================== Friday, Apr 20, 2018 5 minute read Are you a [representative of a Member Organization in good standing](https://www.apereo.org/content/bylaws#article-5) contemplating whom to nominate for the [available Apereo board of directors seats](https://groups.google.com/a/apereo.org/d/topic/announcements/rCtIZGF2eos/discussion) ? Here are some ideas. Until 1700 Eastern on April 20th 2018, it’s not too late to widen the pool. (I haven’t checked with most people listed here to see if they’d actually be willing to serve - the point of this post is to provoke thought on who _you_ would like to see serving on this board and _why_, thoughts on what characteristics would make for excellent board leadership and round out the perspectives available in Apereo.) (As often I speak here only wearing my individual contributor hat.) Vicky Brasseur -------------- With experience serving on the Open Source Initiative board, as an author and moderator on opensource.com, and as a professional software engineer, Vicky would be a valuable voice on the Apereo Board. Vicky has literally written the [book on contributing to open source software](https://pragprog.com/book/vbopens/forge-your-future-with-open-source) . If Apereo can’t draw in Vicky’s attentions gratis through board service, I advocate Apereo hiring Vicky’s significant expertise through her [consulting services](https://www.vmbrasseur.com/services/) . Audrey Watters -------------- [Audrey](http://audreywatters.com/) is a very important voice of EdTech skepticism. It would be helpful to have her at the table. Karen Sandler ------------- [Karen](https://sfconservancy.org/about/staff/#karen) is executive director of the Software Freedom Conservancy. Karen would bring * legal experience, including with the [Conservancy’s perspective](https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/) on the necessity of ICLAs * experience directing a non-profit foundation with an annual budget on the same order of magnitude as Apereo * experience in diversity and inclusion especially through her Outreachy work Apereo might learn much from Conservancy perspective. Tim Vertein ----------- My colleague Tim is a thoughtful, productive, effective professional with a proven commitment to the university and to serving university participants well. He’d make a great Apereo Board director for many of the same reasons [he’d make a great Apereo fellow](https://git.doit.wisc.edu/andrew-petro/2018-vertein-apereo-fellow-nomination/blob/master/README.md) . Misagh Moayyed -------------- Misagh is the Apereo CAS project PMC chair. I think Apereo at the Board level has unrealized opportunity to better consider the perspective and experiences of the people working in Apereo projects. The disconnect between (relatively closed) Board governance and “100% open” projects might be alleviated through bringing those perspectives closer to the governance. Misagh has distinguished himself through thoughtful stewardship of the Apereo CAS project, one of the more successful Apereo projects in breadth of adoption, quantity of contributors, and in engineering attention to enabling divergent local configuration of a shared open source software product. Shane Curcuru ------------- Apereo sometimes tries to take Apache’s lead and presumably could do so even better informed by a board director who has experience and achievement in the Apache Software Foundation context, evident from Apache committership, Apache PMC membership, Apache Board Director experience, and Apache Foundation Membership. ([Membership in the Apache Software Foundation](https://apache.org/foundation/members.html) is a big deal. You can’t buy it.) > Membership in The Apache Software Foundation is a privilege and is by invitation only. Shane specifically has experience with Apache incubation and community development, both especially relevant to Apereo’s challenges. If Apereo can’t draw in Shane’s attentions gratis through Board service, I advocate Apereo hiring Shane’s significant expertise under the auspices of his open source community engagement consultancy, [Punderthings Consulting](http://punderthings.com/) . Pat Masson ---------- [Pat](https://opensource.org/docs/board-annotated#PatrickMasson) is General Manager of the Open Source Initiative. Pat has experience with higher education and particularly with Apereo. The OSI’s experience is also relevant in that it has a successful individual membership program. As Apereo bootstraps its own individual membership program OSI’s experience might help catapault this to sustainability. Ben Balter ---------- Ben is a lawyer with an important perspective on [tradeoffs in contributor license agreement rigor](https://ben.balter.com/2018/01/02/why-you-probably-shouldnt-add-a-cla-to-your-open-source-project/) . Also, Ben’s experience in federal government service might be a helpful public service perspective on the board. Tim Carroll ----------- Tim is a current Apereo board member whose term is ending and who is available for re-nomination. It might be a fine thing to re-nominate Tim. He seems a voice of pragmatism on the board. On the public record, Tim * shared [an article on the open@ list](https://groups.google.com/a/apereo.org/d/topic/open/Xtdt2I8VMQQ/discussion) * [engaged](https://groups.google.com/a/apereo.org/d/msg/licensing-discuss/c1puG3RKZcA/nPDMUCU6EAAJ) regarding the failed 2016 attempt to unburden Apereo ICLA policy. (I wish that had succeeded, but engagement was still better than not engaging with the issue). * [engaged](https://groups.google.com/a/apereo.org/d/msg/open/GNtB1MGvZK4/rebkAZPSBwAJ) regarding a proposal to create an open parallel to the closed `projects@` email list (advocating using existing `open@` for this purpose) * [voiced a way to un-stick a potential incubation](https://groups.google.com/a/apereo.org/d/msg/incubation/86VDDg_ADZI/IvFNEKSZBQAJ) Of the 8 Apereo board meetings in the past year for which [minutes](https://www.apereo.org/content/board-meeting-minutes) are available, 6 show Tim as attending (75%). Charles Severance ----------------- Dr. Chuck is the Apereo Sakai project PMC chair. He also has experience serving as an Executive Director of an open source foundation and as a board member. This combination of executive, governance, and working-in-the-open-source-project perspectives could be highly valuable on the board. Bryan Ollendyke --------------- [Bryan](https://www.drupal.org/u/btopro) is tremendously passionate about Apereo-incubating ELMS:LN, about openness and about improving higher education and about the quality of community interactions. Bryan’s work is well-regarded. The energy, passion, sense of urgency, and bias for action he brings might in itself make his board term very worthwhile. A registrar ----------- Apereo ought to be adding tremendous value to the work of university registrars. What are the not-yet-realized opportunities in this space and would bringing a registrar’s perspective closer to the governance help? Another CIO ----------- Apereo ought to be adding tremendous value and leverage to the work of university CIOs, broadening the viable tactical and strategic options and having the side effect of pressuring proprietary and SaaS vendors to better serve education (out of a healthy concern about the alternatives available to universities). What are the not-yet-realized opportunities in this space and would bringing another CIO’s perspective closer to the governance help to realize those opportunties? Apereo Fellows -------------- I’d expect any of the [Apereo Fellows](https://www.apereo.org/communities/apereo-fellows) would bring an informed perspective to the board. Others ------ What experiences and perspectives would you like to see more of on the Apereo board? Who might bring those to bear? Is there an opportunity for that to happen? /Andrew Petro as individual contributor Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Nominate+awesome+fits+for+the+Apereo+board&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&title=Nominate+awesome+fits+for+the+Apereo+board "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&title=Nominate+awesome+fits+for+the+Apereo+board "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&name=Nominate+awesome+fits+for+the+Apereo+board "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&title=Nominate+awesome+fits+for+the+Apereo+board "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&title=Nominate+awesome+fits+for+the+Apereo+board "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F20%2Fnominate-to-board%2F&t=Nominate+awesome+fits+for+the+Apereo+board "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # One Can Only Hope in Buchistan – Apereo Community Blog One Can Only Hope in Buchistan ============================== Friday, Jun 22, 2018 1 minute read > _A true story inspired by real events. Seriously. Bryan Cranston has been approached for the role of “Some”._ * United Nations Strategic Alliance Hotline. How may I help you? * Hi there. This is Some Person and I am calling to share some valuable suggestions about the desperate state of Buchistan with you. Is this the right line? * Certainly. What seems to be your concern? * I don’t know if you are keeping tabs on this, but Buchistan is in complete disarray. Crime is rampant and deadly infectious diseases are widespread. People… * If you would allow me a quick mome… * …are starving and wildlife habitat is miserably endangered. Natural resources are at an all-time low. _Sigh_…I am really not sure how I am supposed to… * If I could ask for your… * …take my enterprise family to production…I mean…vacation next month with all this misery. The entire state of affairs in Buchistan is like one horror show after another; the very real combination of all [Black Mirror](https://www.imdb.com/title/tt2085059/) episodes combined into one giant pile of despondent torturous anguish looping through for all eternity. What is being done about this? * We are pulling all our resources into resolving issues. In fact, there is a great website with instructions on how you can get invo… * My apologies; I simply have no time or energy to spare here. Just wanted to share notes and let you know that I will not be considering Buchistan for any joyous excursions unless and until such issues are handled. * Understood; thank you Some. I can assure you that all concerns are being reviewed. We will have more news on this later. * Ah, that is so wonderful to hear. When? * Some time. #HappyFriday [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=One+Can+Only+Hope+in+Buchistan&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&title=One+Can+Only+Hope+in+Buchistan "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&title=One+Can+Only+Hope+in+Buchistan "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&name=One+Can+Only+Hope+in+Buchistan "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&title=One+Can+Only+Hope+in+Buchistan "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&title=One+Can+Only+Hope+in+Buchistan "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F22%2Funited-nations-buchistan%2F&t=One+Can+Only+Hope+in+Buchistan "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Saving Time is Time Consuming – Apereo Community Blog Saving Time is Time Consuming ============================= Friday, Mar 29, 2019 1 minute read > _A true story inspired by real events. Seriously._ * Hello? * Startup Times Hotline where trying is the first step to failure. How may I help you? * I am an enterprise application developer, working for an enterprise business aiming to urgently improve the state of our enterprise…and maybe yours. Not sure. I’ll have to check with the enterprise. * What is this inquiry about? * I have excellent news. After many many months of trial and error and an unbelievable demonstration of human perseverance, we have managed to urgently reduce the start-up time of our enterprise application significantly. Isn’t this the sort of thing your institution writes articles about? * Absolutely! How significant of a significance are we talking about here? * The startup-time of the old version was around `35` seconds, and now through hulkish feats of solid engineering, we are looking at a startup-time of about `30` seconds. * So, `5` seconds? * I am not sure I appreciate your tone here. `5` seconds is a looooong time. If you were on your deathbed, wouldn’t you want to have `5` seconds more with your loved ones? Of course you would! Note that we used to restart the application almost on a daily basis. This is a life savings of almost one minute a week. * Uh…OK…which means? * Exactly. It means after a couple of hundred years, this effort would start to save lives and reunite families. Do you now understand the significance of this improvement? * Sure, very impressive. Would you like to come in for a …? * Sorry. Hold on one second…I am getting a text from my enterprise architect…Oh…wait…I am being told we would be retiring the application in the very near future and we are being acquired by an enterprise solution. * Sorry to hear that. I hope the adoption and transition process goes smoothly? * Yeah, but usually these things take a long time. * Like…`5` seconds long or…? Hello? Hello?! #HappyFriday [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Saving+Time+is+Time+Consuming&url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&title=Saving+Time+is+Time+Consuming "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&title=Saving+Time+is+Time+Consuming "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&name=Saving+Time+is+Time+Consuming "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&title=Saving+Time+is+Time+Consuming "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&title=Saving+Time+is+Time+Consuming "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F29%2Fstartup-times%2F&t=Saving+Time+is+Time+Consuming "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Bootiful CAS Client – Apereo Community Blog Apereo CAS - Bootiful CAS Client ================================ Wednesday, Feb 26, 2020 2 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Overview ======== CAS Developer Scenario: After spending a few days in trying to stand up a newer version CAS IdP, you realize that you finally have it running! You are so ecstatic that you stand up and start dancing and singing, "I did it! I did it! Woohoo!", to the dismay of your office mates. Now you are ready to test and verify that your new CAS instances is working. You start thinking to yourself: "How am I going to test CAS?" "Hmm...Should I re-point a Prod app to the new CAS instance for a few minutes?" "Maybe I can do this late at night, around 2 a.m. or so?" Then you realize what you are saying "What! Am I crazy!" "The last thing I need is for the boss to run in here threatening to fire me!" "I'm still paying off my awesome CosPlay outfit from last years Comic-Con!" "Maybe there is some open source CAS SP I can download and use?" "This one sucks!" "This one looks cool, but I could probably write one from scratch before I will figure out these directions!" "What to do?" Does this sounds like something you have gone through? Stumped on how to test CAS? Then I have something for you! The answer my friend is not blowing in the wind, it is rather just one small click away at [Bootiful CAS Client](https://github.com/UniconLabs/bootiful-cas-client) ! An easy peasy CASified Client! Bootiful CAS Client =================== ### Installation * Clone or download the source code from [Bootiful CAS Client](https://github.com/UniconLabs/bootiful-cas-client) * Update the file `src/main/resources/application.yml` with the URL’s needed to test: cas: #Required properties server-url-prefix: https://localhost:8143/cas server-login-url: https://localhost:8143/cas/login client-host-url: https://localhost:8443 * Update the same file to point to the keystore that will need to be created: server: port: 8443 ssl: enabled: true key-store: /directory/tothe/.keystore key-store-password: changeit * Now from the command line run: ./gradlew clean bootRun * Visit the `client-host-url` you entered, in our case it is https://localhost:8443, in your browser of choice and enjoy the CASified Spring Boot app! So… === I hope you enjoy this easy peasy CASy client on all your future CAS testing! Finally, if you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem and care about its long-term success and sustainability, this is a viable option to consider. As [Misagh Moayyed](https://fawnoos.com/) says ‘Happy Coding’! [Axel Stohn](https://github.com/astohn) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Bootiful+CAS+Client&url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&title=Apereo+CAS+-+Bootiful+CAS+Client "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&title=Apereo+CAS+-+Bootiful+CAS+Client "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&name=Apereo+CAS+-+Bootiful+CAS+Client "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&title=Apereo+CAS+-+Bootiful+CAS+Client "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&title=Apereo+CAS+-+Bootiful+CAS+Client "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F26%2Fcas-bootiful-client%2F&t=Apereo+CAS+-+Bootiful+CAS+Client "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Multifactor Authentication with U2F and Bypass – Apereo Community Blog CAS Multifactor Authentication with U2F and Bypass ================================================== Tuesday, Oct 6, 2020 1 minute read In some CAS deployments multifactor authentication can be done using U2F keys. Sometimes not all the users have the key, but they want to use the service. On the other hand there are machine to machine users that cannot push the button on USB key. For this two kinds of users U2F bypass is the only way to use CAS in such deployment. Environment =========== * CAS `6.2.2` Configuring Authentication ========================== cas.authn.ldap[0].type=AUTHENTICATED cas.authn.ldap[0].ldapUrl=ldap://10.30.10.10:389 cas.authn.ldap[0].useSsl=false cas.authn.ldap[0].searchFilter=cn={user} cas.authn.ldap[0].baseDn=ou=users,dc=domain11 cas.authn.ldap[0].bindDn=cn=admin,dc=domain11 cas.authn.ldap[0].bindCredential=1221 cas.authn.ldap[0].principalAttributeList=memberOf,memberof,cn Configuring U2F as second factor ================================ cas.authn.mfa.globalProviderId=mfa-u2f cas.authn.mfa.u2f.rank=0 cas.authn.mfa.u2f.name=AAA cas.authn.mfa.u2f.expireRegistrations=300 cas.authn.mfa.u2f.expireRegistrationsTimeUnit=SECONDS cas.authn.mfa.u2f.expireDevices=30 cas.authn.mfa.u2f.expireDevicesTimeUnit=DAYS cas.authn.mfa.u2f.json.location=file:///etc/cas/config/u2.json Default Bypass Configuration ============================ We have CAS configured with LDAP and U2F support and we need to bypass second factor to certain users. To do so we can: 1) In LDAP add description field to exact users. 2) In cas.properties add “description” attribute to cas.authn.ldap\[0\].principalAttributeList option cas.authn.ldap[0].principalAttributeList=memberOf,memberof,cn,description 3) Set bypass type and bypass criteria cas.authn.mfa.u2f.bypass.type=DEFAULT cas.authn.mfa.u2f.bypass.principalAttributeName=description All users with description attribute present should bypass second factor. [Egor Ivanov](https://baltinfocom.ru/BigData) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Multifactor+Authentication+with++U2F+and+Bypass&url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&title=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&title=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&name=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&title=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&title=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F06%2Fconfigure-ldap-u2f-and-bypass%2F&t=CAS+Multifactor+Authentication+with++U2F+and+Bypass "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Contribution Guidelines – Apereo Community Blog Apereo CAS - Contribution Guidelines ==================================== Wednesday, Jul 5, 2017 1 minute read [See this](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Contribution+Guidelines&url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&title=Apereo+CAS+-+Contribution+Guidelines "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&title=Apereo+CAS+-+Contribution+Guidelines "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&name=Apereo+CAS+-+Contribution+Guidelines "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&title=Apereo+CAS+-+Contribution+Guidelines "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&title=Apereo+CAS+-+Contribution+Guidelines "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fcas-contribution-guide%2F&t=Apereo+CAS+-+Contribution+Guidelines "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Wednesday, Sep 26, 2018 1 minute read Overview ======== This is the public version of an [Apereo CAS project vulnerability disclosure](https://groups.google.com/a/apereo.org/forum/#!topic/cas-appsec-public/zXqxDN9rB8A) , describing an issue in CAS where an adversary may be able to bypass the second factor (token) although MFA is requested during the login process. This issue applies to all MFA providers **except the Duo provider** (which is therefore NOT vulnerable). Affected Deployments ==================== The attack vector applies to all deployments of the CAS server for the versions: * 5.3.0, 5.3.1 and 5.3.2 * lower or equal to 5.2.6. If you have deployed the version 5.3.0, 5.3.1 or 5.3.2, you **MUST** upgrade to the version 5.3.3. If you have deployed a version lower or equal to version 5.2.6, you **MUST** upgrade to the version 5.2.7. Severity ======== This is a serious issue where successfully exercising this vulnerability allows the adversary to bypass the second factor (token) required by the MFA policy. This makes any MFA configuration to re-inforce security completely useless. Patching ======== Patch releases are available to address CAS vulnerable deployments. Upgrades to the next patch version for each release should be a drop-in replacement. The patch simply ensures that the MFA factor (token) is effectively required when MFA is requested. Timeline -------- The issue was originally reported to the CAS application security team on August, 2018 and upon confirmation, CAS was patched. Procedure --------- Modify your CAS overlay to point to the version `5.2.7` or `5.3.3`. A snippet of a `pom.xml` for a CAS overlay follows: org.apereo.cas cas-server-webapp ${cas.version} war runtime 5.3.3 Support ======= If you have questions on the details of this vulnerability and how it might be reproduced, please contact `security@apereo.org` or `cas-appsec-public@apereo.org`. Resources ========= * [Original Announcement](https://groups.google.com/a/apereo.org/forum/#!topic/cas-appsec-public/zXqxDN9rB8A) * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) [Jérôme LELEU](https://github.com/leleuj) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F26%2Fmfavulndisc%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Why you should choose CAS as your SSO system – Apereo Community Blog Why you should choose CAS as your SSO system ============================================ Thursday, Oct 25, 2018 4 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Most of the customers for whom I work have already chosen the CAS server and its ecosystem when I come in to help them. Yet, from time to time, I’m contacted earlier in the decision process when the client is still thinking about the products and protocols he wants to use. Advocating for the CAS server is an easy task for me, even if generally, technical reasons are just a small part of the game (politics and relationships really matter). I especially want to disabuse people who believe that CAS software is just about the CAS protocol, it’s so much more. Some may think that as a CAS committer and as an IAM freelance, I’m biased towards CAS. This is true, but certainly less than any salesman who will earn fees for each sold product. Eventually, this is what I say: ### 1) CAS is Open Source Most customers primarily choose Open Source software because it’s free. While this is a good reason, they still need to pay consultants to help them. To me, there are greater benefits, especially the fact that you can contribute to the project. If you buy an SSO system from a big company, want a new feature and are the only one in the world, it’s too bad for you, there is little chance you will get your new feature. With Open Source software, you can make it happen! ### 2) CAS is a very modern software While the general code quality of the CAS server has always been good, I must admit that the whole architecture and design have strongly improved since version 5 where it has embraced the Spring Boot ecosystem. I was a bit reluctant on this huge change, but Misagh was definitely right as using Spring Boot was a big jump forward. There are some glitches here and there, but overall, the code is easy to read and understand and things are really modular. ### 3) CAS has many features The CAS server offers many useful capabilities, from obvious ones to more advanced ones. It handles various authentication methods, multi-factor authentication (MFA), can remember the user, force or try authentication, offers a dashboard and monitoring, has logs and audits, manages passwords, etc. Of course, you cannot only assess a software by the number of its features but having many options is generally a good thing. ### 4) CAS is very popular The CAS server is one of the most popular software in IAM. With around five thousands stars on github.com, CAS is a well-known project. Many higher-education schools and companies use it, so you can easily find help from the CAS community or paid consultants. The more the CAS server is installed, the more people read its source code and test it, the more security vulnerabilities are discovered and fixed. It makes it a safe choice for your SSO system. ### 5) CAS fits everywhere Your existing environment is the first most important criteria when choosing an SSO system. Most companies never start a new project from scratch: for example, they use Redis on CentOS, a bit of MongoDB also and their users’ storage is an old LDAP system. You must cope with all that constraints. If your software only supports technologies A and B, you can only address clients willing to use A or B. The CAS server can: * use many authentication methods: LDAP, databases, X509, Cassandra, Radius, Spnego, JWT, AWS Cloud Directory and many more * handle many storage systems: Memcached, Redis, Oracle, Hazelcast, CouchDB, Couchbase, etc. ### 6) CAS is the master of interoperability Your existing environment is also the second most important criteria when choosing an SSO system! Big bang projects almost always fail and it’s hard to deal with legacy. I don’t remember having a customer without an existing software to integrate with. And this is the great strength of CAS: * the CAS server can act as a SAML IdP, an OAuth provider, an OpenID Connect provder or as a CAS server of course * but it can also play the role of a client delegating the authentication to another CAS server, to a SAML IdP, to Facebook, Google, Twitter and many other identity providers. This is one of the main contributions I brought to CAS and I’m especially proud of this interoperability. CAS clients used for integration in web applications exist in many technologies as well: Java, PHP, .Net, Ruby, Python, Node.js, Apache module, etc. CAS is a great software, it is worth considering if you plan to choose an SSO system. [Jérôme LELEU](https://github.com/leleuj) Originally posted on the [pac4j blog](http://www.pac4j.org/blog/why-you-choose-cas-as-your-sso-system.html) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Why+you+should+choose+CAS+as+your+SSO+system&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&title=Why+you+should+choose+CAS+as+your+SSO+system "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&title=Why+you+should+choose+CAS+as+your+SSO+system "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&name=Why+you+should+choose+CAS+as+your+SSO+system "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&title=Why+you+should+choose+CAS+as+your+SSO+system "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&title=Why+you+should+choose+CAS+as+your+SSO+system "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F25%2Fwhy-you-should-choose-cas-as-your-sso-system%2F&t=Why+you+should+choose+CAS+as+your+SSO+system "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - VMware Identity Manager SAML2 Integration – Apereo Community Blog Apereo CAS - VMware Identity Manager SAML2 Integration ====================================================== Monday, Dec 3, 2018 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Keith Conger of Colorado College, an active member of the CAS community, was kind enough to contribute this guide. VMware Identity Manager is identity management for the mobile cloud era that delivers on consumer-simple expectations like one-touch access to nearly any app, from any device, optimized with AirWatch Conditional Access. As a SAML2 service provider, VMware Identity Manager can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) VMware Identity Manager Configuration ===================================== * Register CAS as an identity provider ![](https://user-images.githubusercontent.com/1205228/49401590-d9c07a00-f704-11e8-9f65-3813a078d924.png) * Configure authentication methods ![screen shot 2018-11-27 at 3 01 55 pm](https://user-images.githubusercontent.com/1205228/49401739-49cf0000-f705-11e8-8c7b-c862f69f7d63.png) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the VMware Identity Manager relying-party registration record in JSON definition files. The JSON file to contain the VMware Identity Manager registration record would be as follows: { @class: org.apereo.cas.support.saml.services.SamlRegisteredService serviceId: your-vmware-idm-entity-id name: VMware Identity Manager id: 1 description: VMware Identity Manager attributeReleasePolicy: { @class: org.apereo.cas.services.ReturnMappedAttributeReleasePolicy allowedAttributes: [\ @class: java.util.TreeMap\ givenName: [ java.util.ArrayList [ firstName ] ]\ mail: [ java.util.ArrayList [ email ] ]\ sAMAccountName: [ java.util.ArrayList [ userName ] ]\ sn: [ java.util.ArrayList [ lastName ] ]\ userPrincipalName: [ java.util.ArrayList [ userPrincipalName ] ]\ ] } metadataLocation: /path/to/vmware-idm.xml signAssertions: true skipGeneratingSubjectConfirmationNotBefore: true signResponses: true } A few things to point out: * You will of course need to adjust the `serviceId` and `metadataLocation` to match your data and VMware Identity Manager instance. * Make sure CAS has retrieved the allowed attributes (i.e. `mail`, `givenName`, etc) listed in the JSON definition file. Finale ====== Thanks to Keith Conger of Colorado College who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&title=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&title=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&name=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&title=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&title=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F03%2Fcas53-vmwareidentitymgr-saml2-integration%2F&t=Apereo+CAS+-+VMware+Identity+Manager+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - HappyFox SAML2 Integration – Apereo Community Blog Apereo CAS - HappyFox SAML2 Integration ======================================= Tuesday, Dec 4, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . HappyFox is an all-in-one help desk ticketing system. As a SAML2 service provider, HappyFox can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) HappyFox Configuration ====================== Use [these instructions](https://support.happyfox.com/kb/article/515-using-saml-for-single-sign-on/) to set up HappyFox as a SAML2 service provider. CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the HappyFox relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://[name].happyfox.com/saml/metadata/", "name" : "HappyFox", "description": "HappyFox", "id" : 1, "evaluationOrder" : 1, "metadataLocation" : "file:/etc/cas/config/saml/happyfox-metadata.xml", "usernameAttributeProvider" : { "@class" : "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider", "usernameAttribute" : "mail" } } Note that HappyFox does not provide its own SP metadata and you will have to create it youself. The following is example of what that metadata may look like: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress A few things to point out: * You will need to adjust the `serviceId` and `metadataLocation` to match your data and the HappyFox instance. * Make sure CAS has retrieved the allowed attributes (i.e. `mail` etc) listed in the JSON definition file. This is required in the final generated SAML2 response to create the proper `NameIDFormat` element. * Make sure the SP metadata has the correct entity id, matching your HappyFox instance address. Finale ====== If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+HappyFox+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&title=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&title=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&name=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&title=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&title=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-happyfox-saml2-integration%2F&t=Apereo+CAS+-+HappyFox+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Cisco Webex SAML2 Integration – Apereo Community Blog Apereo CAS - Cisco Webex SAML2 Integration ========================================== Tuesday, Dec 4, 2018 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Keith Conger of Colorado College, an active member of the CAS community, was kind enough to contribute this guide. Cisco Webex, formerly WebEx Communications Inc., is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. As a SAML2 service provider, Cisco Webex can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) Cisco Webex Configuration ========================= Download the service provider metadata and upload the CAS identity provider metadata. No other configuration is required. CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the Cisco Webex relying-party registration record in JSON definition files. The JSON file to contain the Cisco Webex record would be as follows: { @class: org.apereo.cas.support.saml.services.SamlRegisteredService serviceId: ^https://idbroker.webex.com/.* name: Cisco Webex id: 1 description: Cisco Webex usernameAttributeProvider: { @class: org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider usernameAttribute: mail } attributeReleasePolicy: { @class: org.apereo.cas.services.ReturnMappedAttributeReleasePolicy allowedAttributes: [\ @class: java.util.TreeMap\ givenName: [ java.util.ArrayList [ firstName ] ]\ mail: [ java.util.ArrayList [ email ] ]\ sn: [ java.util.ArrayList [ lastName ] ]\ displayName: [ java.util.ArrayList [ displayName ] ]\ ] } metadataLocation: /path/to/webex-metadata.xml signAssertions: true skipGeneratingSubjectConfirmationNotBefore: true requiredNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress signResponses: true } A few things to point out: * You will need to adjust the `serviceId` and `metadataLocation` to match your data and the Cisco Webex instance. * Make sure CAS has retrieved the allowed attributes (i.e. `mail`, `givenName`, etc) listed in the JSON definition file. Finale ====== Thanks to Keith Conger of Colorado College who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Cisco+Webex+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&title=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&title=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&name=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&title=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&title=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F04%2Fcas53-cisco-webex-saml2-integration%2F&t=Apereo+CAS+-+Cisco+Webex+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - HireTouch SAML2 Integration – Apereo Community Blog Apereo CAS - HireTouch SAML2 Integration ======================================== Saturday, Dec 22, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. [HireTouch](http://hiretouch.com/) offers talent management solutions and is built specifically for human resources departments and hiring managers. As a SAML2 service provider, HireTouch can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://[instance].hiretouch.com/admin/saml/consume", "name" : "HireTouch", "id" : 1, "metadataLocation" : "/path/to/metadata.xml", "encryptAssertions" : false, "signAssertions" : false, "signResponses" : true, "attributeReleasePolicy" : { "@class" : "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy", "allowedAttributes" : [ "java.util.ArrayList", ["uid"]] } } A few things to point out: * You will need to adjust the `metadataLocation` to match your instance. * Make sure CAS has retrieved the allowed attributes (i.e. `uid` etc) listed in the JSON definition file. * Make sure the SP metadata has the correct entity id, matching the HireTouch instance. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+HireTouch+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&title=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&title=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&name=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&title=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&title=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F22%2Fcas53-hiretouch-saml2-integration%2F&t=Apereo+CAS+-+HireTouch+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - eLumen SAML2 Integration – Apereo Community Blog Apereo CAS - eLumen SAML2 Integration ===================================== Monday, Dec 24, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. eLumen is a higher-ed, assessment and curriculum management system that gives real insight into each students’ engagement and progress—while satisfying the growing demands of accreditation and other compliance mandates. As a SAML2 service provider, it can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "[entity-id].elumenapp.com", "name" : "ELumen", "id" : 1, "evaluationOrder" : 1, "metadataLocation" : "/path/to/elumen-metadata.xml", "encryptAssertions" : false, "signAssertions" : false, "signResponses" : true, "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", "allowedAttributes": { "@class": "java.util.TreeMap", "uid": "uid", "eduPersonPrincipalName": "groovy { return attributes['eduPersonPrincipalName'].get(0) + '@exampl.org' }" } } } A few things to point out: * You will need to adjust the `metadataLocation` to match your instance. * Make sure CAS has retrieved the allowed attributes (i.e. `eduPersonPrincipalName`, `uid` etc) listed in the JSON definition file. * Make sure the SP metadata has the correct entity id, matching the instance. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+eLumen+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&title=Apereo+CAS+-+eLumen+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&title=Apereo+CAS+-+eLumen+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&name=Apereo+CAS+-+eLumen+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&title=Apereo+CAS+-+eLumen+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&title=Apereo+CAS+-+eLumen+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-elumen-saml2-integration%2F&t=Apereo+CAS+-+eLumen+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Rave SAML2 Integration – Apereo Community Blog Apereo CAS - Rave SAML2 Integration =================================== Sunday, Dec 23, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. Rave is a mass notification system designed to deliver fast and effective messaging for routine and emergency communications. As a SAML2 service provider, Rave can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://www.getrave.com/shibboleth-sp", "name" : "Rave", "id" : 1, "metadataLocation" : "/path/to/metadata.xml", "encryptAssertions" : false, "signAssertions" : false, "signResponses" : true, "requiredNameIdFormat" : "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", "allowedAttributes": { "@class": "java.util.TreeMap", "employeeNumber": "urn:oid:1.2.840.113556.1.2.610", "eduPersonPrincipalName": "groovy { return attributes['eduPersonPrincipalName'].get(0) + '@example.org' }" } } } A few things to point out: * You will need to adjust the `metadataLocation` to match your instance. * Make sure CAS has retrieved the allowed attributes (i.e. `employeeNumber`, `eduPersonPrincipalName` etc) listed in the JSON definition file. * Make sure the SP metadata has the correct entity id, matching the Rave instance. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Rave+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&title=Apereo+CAS+-+Rave+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&title=Apereo+CAS+-+Rave+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&name=Apereo+CAS+-+Rave+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&title=Apereo+CAS+-+Rave+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&title=Apereo+CAS+-+Rave+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F23%2Fcas53-getrave-saml2-integration%2F&t=Apereo+CAS+-+Rave+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - OohLala Mobile SAML2 Integration – Apereo Community Blog Apereo CAS - OohLala Mobile SAML2 Integration ============================================= Monday, Dec 24, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. Ready Communication’s OohLala Mobile provides a mobile community and communication tools for higher education. As a SAML2 service provider, it can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://integration.oohlalamobile.com/saml/[instance-name]/metadata", "name" : "OohLaLa", "id" : 1, "metadataLocation" : "https://integration.oohlalamobile.com/saml/[instance-name]/metadata", "encryptAssertions" : false, "signAssertions" : false, "signResponses" : true, "attributeReleasePolicy" : { "@class" : "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy", "allowedAttributes" : [ "java.util.ArrayList", ["givenName","sn","mail","uid"]] } } A few things to point out: * You will need to adjust the `metadataLocation` to match your instance. * Make sure CAS has retrieved the allowed attributes (i.e. `givenName`, `sn` etc) listed in the JSON definition file. * Make sure the SP metadata has the correct entity id, matching the instance. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&title=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&title=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&name=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&title=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&title=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oohlalamobile-saml2-integration%2F&t=Apereo+CAS+-+OohLala+Mobile+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Cranium Cafe SAML2 Integration – Apereo Community Blog Apereo CAS - Cranium Cafe SAML2 Integration =========================================== Monday, Dec 24, 2018 1 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. Cranium Cafe is a virtual teleconferencing platform that creates a simple, mobile in-office appointment. As a SAML2 service provider, it can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://my.craniumcafe.com/login/saml2", "name" : "CraniumCafe", "id" : 1, "metadataLocation" : "https://my.craniumcafe.com/login/saml2_metadata", "encryptAssertions" : false, "signAssertions" : false, "signResponses" : true, "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", "allowedAttributes": { "@class": "java.util.TreeMap", "eduPersonScopedAffiliation": "groovy { return attributes['eduPersonAffiliation'].get(0) + '@example.org' }" "displayName": "displayName", "mail": "mail", "eduPersonPrincipalName": "groovy { return attributes['eduPersonPrincipalName'].get(0) + '@example.org' }" } } } A few things to point out: * You will need to adjust the `metadataLocation` to match your instance. * Make sure CAS has retrieved the allowed attributes (i.e. `eduPersonPrincipalName`, `mail` etc) listed in the JSON definition file. * Make sure the SP metadata has the correct entity id, matching the instance. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&title=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&title=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&name=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&title=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&title=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F24%2Fcas53-oclc-saml2-integration%2F&t=Apereo+CAS+-+Cranium+Cafe+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS as an OAuth2 Authorization Server – Apereo Community Blog Apereo CAS as an OAuth2 Authorization Server ============================================ Tuesday, Feb 19, 2019 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . CAS --- Apereo CAS can authenticate users in many ways, including by delegating to other authentication providers, and it can get attributes about those users from many places, and finally it can communicate that identity along with those attributes to applications (aka services) via various protocols such as the CAS Protocol, SAML, and OpenID Connect. Outline ------- In this blog post we are going describe how to configure CAS server to act as Oauth2 authorization server as well as how to set up a sample Spring Boot based web app acting as an Oauth2 client, delegating to CAS to do authentication transactions using `authorization_code` grant type as well as `code` response type. The starting position is based on the following: * CAS `6.1.0-RC1` overlay * CAS Oauth2 sample client web app * [Java 11 for CAS server](https://adoptopenjdk.net/?variant=openjdk11&jvmVariant=hotspot) * Java 8 to run client app * Edit `/etc/hosts` with: 1.2.3.4 casoauth.example.org where `1.2.3.4` is replaced with the main IP address of your workstation. CAS server set up ----------------- In your standard CAS 6 overlay project (we’re going to use Gradle-based one), add the following module in `build.gradle`: compile "org.apereo.cas:cas-server-support-oauth-webflow:${project.'cas.version'}" Add OAuth2 registered service representing our client application to CAS’ service registry (we’re using JSON one with hjson syntax flavor): { @class : org.apereo.cas.support.oauth.services.OAuthRegisteredService clientId: exampleOauthClient clientSecret: exampleOauthClientSecret serviceId: ^https://casoauth.example.org:9999/.* name: OAuthService id: 1000 supportedGrantTypes: [ "java.util.HashSet", [ "authorization_code" ] ] supportedResponseTypes: [ "java.util.HashSet", [ "code" ] ] } Note the `clientId` and `clientSecret` values are significant here as we’ll use those in the client app configuration Oauth2 client web application set up ------------------------------------ Download/clone [CAS Oauth2 client sample web app](https://github.com/cas-projects/oauth2-sample-java-webapp) Modify oauth2 configuration section like so `src/main/resources/application.yml`: security: oauth2: client: clientId: exampleOauthClient clientSecret: exampleOauthClientSecret accessTokenUri: https://casoauth.example.org:8443/cas/oauth2.0/accessToken userAuthorizationUri: https://casoauth.example.org:8443/cas/oauth2.0/authorize clientAuthenticationScheme: form resource: userInfoUri: https://casoauth.example.org:8443/cas/oauth2.0/profile preferTokenInfo: false Run server and client ===================== On JDK 11, build and run CAS server as per usual e.g. using `java -jar ...` Make sure it starts on the default port of `8443`. Switch to JDK 8 and build and run sample app by invoking `./run.sh` from the root of its directory structure. Then visit `https://casauth.example.org:9999/dashboard/login` and watch redirect to CAS, login and redirect back using OAuth2 “protocol dance” with `authorization_code` grant type and `code` response type. For more info on other OAuth2 flow types, see the [documentation page](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) Finale ------ Hopefully this helped you learn about how to set up CAS’s support for Oauth2 authorization server as well as integrate Oauth2 client application with it. [Dmitriy Kopylenko](https://github.com/dima767) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+as+an+OAuth2+Authorization+Server&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&title=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&title=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&name=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&title=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&title=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F19%2Fcas61-as-oauth-authz-server%2F&t=Apereo+CAS+as+an+OAuth2+Authorization+Server "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS is now on Develocity – Apereo Community Blog Apereo CAS is now on Develocity =============================== Saturday, Mar 9, 2024 4 minute read [Apereo CAS](https://github.com/apereo/cas) is free and open-source software published under the Apache v2 license, built primarily on the Java platform and uses [the Gradle build tool](https://gradle.com/) extensively for its builds, tests, releases, deployments and more. CAS is now relying on Develocity to improve build and test feedback cycle times. The [Apereo CAS Develocity instance](https://develocity.apereo.org/) is completely public and provides the project with a dashboard to analyze build scans as well as powerful build caching techniques making both CI and local builds extremely fast and efficient. Furthermore, CAS has also turned on Develocity’s [Predictive Test Selection](https://develocity.apereo.org/scans/test-selection) features for all of its unit tests. This is a superb Develocity feature that saves testing time by identifying, prioritizing, and running only tests that are likely to provide useful feedback during test runs. How did we get here? -------------------- Gradle accepts and supports select open-source projects with **FREE** instances of Develocity. I had applied to the program a WHILE ago and was pleasantly surprised to hear back from Gradle with the good news that CAS was accepted into the project. Over a few months and a series of sessions, I worked with Gradle solution engineers, [Gasper Kojek](https://github.com/ribafish) and [Nelson Osacky](https://github.com/runningcode) to evaluate the CAS codebase, its integration with Gradle and various build plugins and ways it could be optimized. Our primary tool to identify and fix inefficiencies in the CAS Gradle build was to complete a series of [build validation exercises](https://github.com/gradle/gradle-enterprise-build-validation-scripts/blob/main/Gradle.md) . These experiments come in the form of dedicated scripts that were run against the CAS codebase where each run published build scans for us to analyze, review, and improve. Throughout the experiments, we tried to optimize the CAS Gradle build for: 1. … incremental builds when invoked from the same location. 2. … local build caching when invoked from the same location. 3. … local build caching when invoked from different locations. 4. … remote build caching when invoked from different CI agents. 5. … remote build caching when invoked on CI agent and local machine. One interesting challenge with the CAS codebase is that tests backed by JUnit are split up into many different test categories, across many many subprojects. Initially, the experiments only were run using a handful of relevant test categories and as issues were identified and fixed, we expanded the coverage to more test categories. Fixes applied to the CAS codebase mainly include: * removal of absolute paths. * making sure build tasks define their inputs and outputs correctly. * removing dynamic values, system/environment variables from the build to remove cache invalidation. * removal of non-deterministic native image JSON hints, fixed by the [Spring team](https://github.com/spring-projects/spring-framework/issues/31852) . Overall, the CAS build is now healthier and more predictable. Predictive Test Selection ------------------------- Develocity also offers fantastic [Predictive Test Selection](https://develocity.apereo.org/scans/test-selection) features and this is now turned on for all CAS test categories. As was indicated earlier, this feature saves testing time by identifying and running only tests that are likely to provide useful feedback and Develocity accomplishes this by applying a machine learning model that uniquely incorporates fine-grained code snapshots, comprehensive test analytics, and flaky test data. More build data and runs would allow the machine learning model to improve its prediction engine and offer better decisions as time goes on. To accommodate this better and reduce the chance of incorrect predictions and accidental slip-ups, CAS will also run its suite of unit tests using a fixed schedule with predictive test selection disabled. This capability is proving to be extremely valuable in cutting down test execution time and therefore resulting in a quicker feedback loop. You can evaluate the data produced by simulations and actual usage to get an idea of the serial test time saved. Credits ------- I want to thank Gradle for their commitment to supporting open-source and for providing Apereo CAS with a **FREE** Develocity instance. The series of improvements that were identified via the Develicity instance and build scan results were quite impressive and educational, and certainly allowed the project to build, fix, and release more efficiently. This is excellent news for developers, contributors, and users of the software. I am also thankful for [Gasper](https://github.com/ribafish) and [Nelson’s](https://github.com/runningcode) time and expertise in our sessions together. They were quite helpful and patient with me, explained every topic and technical challenge in great detail, followed up and responded to my comments and questions super quickly and even got hands-on and contributed a few fixes to the CAS project itself! You guys rock! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+is+now+on+Develocity&url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&title=Apereo+CAS+is+now+on+Develocity "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&title=Apereo+CAS+is+now+on+Develocity "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&name=Apereo+CAS+is+now+on+Develocity "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&title=Apereo+CAS+is+now+on+Develocity "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&title=Apereo+CAS+is+now+on+Develocity "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2024%2F03%2F09%2Fdevelocity%2F&t=Apereo+CAS+is+now+on+Develocity "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Performance improvements on the service registry – Apereo Community Blog Performance improvements on the service registry ================================================ Monday, Feb 9, 2026 2 minute read This is a task planned through NLNet funding. Context ======= When it comes to the CAS server, performance is generally not a concern. Going with the defaults should be enough in 99% of cases. However, in some rare edge cases, the performance of the service registry can become a problem. The service registry is the storage used to define all the applications allowed to authenticate with the CAS server via the CAS, OAuth, SAML, or OpenID Connect protocols. With a few hundred services, performance can drastically deteriorate. Therefore, we have worked on improving the performance of the service registry for all use cases. Benchmarks and profiling have been conducted to understand the main hotspots of time consumption. Two features are particularly resource-consuming: sorting services and matching services. Better sorting ============== Despite careful code reviews, there is always room to improve the source code. The first action we took was to turn the internal `Comparator` used in the `BaseRegisteredService` component into a singleton shared across all instances: private static final Comparator INTERNAL_COMPARATOR = Comparator .comparingInt(RegisteredService::getEvaluationPriority) .thenComparingInt(RegisteredService::getEvaluationOrder) .thenComparing(service -> StringUtils.defaultString(service.getName()), String.CASE_INSENSITIVE_ORDER) .thenComparing(RegisteredService::getServiceId) .thenComparingLong(RegisteredService::getId); as well as improving string comparison by using `String.CASE_INSENSITIVE_ORDER`. Better matching =============== In Java pattern matching, creating regex patterns is always very time-consuming, and a global cache was already available to improve performance. However, thorough tests have shown that things could be improved further in this area by using a specific property to store the regex pattern in `BaseRegisteredService`: @JsonIgnore @Getter(AccessLevel.NONE) @Setter(AccessLevel.NONE) @Transient private transient Pattern patternServiceId; ... /** * Set the service identifier and pre-compute its regex pattern. * * @param serviceId the service id */ @CanIgnoreReturnValue public BaseRegisteredService setServiceId(final String serviceId) { Assert.notNull(serviceId, "Service id cannot be null"); this.serviceId = serviceId; this.patternServiceId = RegexUtils.createPattern(serviceId); return this; } @Override public Pattern compileServiceIdPattern() { if (this.patternServiceId == null) { setServiceId(this.serviceId); } return this.patternServiceId; } And to use it for matching: @Override public boolean matches(final RegisteredService registeredService, final String serviceId) { return registeredService.compileServiceIdPattern().matcher(serviceId).matches(); } With these two improvements, the benchmark (on a CAS server with 1000 services) between version `8.0.0-RC1` and the latest version `8.0.0-SNAPSHOT` shows that _the reference time drops from 81 seconds to 51 seconds_! Going further ============= Despite these improvements, the benchmarks still show that a lot of time is spent in the “sorting phase”: ![](https://apereo.github.io/images/perfservregis_flamegraph.png) The slowdown is located in the `getCandidateServicesToMatch` method of the `DefaultServicesManager` component. Indeed, despite the cache of services, the `sorted` clause is still applied and consumes a lot of time. So, in the case of a cache size set to 0: cas.service-registry.cache.initial-capacity: 0 cas.service-registry.cache.cache-size: 0 we now keep a copy of the sorted list of services, which makes processing much faster. With this change in place and enabled (size set to 0), _the benchmark time drops again to 24 seconds!_ This might be a new option to enable if you have clearly identified that the service registry does not perform well in your CAS deployment. Availability ============ The performance improvements described in this document will ultimately be available in CAS `8.0.0`, and you should be able to benefit from them as of `8.0.0-RC2`. On behalf of the CAS project, [Jerome LELEU](https://github.com/leleuj) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Performance+improvements+on+the+service+registry&url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&title=Performance+improvements+on+the+service+registry "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&title=Performance+improvements+on+the+service+registry "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&name=Performance+improvements+on+the+service+registry "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&title=Performance+improvements+on+the+service+registry "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&title=Performance+improvements+on+the+service+registry "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F09%2Fperformance-improvements-service-registry%2F&t=Performance+improvements+on+the+service+registry "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Summer 2017 uPortal Roadmap Update – Apereo Community Blog Summer 2017 uPortal Roadmap Update ================================== Wednesday, Aug 30, 2017 2 minute read Summary ======= Almost two dozen conference attendees came to the uPortal Roadmap BOF at the Open Apereo 2017 conference. Prior to the conference, members of the community were invited to submit and comment on roadmap ideas in [a shared google doc](https://goo.gl/wZ7VTC) . 15 items were suggested but during the BOF we focused on which ones we anticipated someone would actually devote time and resources to. In the end, we anticipate making progress over the next year on the 8 items listed below. Release of uPortal 5 ==================== This long awaited release includes a refactoring of the build system using a Gradle-based build in the [uPortal-start](https://github.com/Jasig/uPortal-start) repository. We are currently aiming for a mid-September release candidate and feature freeze followed by a GA release by the end of October. Semantic versioning and releasing often ======================================= While no specific action items were identified, we renewed our commitment to ship releases more often and use semantic versioning when doing so. We should not be afraid of doing more frequent major releases. Better web service API documentation ==================================== Most of the existing web service APIs are not well documented. This makes them harder to use or sometimes even be aware of. There was a commitment to documenting new APIs that are developed. UW-Madison committed to documenting APIs it depends on. Easier adoption: Complete and accurate documentation ==================================================== A work in progress, we are looking at shifting uPortal 5 documentation to github.io with an initial focus on installing and configuring core uPortal. This remains [in early stages](https://jasig.github.io/uPortal/) and the details are in flux. Discussion continues on the uportal email lists. Separation of presentation layer ================================ This will be a work in progress for some time. While uPortal Home has adopted this modern architecture, uPortal core is being refactored piecemeal. It is anticipated that developers will move towards more modularization as they work with specific parts of the codebase. uPortal install - demo edition (fka QuickStart) =============================================== This would be a modern version of the quick start we previously published with uPortal releases. Someone interested in seeing uPortal in action would be able to download the demo edition and have it running locally within minutes. uPortal install - front end developer edition ============================================= While the demo edition is targeted for demonstration purposes only, this version of uPortal is an easy way for front end developers to stand up a uPortal server locally, turn it on, and start developing the front ends of applications. The only additional requirements would be downloading a JDK and git client and cloning the [uPortal-start](https://github.com/Jasig/uPortal-start) repo. Develop a lightweight uPortal ecosystem incubation process ========================================================== Developers in the uPortal community are doing interesting innovative work for local campuses that others could benefit from yet this work cannot be easily adopted. This roadmap item is an effort to lower the barriers to local work participating more directly in the greater uPortal ecosystem. The uPortal Steering Committee is close to issuing a draft of a process that, given certain assumptions, will make it easier for someone to share code without having to go through the full Apereo project incubation process. Everyone has some code to share. Borrowing from the Sirius Cybernetics Corporation, “Share and enjoy!” [Jim Helwig](mailto:jim.helwig@wisc.edu) uPortal Steering Committee Chair Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Summer+2017+uPortal+Roadmap+Update&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&title=Summer+2017+uPortal+Roadmap+Update "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&title=Summer+2017+uPortal+Roadmap+Update "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&name=Summer+2017+uPortal+Roadmap+Update "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&title=Summer+2017+uPortal+Roadmap+Update "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&title=Summer+2017+uPortal+Roadmap+Update "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F30%2Fsummer-2017-uportal-roadmap-update%2F&t=Summer+2017+uPortal+Roadmap+Update "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Feedback on draft Apereo strategy – Apereo Community Blog Feedback on draft Apereo strategy ================================= Wednesday, Apr 4, 2018 13 minute read In which I comment on [the draft strategic plan Apereo articulated for 2018](https://www.apereo.org/content/apereo-foundation-strategic-planning) . As often: I am speaking here wearing only my individual contributor hat. Feedback on Apereo strategy: focus on revenue to achieve sustainability ======================================================================= TL;DR: **Emphatically focus on recurring revenue to achieve sustainability. Aggressively defer everything not focused upon this.** Context ------- * [Apereo strategic plan](https://www.apereo.org/content/apereo-foundation-strategic-planning) * Apereo [failed to secure enough recurring revenue](https://groups.google.com/a/apereo.org/d/msg/sakai-pmc/gta0LD1phrg/E0-diMLeAAAJ) to retain a full-time position supporting Sakai (Sakai-specific funding) and more generally roughly broke even on recurring membership revenue. Vision ------ (what future state are we trying to bring about?) TL;DR: **Most higher education institutions will collaboratively develop, maintain, and locally implement free and open source software solutions meeting its needs, at all scales, and in all ways, doing this through and facilitated by Apereo.** Unpacking this: **Higher education will collaboratively develop, maintain, and locally implement free and open source software solutions meeting the needs of higher education.** These will be directly valuable (delivering effective user experiences to higher education constituents is awesome) and will be indirectly valuable in the pitfalls they avoid, the choices they afford, and the effect they have on the proprietary software offered to higher education through inspiration and through competition. Higher education will do this **at all scales**, for example both at the handy little WordPress plug in end of things and the comprehensive lecture capture solution or learning management system or ERP end of things. Higher education will do this **in all ways**, and notably, **not just through coding.** The activities of collaboration and maintenance of effective free and open source software solutions meeting the needs of higher education are so very much more than just coding or even of developing novel software solutions. There’s value in communities of practice, in context for understanding higher-education-specific perspectives on more general open source software solutions, in exerting higher-education-serving influences on open source software projects with wider contexts beyond higher education. To give an example: apparently [WordPress powers more than 30% of the Web](https://wordpress.org/about/features/) , including a great many sites in and around higher education. Higher education doesn’t need its own WordPress-like thing. But higher education may very well have particular needs for plugins for WordPress, for ways of using WordPress, for problems to solve with WordPress, for experiences to share. There’s a there there in the “in higher education” part of “Using WordPress in higher education”. Higher education might particularly need WordPress plugins to fulfill accessibility and usability expectations, and might particularly need clarity about what WordPress implementation choices are and are not consistent with higher education’s especial needs to provide accessibility. There’s worthwhile work to be done and insights to share to facilitate higher education success in leveraging WordPress. **Apereo will be the organization that enables higher education to succeed at this collaborative development, maintenance, and local implementation**. Apereo will be the context for this work, particularly facilitating the cross-institutional aspects of this and the natural handoff of participation from institutions to institutions as time and circumstances evolve. Apereo will deliver identifiable value to higher education, value to any given member institution in excess of the membership fees borne by that institution. To give an example: Sakai is a free and open source by for and about higher education learning management system. Such a thing should very much exist and be a viable option. It does and is. Sakai deserves significant sustaining resources. The preeminent actually open source learning management system for higher education ought to be tremendously supported. Apereo qua Apereo should be adding lots of value to this. **Most higher education institutions will be Apereo members, because most higher education institutions will be (already are) making significant use of free and open source software solutions** and that use will be more effective and more confident because of the value Apereo is adding to it. If they’re not using Sakai as a learning management system or OpenCast for lecture capture or an open source ERP, they’re most certainly using WordPress or Drupal somewhere or are generating and transforming CSV files representing institutional data or integrating across SaaS vendor products or educators are using open source text editors to author lesson plans or… There’s tremendous breadth of opportunity for higher education to benefit from open source, so there’s tremendous breadth of opportunity for Apereo to add value to higher education’s benefiting from open source. **Strategy:** (how are we going to get to achieve this vision?) First and foremost, **Apereo must achieve critical mass of recurring revenues (membership fees) to achieve sustainability.** There are all sorts of opportunities to add value to collaborative open source in higher education. But to meaningfully pursue these, to meaningfully impact the world over the longer term, Apereo needs to exist with enough substance to be able to, well, do things. The thing about unsustainable things is that they’re really hard to sustain. Working towards the vision will require sustained effort for many years (forever?) and so achieving sustainability is essential. So here’s the strategy: 1. Increase revenue 2. Use all available resources, including revenue, to further increase revenue. 3. Increase revenue 4. Apply staff and other efforts to provide members a positive return on their membership investment. Apereo must deliver recognizable value to the members, value enough that the members are saying “Sure am happy to be paying for that membership, because we’re clearly getting more out of Apereo than we’re paying into it.” This will stabilize and retain revenue. 5. Increase revenue through the increased memberships as more and more of higher education sees Apereo as a source of value very much worth sustaining. 6. Increase revenue through (carefully targeted?) increased membership fees as more Apereo members are realizing more value from their Apereo membership. 7. Use the increased revenue to add more value to higher education. Use the increased value to higher education to secure more revenue. Repeat until the vision is achieved (in practice, forever). The most important challenge here is that at the early end of this strategy Apereo is adding less value to higher education and so revenue, in the form of memberships, are harder to secure, whereas at the later end of this strategy Apereo is adding more value to higher education and so revenue, in the form of memberships, is easier to secure. **The most existential risk is in the early phases.** **So the thing to do is to focus on escaping the early phases.** So here’s what this strategy means: **Focus entirely on things that will increase revenue (membership). Defer everything that won’t affect revenue (membership).** Considering incubating a new open source software project? Is that project going to bring in more membership revenue? Yes? Pull it in. No? Hold off. Having a presence anywhere? Is that presence going to bring in more members, or is it necessary to retain existing members? No? Don’t go. Is securing ICLAs going to bring in new or retain members? Great, do it, more members are absolutely essential to sustainability. It’s not going to impact membership? Suspend the whole program. Is re-licensing a project from a New BSD license to an Apache2 license going to bring in more members, or is it necessary to retain existing members? Yes? Great, undertake that hassle. No? Defer it. Considering a partnership? Neat. Will it increase recurring membership revenue? Go for it. It won’t? It’s a distraction, defer it. Apereo cannot afford to do anything that isn’t increasing recurring revenue. Doing anything that isn’t increasing recurring revenue has the opportunity cost of _not_ doing something more likely to increase revenue. Intentionally navigating these tradeoffs is essential to maximizing Apereo’s odds of having a meaningful influence a decade from now. **This is painful. Opportunities that by other measures would be worthwhile must be foregone. But this is how to get to sustainability, and without sustainability, nothing else Apereo does is going to matter much over the long term.** **The idea isn’t to _never_ do anything other than pursue recurring revenue. The idea is prioritize pursuing recurring revenue until recurring revenue is sufficient to afford the luxury of applying resources to pursue the organizational mission.** Feedback on Apereo draft ------------------------ With this vision (higher education succeeding wildly by collaboratively meeting its needs through free and open source software) and strategy (achieve critical mass to enable Apereo adding value and doing so sustainably) in mind, here’s my feedback on Apereo’s draft strategic themes: ### 1\. Membership, Financial Health and Fundraising > In 2018 Apereo will focus on recruiting adopters of Apereo software and other educational and commercial organisations into an expanded foundation membership. Yes, do that. All of higher education should be Apereo members. Get far enough towards that to achieve sustainability. Consider reviving the individual membership program. Consider ways to price discriminate so that institutions that can pay more do. ### 2\. Foundation Services & New Ideas > 2018 will see a review of key Apereo services to support the community, together with the elaboration of a process for introducing new services and areas of activity, and reviewing - and potentially retiring old ones. If adding a service will yield more members or is necessary to retain members, do it. If it won’t affect membership, defer it or suspend it. One kind of service that might widen memberships are those that affect breadth. A better implementation of more active discussion lists or chat might enable Apereo to widen scope into e.g. higher education knowledge sharing around WordPress plugins. Become the place for higher education to talk WordPress, to collaborate, to share – and maybe Apereo could reach 500 more people across 100 more institutions. Pull in 10% of those institutions as members and maybe we’re getting somewhere. Curtail services offered to non-members who aren’t going to become members. Look for opportunities to expand into spaces and activities that will increase membership with low or no additional infrastructure and services commitments. Job posting board reserved for members? Maybe members would value being able to post opportunities (presumably, about working with open source for the institution) to a context that reaches IT professionals likely to have experience with higher education and with open source? Speakers or consultants directory? Maybe members would value more ready leads on expertise about open source in higher education. Institutional project matching service? Maybe members would value leads on what others have experienced with specific open source technologies or attempting to leverage open source for specific kinds of projects. _These may be terrible ideas._ The lens for evaluating them is whether they will retain and increase membership revenue. ### 3\. Software Community Health > Apereo will explore the potential for a light-touch framework for expressing and communicating the health of constituent software communities during the course of 2018, as a contribution to greater transparency and adoption. This doesn’t sound like it will attract or retain membership revenues. If this isn’t going to bring in more members and it’s not essential to retain existing members, defer it. Apereo just can’t afford this. The constituent software communities are however healthy they are. They’ll do what they can do, or not, to determine and communicate health. There are [some badging, checklisting, health assessing efforts afoot](https://groups.google.com/a/apereo.org/d/msg/open/PWWF0xtz480/GwWd3sE5AgAJ) more generally in open source. That’ll have to be good enough. ### 4\. Communications, Outreach and Engagement > Apereo will expand its communications efforts across three principle audience axes - specific to role (CIO, Faculty, Learning Technologist, Student, Researcher), to interest area (specific software, theme or topic), and geographical region or country. Cut this down to only the communication efforts that will attract and retain members. That probably means focusing on helping CIOs to see value and urgency in Apereo membership, maybe targeting institutions that have already adopted Apereo software significantly (so, most likely to care) and in regions likely to be able to afford an Apereo membership (so, more likely to impact overall revenue more). It’s not that other kinds of communication aren’t valuable. It’s that Apereo can’t afford it until it can. > Above-campus or cloud-based service provision, and its interaction with open source software, is a theme of specific interest that will be assigned priority in the coming year, particularly in terms of approaches taken in different parts of the world. If there’s any way to defer this, defer it. It sounds like a distraction from securing memberships. > Communications and outreach is a critical enabler of objectives around membership and financial health. In particular community members will be encouraged and equipped to represent their engagement in Apereo activities, and use of Apereo software, as they engage with other associations they are active within - EDUCAUSE, AXIES, ALT etc. This sounds promising. > The Foundation will continue to support a range of global, regional and individual software community events over the course of the coming year, seeking economies of scale by combination or linkage where appropriate, and working with partner organisations to increase effectiveness and reduce costs. Do as little of this as Apereo can get away with and leverage it as much as possible to draw in more members and retain existing members. ### 5\. Partnerships > Apereo will continue to seek partnerships with organisations with missions that overlap its own, or are complimentary. Pursue new and invest in existing partnerships only insofar as these will pull in more members and retain existing members. Consider reworking existing partnerships. For example, every French university should be an Apereo member. Apereo cannot afford to forgo this revenue, and ESUP cannot afford _not_ to support Apereo in this way over the longer term in order to make the open source software ESUP relies upon more sustainable. > We will act to promote LAMP as a solution for smaller institutions, and deepen our collaboration with ESUP-Portail, as it continues to grow the adoption of, and contribution to, an increasing range of Apereo software in France. Only do this if it’s going to increase membership. Investing in LAMP and ESUP should be through the lens of expected recurring revenue returns on that investment. ### 6\. Development Opportunities and Recognition Programs > It is appropriate that we review progress so far to encourage and resource further development, and additional strands of these \[recognition\] activities. 2018 will also see the exploration of a series of developmental activities for Apereo community participants, beginning to unlock the potential for further sharing of expertise across the broad community. Apereo can’t afford this. I imagine no institution became or remained a member because of an Apereo fellowship or an ATLAS award. (The Fellowship program in particular seems to have an interesting track record of fellows exiting Apereo contexts soon after their fellowship). by Andrew Petro as individual contributor Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Feedback+on+draft+Apereo+strategy&url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&title=Feedback+on+draft+Apereo+strategy "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&title=Feedback+on+draft+Apereo+strategy "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&name=Feedback+on+draft+Apereo+strategy "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&title=Feedback+on+draft+Apereo+strategy "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&title=Feedback+on+draft+Apereo+strategy "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F04%2F04%2Fapereo-strategy%2F&t=Feedback+on+draft+Apereo+strategy "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.1.x Load Tests by Lafayette College – Apereo Community Blog CAS 5.1.x Load Tests by Lafayette College ========================================= Monday, Sep 25, 2017 6 minute read **Contributed Content** [Carl Waldbieser](mailto:waldbiec@lafayette.edu) , an active member of the CAS community, was kind enough to share this analysis. Lafayette College has an active user base of XXX and regularly records 78 CAS authentication events/minute on average with peaks of 220 events/minute. In preparation of deploying CAS `5.1.x`, locust.io was used to put CAS under load and soak and stress tests. Results indicate that CAS `5.1.x` deployed with reasonable hardware in a multi-node deployment architecture using nginx+ and hazelcast. Deployment architecture, testing scenarios and results are detailed in the rest of this blogs post. In preparation for a service upgrade from CAS server version `5.0.x` to version `5.1.x`, load testing trials were conducted on the CAS stage environment. All trials were carried out against the same deployment architecture, with all nodes configured identically. The deployment architecture and nodes have not changed since the last load test was conducted around April 25, 2017. Overview ======== The deployment architecture itself consists of 3 virtual machine nodes: * cas3.stage.lafayette.edu * cas4.stage.lafayette.edu * cas5.stage.lafayette.edu ![architecture-500x538](https://user-images.githubusercontent.com/1205228/30987126-c3d0618e-a4a2-11e7-8817-122c954752d3.png) Each node has 3.7 GiB real memory available to it and 2 CPUs. The characteristics of the CPUs are as follows: * Architecture: x86\_64 * CPU op-mode(s): 32-bit, 64-bit * Byte Order: Little Endian * CPU(s): 2 * On-line CPU(s) list: 0,1 * Thread(s) per core: 1 * Core(s) per socket: 2 * Socket(s): 1 * NUMA node(s): 1 * Vendor ID: GenuineIntel * CPU family: 6 * Model: 42 * Model name: Intel Xeon E312xx (Sandy Bridge) * Stepping: 1 * CPU MHz: 1899.999 * BogoMIPS: 3799.99 * Hypervisor vendor: KVM * Virtualization type: full * L1d cache: 32K * L1i cache: 32K * L2 cache: 4096K * NUMA node0 CPU(s): 0,1 The nodes are deployed behind an Nginx+ proxy in an active-active-active configuration. The nodes share ticket information using encrypted hazelcast messages, so any application state is shared. The Test Swarm ============== The testing framework used was [**locust.io**](http://locust.io/) , a Python based load testing framework. The test suite deploys a fixed number of “locusts” against a web site. The initial population ramps up with a configurable “hatch rate”. In the tests, locusts were conceptually divided into 3 “lifetime” categories: * Short-lived locusts live approximately 60 seconds. * Medium-lived locusts last for approximately 5 minutes. * Long-lived locusts exist for approximately 2 hours. The category to which a given locust is assigned is randomly determined with a ratio of short : medium : long being 7:2:1. Ideally, 70% of the population is short-lived, 20% is medium lived, and 10% is long-lived. The lifetime of a locust determines how long it will retain and make use of a single web SSO session. Short-lived locusts discard their sessions quickly. Long-lived locusts hold on to them for considerable time. All locusts continually request and validate service tickets throughout their lives every 5-15 seconds. All locusts are only 25% likely to log out upon their deaths. The CAS service must continue to track TGTs of locusts that have not logged out until the ticket expires, so this behavior can put pressure on the memory storage resources of the nodes. Each locust uses credentials taken randomly from one of 9 test accounts. Each locust has a 1% chance of entering an erroneous password for an account. Locusts that fail to authenticate will die immediately. When a locust dies, it is reborn immediately. Its lifetime category remains the same, but its SSO session and all other random parameters are reset. SSO Session Tracking ==================== SSO sessions are tracked by the TGTs they produce. Any event that creates or destroys a TGT is logged, and these observations are plotted after the fact. Because only 25% of locusts will explicitly end a session, many sessions will accumulate and consume storage in the CAS ticket registry until the session times out. Using the probability of long, medium, and short lived locusts in the population, the actual number of active sessions at any time is estimated. The charts produced should provide a reasonable estimate of how many simultaneous sessions are being managed by the CAS service at any given time. | | | | --- | --- | | Trial | 01 | | Date / duration | 2017-09-05 from 09:30:00-04:00 until 16:44:00-04:00 (7h 14m) | | Number of locusts | 150 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940336-9615a106-a3ed-11e7-99c9-4867207a1d1c.png) The first trial produced authentication events at a rate of 1,800.11 events/minute. The majority of these were service ticket creation and validation events. The trial was concluded with no noticeable degradation in performance. ![image](https://user-images.githubusercontent.com/1205228/30940375-be2d7b6e-a3ed-11e7-834f-e36611196c67.png) Net SSO sessions increased at a rate of 73.5 sessions per minute until the idle session timeout duration was reached. | | | | --- | --- | | Trial | 02 | | Date / duration | 2017-09-20, 09:00:00-04:00 - 17:00:00-04:00 (8 hours) | | Number of locusts | 50 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940409-dfedd104-a3ed-11e7-9dad-2a612d620a41.png) An average of 600.46 events per second were handled by the CAS service under load during this trial. There were no noticeable service disruptions. ![image](https://user-images.githubusercontent.com/1205228/30940430-f7330316-a3ed-11e7-978a-85e894ee1d82.png) Net SSO sessions increased at a rate of 27.4 sessions per minute, until the session idle timeout duration was reached. | | | | --- | --- | | Trial | 03 | | Date / duration | 2017-09-22, 09:05:00-04:00 - 09:33:00-04:00 (28 minutes) | | Number of locusts | 175 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940483-1a8fbdae-a3ee-11e7-834c-c4195f541e1f.png) ![image](https://user-images.githubusercontent.com/1205228/30940514-2ff0260c-a3ee-11e7-8639-baa84dea93a3.png) Net SSO sessions increased at a rate of 82.9 sessions per minute. | | | | --- | --- | | Trial | 04 | | Date / duration | 2017-09-22, 11:49:00-04:00 - 12:30:00-04:00 (41 minutes) | | Number of locusts | 200 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940569-5556cda6-a3ee-11e7-8264-e8e74b0285ff.png) ![image](https://user-images.githubusercontent.com/1205228/30940590-6b3bdfee-a3ee-11e7-831b-9a94a8043b50.png) Net SSO sessions increased at a rate of 93.0 sessions per minute. | | | | --- | --- | | Trial | 05 | | Date / duration | 2017-09-22, 15:10:00-04:00 - 15:47:00-04:00 (37 minutes) | | Number of locusts | 125 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940615-8191ee50-a3ee-11e7-984b-7baadd2fc58d.png) ![image](https://user-images.githubusercontent.com/1205228/30940640-92a1097e-a3ee-11e7-985d-99655421f6aa.png) Net SSO sessions increased at a rate of 64.0 sessions per minute. | | | | --- | --- | | Trial | 06 | | Date / duration | 2017-09-22, 16:35:00-04:00 - 16:50:00-04:00 (20 minutes) | | Number of locusts | 250 | | Hatch rate | 10/s | ![image](https://user-images.githubusercontent.com/1205228/30940675-ac953d28-a3ee-11e7-9864-46c3d1474961.png) ![image](https://user-images.githubusercontent.com/1205228/30940692-bf9d0266-a3ee-11e7-9ad0-ada30272a356.png) Net SSO sessions increased at a rate of 124.6 sessions per minute. Effect of Number of Locusts on Mean Rate of Events -------------------------------------------------- Observations from the previous trial and the current trial were plotted in order to give some sense of the influence the number of locusts in the test swarm would have on the mean rate of events processed by the service each minute. The data suggest that for each additional locust added, there are approximately 12 more events generated per minute. ![image](https://user-images.githubusercontent.com/1205228/30955982-75549116-a442-11e7-8f9a-d250926302d4.png) Observed and Predicted Mean Rates --------------------------------- | | | | | --- | --- | --- | | | mean\_rate | mean\_rate\_observed | | locusts | | | | 0 | 1.09 | N/A | | 25 | 300.51 | N/A | | 50 | 599.93 | 600.46 | | 75 | 899.35 | N/A | | 100 | 1,198.76 | N/A | | 125 | 1,498.18 | 1,496.84 | | 150 | 1,797.60 | 1,800.11 | | 175 | 2,097.02 | 2,095.36 | | 200 | 2,396.43 | 2,395.12 | | 225 | 2,695.85 | N/A | | 250 | 2,995.27 | 2,996.53 | | 275 | 3,294.69 | N/A | | 300 | 3,594.10 | N/A | | 325 | 3,893.52 | N/A | | 350 | 4,192.94 | N/A | Effect of Number of Locusts on Increase in SSO Sessions ------------------------------------------------------- The rate at which net new SSO sessions are created during the period from the beginning of a trial until the discarded TGTs begin to timeout is also useful. Since it seems to be a linear function of the number of locusts, this figure can be used to predict the number of SSO sessions that will be present were a trial to reach the session timeout mark. ![image](https://user-images.githubusercontent.com/1205228/30955909-366a6f0c-a442-11e7-93b7-844e57c343ad.png) Conclusions =========== Measurements 1 taken from the production CAS service from September 1-22, 2017 during normal business hours (9am to 5pm) have the following characteristics: | | | | --- | --- | | mean | 78 events / minute | | median | 75 events / minute | | mode | 59 events / minute | | max | 220 events / minute | | min | 8 events / minute | | standard deviation | 28 | The data suggests that the production CAS service is operating well under the maximum sustainable load, and should have plenty of capacity to spare for temporary spikes in utilization. [Carl Waldbieser](mailto:waldbiec@lafayette.edu) 1 Splunk query for Sep 1-21, 2017: index=auth_cas (sourcetype=cas OR sourcetype=cas5) action=* date_hour >= 9 date_hour <= 16 date_wday!="saturday" date_wday!="sunday" | bin _time span=1m | stats count by _time | stats min(count) max(count) mean(count) mode(count) median(count) stdev(count) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.x+Load+Tests+by+Lafayette+College&url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&title=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&title=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&name=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&title=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&title=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F25%2Fcas51-perfresults-LafayetteCollege%2F&t=CAS+5.1.x+Load+Tests+by+Lafayette+College "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Forced Authentication with Apereo CAS – Apereo Community Blog Forced Authentication with Apereo CAS ===================================== Monday, Feb 26, 2018 5 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This post summarizes a recent conversation I had with a few colleagues on strategies one may use to support forced authentication with CAS and the journey we went on to discover and diagnose a few integration issues with an application protected by [mod\_auth\_cas](https://github.com/apereo/mod_auth_cas) . Let’s begin. The Problem =========== Some CAS deployments present with the rather common requirement to challenge the user to re-enter credentials in some applications. To accommodate this, it’s likely that deployments may opt into creative yet _non-standard_ solutions such as applications themselves prompting for credentials to replay them in a back-end call. This is problematic for a number of reasons: * Applications present a differently styled login form. * Applications directly get involved in handling user credentials. Last but most important: > The only thing necessary for the triumph of evil is for good men to replay credentials. So, is there a way to force re-authentication with CAS? Forced Authentication ===================== The [CAS protocol](https://apereo.github.io/cas/development/protocol/CAS-Protocol-Specification.html) has a specific parameter dedicated to forced authentication, named as `renew=true`. If supplied as part of an authentication request: > Single sign-on will be bypassed. In this case, CAS will require the client to present credentials regardless of the existence of a single sign-on session with CAS. If supplied as part of a validation request: > Ticket validation will only succeed if the service ticket was issued from the presentation of the user’s primary credentials. It will fail if the ticket was issued from a single sign-on session. **Version Caveat** If you have deployed CAS `5.2.x`, you need to at least be on `5.2.3` for the renew parameter to function correctly. It goes without saying that `renew=true` works best if you wish to let the application make that decision when needed. Alternatively, you may also control this behavior centrally by [marking the relevant application/service](https://apereo.github.io/cas/development/installation/Configuring-Service-Access-Strategy.html#disable-service-sso-access) in the CAS service registry (JSON file, etc) such that it would not participate in SSO and would always be asked for credentials regardless of what the application says. Real Life Example ================= Let’s say we have an application at `https://secure-dev.example.org/groups/` that has SSO enabled. We need one subfolder of that app at `https://secure-dev.example.org/groups/reauth/` to require re-authentication to access. So, (assuming a [JSON service registry](https://apereo.github.io/cas/development/installation/JSON-Service-Management.html) ), we have one service registration record requiring SSO to cover any app on the host. Note that SSO participation is by default on and it’s perfectly good for us to practice laziness here. { @class: org.apereo.cas.services.RegexRegisteredService serviceId: ^https?://[\w]+-dev.example.org/.* name: secure-dev.example.org id: 1200 description: Everything evaluationOrder: 1200 } We set up another service registration with a lower (i.e. processed first; think of it like the Olympics rankings) evaluation order and `ssoEnabled: false` to cover the subfolder: { @class: org.apereo.cas.services.RegexRegisteredService serviceId: ^https?://[\w]+-dev.example.org/groups/reauth/.* name: secure-dev.example.org Groups Reauth id: 1200 description: Groups Reauth evaluationOrder: 1100 accessStrategy: { @class: org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy ssoEnabled: false } } Our application, protected by [mod-auth-cas](https://github.com/apereo/mod_auth_cas) has the following configuration: AuthType CAS AuthName "CAS" CASScope /groups/reauth CASAuthNHeader SOME_LoginID CASScrubRequestHeaders On CASCookie MOD_AUTH_CAS_REAUTH Options None require valid-user Order allow, deny Allow from all AuthType CAS AuthName "CAS" CASScope / CASAuthNHeader SOME_LoginID CASScrubRequestHeaders On CASCookie MOD_AUTH_CAS Options None require valid-user Order allow, deny Allow from all At first glance, this should do exactly as you would expect if only it weren’t for a small caveat. The Caveat ---------- If the request begins with `https://secure-dev.example.org/groups/reauth/` first and then goes to `https://secure-dev.example.org/groups/`, the user would be prompted to log in - as expected because those locations use different cookie names. However, once logged in, the user would get caught in a redirect loop between `mod_auth_cas` and CAS. It turns out that there were two issues. One was that more precise location is placed first in the config: CASCookie MOD_AUTH_CAS_REAUTH CASScope /groups/reauth/ ... CASCookie MOD_AUTH_CAS CASScope / … This made mod\_auth\_cas use the last applicable `CASScope` directive which meant that the `MOD_AUTH_CAS_REAUTH` cookie was being set at `Path=/` instead of `Path=/groups/reauth/`. This might have been fine except for the way mod\_auth\_cas parses the values in the `Cookie` header. It _tokenizes_ the header on `;` then iterates through each cookie string by matching the number of characters equal to the length of the expected cookie name defined by the `CASCookie` directive. If the cookie string starts with the `CASCookie` name, it skips the next character, assuming that it’s `=` and takes all remaining characters. So what was happening was that, given the cookie header `Cookie: BLARG=WuzzleWuzzle;MOD_AUTH_CAS_REAUTH=foofoofoofoo;`, mod\_auth\_cas was matching the cookie string `MOD_AUTH_CAS_REAUTH=foofoofoofoo` with the `CASCookie` name of `MOD_AUTH_CAS`. Finding that, it skipped the `_` and returned `REAUTH=foofoofoofoo` as the CAS cookie value. That isn’t a valid format for a CAS cookie so it redirected back to CAS. CAS, finding a valid `TGC`, then performed SSO and redirected back to the service. The service ticket was never validated because mod\_auth\_cas checks for the presence of a cookie before it checks for the ticket parameter. Finding the invalid cookie again, it redirected back to CAS and so on until the browser threw up its hands in defeat. So, just something to look out for: * When using mod\_auth\_cas, configuration elements that share a scope (e.g. `/groups`, `/groups/reauth`) **MUST be listed in order of least to most precise**. * The `CASCookie` directives that share a scope **MUST NOT be substrings of each other**. Summary ======= I hope this review was of some help to you and I am sure that both this post as well as the functionality it attempts to explain can be improved in any number of ways. Please feel free to [engage and contribute](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) as best as you can. …and of course, a very special thanks to all colleagues who took part in this post, exchanged dialogue, verified behavior and generously took the time to share their analysis and findings. Thank you. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Forced+Authentication+with+Apereo+CAS&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&title=Forced+Authentication+with+Apereo+CAS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&title=Forced+Authentication+with+Apereo+CAS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&name=Forced+Authentication+with+Apereo+CAS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&title=Forced+Authentication+with+Apereo+CAS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&title=Forced+Authentication+with+Apereo+CAS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fforcedauth-modauth-cas%2F&t=Forced+Authentication+with+Apereo+CAS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Friday, Dec 20, 2019 1 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects surrogate authentication and impersonation. This post will be updated with additional details once the grace period has passed. Affected Deployments ==================== The attack vector applies to deployments of the CAS server for the following versions: - 5.3.x - 6.0.x - 6.1.x Severity ======== It is recommended that upgrades be carried out to removes any chances of security breaches. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Timeline -------- The issue was originally reported to the CAS application security team on December 18th, 2019 and upon confirmation, CAS was patched on December 20th. Procedure --------- ### 5.3.x Modify your CAS overlay to point to version `5.3.15`. A snippet of a `pom.xml` for a CAS overlay follows: 5.3.15 ### 6.0.x Modify your CAS overlay to point to the version `6.0.8`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.0.8 ### 6.1.x Modify your CAS overlay to point to the version `6.1.3`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.1.3 ### 6.2.x Modify your CAS overlay to point to the version `6.2.0-RC2`, _when released_. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.2.0-RC2 Support ======= CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F20%2Fsurrogatevuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Saturday, Feb 8, 2020 1 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects the security and cypto operations of the authentication webflow states. Affected Deployments ==================== The attack vector applies to deployments of the CAS server for the following versions: - 5.3.x - 6.0.x - 6.1.x Severity ======== Details will be posted here publicly once the [grace period](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) has passed. Severity is considered low, though it is recommended that upgrades be carried out to removes any chances of security breaches. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Timeline -------- The issue was originally reported privately via a direct email on January 21st, 2020 and upon confirmation, CAS was patched on February 7th, 2020. Procedure --------- ### 5.3.x Modify your CAS overlay to point to version `5.3.15.1`, _when released_. A snippet of a `pom.xml` for a CAS overlay follows: 5.3.15.1 ### 6.0.x Modify your CAS overlay to point to the version `6.0.8.1`, _when released_. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.0.8.1 ### 6.1.x Modify your CAS overlay to point to the version `6.1.5`, _when released_. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.1.5 ### 6.2.x Modify your CAS overlay to point to the version `6.2.0-RC3`, _when released_. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.2.0-RC3 Support ======= CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F02%2F08%2Fwebflowcrypto%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Friday, Jul 24, 2020 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects the handling of user credentials managed by the ticket registry. All ticket registries supported by CAS are impacted by the issue, and specially more so if the ticket registry relies on persistent storage. This post will be updated with additional details once the grace period has passed. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.1.x - 6.2.x If your CAS version is not listed above and is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that _Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS application security working group](https://apereo.github.io/cas/Mailing-Lists.html#cas-public-security-list-cas-appsec-publicapereoorg) to learn more about this security vulnerability report. Severity ======== It is _STRONGLY_ recommended that upgrades be carried out to removes any chances of security breaches. The problem stems from the fact that user credentials during authentication events are captured and stored alongside the ticket-granting ticket in serialized form, which becomes a problem once the ticket itself is stored in the registry. This issue is masked if the ticket registry of choice does not support persistence (i.e. keeping data only in memory) or if the registry is configured to sign and encrypt data. In either of such scenarios, the impact is lessened although for best results, it would be best to apply the recommended patches outlined below. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Timeline -------- The issue was originally reported to the CAS application security team on July 23rd, 2020 and upon confirmation, CAS was patched on July 24th, 2020. Procedure --------- ### 6.1.x Modify your CAS overlay to point to the version `6.1.7.1`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.1.7.1 ### 6.2.x Modify your CAS overlay to point to the version `6.2.1`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.2.1 Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS application security working group](https://apereo.github.io/cas/Mailing-Lists.html#cas-public-security-list-cas-appsec-publicapereoorg) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F07%2F24%2Fcredvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - dotCMS SAML2 Integration – Apereo Community Blog Apereo CAS - dotCMS SAML2 Integration ===================================== Thursday, Sep 6, 2018 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Keith Conger of Colorado College, an active member of the CAS community, was kind enough to contribute this guide. dotCMS is an open source content management system (CMS) written in Java for managing content and content-driven sites and applications. As a SAML2 service provider, dotCMS can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) Configuration ============= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the dotCMS relying-party registration record in JSON definition files. The JSON file to contain the dotCMS registration record would be as follows: { @class: org.apereo.cas.support.saml.services.SamlRegisteredService serviceId: your-dotcms-entity-id name: dotCMS id: 1 description: dotCMS Content Mangement System attributeReleasePolicy: { @class: org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy attributeFilter: { @class: org.apereo.cas.services.support.RegisteredServiceMutantRegexAttributeFilter patterns: { @class: java.util.LinkedHashMap memberOf: (?<=CN=)([^,]+)->$1 } } allowedAttributes: [\ java.util.ArrayList\ [\ mail\ givenName\ memberOf\ sn\ ]\ ] } metadataLocation: https://path.to.your.dotcmscloud.com/dotsaml/metadata/3dd4ad1e-e2ab-492e-a428-87af35d341fd signAssertions: true skipGeneratingSubjectConfirmationNotBefore: true signResponses: true } A few things to point out: * You will of course need to adjust the `serviceId` and `metadataLocation` to match your data and dotCMS instance. * Make sure the `AssertionConsumerService` endpoint in the dotCMS metadata contains the `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect` binding. * Make sure CAS has retrieved the allowed attributes (i.e. `mail`, `givenName`, etc) listed in the JSON definition file. * Regarding the `memberOf` attribute, the values fetched from the directory are typically in the format of `CN=WebAdmin,OU=something,OU=something,DC=somewhere,DC=edu`. The service provider requires only the `CN` portion of the attribute value where CAS would need to produce `WebAdmin` instead of `CN=WebAdmin,OU=something,OU=something,DC=somewhere,DC=edu`. This bit is handled via the `RegisteredServiceMutantRegexAttributeFilter` element in the JSON file. Finale ====== Thanks to Keith Conger of Colorado College who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+dotCMS+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&title=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&title=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&name=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&title=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&title=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F06%2Fcas53-dotcms-saml2-integration%2F&t=Apereo+CAS+-+dotCMS+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Microsoft Office 365 SAML2 Integration – Apereo Community Blog Apereo CAS - Microsoft Office 365 SAML2 Integration =================================================== Thursday, Dec 6, 2018 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Paul Spaude of Unicon, Inc was kind enough to contribute this guide. Office 365 is a line of subscription services offered by Microsoft, as part of the Microsoft Office product line. As a SAML2 service provider, Office 365 can be integrated with CAS running as a SAML identity provider and this blog post provides a quick walkthrough of how to make that integration possible. Our starting position is based on the following: * CAS `5.3.x` * Java 8 * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) Office 365 Configuration ======================== The following resources should come in handy: * [Azure Active Directory: Single Sign-On SAML protocol](https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol) * [Office 365 – Why You Need to Understand ImmutableID](https://blogs.perficient.com/2015/04/01/office-365-why-you-need-to-understand-immutableid/) Azure Active Directory SAML2 metadata may be [found here](https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml) . CAS Configuration ================= First, ensure that your CAS deployment is equipped to act as a [SAML2 identity provider](https://apereo.github.io/cas/5.3.x/installation/Configuring-SAML2-Authentication.html) . Next, you may also use the [JSON Service Registry](https://apereo.github.io/cas/5.3.x/installation/JSON-Service-Management.html) to keep track of the relying-party registration record in JSON definition files. The JSON file to contain the service provider relying-party record would be as follows: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "urn:federation:MicrosoftOnline", "name" : "Office365_SP", "description" : "Microsoft Office 365 / Azure AD", "id" : 10, "metadataLocation" : "file:///path/to/WindowsAzureAD-metadata.xml", "encryptAssertions" : false, "signAssertions" : true, "signResponses" : false, "requiredNameIdFormat" : "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "usernameAttributeProvider" : { "@class" : "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider", "usernameAttribute" : "objectGUID" }, "attributeReleasePolicy" : { "@class" : "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", "allowedAttributes" : { "@class" : "java.util.TreeMap", "userPrincipalName" : "IDPEmail" } } } A few things to point out: * You will need to adjust the `metadataLocation` to match your data and the Office 365 instance. * Make sure CAS has retrieved the allowed attributes (i.e. `IDPEmail`, `objectGUID` etc) listed in the JSON definition file. This is required in the final generated SAML2 response to create the proper `NameIDFormat` element. * Make sure the SP metadata has the correct entity id, matching your Office 365 instance address. Finale ====== Thanks to Paul Spaude of Unicon, Inc who was kind enough to share the above integration notes. If you too have an integration with a well-known SAML2 service provider, please consider sharing that guide in form of a blog post here as well. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration&url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&title=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&title=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&name=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&title=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&title=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F12%2F06%2Fcas53-office365-saml2-integration%2F&t=Apereo+CAS+-+Microsoft+Office+365+SAML2+Integration "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Scripting Multifactor Authentication Triggers – Apereo Community Blog Apereo CAS - Scripting Multifactor Authentication Triggers ========================================================== Thursday, Nov 22, 2018 2 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** Keith Conger of Colorado College, an active member of the CAS community, was kind enough to contribute this guide. If you have configured multifactor authentication with CAS with a provider (i.e. [Duo Security](https://apereo.github.io/cas/5.3.x/installation/DuoSecurity-Authentication.html) ), you may find yourself in need of conditionally triggering MFA based on a variety of factors rather dynamically. Here is a possible scenario: * Allow internal access to a service without forcing MFA via IP range * Rejecting external access to a service unless in MFA LDAP group CAS provides a large number of strategies to [trigger multifactor authentication](https://apereo.github.io/cas/5.3.x/installation/Configuring-Multifactor-Authentication-Triggers.html) . To deliver the use case, we can take advantage of a Groovy-based trigger to implement said conditions. The script is invoked by CAS globally (regardless of application, user, MFA provider, etc) whose outcome should determine whether an MFA provider can take control of the subsequent step in the authentication flow. Our starting position is based on the following: * CAS `5.3.x` * Java `8` * [Maven Overlay](https://github.com/apereo/cas-overlay-template) (The `5.3` branch specifically) Configuration ------------- With [Duo Security](https://apereo.github.io/cas/5.3.x/installation/DuoSecurity-Authentication.html) configured as our multifactor authentication provider, we can start off with the following settings: cas.audit.alternateClientAddrHeaderName=X-Forwarded-For cas.authn.mfa.groovyScript=file:/path/to/GroovyScript.groovy Here, we are teaching CAS to use the `X-Forwarded-For` header when fetching client IP addresses, and we are also indicating a reference path to our yet-to-be-written Groovy script. The script itself would have the following structure: import java.util.* import org.apereo.inspektr.common.web.*; class GroovyMfaScript { String privateIPPattern = "(^127\\.0\\.0\\.1)"; String mfaGroupPattern = "CN=MFA-Enabled"; String servicePattern = "https://app.example.org"; def String run(final Object... args) { def service = args[0]; def registeredService = args[1]; def authentication = args[2]; def logger = args[3]; if (service.id.contains(servicePattern)) { def clientInfo = ClientInfoHolder.getClientInfo(); def clientIp = clientInfo.getClientIpAddress(); logger.info("Client IP [{}]", clientIp); if (clientIp.find(privateIPPattern)) { logger.info("Internal IP address"); def memberOf = authentication.principal.attributes['memberOf'] for (String group : memberOf) { if (group.contains(mfaGroupPattern)) { logger.info("In MFA group"); return "mfa-duo"; } } return null; } return "mfa-duo"; } return null; } } The above script goes through the following conditions: * The requesting application is `https://app.example.org`. * The incoming client IP address matches the pattern `(^127\\.0\\.0\\.1)`. * The authenticated user carries a `memberOf` attribute with a value of `CN=MFA-Enabled`. If all of those conditions are true, then MFA is activated…or else ignored. Note that the function of a Groovy trigger is not specific to a multifactor authentication provider. So long as the conditions execute correctly and the provider is configured properly, it can be used to signal any provider back to the authentication flow. Finale ------ Thanks to Keith Conger of Colorado College who was kind enough to share the above integration notes. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&title=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&title=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&name=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&title=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&title=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F22%2Fcas5-groovy-mfa%2F&t=Apereo+CAS+-+Scripting+Multifactor+Authentication+Triggers "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS Dynamic Configuration Management – Apereo Community Blog Apereo CAS Dynamic Configuration Management =========================================== Saturday, Feb 7, 2026 5 minute read Configuration sources that supply properties and settings to Apereo CAS server deployments generally tend to be static. Their main responsibility is to feed the server a collection of properties and settings, typically very early on during the bootstrapping phase, before the CAS application context has had a chance to be created. Once built and available, the application context remains largely in read-only mode and can only be observed until the next restart. This post provides an overview of how configuration sources can provide dynamic updates to the CAS server and allow it to react and reload its configuration and components without having to restart the server. Please note that this work is commissioned as part of the CAS proposal to [NLnet](https://apereo.github.io/2026/02/01/cas-nlnet/) . Overview ======== Configuration sources in Apereo CAS typically include static `.properties` or `.yaml` files. Once the server has had a chance to read and process the collection of settings in such files, they mainly stay out of the way and subsequent changes to these files _usually_ requires a restart. While CAS can be configured to watch for updates to property files and react, our objective here is mainly focused on external configuration sources, particularly those that are based on SQL databases or MongoDb. In addition to allowing CAS to use such external sources to support dynamic updates, we also intend to extend this functionality and make it available in the CAS admin interface, codenamed Palantir. Today, Palantir presents a read-only web view of active configuration settings and properties that control server behavior. The operator is only able to view all properties and settings, as well as their source, default values, etc. Thus, we intend to enhance Palantir functionality to allow the CAS operator to add, edit, and possibly remove configuration settings at runtime using a web-based editor. The operator should have the ability to update existing settings or add new ones, have them be stored in the appropriate persistent configuration store that survives restarts. All server functionality that depends on a given setting should be able to seamlessly refresh itself to work with the new copy of the setting. MongoDb Configuration Source ============================ It is already possible to use an external MongoDb instance as the configuration source for CAS properties. This capability is handled by the `cas-server-support-configuration-cloud-mongo` module, which automatically creates a collection called `MongoDbProperty` and stores properties using this structure: { "id": "kfhf945jegnsd45sdg93452", "name": "the-setting-name", "value": "the-setting-value" } To teach CAS about the MongoDb instance, the connection information can be supplied via: export CAS_SPRING_CLOUD_MONGO_URI="mongodb://..." The underlying core component, `MongoDbPropertySource`, is one that is modified to implement operations requested by a `MutablePropertySource`. Mutability in this case means that the source can be updated, settings can be removed, etc. This is the mechanism required of all property sources in CAS (that is absent in Spring Cloud today), if they wish to participate in dynamic updates. Of course, when you just start out, the MongoDb collection is empty, and it can live next to your existing `.properties` and `.yaml` files, though it has a higher priority and can be asked to override settings elsewhere. Also note that, as implied, while the focus here is mainly on MongoDb, you can run CAS with multiple configuration sources at the same time. On paper, it is possible to have CAS load properties from files, MongoDb, SQL databases, etc., all at the same time. Now, when you build and launch the Palantir admin module, you may be presented with this interface: ![](https://apereo.github.io/images/image.png) You can start by creating configuration properties: ![](https://apereo.github.io/images/image-1.png) Or reload what is already there, delete and clear everything, or import from `.properties` or `.yaml` files. The import functionality might be especially useful if you wish to migrate from one static source, such as a `.properties` file to a dynamic source like MongoDb. When creating new settings, you can also switch to the `Environment` tab and look at how the CAS application context and environment is formed. ![](https://apereo.github.io/images/image-2.png) You can look at the effective value for a property: ![](https://apereo.github.io/images/image-3.png) Or take something that is available, import it into your dynamic property source (i.e. MongoDb) and override its value: ![](https://apereo.github.io/images/image-4.png) _Important_: remember that just because a property exists in a configuration source, it does not mean that CAS will be able to immediately notice the change to start using it. The configuration source is mainly kept in isolation and separate from the active runtime context, and can be changed and updated as many times as necessary until you’re ready to put changes into effect. When the time is right, you can ask CAS to refresh itself: ![](https://apereo.github.io/images/image-5.png) Once refreshed, CAS settings that are put into your configuration source should be activated. SQL Configuration Source ======================== Note that the exact same concept is available to CAS when a SQL database is used to house configuration settings. The difference now is, this capability is handled by the `cas-server-support-configuration-cloud-jdbc` module. By default, settings are expected to be found under a `CAS_SETTINGS_TABLE` that contains the columns: `id`, `name` and `value`. Note that id is a unique identifier for each record and may be generated automatically. And similar to MongoDb, the SQL connection information can be taught to CAS via: export CAS_SPRING_CLOUD_JDBC_URL="jdbc:..." Availability ============ The capabilities described in this document will ultimately be available in CAS `8.0.0`, and you should be able to start playing with them as of `8.0.0-RC2`. The configuration sources that can handle dynamic updates and are covered include: * Amazon S3 * Amazon DynamoDb * Amazon Secret Manager * Amazon Systems Manager Parameter Store (SSM) * JDBC (As was covered here) * MongoDb (As was covered here) * REST Subsequent improvements and fixes will also be included in future release candidates prior to the final release. On behalf of the CAS project, [Misagh Moayyed](https://fawnoos.com/misagh) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+Dynamic+Configuration+Management&url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&title=Apereo+CAS+Dynamic+Configuration+Management "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&title=Apereo+CAS+Dynamic+Configuration+Management "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&name=Apereo+CAS+Dynamic+Configuration+Management "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&title=Apereo+CAS+Dynamic+Configuration+Management "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&title=Apereo+CAS+Dynamic+Configuration+Management "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F07%2Fcas-dynamic-configuration-management%2F&t=Apereo+CAS+Dynamic+Configuration+Management "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Monday, Mar 6, 2017 1 minute read Overview ======== This is the public version of an Apereo CAS project vulnerability disclosure describing an issue in CAS where an adversary may be able to bypass certain administrative endpoints, in spite of CAS access rule in place. The following administrative endpoints are exposed and vulnerable to this attack: * `/configserver/` * `/cas/status/metrics` Affected Deployments ==================== The attack vector specifically applies to all deployments of CAS `5.0.x` deployments. If you have deployed **any version** of CAS `5.0.x`, you **MUST** take action to upgrade. If you have deployed any **other** versions of CAS, disregard this announcement. Severity ======== This is a serious issue where successfully exercising this vulnerability allows the adversary gain insight into the running CAS software, collect stats and metrics and potentially observe the collection of configured CAS settings in configuration files. Patching ======== Patch releases are available to address CAS `5.0.x` deployments. Upgrades to the next patch version for each release should be a drop-in replacement. The patch simply ensures that the exposed endpoints honor the CAS access rules, and otherwise block attempts. When you have applied the patch, please double check all endpoints and ensure access is appropriately controlled. Timeline -------- The issue was originally reported to the CAS application security team on February 20, 2017. Upon confirmation, CAS was patched on February 22, 2017 and released. The original release announcement is [available here](https://github.com/apereo/cas/releases/tag/v5.0.3.1) . Procedure --------- ### Update Version Modify your CAS overlay to point to version `5.0.3.1`. A snippet of a `pom.xml` for a CAS overlay follows: org.jasig.cas cas-server-webapp ${cas.version} war runtime 5.0.3.1 Double check your `cas.properties` file for the following setting: # cas.adminPagesSecurity.ip=the-authorized-ip-pattern ### Adjust Overlay If your CAS build has overlaid the `src/main/resources/bootstrap.properties` file, make sure the following line is corrected there: spring.cloud.config.server.prefix=/status/configserver Alternatives ------------ If you are unable to apply the patch, it’s then best to ensure the outlined endpoints are blocked completely via load balancers, proxies, firewalls, etc. Support ======= If you have questions on the details this vulnerability and how it might be reproduced, please contact `security@apereo.org` or `cas-appsec-public@apereo.org`. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F06%2Fmoncfgsecvulndisc%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS Receives NLnet Grant to Advance CAS Development – Apereo Community Blog Apereo CAS Receives NLnet Grant to Advance CAS Development ========================================================== Sunday, Feb 1, 2026 6 minute read We’re excited to share that the Apereo CAS project has been awarded funding from NLnet, through the NGI0 Commons Fund, to support the development of CAS — an initiative aimed at strengthening open, sovereign, and self-hosted identity infrastructure on the internet. We also extend our sincere gratitude to the Apereo Foundation for their continued support and stewardship. Their assistance was instrumental in helping us secure the necessary funding, and their commitment to open source identity infrastructure remains a vital part of the CAS project’s ongoing success. About Apereo ============ [The Apereo Foundation](https://www.apereo.org/about) is a global non-profit advancing open source software in service of higher education. Since its founding in 2012, Apereo has empowered colleges and universities to build, use, and sustain innovative software for teaching, learning, research, and campus operations. At the heart of Apereo is a vibrant, collaborative community—institutions, educators, developers, and technologists—working together to solve common challenges and shape the future of education technology. Through shared development, open governance, and a culture of transparency, members co-create solutions that are cost-effective, adaptable, and aligned with academic values. About CAS ========= [Apereo CAS (Central Authentication Service)](https://www.apereo.org/programs/software/cas) , released under an Apache 2.0 license, is an open source identity provider. Offering native clustering capabilities and a resilient architecture, Apereo CAS acts as an identity provider for all applications deployed by an organization at scale, supporting hundreds of thousands of users. Developed in the early 2000s, Apereo CAS has since expanded to play a critical role in providing security across various public interests: government agencies, NGOs, and the business sector. About NLnet =========== [NLnet](https://nlnet.nl/) , a foundation dedicated to promoting open technologies that benefit the public interest, has committed funding to support the CAS development effort. This is provided via the NGI0 Commons Fund, which focuses on improving the privacy, resilience, and trustworthiness of internet infrastructure. NLnet’s role is intentionally non-operational: the foundation exists to enable impactful work, not to direct it. The success of the project is measured by the public benefit it delivers to the wider internet and identity community. Proposal & Work Ahead ===================== Our proposal focuses on expanding CAS in specific areas that include support for better management interfaces, from smaller enhancements and bug fixes that focus on security to larger development efforts to improve authentication protocol support with a targetted focus on OpenID Connect. All work produced under this project — including source code, designs, and documentation — will be released publicly under the Apereo CAS project existing license, Apache v2. The results will not be proprietary and can be freely used, modified, and repurposed by anyone. This work is undertaken voluntarily and in the public interest. It is not an employment contract or a commercial arrangement; the funding here is provided to support open-source development aligned with NLnet’s mission. We’re grateful not only for NLnet’s support, but also for the broader ecosystem of experts and organizations involved with the NGI0 Commons Fund who help ensure projects like this have lasting, wide-reaching impact. Tasks & Work Items ------------------ As part of this project, the following work items will be worked out and developed. External Identity Provider Management ------------------------------------- The CAS admin interface, codenamed Palantir, will be enhanced to allow for registration and modifications of identity providers for external authentication using a web-based editor. CAS already has the ability to support identity providers that understand the CAS, OpenID Connect, OAuth, or SAML2 protocols. However, the registration process for such identity providers requires access to CAS configuration files, which further require the deployer to rebuild and redeploy the software. This task intends to provide a graphical interface, included in Palantir, that allows one to register and update such identity providers without having to rebuild and redeploy the system, with the assumption that CAS configuration is backed by a persistent storage such as a SQL database or MongoDb. Configuration Management ------------------------ The CAS admin interface, codenamed Palantir, presents a read-only web view of active configuration settings and properties that control server behavior. The operator is only able to view all properties and settings as well as their source, default values, etc. Real changes to settings require manual modifications and server restarts. This task is about enhancing Palantir to allow the CAS operator to add, edit, and possibly remove configuration settings at runtime using a web-based editor. The operator should have the ability to update existing settings or add new ones, have them be stored in the appropriate persistent configuration store that survives restarts. All server functionality that depends on a given setting should be able to seamlessly refresh itself to work with the new copy of the setting. Specifically, * Support SQL databases for configuration store updates * Support MongoDb for configuration store updates Release Maintenance ------------------- CAS is currently pushing towards its next major iteration under version `8.0.0`. This task is about supporting the development lifecycle and allowing for several release candidates to be published, typically one every 4-5 weeks, to allow the community to experiment and to deliver a steady stream of fixes and minor enhancements before the final release. Activities include upgrading libraries, build tools, documentation corrections, minor bug fixes, and finally getting the release published. Our estimated timeline for the final GA release is around May/June 2026. Performance Improvements ------------------------ CAS stores its authorized applications in the services registry. When many applications are defined (several hundreds), there are performance drawbacks related to sorts and patterns computation. Specifically, * Improve sorting * Improve regular expression pattern computation Bug Fixes --------- * Passwordless support for LDAP does not properly handle MFA via an attribute. * Secret validation in OAuth suffers from URL decoding. * SAML logout requests sent in SOAP binding don’t have the proper form (extra parameter) and the right content type. * Process results from security audit and accessibility scan provided by NLnet. OpenID Federation ----------------- Today, OpenID Connect is the standard protocol for authentication. It has many specifications on top of OAuth to bring new features (like sessions management), but the last big feature is Federation which should be available in CAS, acting both as a server and as a client. Specifically, * Implement the CAS server as a Trust Anchor * Implement the CAS server as a Federation Operator * Add federation support to the CAS server as an OP (`/.well-known/openid-federation`) * Add federation support to the CAS server as a RP: `/.well-known/openid-federation`, consume TA/Operator, validate chains up to an OP. Open Development, Open Governance ================================= The project is led by Misagh Moayyed and Jérôme Leleu, both long-time CAS core developers with deep experience in open standards and free software. Misagh will serve as the primary point of contact for the project. In the spirit of transparency and collaboration: * Progress updates will be shared with the community at least every two months * A public status page will track milestones and outcomes * The broader CAS user and developer community is encouraged to follow along, contribute, and provide feedback. Our efforts span an initial 12-month period, with the possibility of extension by mutual agreement if the work remains relevant. As always, success will be defined by usefulness, adoption, and the value delivered to the community. We’re excited to get started and even more excited to build this together. Stay tuned for updates, and thank you to NLnet and the NGI0 Commons Fund for investing in open identity, open infrastructure, and the public good. On behalf of the Apereo Foundation & CAS project, [Misagh Moayyed](https://fawnoos.com/misagh) , [Jérôme Leleu](https://www.casinthecloud.com/index-en.html) , [Josh Baron](https://www.apereo.org/profile/josh-baron) , [Patrick Masson](https://www.apereo.org/profile/patrick-masson) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development&url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&title=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&title=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&name=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&title=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&title=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F02%2F01%2Fcas-nlnet%2F&t=Apereo+CAS+Receives+NLnet+Grant+to+Advance+CAS+Development "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Better by design 2017: Integrating accessibility across design and development lifecycle – Apereo Community Blog Better by design 2017: Integrating accessibility across design and development lifecycle ======================================================================================== Tuesday, Aug 22, 2017 4 minute read I recently attended a day-long workshop on [Integrating accessibility across the design and development lifecycle](http://betterbydesignconference.com/workshops/workshop-accessibility-design-development-life-cycle/) by [Karl Groves](http://www.karlgroves.com/) at [Better By Design](http://betterbydesignconference.com/) 2017. The most important point I took from the workshop was a reminder to **automate functionally testing the front end for those usability characteristics and WCAG targets amenable to automated testing**. Mostly the workshop was a call-to-action to care about accessibility, to comply with law and regulation about accessibility, and to avoid expensive legal liability. The workshop motivated thinking about accessibility and usability through the lens of fictional startups wherein, contrary to our typical lived developer experience, accessibility would be prioritized in product vision, design, hiring, corporate priorities, technical support, etc. A healthy thought experiment perhaps too far from my lived reality to be fully relatable. Automate front-end testing. --------------------------- Suggested tech stack: * [Selenium WebDriver](http://www.seleniumhq.org/projects/webdriver/) : drive web browsers via automation * [Mocha](https://mochajs.org/) : JavaScript test framework * [Chai](http://chaijs.com/) : assertion library * [Should](https://github.com/shouldjs/should.js) : another assertion library * [Cucumber](https://cucumber.io/) : executable specifications The speaker’s product, [tenon.io](https://tenon.io/) , has something to offer for a11y checking automation. It’s usability -------------- Don’t primarily think of it as a11y, as extra stuff to do to accommodate disability. Think of it as making your app usable for everyone. Focusing on a11y and disability is useful for legal compliance and to help broaden thinking of all the users and all their needs. If it takes thinking about blindness specifically to get you to pay attention to screen reader experiences, so be it. But mostly if you build it right, if it’s clear **what things are and what they do**, if it’s usable and thoughtful and high quality, accessibility takes care of itself. And of course automate testing for any code quality characteristics that can be automatically detected, because that’s what computers are for. Software development has a quality and a culture problem -------------------------------------------------------- The problem is * Software products are of agonizingly poor quality. * Software development culture is often broken, with lack of empathy, empowerment, attention to quality and detail, resources. Of course low quality software built in agonizing culture has poor usability and poor accessibility. Do less. Do it with radically higher quality. Win. The different versions and levels of WCAG ----------------------------------------- WCAG 1: three priority levels (1, 2, 3) organized by importance to the usability. WCAG 2: A, AA, and AAA levels organized by expected cost to implement. WCAG A is no-UI-impact stuff that you have no excuse not to do. Very low cost. WCAG AA is modest-impact stuff that you really ought to do but it comes at a cost. This is de-facto where the industry has landed as acceptable. You’re liable to suit if you don’t meet WCAG AA; remediation will likely be to meet WCAG AA. WCAG AAA is potentially tremendously expensive stuff. All of A, AA, and AAA are important to accessibility, usability. It’s not that the AAA stuff isn’t important, it’s that it’s potentially expensive to comply. Good practice: **meet all of AA. Meet parts of AAA that you can feasibly** achieve. Good practice: **don’t volunteer to meet AAA** – you’re probably just not going to do it. Recommendation: lurk or participate directly in WCAG 3 standard development. ( [community group](https://www.w3.org/community/silver/) ) Performance budget analogy -------------------------- Concept: performance budget. From the outset, how slow will we allow our site / application / pages to be? By what measures? Then work within that budget. Analogous concept: accessibility budget. How un-usable will we allow our site / application / pages to be? Then work within that budget. Don’t remediate to WCAG AA. Decide WCAG AA is your “accessibility budget” from the outset and anything violating WCAG AA, it’s just not in your project’s budget. Drag-and-drop re-ordering as a11y challenge ------------------------------------------- Almost any UI control can be made usable and accessible for all users. Drag-and-drop re-ordering is a notorious exception to this. Provide an alternative experience so that users who cannot easily use visual drag-and-drop controls can instead re-order or re-arrange objects in another way. Misc ---- Other grab bag of points made, references. * **Accessibility** as differentiator on resume. a11y is important and getting more important; companies are hiring for it. * Paciello Group: [inclusive design principles](http://inclusivedesignprinciples.org/) . * Inclusive Design Patterns book by Heydon Pickering . Seems to be [available online as a PDF](http://smashingconf.com/pdf/inclusive-design-patterns.pdf) . * [Brad Frost atomic design](http://atomicdesign.bradfrost.com/) , [pattern lab](http://patternlab.io/) * [Inclusive Design Principles](http://inclusivedesignprinciples.org/) * [Josh Blue](http://www.joshblue.com/) (comedian) * [DHS Trusted Tester program](https://www.dhs.gov/trusted-tester) * [Just Ask: Integrated Accessibility throughout Design](http://uiaccess.com/accessucd/) (book) (contents available online) * [Lean UX](http://www.jeffgothelf.com/lean-ux-book/) (book) * [ARIA practices guide](https://github.com/w3c/aria-practices) , [as published](https://www.w3.org/TR/wai-aria-practices-1.1/) Planning to automate MyUW accessibility testing ----------------------------------------------- Added to draft Q4 MyUW roadmap an item to automate functionally testing a11y criteria in MyUW as deployed to a test tier. This doesn’t guarantee we’ll actually do this in Q4 – it just places a reminder to consider it when tightening up Q4 planning. \-[Andrew](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&title=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&title=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&name=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&title=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&title=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F22%2Fbbd-integrating-a11y-across-lifecycle%2F&t=Better+by+design+2017%3A+Integrating+accessibility+across+design+and+development+lifecycle "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Let Your Docker Containers Speak – Apereo Community Blog Let Your Docker Containers Speak ================================ Thursday, Aug 24, 2017 3 minute read If you are like me, you have probably come to the same conclusion that Docker does wonders with the automation of much of the needed infrastructure while working on a particular development task. For example, I primarily keep myself busy in the realm of [Identity and Access Management (IAM)](https://www.unicon.net/solutions/identity-and-access-management) and there does not a day go by where I find myself in need of a running [SAML service provider](https://github.com/UniconLabs/spring-security-saml-java-sp) , a CASified PHP application protected by [mod\_auth\_cas](https://github.com/apereo/mod_auth_cas) running inside Apache, or a full blown [Grouper deployment](https://github.com/Unicon/grouper-dockerized) for which I might be trying to add a changelog consumer, etc. Docker can automate and (more importantly) isolate all of that _noise_, allowing me to focus on the task at hand. Today and while I have opted for both approaches given context and need, my preference is to keep the core platform/application I am working on outside the running Docker ecosystem while leaving all of the stuff-I-need-for-the-integration components inside. I find that this strategy allows for faster builds and more performant/natural debugging and diagnostics. However, one problem I run into often is: how do I connect the two separate environments? Or put another way, how do I let a component running in Docker make a back-channel call to something outside running on the host? Being so far away from home can be challenging. This blog is about that problem. That Problem ------------ My docker setup usually is based on [this project](https://github.com/UniconLabs/dockerized-idp-testbed) , which is the wonderful produce of my esteemed colleague, [@jtgasper3](https://github.com/jtgasper3) . As the perfect IAM testbed, it is _composed_ (catch the pun?) of an LDAP server, a Shibboleth SP, Apache httpd, a CASified PHP application, simpleSAMLphp, a Shibboleth IdP and possibly more. I simply enable/disable components I need running in the package and viola! It takes care of the rest. I am not going to bore you with all the intricate details of how this is all organized docker-wise, but one thing that is perhaps relevant is that each running component is tagged with a `networks` configuration that simply [controls the application networking](https://docs.docker.com/compose/networking/) via custom networks where each can be linked to a driver configuration (i.e. `bridge`, the default for the Docker engine). This might come in handy, should you decide to go fancier and beyond what I explain here for a solution. Long story short, the issue had to do with the dockerized Shibboleth SP unable to make a SOAP query to my IdP running outside. If you think about it, this sort of makes sense. What runs inside does not necessarily know anything about what’s on the outside. It might seem like everything is simply running on _the same machine_, but `localhost` for you, an outsider, is a very different unknown to the Shibboleth SP container running in its own network. I needed an inside man. One Solution ------------ I am convinced there are better solutions that muck around with native docker networking configuration, bridging host and container. Indeed, one can set up [extra hosts](https://docs.docker.com/compose/compose-file/#extra_hosts) , perhaps define a `host` [network mode](https://docs.docker.com/compose/compose-file/#network_mode) of some kind, etc. Who knows! That was a rabbit hole I didn’t want to venture into and so I settled for the following simpler albeit temporary solution. export DOCKERHOST=$(ifconfig | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" | \ grep -v 127.0.0.1 | awk '{ print $2 }' | \ cut -f2 -d: | head -n1) If you open up your terminal and run that command, you might see something like: > echo $DOCKERHOST 192.168.1.170 Sweet! Next, I was able to modify the relevant configuration files and use `192.168.1.170` anywhere the dockerized Shibboleth SP needed to make a call to the outside world. While this works fine, I should note that it is absolutely a **temporary solution** as hardcoding an IP address that might change later on obviously is a broken path but it did suffice my development needs at the time. Post-credits Scene ================== …and oh, if you need to find a quick way to SSH into a running Docker container, put the following in your profile: function dockerssh() { export CID=$(docker ps -aqf "name=$1"); docker exec -it $CID /bin/bash } Then use as follows: dockerssh [container-name] …and you’re in. HTH. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Let+Your+Docker+Containers+Speak&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&title=Let+Your+Docker+Containers+Speak "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&title=Let+Your+Docker+Containers+Speak "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&name=Let+Your+Docker+Containers+Speak "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&title=Let+Your+Docker+Containers+Speak "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&title=Let+Your+Docker+Containers+Speak "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F24%2Ftip-docker-container-to-host%2F&t=Let+Your+Docker+Containers+Speak "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # July 2017 uPortal Slack summary – Apereo Community Blog July 2017 uPortal Slack summary =============================== Wednesday, Aug 2, 2017 1 minute read In July 2017, 5 people participated substantially in conversation in the [slack.apereo.org #uportal channel](https://apereo.slack.com/messages/C0MNUQDN3/) . (This is around half as many participants as in June.) * Andrew Petro * Benito Gonzalez * Christian Murphy * Drew Wills * KaJuan Johnson Conversation highlights include: * Christian expressing interest in the new GitHub feature around CODEOWNERS files automating suggested code reviewers. ([uportal-dev thread](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/-GZrLbjcM7A/discussion) ). * Drew expressing excitement about [a Pull Pequest removing Ant and Maven from the uPortal-start build](https://github.com/Jasig/uPortal-start/pull/21) . ([uportal-dev@ thread](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/W0T9MSRpfNw/discussion) ) * KaJuan asking about filtering and placeholder replacement in Gradle. * Christian expressing excitement about [a Pull Request cleaning up uPortal’s Gradle build](https://github.com/Jasig/uPortal/pull/937) * Christian asking that the Coveralls status reports for uPortal PRs be switched back on. * Christian asking about `uPortal-developer` GitHub team access to a couple specific repos. * A branch of conversation about Apereo needing something like [the Apache Attic](https://attic.apache.org/) * A branch of conversation with the insight that if we want to emulate Apache, maybe we should just do more of our work directly in an Apache Software Foundation context. * Love for the now active [Apereo uPortal Twitter account](https://twitter.com/uPortal) and exploring updating its avatar image. On Slack -------- I have [concerns about the openness properties of Slack as implemented by Apereo](https://groups.google.com/a/apereo.org/d/msg/open/cbk9NLb43LQ/btRpD_09AwAJ) . You can’t access it or read its logs anonymously; it’s not Google search indexed. Past ten thousand messages back, messages aren’t available even if you log in. Summarizing the conversations in this anonymously, publicly accessible, and Google indexable context somewhat mitigates these problems. But not necessarily other problems that make [email list communications preferable in open source projects](https://dave.cheney.net/2017/04/11/why-slack-is-inappropriate-for-open-source-communications) . Arguably, all of the conversations held in the `#uportal` Slack channel this month could have been held via email on `uportal-dev@` or `uportal-user@` email lists additionally or instead. Some relevant email list threads are linked above. \-[Andrew](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=July+2017+uPortal+Slack+summary&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&title=July+2017+uPortal+Slack+summary "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&title=July+2017+uPortal+Slack+summary "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&name=July+2017+uPortal+Slack+summary "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&title=July+2017+uPortal+Slack+summary "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&title=July+2017+uPortal+Slack+summary "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F02%2Fjuly-2017-uportal-slack-summary%2F&t=July+2017+uPortal+Slack+summary "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # uPortal annual report, June 2018 edition – Apereo Community Blog uPortal annual report, June 2018 edition ======================================== Monday, Jun 25, 2018 7 minute read [Apereo’s 2017-2018 annual report](https://www.apereo.org/sites/default/files/content/pdfs/Annual%20Report%203June18.pdf) includes a section on uPortal, based on [some notes](https://docs.google.com/document/d/1hkn9E-Ke9hROSOlCe957p0Z5BRBlykmw7vKvtzA5ClA/edit?usp=sharing) the uPortal community [put together](https://groups.google.com/a/apereo.org/d/topic/uportal-user/6bSRQjvpY8I/discussion) . This post works from that content, evolving towards a more free-standing yet hyperlinked read. uPortal continues to lead as an open source enterprise portal solution by and for higher education. Calls to action --------------- * Join [uPortal’s Supporting Subscription program](https://www.apereo.org/projects/uportal/uportal-supporting-subscription-model) . * Propose projects into the new [uPortal Ecosystem Intake Process](https://uportal-contrib.github.io/intake-process.html) . * Directly participate in uPortal. * Engage in Apereo. * Become an [individual Apereo member](https://www.apereo.org/friends) . (These calls to action are re-stated with supporting detail in the conclusion.) Summary ------- (The year described herein is 2017-05-01 through 2018-04-30). * Growth: Growth of the uPortal-as-ecosystem idiom, with the [`uPortal-home`](https://github.com/uPortal-Project/uportal-home) software product successfully graduating from Apereo Incubation, and 4 new software products entering the ecosystem via a clarified [Intake Process](https://uportal-contrib.github.io/intake-process.html) . * Life: Almost 100 versioned releases of uPortal ecosystem software products. * Participation: 7 new core contributors, 1 new core committer, calls, meetups, presentations, and list discussions, oh my. * Financial responsibility: $26,000 recurring revenue with a $51,000 fund balance. * Hope: to increase recurring revenue to sustainably fund effort transforming individual and institutional return-on-investment on uPortal participation and thereby encouraging a virtuous cycle towards more investment with better ROI encouraging more investment yielding better returns encouraging more investment yielding… Ecosystem --------- A variety of software products complement the core platform to make up the greater uPortal ecosystem. uPortal further developed the ecosystem idiom this year, introducing a more formal [uPortal Ecosystem Intake Process](https://uportal-contrib.github.io/intake-process.html) clarifying how to recognize projects as part of the ecosystem, ideally starting collaboration and openness at a very early stage in these ancillary software product initiatives. The ecosystem grew with 1 project successfully exiting Apereo Incubation ([`uPortal-home`](https://github.com/uPortal-Project/uportal-home) ) and 4 new projects entering the ecosystem via the new [Intake Process](https://uportal-contrib.github.io/intake-process.html) : * `ESUP-filemanager` * `Soffit-kotlin-example` * `uPortal-setup-scripts` * `uPortal-web-components` A new `uPortal-contrib` Github organization hosts projects upon intake. Releases -------- The project continues to show healthy activity, with almost 100 versioned releases of software products within the ecosystem. Counting core, intook, and incubating software products (“software products in the uPortal ecosystem”), and _not_ counting open source software products in the neighborhood but not formally part of the ecosystem: **97 total releases**. ### uPortal core releases * 22 releases * (1 major, 7 patch, 1 release candidate, and 13 milestones) ### Alternative user interfaces * [`uPortal-home`](https://github.com/uPortal-Project/uportal-home) : 13 releases (2 major, 6 minor, 5 patch) * `uPortal-app-framework`: 16 releases (5 major, 5 minor, 6 patch) ### Portlet releases 9 Portlet software products saw at least one release, with 36 total releases. * `AnnouncementsPortlet`: 10 releases. (1 minor, 9 patch) * `CalendarPortlet`: 4 releases. (1 minor, 3 patch) * `FeedbackPortlet`: 3 releases (1 minor, 2 patch) * `JasigWidgetPortlets`: 1 minor release. * `NewsReaderPortlet`: 7 releases. (1 major, 1 minor, 5 patch) * `NotificationPortlet`: 6 releases. (2 minor, 4 patch) * `SimpleContentPortlet`: 6 releases. (1 major, 3 minor, 2 patch) * `WeatherPortlet`: 2 patch releases. * `WebProxyPortlet`: 2 patch releases. ### Supporting software products * Resource-server: 5 releases (2 minor, 3 patch) Participation ------------- The core uPortal platform project added 1 new committer (Jim Helwig 2017-07-19) and 7 new contributors, with 18 total contributors. This year saw an increase in direct participation by commmunity members in France, through submissions to the new [Intake Process](https://uportal-contrib.github.io/intake-process.html) and translations of documentation. Contributors this year to core uPortal, new in bold: * Ludovic Auxepaules * **Chris Beach** * **Josh Brudnak** * **Colin Campbell** * Christian Cousquer * **Nisith Dash** * **Mairi Fraser** * Benito Gonzalez * **Allan Jackson** * **KaJuan Johnson** * Christian Murphy * Gary Roybal * Andrew Petro * Brandon Powell * Corey Rowe * Jonathan Tran * Timothy Vertein * Drew Wills (Note that this is counting committers and contributors in _the core uPortal platform itself_ and does not account for contributors and committers in the other ecosystem projects.) Public engagement opportunities included 5 calls or webinars, 2 in-person meetups, 16 conference presentations, and over 1,000 discussion list posts. Newly introduced shared Google Team Drives welcome collaboration and sharing of artifacts in less source-code-centric ways. This tooling has already proven conducive to sharing local user research findings from uPortal adopters. uPortal handled one security vulnerability this year: * 2017-09-26: Feedback portlet injectable fixed in Feedback Portlet `1.2.1`. Aaron Grant, Drew Wills, and Christian Murphy filled roles in the security incident handling process. Financials ---------- Institutions can sustain the project through the [uPortal Supporting Subscription program](https://www.apereo.org/projects/uportal/uportal-supporting-subscription-model) , a rider to the [institutional Apereo membership](https://www.apereo.org/content/apereo-member-organizations) . uPortal added 1 subscriber to a total of 3 with annual revenue of $26,000 and a fund balance of $51,000. Current uPortal Supporting Subscribers: * University of Wisconsin-Madison (uPortal Champion) * Oakland University (uPortal Booster) * Brigham Young University (uPortal Friend) Thusfar the project has avoided spending these funds in ad-hoc ways, preferring to accumulate a stabilizing asset balance and work towards a level of recurring revenue that will enable a sustainable application of funds. In the year to come, the project hopes to reach a threshold of recurring revenue to afford funding a full-time Foundation position charged with * driving down barriers to adoption and participation * improving the institutional and individual return-on-investment in that participation. Improving the return-on-investment on adoption and participation will make adoption and participation more rewarding which will encourage more of it. More investment will create more opportunities to improve the return-on-investment. A virtuous cycle ensues. Challenges and opportunities ---------------------------- ### Apereo as CVE numbering authority Formal vulnerability identifiers (CVE IDs) are prohibitively difficult to acquire. This limits effectiveness of communication about security. [Apereo becoming a CVE Numbering Authority](https://groups.google.com/a/apereo.org/d/topic/open/WBTjhIaoJj8/discussion) could reduce friction in and increase effectiveness of communication about security vulnerabilities. ### Measuring and recruiting adopters We do not have an effective way to measure adopters. There are doubtless unrealized opportunities to draw in adopters as [Apereo institutional members](https://www.apereo.org/content/apereo-member-organizations) , [uPortal supporting subscription subscribers](https://www.apereo.org/projects/uportal/uportal-supporting-subscription-model) , and most importantly as collaborators in the uPortal ecosystem. ### Growing the uPortal ecosystem The growth of the intake, contrib, ecosystem, and attic concepts and processes sets the stage to more clearly welcome, characterize, collaborate within, and communicate about projects in the uPortal ecosystem. ### Sustainably converting uPortal Supporting Subscription revenue to forward progress Hitting recurring revenue thresholds would unlock converting revenue to forward progress yielding a return-on-investment for subscribers which might encourage additional investment, a virtuous and sustainable cycle ensuing. ### [Discourse](https://www.discourse.org/) as superior discussion forums solution [Discourse](https://www.discourse.org/) has been adopted [elsewhere](https://community.unizin.org/) to positive effect and might do a lot of good in Apereo as a next step beyond [the exising Google Groups forums solution](https://groups.google.com/a/apereo.org/forum/#!search/uportal) . ### Collaborate with other Apereo projects uPortal and other Apereo projects might collaborate more on shared concerns like * project lifecycle process * security incident handling * communications * release engineering doing these and other things better in collaboration than they can be done in isolated project siloes. Calls to action, reprise ------------------------ * uPortal adopting institutions, **join [uPortal’s Supporting Subscription program](https://www.apereo.org/projects/uportal/uportal-supporting-subscription-model) **. This rider to an institutional Apereo membership builds essential recurring revenue for resourcing the uPortal project for confident sustainability. Begin this as modestly as your institution may need; every little bit will help this program hit the transformative threshold of potentially adding a full time staffer focused on carrying uPortal qua open source project forward. If your institution is already subscribing, increase your commitment. **The opportunities for a more confident uPortal future are real.** * **Propose ancillary projects** (software products) into [uPortal’s new Ecosystem Intake Process](https://uportal-contrib.github.io/intake-process.html) . It has never been easier to approach developing a plug-in for use with uPortal (whether user-facing content, back-end service, or otherwise). The best time to share code and welcome involvement of the wider community is the moment you start. If you locally see a need, it’s very likely that another adopter could learn from this, could collaborate upon it, or could adopt the add-on and likewise has locally developed add-ons that you could be adopting too. **The opportunities for more and better collaboration are real.** * **Directly participate in uPortal.** It has never been easier to collaborate on uPortal, its documentation, and its ancillary projects. Suggesting an edit to even this “marketing-flavored” post is feasible via GitHub’s tooling, without leaving your Web browser. **The opportunities for collaboration are real, and are beyond code.** * **Engage in Apereo.** Ensure your institution is a [member of Apereo](https://www.apereo.org/content/apereo-member-organizations) . Maintain an active relationship with your institutional representative. Engage directly on the [open@](https://groups.google.com/a/apereo.org/forum/#!forum/open) list and ensure you’re subscribed to the [announcements@](https://groups.google.com/a/apereo.org/forum/#!forum/announcements) list. **The opportunities for participation in all things Apereo are real.** * **Become an [individual Apereo member](https://www.apereo.org/friends) .** Apereo’s membership model is no longer solely that of higher education institutions as members – you as an individual human being can join, gaining a vote for a Foundation Board seat. **The opportunities to engage in more interesting ways are real.** \- Andrew Petro wearing individual contributor [hat](https://www.apache.org/foundation/how-it-works.html#hats) . Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=uPortal+annual+report%2C+June+2018+edition&url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&title=uPortal+annual+report%2C+June+2018+edition "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&title=uPortal+annual+report%2C+June+2018+edition "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&name=uPortal+annual+report%2C+June+2018+edition "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&title=uPortal+annual+report%2C+June+2018+edition "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&title=uPortal+annual+report%2C+June+2018+edition "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F06%2F25%2Fup-annual-report%2F&t=uPortal+annual+report%2C+June+2018+edition "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Publish Private CAS Releases – Apereo Community Blog Publish Private CAS Releases ============================ Saturday, Jul 17, 2021 9 minute read Overview ======== If you contribute a fix or new feature to CAS you either need to use a snapshot build, wait for an official release or publish your own release to a private repository. In my situation I work somewhere that uses Gitlab for CI/CD and has a private repository that is not accessible to Github CI/CD and I didn’t want to figure out how to run a Github private runner since I am already using Gitlab private runners. By using Github Actions to build and publish CAS, but pushing the release to a cloud hosted private repository such as are available from AWS, Azure and Github, I am able to build a CAS release at any time from my fork and my private overlay can be built in Gitlab using privately published artifacts from one of the cloud hosted repositories. I prefer not having my CAS fork deviate from the main project (keeping any customizations in the overlay but usually contributing them back) so I added Github Actions workflows to CAS 6.4+ that make it easier to publish a tagged release from a fork to a private repository. One workflow is for publishing to a private AWS CodeArtifact repository, another is for publishing to the GitHub Packages repository, and a third workflow can publish to an Azure Artifacts repository, but the Azure Artifacts workflow is generic enough that it could be used to publish to a private Nexus or Artifactory repository if it were accessible. How to Release ============== All three workflows only trigger on a four digit Git tag starting with a 6 or 7 (e.g. 6.4.0.1). The four digit version differentiates the version from an official CAS release. These releases will be in your own repository where they should not conflict with other resources in other repositories. When you initially tag the release, all three workflows (GitHub, AWS, and Azure) will kick off, and the GitHub repository publish should work since it requires no setup. If you don’t want to publish to GitHub then you should cancel the workflow. Once the workflows have triggered, disable any of the workflows that won’t be used or that you haven’t configured the secrets for so they won’t trigger on future tags. Creating the tag to trigger the release is easy to do with the `Draft a new release` button on the Releases page for the CAS forked repository. Cost Disclaimer =============== None of these private repositories are free although they may have a free tier. I have run my tests against GitHub as someone with a GitHub Pro subscription which comes with 2GB of Packages storage. After that it claims to charge $0.25/GB/month and that storage may be shared with GitHub Actions artifacts and logs. CAS publishes many modules so 2GB of storage may not hold many versions. GitHub Packages storage may be free for public repositories. You can purge all versions of your CAS packages with a script like this, which needs to live at root of CAS project: #!/bin/bash USERNAME_PAT=GitHub_username:personal_access_token GROUP=org.apereo.cas for TYPE in api core support webapp; do cd $TYPE for PACKAGE in cas-server*; do curl --fail -X DELETE -u $USERNAME_PAT -H "Accept: application/vnd.GitHub.v3+json" https://api.GitHub.com/user/packages/maven/$GROUP.$PACKAGE RC=$? echo "Delete package $PACKAGE: $RC" done cd .. done More targeted deleting could be done with a more involved script. Publishing to GitHub Packages Repository ======================================== The GitHub Packages repository can be used with no setup because you already have a CAS fork in GitHub and workflows in your fork can publish packages by default. Unfortunately the GitHub Package Repository workflow gets errors like the following on random published files: > Failed to publish publication 'mavenJava' to repository 'CAS-Releases' > Could not PUT 'https://maven.pkg.GitHub.com/hdeadman/cas/org/apereo/cas/cas-server-core-api-mfa/6.4.0.28/cas-server-core-api-mfa-6.4.0.28.jar.md5'. Received status code 409 from server: Conflict It also fails to publish the CAS shell jar, with a `400` error, possibly because it is too large, but it is not much larger than the CAS Tomcat webapp war which publishes fine. Execution failed for task ':support:cas-server-support-shell:publishMavenJavaPublicationToCAS-ReleasesRepository'. > Failed to publish publication 'mavenJava' to repository 'CAS-Releases' > Could not PUT 'https://maven.pkg.GitHub.com/hdeadman/cas/org/apereo/cas/cas-server-support-shell/6.4.0.33/cas-server-support-shell-6.4.0.33.jar'. Received status code 400 from server: Bad Request Since CAS publishes so many files, it is highly unlikely that a full release will be successfully published until the issue with GitHub is resolved. I am assuming the issue is on the GitHub side because these errors don’t show up when publishing to other repository types. CAS publishes over 400 modules and each module includes resources, tests, sources, javadoc jars, the main artifact and a gradle module file, each of which has four hash files (md5, sha1, sha256 and sha512), so you are talking about enough files getting published to have at least one `409 Conflict` error and that is enough to kill the build. By skipping the CAS shell jar, which doesn’t work due to `400 Bad Request` error, for GitHub Package Repository only, and reducing the number of artifacts published per module to only include the main artifact (skipping source, resource, javadoc, and tests), publishes to GitHub Package Repository did succeed three times, followed by five failures, and then two more successes in three tries. For now, it seems to fail slightly more than half the time which is not reliable enough to use. I plan to open an issue with GitHub, so hopefully they can fix it, given a reliable way to recreate the problem. Publishing to GitHub often fails when publishing small files such as an md5 hash file. One would think that they could compare the contents of the file they are adding with the file that already exists for some reason and not return a `409` if the file being `PUT` was identical to what was there. Publishing to AWS CodeArtifact Repository ========================================= Publishing to an AWS Code Artifact repository has so far been very reliable (no failures). It requires more setup and configuration but is not difficult if you already have an AWS account and are familiar with setting up security policies. 1. In the AWS Console under the CodeArtifact service, create “domain” and a “repository” under that domain. 2. Create an IAM user that can’t login but that will own access tokens for publishing to CodeArtifact 3. Attach the `AWSCodeArtifactAdminAccess` policy to the user. (That is more privileges than should be necessary, but I gave up finding a minimal policy that worked. I am comfortable with a dedicated user that can’t login and whose Access Key will live as a relatively inaccessible GitHub Repository Secret. Depending on what else you might use CodeArtifact for, reduced privileges may be in order.) 4. Create the following secrets in your fork of the CAS repository (under repository settings): CODE_ARTIFACT_DOMAIN determined when the repository is created. CODE_ARTIFACT_URL determined when the repository is created. CODE_ARTIFACT_AWS_ACCESS_KEY_ID and CODE_ARTIFACT_AWS_SECRET_ACCESS_KEY should be created from IAM user with publish rights on repo CODE_ARTIFACT_REGION is the region where the CodeArtifact repository exists Publishing to Azure Artifacts Repository ======================================== Azure Artifacts seems to be reliable and is easier to setup than AWS CodeArtifact. When you create an Azure Devops account you will get an organization and within that organization you can create a project. Inside the project, under settings, you can enable the `Artifacts` service. Inside the Artifacts service you create a “feed” which just needs a name. The feed has some settings related to visibility (organization or specific members) and scope (project or organization), and whether it should pull from dependencies from upstream sources. The feed can handle many types of dependencies, not just Maven. Once you have created the feed, click `Connect to Feed` and choose `Gradle` and it will show a build script example on how to connect. Oddly it shows using a Maven settings.xml file to set the username/password for the Gradle Maven repository, but you can ignore that since CAS has a workflow that works with Azure Artifacts and it doesn’t use a settings.xml file. On the “connect” page, note the URL of the maven repository and the username. There will be a link for creating a personal access token which will you will need to configure as a secret on your CAS fork in GitHub. The personal access token seems to require an expiration date, but it just needs to have the `Package (read & write)` permissions. The Azure Artifacts workflow requires the following secrets which you can create using the URL, username and personal access token for the password. ARTIFACTS_REPOSITORY_USER=Azure username ARTIFACTS_REPOSITORY_PWD=Azure personal access token ARTIFACTS_REPOSITORY_URL=Azure artifacts URL The workflow that publishes to Azure Artifacts is fairly generic and could probably be used for publishing to a private Nexus or Artifactory instance since it just needs a URL, username and password. It’s not as easy to setup as the GitHub Package Repository which requires no secrets but it seems to be more reliable than GitHub Package Repository (at this time). Using Published Artifacts in a CAS Overlay ========================================== When building your local CAS overlay project and using your personal tag from your private repository, make sure you are using a recent version of the overlay or a recent version of the CAS Initializr which has support for using a private repository if the URL and username properties are set as properties and the password is defined in an environment variable. Set the following properties in your ~/.gradle/gradle.properties using the URLs and username for your AWS CodeArtifact or Azure Artifacts repositories: privateRepoUrl=https://xxx-000000000000.d.codeartifact.us-east-2.amazonaws.com/maven/yyy/ privateRepoUsername=aws For the AWS CodeArtifact repository you will need to set the repository password in the environment with something like: export PRIVATE_REPO_TOKEN=$(aws codeartifact get-authorization-token --domain yourdomain --domain-owner 000000000000 --query authorizationToken --output text --region us-east-2) For the Azure Artifacts repository you set PRIVATE\_REPO\_TOKEN to person access token. export PRIVATE_REPO_TOKEN="PERSONAL ACCESS TOKEN" Then run the build referencing the tag used to publish your private CAS build: ./gradlew -Pcas.version=6.X.X.X clean build The AWS CLI needs to be installed and configured with access keys for a user with sufficient rights to use the repository. If the repository is not in the default region specified in your config, include the region on the command line, e.g. `--region us-east-2`. In the case of Azure Artifacts, the PRIVATE\_REPO\_TOKEN would be set to a personal access token. Resources ========= * [AWS CodeArtifact](https://aws.amazon.com/codeartifact/) * [Azure Artifacts](https://azure.microsoft.com/en-us/services/devops/artifacts/) * [GitHub Packages](https://github.com/features/packages) Screen Shots ============ ### AWS CodeArtifact ![AWS CodeArtifact Image](https://raw.githubusercontent.com/apereo/apereo.github.io/master/_posts/cas/images/awscodeartifact.png) ### Azure Artifacts ![Azure Artifacts Image](https://raw.githubusercontent.com/apereo/apereo.github.io/master/_posts/cas/images/azureartifacts.png) ### Github Packages ![GitHub Packages Image](https://raw.githubusercontent.com/apereo/apereo.github.io/master/_posts/cas/images/githubpackages.png) [Hal Deadman](https://github.com/hdeadman) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Publish+Private+CAS+Releases&url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&title=Publish+Private+CAS+Releases "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&title=Publish+Private+CAS+Releases "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&name=Publish+Private+CAS+Releases "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&title=Publish+Private+CAS+Releases "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&title=Publish+Private+CAS+Releases "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2021%2F07%2F17%2Fpublish-private-release%2F&t=Publish+Private+CAS+Releases "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Get Productive with Shell Aliases – Apereo Community Blog Get Productive with Shell Aliases ================================= Saturday, Jul 14, 2018 4 minute read Over the years, I have collected a number of shell aliases from various blog posts and websites that have tremendously helped me navigate and automate confusing workflows and remember complicated terminal commands. This post, for what it’s worth, is about giving back to the developer community with me sharing aliases I find to be extremely useful in hopes that you, dear reader, also find them useable and productive. There may be better options for housing such aliases, but for better or worse, all commands are to be put inside `~/.profile`, all of which have been exercised on **macOS**. Activate Profile ---------------- alias editp='edit ~/.profile' alias actp='source ~/.profile' Change Directory ---------------- alias cd..='cd ../' # Go back 1 directory level (for fast typers) alias ..='cd ../' # Go back 1 directory level alias ...='cd ../../' # Go back 2 directory levels alias .3='cd ../../../' # Go back 3 directory levels alias .4='cd ../../../../' # Go back 4 directory levels alias .5='cd ../../../../../' # Go back 5 directory levels alias .6='cd ../../../../../../' # Go back 6 directory levels Editors ------- alias edit="code" # Visual Studio Code alias this="edit ." alias subl="/Applications/Sublime\ Text.app/Contents/SharedSupport/bin/subl $@" alias this="edit ." Variables for Colorful Output ----------------------------- BOLD=$(tput bold) BLACK=$(tput setaf 0) WHITE=$(tput setaf 7) BLUE=$(tput setaf 4) GREEN=$(tput setaf 2) NORMAL=$(tput sgr0) Mastering the SSH Agent ----------------------- export env=$HOME/.ssh/environment function agent_is_running() { if [ "$SSH_AUTH_SOCK" ]; then # ssh-add returns: # 0 = agent running, has keys # 1 = agent running, no keys # 2 = agent not running ssh-add -l >/dev/null 2>&1 || [ $? -eq 1 ] else false fi } function agent_has_keys() { ssh-add -l >/dev/null 2>&1 } function agent_load_env() { . "$env" >/dev/null } function agent_start() { echo "Starting SSH agent..." (umask 077; ssh-agent >"$env") . "$env" >/dev/null } function add_all_keys() { echo "Adding SSH keys..." ls ~/.ssh | grep ^id_rsa.*$ | sed "s:^:`echo ~`/.ssh/:" | xargs -n 1 ssh-add } if ! agent_is_running; then agent_load_env fi # if your keys are not stored in ~/.ssh/id_rsa.pub or ~/.ssh/id_dsa.pub, you'll need # to paste the proper path after ssh-add if ! agent_is_running; then agent_start add_all_keys elif ! agent_has_keys; then add_all_keys fi echo `ssh-add -l | wc -l` SSH keys registered. unset env Fancy Git Prompt ---------------- if [ -f "$(brew --prefix bash-git-prompt)/share/gitprompt.sh" ]; then GIT_PROMPT_THEME=Default source "$(brew --prefix bash-git-prompt)/share/gitprompt.sh" fi Switch JDK Versions ------------------- function setjdk() { if [ $# -ne 0 ]; then removeFromPath '/System/Library/Frameworks/JavaVM.framework/Home/bin' if [ -n "${JAVA_HOME+x}" ]; then removeFromPath "$JAVA_HOME/bin" fi export JAVA_HOME=`/usr/libexec/java_home -v $@` export PATH=$JAVA_HOME/bin:$PATH echo -e "JAVA_HOME to $@" fi } function removeFromPath() { export PATH=$(echo $PATH | sed -E -e "s;:$1;;" -e "s;$1:?;;") } …where you can do: setjdk 1.8 or: setjdk 11 Spawn Databases via Docker -------------------------- function mysql() { docker run --name mysql -p3306:3306 --env="MYSQL_ROOT_PASSWORD=password" --env="MYSQL_DATABASE=test" -d mysql } function sqlserver() { docker run -e 'ACCEPT_EULA=Y' -e 'SA_PASSWORD=p@ssw0rd' -p 1433:1433 microsoft/mssql-server-linux:2017-CU7 } Gradle ------ ### Dependency Insight function gdep() { ./gradlew dependencyInsight --configuration "$2" --dependency "$1" } …where you can do: gdep compileClasspath jackson ### Properties alias gprop="edit ~/.gradle/gradle.properties" Helpers ------- alias openPorts='sudo lsof -i | grep LISTEN' alias cls="clear" alias del='rm' alias path='echo -e ${PATH//:/\\n}' alias hostfile="sudo atom /etc/hosts" # Requires Atom function mcd() { mkdir -p "$1" && cd "$1"; } alias dir="ls -a -l" alias myip="curl ifconfig.co/json" Docker ------ ### Search & Destroy alias dkc="docker stop $(docker ps -aq); docker rm $(docker ps -aq)"; ### SSH Into Container function dockerssh() { export CID=$(docker ps -aqf "name=$1"); docker exec -it $CID /bin/bash } Git --- ### Commit Changes function gc() { echo -e "${GREEN}Commit message:\n${WHITE}\t$1\n${NORMAL}" echo "Adding all changes..." git add --all echo "Committing changes..." git commit -S -am "$1" echo "Fetching all submodules..." modules=($(git submodule | awk '{print $2}')) for module in "${modules[@]}"; do echo -e "\tSwitching to module ${WHITE}${module}${NORMAL}" pushd $module > /dev/null echo -e "\tFetching status for module ${WHITE}${module}${NORMAL}" modulestatus=$(git status --porcelain | wc -l) if [[ $modulestatus -ne 0 ]]; then echo -e "\t${GREEN}Updating module: ${WHITE}${module}${NORMAL}" echo -e "\tAdding changes for module ${WHITE}${module}${NORMAL}" git add --all echo -e "\tCommitting changes for module ${WHITE}${module}${NORMAL}" git commit -S -am "$1" git status --short else echo -e "\tNo changes found to commit for module ${WHITE}${module}${NORMAL}" fi popd > /dev/null done echo -e "${GREEN}Done!\nStatus:${NORMAL}" git status } ### Misc alias delmerged="git branch --merged | grep -v "\*" | grep -v master | grep -v dev | xargs -n 1 git branch -d" alias gco="git checkout $1" alias gbo="git checkout -b $1" alias gp="git push --set-upstream $1 $2" alias gl="git pull $1 $2" alias grs="git reset --hard && git clean -fd" alias gba="git branch -a" alias gbr="git branch -r" alias gs="git status -s -b" alias gpl="git pull origin master --no-edit --allow-unrelated-histories" alias gps="git push origin master --recurse-submodules=on-demand " alias gst="git status" alias ggc="git gc --aggressive --prune=now" Processes --------- function pidit() { ps -ef | grep "$@" | grep -v grep | awk '{print $2}' } function proc() { ps -ef | grep "$@" | grep -v grep } function kp() { ps -ef | grep "$1" | grep -v grep | awk '{print $2}' | xargs kill } Search Aliases -------------- function cm() { alias | grep "$@" | head -n 1 } Contribute to Apereo Blog ------------------------- Once you have cloned the Apereo Blog repository: alias blog="cd /path/to/apereo.github.io" alias blogthis="blog; this" That’s it. I hope you find these useful. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Get+Productive+with+Shell+Aliases&url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&title=Get+Productive+with+Shell+Aliases "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&title=Get+Productive+with+Shell+Aliases "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&name=Get+Productive+with+Shell+Aliases "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&title=Get+Productive+with+Shell+Aliases "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&title=Get+Productive+with+Shell+Aliases "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F07%2F14%2Fshell-aliases-collection%2F&t=Get+Productive+with+Shell+Aliases "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # June 2017 uPortal Slack summary – Apereo Community Blog June 2017 uPortal Slack summary =============================== Wednesday, Jul 5, 2017 1 minute read In June 2017, 11 people participated substantially in conversation in the [slack.apereo.org #uportal channel](https://apereo.slack.com/messages/C0MNUQDN3/) . * Aaron Grant * Andrew Petro * Brandon Powell * Christian Cousquer * Christian Murphy * David Sibley * Drew Wills * Jim Helwig * Marissa Warner-Wu * Matt Clare * Tim Vertein Conversation highlights include: * Aaron Grant’s [uportal\_commit\_stats](https://github.com/blamonet/uportal_commit_stats) script and findings about uPortal contributions. [gitinspector](https://github.com/ejwa/gitinspector) might also be useful for uPortal-related Git history analysis. * Internationalization of documentation stored in Git. What Symfony does in its [primary](https://github.com/symfony/symfony-docs) and [French-translation](https://github.com/symfony-fr/symfony-docs-fr) documentation. (Separate repos.). Alternatively, the [jekyll-multiple-languages-plugin](https://github.com/Anthony-Gaudino/jekyll-multiple-languages-plugin) . Example [ReactJS portlet with i18n support](https://github.com/bpowell/i18n-react-portlet) based in [i18next](https://www.i18next.com/) . * Sharing resources from the Open Apereo 2017 conference, including [Portal?! uPortal! What is this Béchamel](https://cousquer.github.io/apereo2017/) , [Speeding up uPortal with ReactJS](https://www.slideshare.net/bpowell29a/speeding-up-uportal-with-reactjs) , [two-hard-problems](https://www.icloud.com/keynote/0vEJysMgblVjGUv0ystx1xWrA#two-hard-problems) . (Cf. [uportal-dev@ thread re conference artifacts](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/24RjwcDhtOg/discussion) .) * Encouraging interest in the new [Accessibility group](https://groups.google.com/a/apereo.org/forum/#!forum/accessibility) . (Cf. [Accessibility Across Apereo thread on uportal-user@](https://groups.google.com/a/apereo.org/d/topic/uportal-user/KQbBMtUHHFY/discussion) ) * [styled-components](https://www.styled-components.com/) for styling React.js apps, [browser support for Polymer](https://www.polymer-project.org/2.0/docs/browsers) . * [conversational UI example](http://azumbrunnen.me/) * Weather API options, including World Weather Online, Weather Underground, weather.gov, DarkSky API. * The [@uPortal](https://twitter.com/uPortal) Twitter account. * The role of some CSS classes \` up-portlet-control focus externalLink\` (turns out to be used in some JavaScript associated with the maximize menu option). * uPortal 5 [fanciness for setting up Tomcat](https://github.com/Jasig/uPortal-start/pull/6) and [deployment via Gradle](https://github.com/Jasig/uPortal-start/pull/8) . [Renaming the overlays directory](https://github.com/Jasig/uPortal-start/pull/10) (cf. [uportal-dev@ thread on overlays directory renaming](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/7Fu4UfnXpQE/discussion) or [another](https://groups.google.com/a/apereo.org/d/topic/uportal-dev/uaeYARDVRZY/discussion) ). * [myday cloud-based portal](https://www.collabco.co.uk/features/dashboards/) * [sonar](https://sonarwhal.com/) , a linting tool for the web On Slack -------- I have [concerns about the openness properties of Slack as implemented by Apereo](https://groups.google.com/a/apereo.org/d/msg/open/cbk9NLb43LQ/btRpD_09AwAJ) . You can’t access it or read its logs anonymously; it’s not Google search indexed. Only the most recent ten thousand messages are available, so in practice this means logs are unavailable older than about a month back. Summarizing the conversations in this anonymously, publicly accessible and Google indexable context somewhat mitigates these problems. But not necessarily other problems that make [email list communications preferable in open source projects](https://dave.cheney.net/2017/04/11/why-slack-is-inappropriate-for-open-source-communications) . Arguably, all of the conversations held in the `#uportal` Slack channel this month could have been held via email on `uportal-dev@` or `uportal-user@` email lists additionally or instead. Some relevant email list threads are linked above. \-[Andrew](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=June+2017+uPortal+Slack+summary&url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&title=June+2017+uPortal+Slack+summary "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&title=June+2017+uPortal+Slack+summary "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&name=June+2017+uPortal+Slack+summary "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&title=June+2017+uPortal+Slack+summary "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&title=June+2017+uPortal+Slack+summary "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F07%2F05%2Fuportal-slack-summary%2F&t=June+2017+uPortal+Slack+summary "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - External Identity Providers – Apereo Community Blog Apereo CAS - External Identity Providers ======================================== Saturday, Apr 25, 2026 2 minute read External identity providers registered with CAS, such as those that speak the OpenID Connect or SAML2 protocol largely remain static throughout the server lifecycle. Once built and available, their configuration remains in read-only mode and can only be modified with direct access to CAS configuration, server rebuilds and restarts. Building on top of [Dynamic Configuration Management](https://apereo.github.io/2026/02/07/cas-dynamic-configuration-management/) features, newer CAS `8.x` releases now allow one to register and modify external identity providers that can be used for delegated authentication attempts. The registration of external identity providers is now handled and supported by the Palantir admin dashbord. This post provides an overview of external identity providers can be registered with the CAS server dynamically, without having to restart the server. Please note that this work is supported by and executed as part of the CAS proposal to [NLnet](https://apereo.github.io/2026/02/01/cas-nlnet/) . Overview ======== As discussed, the main objective here is to allow the Palantir admin dashbord to support registering external identity providers. Doing so requires one to use [Dynamic Configuration Management](https://apereo.github.io/2026/02/07/cas-dynamic-configuration-management/) features of CAS to allow on-the-fly registration of external providers and gain the ability to edit their configuration without having to rebuild or restart. Starting with most recent releases of CAS `8.x`, Palantir admin dashbord now provides a humble view of all available external identity providers, regardless of their method of registration and configuration: ![](https://apereo.github.io/images/image-6.png) The most notable change here is the `NEW` button which allows one to register an identity provider. Available identity provider types are for now limited to the following set: CAS --- ![](https://apereo.github.io/images/image-7.png) OpenID Connect -------------- ![](https://apereo.github.io/images/image-8.png) OAUTH ----- ![](https://apereo.github.io/images/image-9.png) Keycloak -------- ![](https://apereo.github.io/images/image-10.png) SAML2 ----- ![](https://apereo.github.io/images/image-11.png) Modifications ------------- The registration process requires [Dynamic Configuration Management](https://apereo.github.io/2026/02/07/cas-dynamic-configuration-management/) features of CAS. Once an identity provider is registered, its configuration can be modified and edited exactly as any other CAS setting, since all configuration constructs are eventually translated to CAS properties and ultimately become available to the CAS application context. Roadmap ------- The admin dashboard today supports a limited set of external identity provider types and a narrowed populist view of what can be configured for each provider. Going forward, the intention is to customize and enhance the registration process to add more identity provider types and support additional settings as necessary. On behalf of the CAS project, [Misagh Moayyed](https://fawnoos.com/misagh) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+External+Identity+Providers&url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&title=Apereo+CAS+-+External+Identity+Providers "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&title=Apereo+CAS+-+External+Identity+Providers "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&name=Apereo+CAS+-+External+Identity+Providers "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&title=Apereo+CAS+-+External+Identity+Providers "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&title=Apereo+CAS+-+External+Identity+Providers "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F04%2F25%2Fcas-external-identity-providers%2F&t=Apereo+CAS+-+External+Identity+Providers "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Sunday, Nov 24, 2019 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects multifactor authentication using the `mfa-simple` mode. All other multifactor authentication integrations are unaffected by this vulnerability. When CAS is configured to act as a multifactor authentication provider in `mfa-simple` mode, the validation process that accepts a token from the user is not enforcing token ownership. As a result, any valid token that may not have been issued to the user could be used as he multifactor authentication token to successfully complete the authentication transaction. Credits ======= Special thanks to Pavlos Drandakis, member of the [GUnet Identity Team](https://apereo.github.io/2019/11/24/smfavuln/www.gunet.gr) for originally reporting the issue to the CAS application security group as well as preparing and contributing an immediate fix. Affected Deployments ==================== The attack vector applies to deployments of the CAS server for the following versions: - 6.0.x - 6.1.x Severity ======== To fully exercise a breach, an attacker must have already obtained a valid multifactor authentication token issued by CAS. The attacker would then need to _somehow_ hijack the user’s in-progress authentication attempt, or have access to their credentials already to login, and supply their own token instead of one issued to and shared with the active user. The severity of this issue is considered medium for CAS. It is recommended that upgrades be carried out to removes any chances of security breaches. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Timeline -------- The issue was originally reported to the CAS application security team on November 21st, 2019 and upon confirmation, CAS was patched on November 22nd. Procedure --------- ### 6.0.x Modify your CAS overlay to point to the version `6.0.7`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.0.7 ### 6.1.x Modify your CAS overlay to point to the version `6.1.2`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.1.2 ### 6.2.x Modify your CAS overlay to point to the version `6.2.0-RC1`, _when released_. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.2.0-RC2 Support ======= CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F24%2Fsmfavuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Saturday, Feb 13, 2021 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects handling Google Authenticator accounts for multifactor authentication. If you are not using Google Authenticator for multifactor authentication there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.2.x - 6.3.x If your CAS version is not listed above and is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== The underlying issue allows the adversary to bypass the Google Authenticator 2FA mechanism, by using a mixture of uppercase and lowercase characters in the username, having compromised the user account in the first place. The component abstractions that are responsible for locating user records with Google Authenticator tend to execute search queries in a case-sensitive manner. If the given username contains mixed characters and primary authentication (such as LDAP) allows for case-insensitive usernames, the repository component in the 2FA step might fail to locate the proper user record, and in turn might ask the user/adversary to enroll their own device and log in. It is recommended that upgrades be carried out to removes any chances of security breaches. This post will be updated with additional details once the grace period has passed. Timeline ======== The issue was originally reported on February 9th, 2021 and upon confirmation, CAS releases were patched on February 10th, 2021 and released on February 13th, 2021. Patching ======== Big thanks to Linos Giannopoulos for [reporting this issue](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , supplying a patch to fix the issue and working with the security team to test and discuss the fix. Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.2.x Modify your CAS overlay to point to the version `6.2.8`. ### 6.3.x Modify your CAS overlay to point to the version `6.3.2`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2021%2F02%2F13%2Fgauthvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Monday, Oct 18, 2021 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects its **REST protocol** and functionality. If you are not using the CAS REST functionality to create or query for tickets, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.3.x - 6.4.x If your CAS version is not listed above and is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== CAS is vulnerable to a Reflected Cross Site Scripting attack, via `POST` requests sent to the REST API endpoints. The payload could be injected on URLs: `/cas/v1/tickets/`. Malicious scripts can be submitted to CAS via parameters such as the ticket id or the username. That results in CAS rejecting the request and produce a response in which the value of the vulnerable parameter is echoed back, resulting in its execution. [CVE-2021-42567](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42567) has been reserved to track this issue. Timeline ======== The issue was originally reported on October 13th, 2021 and upon confirmation, CAS releases were patched on October 16th, 2021 and released. Patching ======== Big thanks to Caio Farias for [reporting this issue](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , supplying a patch to fix the issue and working with the security team to test and discuss the fix. Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.3.x Modify your CAS overlay to point to the version `6.3.7.1`. ### 6.4.x Modify your CAS overlay to point to the version `6.4.2`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2021%2F10%2F18%2Frestvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Sunday, Mar 6, 2022 2 minute read Overview ======== This is the version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that when it’s acting as an OpenID Connect identity provider. If you are not using CAS as an OpenID Connect Provider, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.4.x - 6.5.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== The underlying issue is related to revoking previously-issued OAuth/OIDC access tokens when an expired or invalid OAuth code is submitted to the CAS server in exchange for an access token. In this scenario, CAS will correctly reject the invalid code but begins to query the ticket registry to find all other access tokens previously issued for the invalid code to revoke those. This could potentially lead to a DDOS attack on any CAS system acting as an OIDC server by providing fake OAuth codes on the `/token` endpoint. Timeline ======== The issue was originally reported on March 2nd, 2022 and upon confirmation, CAS releases were patched on March 5th, 2022 and released on March 6th, 2022. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.4.x Modify your CAS overlay to point to the version `6.4.6.1`. ### 6.5.x Modify your CAS overlay to point to the version `6.5.1`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F06%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Spring Framework RCE Vulnerability Disclosure – Apereo Community Blog CAS Spring Framework RCE Vulnerability Disclosure ================================================= Thursday, Mar 31, 2022 2 minute read Overview ======== This is the version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that results in an RCE vulnerability in the Spring framework. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.4.x - 6.5.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== [See this](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement) . The specific exploit requires the CAS application to run on Tomcat as a WAR deployment. If CAS is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Follow-up: [see this](https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968) Timeline ======== The issue was originally reported on March 30th, 2022 and upon confirmation, CAS releases were patched on March 31st, 2022 and released on the same day. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.4.x Modify your CAS overlay to point to the version `6.4.6.3`. ### 6.5.x Modify your CAS overlay to point to the version `6.5.3`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Spring+Framework+RCE+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&title=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&title=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&name=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&title=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&title=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2022%2F03%2F31%2Fspring-vuln%2F&t=CAS+Spring+Framework+RCE+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Thursday, Jun 23, 2022 2 minute read Overview ======== This is the version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that when it’s acting as an OAuth **OR** OpenID Connect identity provider. If you are not using CAS as an OAuth **OR** OpenID Connect Provider, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.4.x - 6.5.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== When CAS is acting as an OAuth **OR** OpenID Connect identity provider, the underlying issue allows an attacker to bypass the CAS service registry and application registrations by crafting a special URL and ultimately force CAS to receive a **service ticket** for an unauthorized application that is capable of understanding the CAS protocol. Timeline ======== The issue was originally reported on May 19th, 2022 and upon confirmation, CAS releases were patched on May 25th, 2022, and June 23rd 2022. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.4.x Modify your CAS overlay to point to the version `6.4.6.4`. ### 6.5.x Modify your CAS overlay to point to the version `6.5.5`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2022%2F06%2F23%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Friday, Jul 1, 2022 2 minute read Overview ======== This is the version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that when it’s acting as an OAuth **OR** OpenID Connect identity provider. If you are not using CAS as an OAuth **OR** OpenID Connect Provider, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.4.x - 6.5.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== When CAS is acting as an OAuth **OR** OpenID Connect identity provider, the underlying issue allows an attacker to bypass the CAS service registry and application registrations by crafting a special URL and ultimately force CAS to open-redirect to a supplied URL after logout operations. Timeline ======== The issue was originally reported on June 23rd, 2022 and upon confirmation, CAS releases were patched on June 30th, 2022, and July 1st 2022. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.4.x Modify your CAS overlay to point to the version `6.4.6.5`. ### 6.5.x Modify your CAS overlay to point to the version `6.5.6`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2022%2F07%2F01%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.1.x User Swap - Cause and Analysis – Apereo Community Blog CAS 5.1.x User Swap - Cause and Analysis ======================================== Thursday, Aug 31, 2017 5 minute read **Contributed Content** [Travis Schmidt](mailto:travis.schmidt@gmail.com) , an active member of the CAS community, was kind enough to share this analysis. Problem ======= Shortly after deploying CAS `5.1.2` to our production environment, we received incident reports of users signing into various systems as themselves, but were presented with the accounts of other random users. The first applications we received reports on were GMail and Box, which both used Shibboleth and the ShibCAS plugin to authenticate, so that is where we first focused our attention. Later that day after investigating the first incidents, another was reported on a system that only used CAS to authenticate and our attention switched solely to CAS. After the CAS only incident was reported we did an emergency roll back to our previous CAS `4.2.6` version. After the rollback, no new incidents have been reported. Reproducing the Error ===================== First Attempt ------------- In order to try and identify a cause we looked at the differences between our development environment and our production environment. The most obvious difference is that production is four nodes while development is only three nodes. Since it appeared user info was swapped, the Hazelcast ticket registry was our first suspect and we focused our initial efforts there. We added a fourth node to match production and began load testing again, but were not able to reproduce the error with just this added. Second Attempt -------------- We next focused on our JMeter script used to load test the application. We modified it to put random delays between users being presented with the login page and posting the login page, calls to all three service validate protocols, and a delayed logout to about half the user threads. We still did not produce the error with this new script. Third Attempt ------------- Lastly we tried a massive amount of load, significant factor higher than what we expect in production. We saw significant amount of timeout errors and where the system could not keep up, but not the user swap error. Finally ------- I realized that a significant difference between this deployment and our previous deployment was the removal of the `statistics/ping` endpoint. This meant that the F5 load balancer, and the monitoring systems were changed to call the `cas/status` endpoint. In production this meant that the `cas/status` endpoint was being called on each node once every 2-3 seconds. For all the load testing we did before deployment and after, the development nodes were removed from the load balancer and a static page was being sent to the F5 from Apache. This extra load was never present when running load test before deployment. After running the load test with this `cas/status` being called by the F5, we started to see the timeouts happen earlier in the run. For all test runs to this point I was stopping the test at the first error, and then trying to exam the state of the system. No real information was gleamed from looking at logs. After one test had stopped I tried doing a `cas/login` to the node that produced the error. This is where our breakthrough came. Instead of being presented with the login page, I was looking at the status page. I set the tests to only stop the thread that caused the error and continued running the test. This is when we started to see the responses start to be mixed. It would always start with AJP timeouts, but after a bit we start seeing responses being mixed, and eventually two service validate calls would hit just right and `tesuserYYY` would be validated as `testuserXXX`. Now we were able to consistently reproduce the error. Identifying the Cause ===================== Deployment Infrastructure ------------------------- CAS is run on Apache Tomcat servers that are fronted on each instance by an Apache httpd web server that uses AJP to proxy request to the application. I think this configuration is quite normal and probably used widely elsewhere. We focused our attention on Apache, firstly because they were upgraded the same time as the deployment, and secondly because restarting the web server on an affected node cleared the swapping issue. We tried downgrading, and applying even newer updates, but the problem still persisted. We then tried to upgrade Tomcat to `8.5.x` from our current `8.0.x` version that we are using, but the problem still persisted. Analyzing Customizations ------------------------ We have quite a few customizations that we make to the CAS application. In order to rule out that we introduced the issue with our code, we created clean version of the CAS `5.1.x` branch with [Hazelcast](https://apereo.github.io/cas/5.1.x/installation/Hazelcast-Ticket-Registry.html) , [LDAP](https://apereo.github.io/cas/5.1.x/installation/LDAP-Authentication.html) and [Duo Security](https://apereo.github.io/cas/5.1.x/installation/DuoSecurity-Authentication.html) modules compiled in. The error still occurred with this version of CAS. Analyzing the Network --------------------- We next focused on the AJP proxy between Apache and Tomcat. We reconfigured Tomcat to accept connections on `8443` and called it directly bypassing Apache. This somewhat mitigated the issue. After several runs this way we always saw swapping occur, but it always seemed to just swap the status page with a login or service validate call, but never saw the CAS protocol endpoints swap, or a user swap on validate. Viola! ------ Our focus was then on to the component that produces the status page, `HealthCheckController`. After numbly staring at the code for a while, and trying a few things, we finally noticed that the mapped method for the status page was coded to return a `WebAsyncTask`. How the callable object was being used would turn out to be the cause of our issue. Fixing the Problem ================== I [put together a patch](https://github.com/apereo/cas/pull/2891) targeted at the next CAS `5.1.x` release (`5.1.4` at the time of this writing) to address this problem. The patch is of course merged, and it is also brought forward to `master`. You should be able to mitigate this problem, the very next time you upgrade your CAS `5.1.x` instance. To see the CAS release schedule, please [click here](https://github.com/apereo/cas/milestones) . [Travis Schmidt](mailto:travis.schmidt@gmail.com) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.x+User+Swap+-+Cause+and+Analysis&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&title=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&title=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&name=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&title=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&title=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F31%2Fcas5-userswap-buganalysis%2F&t=CAS+5.1.x+User+Swap+-+Cause+and+Analysis "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - REFEDS MFA Profile with shib-cas-authn3 – Apereo Community Blog Apereo CAS - REFEDS MFA Profile with shib-cas-authn3 ==================================================== Monday, Feb 26, 2018 4 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This is a short story on the birth of the [shib-cas-authn3 plugin](https://github.com/Unicon/shib-cas-authn3) and its newfound support for the [REFEDS MFA Profile](https://refeds.org/profile/mfa) . Overview ======== Though nowadays less so, you may have an IAM deployment composed of both an [Apereo CAS Server](https://github.com/apereo/cas) and a [Shibboleth Identity Provider](https://www.shibboleth.net/) . The original premise for managing such a deployment dates back to days where CAS v3 had \[almost\] no support for the SAML2 protocol and likewise, the Shibboleth Identity Provider v2 lacked support for the CAS protocol. To accommodate all integration needs, institutions deployed both solutions and then set in pursuit of a way to close the space between the two to provide a seamless user experience. …and by seamless, I mean: * How could one manage SSO sessions between the two platforms? * How could one fetch and release attributes to SAML2 SPs? * How could one handle single logout? * How would the user interface elements behave with regards to SAML2 MDUI? * … Viola! ====== So was born the [shib-cas-authn3 plugin](https://github.com/Unicon/shib-cas-authn3) . The plugin simply acts as a link between the two platforms, allowing authentication requests from the Shibboleth IdP to be routed “invisibly” to CAS and then back. Conceptually it sits between the two systems, (though physically it lives inside the IdP), and knows how to translate one protocol (SAML2) to another (CAS) and then does it all in reverse order on the trip back to the SAML service provider. ![untitled](https://user-images.githubusercontent.com/1205228/36662801-d91e9aa6-1af4-11e8-9206-7f4b88632173.png) This is a neat trick because to the SAML2 Service Provider, that fact that authentication from the IdP is delegated to somewhere else is entirely irrelevant. Likewise, the Shibboleth IdP also does not care what external authentication system handles and honors that request. All it cares about is, “I routed the request to X. As long as X gives me back the right stuff, I should be fine to resume”. Author’s Note ------------- I say _nowadays less so_ because today, the Shibboleth IdP v3 has great [support for the CAS protocol](https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration) and Apereo CAS v5 has native [support for the SAML2 Protocol](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) . While “separation of concerns”, “leaving each to its own” and having “boxes and arrows” pointing back and forth and living in perfect harmony in a pretty diagram are excellent conditions to live by, it would be best to consolidate down to one system since the concerns are no longer separate and more so, they tend to cost money and strands of hair quite a bit over time. Given the right circumstances and support, [the Majestic Monolith](https://m.signalvnoise.com/the-majestic-monolith-29166d022228) can be sweet. Handling REFEDS MFA Profile =========================== So then comes the REFEDS MFA Profile: > This Multi-Factor Authentication (MFA) Profile specifies requirements that an authentication event must meet in order to communicate the usage of MFA. It also defines a SAML authentication context for expressing this… And: > The MFA Authentication Context can be used by Service Providers to request that Identity Providers perform MFA as defined below and by IdPs to notify SPs that MFA was used. In more complicated terms, if a SAML SP were to specify `https://refeds.org/profile/mfa` as the required authentication context, the identity provider would need to translate and find the appropriate MFA solution to execute in order to satisfy that requirement and then reassuringly convey the result back to the SP. How could we do this with the Shibboleth Identity Provider, Apereo CAS server, and the shib-cas-authn3 plugin all having their bit of fun in the flow? One Solution ============ Consider the following starting positions: * Since Apereo CAS is ultimately in charge of executing authentication, it would also be the party in charge of executing multifactor authentication. * Our strategy for delivering MFA in response to `https://refeds.org/profile/mfa` would be one backed by Duo Security, [easily supported by CAS](https://apereo.github.io/2018/01/08/cas-mfa-duosecurity/) . Our task list then would be to find ways to: * …communicate the requested authentication context to CAS. * …translate the requested authentication context to something CAS would understand as a trigger for Duo Security MFA. * …ensure the requested authentication context is satisfied by CAS, before handing off a response to the SP. Say hello to [shib-cas-authn3](https://github.com/Unicon/shib-cas-authn3#handling-refeds-mfa-profile) `v3.2.4`. **Collaborate** As of this writing, `3.2.4` is still in beta. Download, deploy, verify and contribute back enhancements as time and DNA permits. Staring with `v3.2.4`, the plugin has native support for REFEDS MFA profile. The requested authentication context class that is `https://refeds.org/profile/mfa` is passed along from the Shibboleth IdP over to this plugin and is then translated to a multifactor authentication strategy supported by and configured in CAS (i.e. Duo Security). The CAS server is notified of the required authentication method via a special `authn_method` parameter by default. Once a service ticket is issued and plugin begins to validate the service ticket, it will attempt to ensure that the CAS-produced validation payload contains and can successfully assert the required/requested authentication context class. For additional info on configuring the plugin, please see [the project’s README](https://github.com/Unicon/shib-cas-authn3#handling-refeds-mfa-profile) . So… === I hope this review was of some help to you and I am sure that both this post as well as the functionality it attempts to explain can be improved in any number of ways. Please feel free to [engage and contribute](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) as best as you can. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&title=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&title=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&name=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&title=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&title=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F26%2Fshibcasauthn-duomfa-refeds%2F&t=Apereo+CAS+-+REFEDS+MFA+Profile+with+shib-cas-authn3 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Friday, Sep 27, 2019 2 minute read Overview ======== This is an Apereo CAS project vulnerability disclosure, describing an issue in CAS that affects random number generation. Apereo CAS is using an insecure source of randomness to generate its password reset URL among other things. This is because Apereo CAS relies upon apache commons lang3 `RandomStringUtils`. [From the documentation of this class](https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html) : > Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure. The following areas and components in CAS make use of `RandomStringUtils` to generate a random number: * Password reset URL, when CAS Password Management is turned on. * Internal token identifiers when CAS is acting as a simple multifactor authentication provider. * JWT encryption key generation, when used specifically via the CAS command-line shell. * OAuth user device code * Anonymous or transient username identifiers CVEs ==== Applications for CVEs were submitted to MITRE for approval by the folks at [snyk.io](https://snyk.io/) : * https://nvd.nist.gov/vuln/detail/CVE-2019-10754 * https://nvd.nist.gov/vuln/detail/CVE-2019-10755 Credits ======= Special thanks to Jonathan Leitschuh for originally reporting the issue to the CAS application security group, and the good folks at [snyk.io](https://snyk.io/) who graciously and patiently provided additional guidance and assistance. Affected Deployments ==================== The attack vector applies to deployments of the CAS server for the versions: - 5.3.x - 6.0.x - 6.1.x Previous CAS versions are considered [EOL](https://apereo.github.io/cas/developer/Maintenance-Policy.html) and are advised to upgrade. Severity ======== Most if not all references to `RandomStringUtils` in CAS are purely used internally and have no significant impact on the security of the deployment or connected integrations. The only _possible_ exception might be the generation of password reset urls when the password management functionality is turned on with the assumption that one can craft a reset URL which: * contains a compromised token that is identical to the one tracked and created by CAS. * is still valid within the configured expiration timeframe. * is signed and encrypted using the same keypair used by CAS. The severity of this issue is considered low for CAS, though it is recommended that upgrades be carried out to removes any chances of security breaches. Patching ======== Patch releases are available to address relevant CAS deployments. The patch effectively replaces usages of `RandomStringUtils` for random number generation with one that relies on a more secure strategy. Upgrades to the next patch version for each release should be a drop-in replacement. Timeline -------- The issue was originally reported to the CAS application security team on September 17th, 2019 and upon confirmation, CAS was patched. Procedure --------- ### 5.3.x Modify your CAS overlay to point to the version `5.3.12.1`. A snippet of a `pom.xml` for a CAS overlay follows: org.apereo.cas cas-server-webapp ${cas.version} war runtime 5.3.12.1 ### 6.0.x Modify your CAS overlay to point to the version `6.0.5.1`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.0.5.1 ### 6.1.x Modify your CAS overlay to point to the version `6.1.0`. A snippet of a `gradle.properties` for a CAS overlay follows: cas.version=6.1.0 Support ======= CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F27%2Fnumvulndisc%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Deployment Using systemd – Apereo Community Blog Apereo CAS - Deployment Using systemd ===================================== Thursday, Nov 28, 2019 2 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . **Contributed Content** [Fabio Martelli of Tirasa S.r.l](https://www.tirasa.net/tirasa/team/fabio-martelli) , an active member of the CAS community, was kind enough to share this analysis. Overview ======== The following is a short and sweet tutorial on how to deploy Apereo CAS using an embedded servlet container and as `systemd` service. Our starting position is based on: * CAS `6.1.x` * Java `11` * [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) Configuration ============= To make the instances start automatically, you need to add the following cas.service script to the `/ etc / systemd / system directory`: [Unit] Description = making network connection up After = network.target [Service] ExecStart = java -server -noverify -Xmx2048M -XX:+TieredCompilation \ -XX:TieredStopAtLevel=1 -Dcas.standalone.configurationDirectory=/opt/cas/conf \ -DKEYSTORE_PASSWORD=... -jar /opt/cas/cas.war [Install] WantedBy = multi-user.target Then run the following commands: systemctl enable cas.service Configure the necessary security policies by creating the `cas.te` file as shown below. This file was obtained by analyzing the audit file with the command: sudo cat /var/log/audit/audit.log | audit2allow -m cas The resulting file was as follows (as mentioned, saved under `cas.te`): case module 1.0; require { type user_tmp_t; type init_t; type http_port_t; type root_t; type unreserved_port_t; type usr_t; type default_t; class file { append create map open rename unlink write }; class process execmem; class dir create; class tcp_socket name_connect; } #============= init_t ============== allow init_t default_t:dir create; allow init_t default_t:file create; allow init_t default_t:file { append open }; allow init_t http_port_t:tcp_socket name_connect; allow init_t root_t:dir create; allow init_t root_t:file { create append open }; allow init_t self:process execmem; allow init_t unreserved_port_t:tcp_socket name_connect; allow init_t user_tmp_t:file { create map write }; allow init_t usr_t:file { append create rename unlink }; Transform the file cas.te into a binary `cas.mod`: checkmodule -M -m -o cas.mod cas.te Create the policy package with the following command: semodule_package -o cas.pp -m cas.mod Install the defined security policies: sudo semodule -i cas.pp Then run CAS: systemctl start cas So… === I hope this review was of some help to you and I am sure that both this post as well as the functionality it attempts to explain can be improved in any number of ways. Please know that all other use cases, scenarios, features, and theories certainly [are possible](https://apereo.github.io/2017/02/18/onthe-theoryof-possibility/) as well. Feel free to [engage and contribute](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) as best as you can. Finally, if you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem and care about its long-term success and sustainability, this is a viable option to consider. Happy Coding, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Deployment+Using+systemd&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&title=Apereo+CAS+-+Deployment+Using+systemd "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&title=Apereo+CAS+-+Deployment+Using+systemd "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&name=Apereo+CAS+-+Deployment+Using+systemd "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&title=Apereo+CAS+-+Deployment+Using+systemd "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&title=Apereo+CAS+-+Deployment+Using+systemd "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F28%2Fcas61x-systemd-deployment%2F&t=Apereo+CAS+-+Deployment+Using+systemd "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - JMeter Performance Testing – Apereo Community Blog Apereo CAS - JMeter Performance Testing ======================================= Friday, Nov 8, 2019 7 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Overview ======== In this tutorial, we are going to be setting up the scenarios needed to performance test CAS. We will be using the JMeter test scripts that are included in the CAS source code repository! How fun is that?! I hope by doing this, you will become more familiar with perf testing and can implement your own testing harness for future releases of CAS. I do want to state that since perf testing can be highly subjective in what should be tested, we are going to be creating the minimal scenarios needed to successfully run the JMeter scripts. I hope you will then build off these scenarios to meet your testing needs. Our starting position is: * CAS `6.1.x` * Java `11` * [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) * [CAS JMeter Scripts](https://github.com/apereo/cas/tree/master/etc/loadtests) * [JMeter - Latest Version](http://jmeter.apache.org/download_jmeter.cgi) * [CAS Online Manual - JMeter Performance Scripts](https://apereo.github.io/cas/6.1.x/high_availability/Performance-Testing-JMeter.html) Note: I am assuming you already have a non-Prod working version of CAS running or at least have the knowledge of setting up a new CAS instance. Also, I will not be going over the process of getting CAS working with SAML2, since that has been covered in several other blog postings on the [Apereo CAS blog](https://apereo.github.io/) site. Finally, I will not be going over the installation of JMeter since there are a ton of online tutorials to install JMeter on any flavor of operating systems. CAS Performance Testing ======================= ### Modules If you are brand new to performance testing and/or JMeter, please review this link [CAS Online Manual - JMeter Performance Scripts](https://apereo.github.io/cas/6.1.x/high_availability/Performance-Testing-JMeter.html) to get a better idea of how the included JMeter scripts work and how they can be customized. There are currently 3 JMeter scripts in the CAS repository, each one focuses on a protocol currently supported by CAS. We will be building scenarios for the two most popular CAS and SAML2. Below are the dependencies that will need to be added to the **build.gradle** file: dependencies { // Other CAS dependencies/modules may be listed here... compile "org.apereo.cas:cas-server-webapp-tomcat:${project.'cas.version'}" compile "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}" compile "org.apereo.cas:cas-server-support-saml-idp:${project.'cas.version'}" } As you can see we will be using the Tomcat container module to support easy deployment of our CAS instance. We will also be using the JSON Service Registry module to support our JSON based Service Provider files. And lastly, we will add the module needed to support the SAML2 protocol. You will probably notice that we did not add a CAS protocol module, why? The CAS protocol is the native protocol used by the CAS application, therefore it is automatically available out of the box. CAS supports CAS! lol So let’s begin! ### CAS Protocol File: **CAS\_CAS.jmx** Once you review the **CAS\_CAS.jmx** file, you will notice that there are only 4 steps included with the script file for the CAS protocol. At a very basic level, the Service Provider (SP) requests authentication for a user, CAS then sends back a ticket to the SP after the users successful login, then the SP asks CAS to validate the ticket, and finally CAS validates the ticket and sends back the already negotiated parameters to the SP. This of course is an oversimplification of the protocol! We are just keeping it simple to make sure we can wrap our tiny brains around it! ;-) Now that we know what is happening in the script, we now need to create the environment so we can run this JMeter script successfully! #### Service Provider To keep it simple, we will not be setting up a Service Provider instance for this perf test since it is not really needed. #### CAS Settings We have already added the **cas-server-support-json-service-registry** module, all we need to do is tell CAS where we will be storing the JSON based Service Provider files. Add the following to the **cas.properties** file: cas.service-registry.json.location=file:/etc/cas/services We will also need to create a new JSON Service file for a fictitious SP under the Service Registry location we just added: **/etc/cas/services/castest-900.json** { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https://castest.edu/.*", "name" : "casTest", "id" : 900 } #### JMeter Settings Update the User Defined Variables tab in the JMeter script to reflect the following: IdPHost = https://casidp.edu:8443 (Same as cas.server.name in cas.properties) CasSP = castest.edu (Same as serviceId in JSON Service file) Since we are keeping this simple, we will initially be testing with one user account. Verify in the **Cas-Users.csv** file that the user of **casuser** is in the file, if not add `casuser,Mellon` to the file. Then verify that script file is pointed to this .csv file under the “CSV Get Users/Passwords” tab of the script file. Now run the JMeter script either from the command line or via the JMeter GUI and hopefully you should get a passing test! ### SAML Protocol File: **CAS\_SAML2.jmx** Once you review the **CAS\_SAML2.jmx** file, you will notice that the script has only 4 steps just like the CAS version, but a whole lot more is taking place in each of those steps! I am not planning on delving much deeper into the SAML2 protocol, since again this is a performance testing tutorial and not a SAML2 protocol tutorial. But I do want to point out that the script was purposely created so that it would support the majority of SAML2 calls with little to no tweaks needed within the HTTP requests sections. To me that is a life saver, whew! #### CAS Settings - Part 1 Update the **cas.properties** file and add: cas.authn.saml-idp.metadata.location=file:/etc/cas/saml cas.authn.saml-idp.entityId=https://casidp.edu:8443/idp Note: At this point you will need to run CAS to generate the appropriate certs and Idp metadata needed for the SAML2 metadata exchange with the SP. #### Service Provider Since we will need to generate metadata for the SP side of the equation, as well as the IdP side, it would behoove us to setup a SAML SP application to take care of generating the metadata for us. I know some of you consider yourselves to be SAML2 virtuoso’s and think you can create a fictitious metadata file on the fly. Not me, I am a simple man with simple ways, so I will stand up a quick SAML2 SP instead. :-) Rather than setup and configure a new SAML2 SP, I used a handy and also dandy Dockerized version of a Shibboleth SP contained in the [Dockerized Idp Testbed](https://github.com/UniconLabs/dockerized-idp-testbed) suite. This is an excellent learning tool that stands up two SAML2 SP’s (Shibb and SimpleSAMLPHP), an Ldap instance and also an Idp via Docker. Nice! Once I downloaded the Dockerized Testbed, I deactivated the Idp side of things and exchanged the metadata between the Shibboleth SP and my CAS instance. For those still learning, the SP metadata can be found in `idp/shibboleth-idp/metadata/sp-metadata.xml`. If you do not want to use the Testbed app, feel free to setup your SAML2 SP of choice! Some notable SP’s are [Shibboleth SP](https://wiki.shibboleth.net/confluence/display/SP3) and [SimpleSAMLPHP](https://simplesamlphp.org/) . Just remember that whatever choice you make, you may have to update the JMeter script to reflect the correct endpoints. #### CAS Settings - Part 2 We will also need to create a new JSON Service file for the SAML2 SP in the same folder we added the castest JSON file. **/etc/cas/services/samltest-1000.json** { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "https://samltest.edu/shibboleth", "name" : "SamlTest", "id" : 1000, "metadataLocation": "/etc/cas/saml/metadata/sp.xml" } #### JMeter Settings Now update the JMeter file to reflect the following: User Defined Variables: IdPHost = https://casidp.edu:8443 (Same as Saml Idp EntityId in cas.properties) CasSP = samltest.edu (Same as serviceId in JSON Service file) ProviderId = https://samltest.edu/shibboleth (EntityId of SP) Now run the JMeter script and hopefully you should get a passing test! So… === I hope this has helped you in understanding how you can performance test CAS going forward and will help you in creating your own testing scenarios! I hope you enjoyed it! Finally, if you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem and care about its long-term success and sustainability, this is a viable option to consider. As [Misagh Moayyed](https://fawnoos.com/) says ‘Happy Coding’! [Axel Stohn](https://github.com/astohn) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+JMeter+Performance+Testing&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&title=Apereo+CAS+-+JMeter+Performance+Testing "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&title=Apereo+CAS+-+JMeter+Performance+Testing "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&name=Apereo+CAS+-+JMeter+Performance+Testing "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&title=Apereo+CAS+-+JMeter+Performance+Testing "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&title=Apereo+CAS+-+JMeter+Performance+Testing "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F08%2Fcas61x-jmeter-load-testing%2F&t=Apereo+CAS+-+JMeter+Performance+Testing "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Python Locust Load Testing – Apereo Community Blog Apereo CAS - Python Locust Load Testing ======================================= Wednesday, Nov 27, 2019 5 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Overview ======== In this tutorial, we are going to learn how we can use the **Locust** starter scripts included in the CAS source repository to load test our CAS instances. For those not familiar with Locust, it is a Python based load testing framework that is fairly popular in the Python community. If you keep up with this blog, you have probably already read the [JMeter tutorial](https://apereo.github.io/2019/11/08/cas61x-jmeter-load-testing/) I wrote earlier this month. We will be using those same testing scenarios and CAS instance to run the Locust scripts against, so it may behoove you to reread that [tutorial](https://apereo.github.io/2019/11/08/cas61x-jmeter-load-testing/) or dare I say, read it for the first time. It is a thriller! ;-) Our starting position is: * CAS `6.2.x` * Java `11` * [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) * [Python 3.7.5](https://www.python.org/downloads/release/python-375/) * [CAS Locust scripts](https://github.com/apereo/cas/tree/master/etc/loadtests) * [Locust - Latest Version](https://locust.io/) Locust Setup ============ Since we will be using Python for this tutorial, you will probably need to setup some sort of virtual environment to run the correct version of Python (3.7.5) for this tutorial. I use [pyenv](https://github.com/pyenv/pyenv) , but any virtual environment creation tool can be used. Another popular tool is [virtualenv](https://virtualenv.pypa.io/en/latest/) . Once you have the Python environment running, you will need to install the required libraries that Locust needs so it can run correctly. You can either install each requirement manually with **pip** or you can install via the **requirements.txt** file included with the scripts. virtenv3.7.5> pip install OR virtenv3.7.5> pip install -r requirements.txt Once you get Locust running and start reviewing the scripts, you will notice is that it is quite different from JMeter. Besides it being written in Python, it also does not have a GUI interface nor does it have the great recording features that JMeter has. The Locust scripts are basically written using plain ole Python. ### Locust Script Breakdown #### Single Protocol Script Files File: **casLocust.py** or **samlLocust.py** So let’s begin by breaking down one of the scripts located in the CAS source code repository, they are located under the **https://github.com/apereo/cas/tree/master/etc/loadtests/locust** directory. I will be using the CAS protocol file (casLocust.py), but feel free to use the SAML (samlLocust.py) version, if it is more inline with how your organization uses CAS. They are both similarly laid out, so it should be easy to follow along with either script. Once you open the file, go to the bottom of the file where you will see a class declaration named the same as the file name, in my case that is the **CASLocust** class. This is where Locust looks to determine how to create and run the **Locust Swarm**! The critical lines are: task_set = CASTaskSet host = "https://mysite.edu:8443" wait_time = between(2, 15) The **task\_set** parameter tells Locust where it can locate the code that will define the behavior of each Locust in the swarm, in this case it is the **CASTaskSet** class. The **host** param contains the URL of the site that the Locust simulated user will run against. For our purposes, this will point to our CAS instance. The **wait\_time** param will determine the amount of seconds Locust will wait to run each task, this will be randomized between 2 and 15 seconds. Let’s take a look at the **CASTaskSet** class. For those following along, it is located towards the top of the file and contains 4 declared methods. The **on\_start** and **on\_stop** methods are the Locust based methods that run before a simulated user starts and after it ends. This means it is an ideal place to load any user based settings that may be required by a simulated user for traversing the CAS site. Currently, only some basic logging is setup within them. I did add some code to the **on\_start** method to turn off SSL error logging, due to having self signed certs. In hindsight, I should have moved this to the Lotus method that initializes the script, I will add that to my to-do list! The other two methods are the user created behaviors of **login** and **logout**. Both these behaviors have the **@seq\_task** decorator added to them. This decorator tells Locust that each of these behaviors is a specific task and they are to be executed in a sequence for each simulated user. The first task will be to login a simulated user into CAS, if no errors occur, then run the second task of logging that simulated user out of CAS. I am not going to go through each line of the **login** method, since that would be more of a lesson in Python coding than Locust script writing. #### Multiple Protocol Script Files File: **bothLocust.py** This script supports both CAS **AND** SAML simulated users access to CAS. Which I think is very cool! The support for both protocols is accomplished by taking advantage of the Locust **@task** decorator. Unlike the **@seq\_task**, where each task is run sequentially, the Locust **@task** decorator tells Locust that this is a task, but there is no sequence order, so each task is picked at random. Also, Lotus has added weighting to the **@task** decorator, so we can manipulate the load test to have twice as many SAML logins as CAS logins or vice versa. With this in mind plus taking advantage of Python’s support for “nested classes”, we now have a script that can be easily expanded to support even more protocols! WooHoo! Running Locust… =============== To Run Locust virtenv3.7.5> locust -f cas5/casLocust.py * Open your browser to **http://localhost:8089/** * Choose # of Users * Choose Hatch rate * Start Swarming Now that we have an idea of how the scripts work, feel free to run Locust against the various scenarios we had setup in the [JMeter posting](https://apereo.github.io/2019/11/08/cas61x-jmeter-load-testing/) . So… === I hope this has helped you in understanding how the Locust Load Testing Framework works and how you can use it to load test CAS. I hope you enjoyed it! Finally, if you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem and care about its long-term success and sustainability, this is a viable option to consider. As [Misagh Moayyed](https://fawnoos.com/) says ‘Happy Coding’! [Axel Stohn](https://github.com/astohn) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Python+Locust+Load+Testing&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&title=Apereo+CAS+-+Python+Locust+Load+Testing "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&title=Apereo+CAS+-+Python+Locust+Load+Testing "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&name=Apereo+CAS+-+Python+Locust+Load+Testing "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&title=Apereo+CAS+-+Python+Locust+Load+Testing "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&title=Apereo+CAS+-+Python+Locust+Load+Testing "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F27%2Fcas62x-locust-load-testing%2F&t=Apereo+CAS+-+Python+Locust+Load+Testing "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5 Load Tests by Lafayette College – Apereo Community Blog CAS 5 Load Tests by Lafayette College ===================================== Friday, Jun 9, 2017 5 minute read **Contributed Content** Carl Waldbieser (``), an active member of the CAS community, was kind enough to share this analysis. * [Overview](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#overview) * [Deployment Architecture](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#deployment-architecture) * [The Test Swarm](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#the-test-swarm) * [The Trials](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#the-trials) * [Trial 1](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-1) * [Trial 2](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-2) * [Trial 3](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-3) * [Trial 4](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-4) * [Trial 5](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-5) * [Trial 6](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#trial-6) * [Conclusions](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/#conclusions) Overview ======== Load testing trials were conducted on the CAS stage environment in order to provide insight into what kind of sustained load the production CAS service will be able to carry. All trials were carried out against the same deployment architecture, with all nodes configured identically. Deployment Architecture ======================= The deployment architecture itself consists of 3 virtual machine nodes. Each node has 3.7 GiB real memory available to it and 2 CPUs. The characteristics of the CPUs are as follows: * Architecture: x86\_64 * CPU op-mode(s): 32-bit, 64-bit * Byte Order: Little Endian * CPU(s): 2 * On-line CPU(s) list: 0,1 * Thread(s) per core: 1 * Core(s) per socket: 2 * Socket(s): 1 * NUMA node(s): 1 * Vendor ID: GenuineIntel * CPU family: 6 * Model: 42 * Model name: Intel Xeon E312xx (Sandy Bridge) * Stepping: 1 * CPU MHz: 1899.999 * BogoMIPS: 3799.99 * Hypervisor vendor: KVM * Virtualization type: full * L1d cache: 32K * L1i cache: 32K * L2 cache: 4096K * NUMA node0 CPU(s): 0,1 The nodes are deployed behind an Nginx+ proxy in an active-active-active configuration. The nodes share ticket information using encrypted Hazelcast messages, a feature built into the CAS software, so any application state is shared. The Test Swarm ============== The testing framework used was `locust.io`, a Python based load testing framework. The test suite deploys a fixed number of “locusts” against a web site. To lean more about locust, please [see this guide](https://apereo.github.io/cas/5.1.x/planning/High-Availability-Performance-Testing.html) . The initial population ramps up with a configurable “hatch rate”. In the tests, locusts were conceptually divided into 3 “lifetime” categories: * Short-lived locusts live approximately 60 seconds. * Medium-lived locusts last for approximately 5 minutes. * Long-lived locusts exist for approximately 2 hours. The category to which a given locust is assigned is randomly determined with a ratio of short : medium : long being 7:2:1. Ideally, 70% of the population is short-lived, 20% is medium lived, and 10% is long-lived. The lifetime of a locust determines how long it will retain and make use of a single web SSO session. Short-lived locusts discard their sessions quickly. Long-lived locusts hold on to them for considerable time. All locusts are only 25% likely to log out upon their deaths. The CAS service must continue to track TGTs of locusts that have not logged out until the ticket expires, so this behavior can put pressure on the memory storage resources of the nodes. Each locust uses credentials taken randomly from one of 9 test accounts. Each locust has a 1% chance of entering an erroneous password for an account. Locusts that fail to authenticate will die immediately. When a locust dies, it is reborn immediately. Its lifetime category remains the same, but its SSO session and all other random parameters are reset. The Trials ========== Trial 1 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `300` | `10/s` | ![](https://user-images.githubusercontent.com/1205228/26984798-cc315252-4d0e-11e7-9802-058f29576dd9.png) The first trial produced authentication events at a rate of over 3,500 event/minute. The majority of these were service ticket creation and validation events. By 13:40 (~5 hours into the trial), degraded performance became noticeable. By 15:50 (~7 hours in), the nodes were swamped. The trial was discontinued shortly thereafter. Trial 2 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `300` | `10/s` | ![](https://user-images.githubusercontent.com/1205228/26984871-1d38b550-4d0f-11e7-8242-6e7d646f8ca4.png) The 2nd trial was similar to the first, but the number of locusts was briefly increased to 500 for a 3 minute duration. The characteristics of trial 2 are very similar to those of trial 1. After responding to ~3,500 / minute for close to 6 hours, the nodes were overwhelmed. Trial 3 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `150` | `10/s` | ![3](https://user-images.githubusercontent.com/1205228/26984914-48d894f0-4d0f-11e7-9e68-c43eafb8804b.png) The 3rd trial used half the number of locusts used in the first 2 trials. The sustained event rate was ~1,700 authentication events per minute. Unlike the previous 2 trials, this trial was concluded prior to the nodes becoming overwhelmed. It is unknown whether the nodes could continue to sustain responding to events at this rate indefinitely. Trial 4 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `50` | `10/s` | ![4](https://user-images.githubusercontent.com/1205228/26984957-68665370-4d0f-11e7-82ac-ca61673e09ec.png) The 4th trial showed the nodes were capable of sustaining a ~600 authentication events/minute rate for a full 24 hours. Because the maximum lifetime of a TGT is 8 hours, there is some reason to believe this rate could have been sustained indefinitely. Trial 5 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `25` | `10/s` | ![5](https://user-images.githubusercontent.com/1205228/26984978-8439edbe-4d0f-11e7-992d-8a80eca2a276.png) This trial was useful in establishing the mean rate of 291 events per minute given a swarm of 25 locusts. This test and test 6 are notably shorter in duration than the other tests, as it is assumed at this point the nodes can sustain the loads indefinitely. Trial 6 ------- | \# of Locusts | Hatch Rate | | --- | --- | | `10` | `10/s` | ![6](https://user-images.githubusercontent.com/1205228/26985007-a23ce76c-4d0f-11e7-9ccf-670146fc8ba6.png) The mean rate of authentication events for this trial is 118 events per minute. Conclusions =========== Measurements taken from the production CAS service from April 17-21, 2017 during normal business hours (9am to 5pm) have the following characteristics: | Mean | Median | Mode | Max | Min | Std Dev | | --- | --- | --- | --- | --- | --- | | 149 events/minute | 139 events/minute | 126 events/minute | 494 events/minute | 2 events/minute | 68 | While there appears to be some “burstiness” in the rate of authentication events, all 3 types of averages are well below the the expected threshold which the trials suggest are indefinitely sustainable. Even the maximum rate of 494 events per minute is well below the sustained rate of trial 4 (~ 600 events / minute). The data suggests that the production CAS service is operating well under the maximum sustainable load, and should have plenty of capacity to spare for temporary spikes in utilization. Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5+Load+Tests+by+Lafayette+College&url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&title=CAS+5+Load+Tests+by+Lafayette+College "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&title=CAS+5+Load+Tests+by+Lafayette+College "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&name=CAS+5+Load+Tests+by+Lafayette+College "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&title=CAS+5+Load+Tests+by+Lafayette+College "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&title=CAS+5+Load+Tests+by+Lafayette+College "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F09%2Fcas5-perfresults-LafayetteCollege%2F&t=CAS+5+Load+Tests+by+Lafayette+College "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Notes from Better by Design 2018 – Apereo Community Blog Notes from Better by Design 2018 ================================ Friday, Aug 24, 2018 10 minute read Notes from a design conference in Madison, WI ============================================= Things I encountered at this conference that challenged me to grow: * Celeste Headlee’s articulating the importance of conversations. * Jorel Dray’s reminder to provide the feedback that others need to grow. * Lou Downe’s call to enable scaling good design by extending more broadly the privilege of the opportunity to practice better service design. Have (better) conversations --------------------------- I found a lot to challenge me [Celeste Headlee](https://twitter.com/CelesteHeadlee) ’s morning keynote ([10 ways to have better conversations](https://betterbydesignconference.com/events/keynote-10-ways-to-have-better-conversations/) ) and in the [conversations practice workshop](https://betterbydesignconference.com/events/practicing-better-conversations/) that immediately followed. See also: * [11 minute TedX talk by this speaker](https://www.ted.com/talks/celeste_headlee_10_ways_to_have_a_better_conversation?language=en) * Book by this author: [We need to talk: how to have conversations that matter](https://www.goodreads.com/book/show/33385019-we-need-to-talk) Our conversations are under-intentional, under-designed. There’s opportunities to have better conversations, by design. Bad news: you cannot fix others’ conversational behavior. (In general, you can’t fix other people). Good news: You can improve your own conversational skills. Online and in email: you are the worst version of yourself. To have better conversations: 1. Single-task. Be present. 2. Don’t lecture. Don’t try to change minds. Instead, go into conversation intending to learn from others. 3. Ask open-ended questions. Who, what, when, where, why, how. Not yes-no questions. 4. Go with the flow of the conversation. Don’t get caught up by some bit or by whatever your mind is teling you relates – let it go and keep up with the conversation as it flows past this. 5. Say you don’t know when you don’t know. 6. Never say “I know how you feel.” You don’t know how the other person feels. Even if you experienced something very similar, you still don’t know how even that experience felt, since with time and distance your mind has dulled that memory. Avoid conversational narcissism. 7. Do not repeat yourself. Say it exactly once, and thereby become the kind of person who’s known to say things exactly once. If people have the impression you repeat yourself, they don’t listen, since their mind assumes they needn’t bother listening because the information will be available from the environment again in the future. If you’re known to say things only once, then people will listen to you the first and only time you say things. 8. Stay out of the weeds. Most details don’t matter most of the time. Most people most of the time do not have the capacity to presently engage with those details. So just drop them. 9. Listen. Really listen to people. Be interested in other people. 10. Keep it brief. Online: you have 8 seconds. In face-to-face conversation, you have 30-60 seconds. It’s not a lot. New research: the liking gap. We under-estimate how much other people like us and enjoy our company. Your inner critic is more critical than others are and hold you to higher standards. Others don’t notice or remember your conversational failures so much as you think. Audience question: What about a culture of “healthy debate”? Answer: Rule for knowing when to engage in “debate”: Any time you want to accomplish anything, don’t “debate”. Audience question: Conversations as ephemeral. What about written communication, email as a way to have a record of conversations? Answer: that record is worth a lot less than you think it is. There’s a huge gap between what the email author thinks the email said and what the email recipient thinks it said. Email is good for: 1. Lists, agendas, and summaries. Send an email listing or agendaing things that you need to have a conversation about. Have the conversation. Then send an email summarizing the conversation. 2. Conveying attachments. 3. Letters. The kind of thing that would have been a longhand real letter in a pre-email era. 4. Praise. It turns out, straight up praise works as well over email as it does in conversation, maybe because looking at it afterward actually works for recipients of praise emails. Remote work: modern teleconferencing tools work great. Phone almost as good as f2f, and solutions with cameras close this gap further. How to get others to behave better in conversation: you can’t. The best you can do is model good behavior. Think of conversation as a game of catch. Both the turn taking, and the setting the other person up for success (catch is only fun if they successfully catch the ball.) Do not offer unsolicited advice. Shift responses vs support responses. Some conversational responses attempt to shift focus to oneself, whereas other conversational responses support the other person. Interesting to think about how this relates to the [Async Manifesto](https://apetro.ghost.io/fixed-async-manifesto/) and to more generally the advantages in making information available asynchronously, on demand, when people are ready to consume it rather than just when you’re ready to say it. How to discover what your users really need ------------------------------------------- [Paige Bennett](https://twitter.com/paigenomadgirl) ’s talk [How to discover what your users really need](https://betterbydesignconference.com/events/peeling-back-the-layers-how-to-discover-what-your-users-really-need/) . We won’t uncover user needs by looking at the data alone. ### Ways to discover user needs Do workshops with users. Actively involve stakeholders – in working roles, photography, facilitation, greeters. Presence of stakeholders improves buy-in through their direct observation. This is more powerful than your reporting results. #### Field visits Observe users in their natural environment. #### Metaphors Helps people to be more expressive and more heard. #### Reframing the question We are not great at imagining what we may do. “Would you use this” –> “Have you used something like this before?” Flip a request for a promise (what would you do) to an observation of current action (what do you currently do). “What would have gotten you to stay?” –> “What did you hope this product would have done for you?” ### Sharing findings with stakeholders Your findings must live on without you. * Workshops * Exhibit pop-ups. Mini museum. * Collateral * Brown bags Audience question: what about remote users? Answer: consider a diary study. Art of feedback --------------- Jorel Dray’s [The art of feedback](https://betterbydesignconference.com/events/afternoon-mini-workshop-1-design-critique/) . Feedback is a process, not an event. Getting feedback (in context of feedback about design work): * Seek out more feedback. * Set the tone. * Handling feedback you don’t agree with: try it before you discredit it. Do what’s right, and also do what was asked for. Show both. * Handling amorphous “I don’t like it” feedback. Gently remind that “it ain’t about you and what you like”, it’s about the design being effective for whatever its goal is. Circle back to the goal and try to get feedback on how the design fares against its goals. * Fight hard, but know when to let it go. Giving feedback: * Respect before anything else. There’s no point in giving feedback to anyone or about anything you don’t respect. * Build a process. What’s working well? What needs to change to meet our objectives? (We do have identified objectives, right?) What would make the work more awesome? Recap. Take notes. Feedback becomes standard and routine, not a punishment. * What, how, when of feedback matters. “You made it too busy” –> “It’s too busy” –> “Try to simplify” –> “Try a version that’s simplified” –> “Try simplifying so that people can focus on that really cool thing you made.” * If time is tight, be specific. * Talk in person when possible. Email is always brutal. * Be timely. * Ask for feedback. If you’re the kind of person who asks for feedback it’s more natural for you to be giving feedback. Demonstrate a state of constant improvement. Demonstrate accepting feedback effectively. * Balance. Affirming and corrective. Standard 3 Mr Rogers to 1 Gorden Ramsay ratio, but sometimes much more Rogers. * It’s not about you. Be what _they_ need you to be to grow. In conclusion: * Work is never bad, it’s just not there yet. * Positive feedback keeps us going. Great feedback improves the world. * Try to find happiness and put energy into growth, not outcome. Keynote: the future of (public) service design ---------------------------------------------- [Lou Downe](https://twitter.com/LouiseDowne) ‘s [The future of (public) service design](https://betterbydesignconference.com/events/closing-keynote-title-tba/) . Just hearing Lou Downe speak in person was inspirational in itself. They’re one of those leaders where you hear them speak and have that feeling of “Yes! Your heart is in the right place. You’re brave. You’re doing the right thing and doing the right things in the right ways. I’d follow you.” The vision they laid out was also compelling. Cenrtalization brought a significant initial increment of experience improvement for people interacting with the UK government, but the UK will achieve the next increment of improvement through empowering decentralized attentions to user experience throughout the UK government. Transformation is the ability of an organization to deliver and maintain a service over time. delivery –> scale and sustainability Successfully delivering services at all is good, better than not. But the long term wins will come from scaling and sustaining service delivery. “Digital” is just a means to an end. Most of government is service design most of the time. Digital Service Standard –> Government Service Standards Design your infrastructure, or your infrastructure will design you. Corralary: designing and offering infrastructure is high leverage. Don’t try to design the future. Design something the future can design. Be strong. Be kind. Carry on. ### Privilege and sharing privilege; privilege as lens for service design Give people the skills and opportunities to help themselves. Collaboration is a privilege. Barriers include money, time, and access to data. Having the space, the slack, the empowerment to improve service design and delivery is a tremendous privilege. Public servants often want to do a better job, to do the right thing, to better serve the public. To deliver experiences that are reasonable, that are in the proudest traditions of thoughtfully and kindly treating others. And often public servants have very little room, empowerment, expertise, support for doing this. In extrema, sticking your neck out to criticize an existing experience, that’s a way to jeopardize a job you may not be able to afford to lose. Making things better is a privilege. The next increment of improvements will be achieved through sharing that privilege. ### (Unpublished) ranty blog posts for the win Anecdote that resonated: Lou’s proudest achievement so far has been spinning up the 5M Pound / year initiative around service delivery manual, style guidance, etc. This originated in a ranty blog post Lou had drafted and been asked not to actually publish, and instead to do something about the issues articulated. There is power in writing. It clarifies thinking and it shares vision, persuades. There are also necessary steps that come after the ranty blog post to take strides forward. Not all ranty blog posts should actually be published (but perhaps really should nonetheless be written). ### On how to approach accessibility and usability Mobile-first, accessibility-first. Extreme testing first. Testing with screen readers. User testing with users with physical and cognitive disabilities. If it works for some of the most difficult user contexts, then it’s more likely to work in other contexts too. This testing teaches you more sooner. Making services accessible is like making a muffin be a blueberry muffin. It’s really hard to get the blueberries in later if you don’t bake them in from the beginning. Extreme testing first is time and resource consuming and expensive and always needs justified. It’s also the most effective way to design highly usable, accessible services. And when it comes right down to it, the law probably requires you to do this. So if you’re taking compliance with that law seriously, well, this is what it really takes to do it. Conclusions ----------- Be interested in humans. * Interested in learning from conversation with humans, * interested in discovering what humans really need, * interested in growing from feedback from humans, and in provding humans the feedback _they_ need to grow, * interested in empowering humans to design and deliver better services at government scale [Andrew Petro](https://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Notes+from+Better+by+Design+2018&url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&title=Notes+from+Better+by+Design+2018 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&title=Notes+from+Better+by+Design+2018 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&name=Notes+from+Better+by+Design+2018 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&title=Notes+from+Better+by+Design+2018 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&title=Notes+from+Better+by+Design+2018 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F24%2Fbetter-by-design-2018%2F&t=Notes+from+Better+by+Design+2018 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Wednesday, Oct 14, 2020 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that affects the handling of secret keys with Google Authenticator for multifactor authentication. This post will be updated with additional details once the grace period has passed. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 5.3.x - 6.0.x - 6.1.x - 6.2.x If your CAS version is not listed above and is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== It is recommended that upgrades be carried out to removes any chances of security breaches. If an upgrade is not possible, we recommend that you carefully review HTTP and access logs to sanitize and scrub details, especially if an external log aggregation tool is in place. This post will be updated with additional details once the grace period has passed. Timeline ======== The issue was originally reported on September 25th, 2020 and upon confirmation, CAS releases were patched and released on October 14th, 2020. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 5.3.x Modify your CAS overlay to point to the version `5.3.16`. ### 6.0.x EOL. Upgrade your CAS overlay to point to CAS `6.1.7.2`. ### 6.1.x Modify your CAS overlay to point to the version `6.1.7.2`. ### 6.2.x Modify your CAS overlay to point to the version `6.2.4`. ### 6.3.x Modify your CAS overlay to point to the version `6.3.0-RC4` when released. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Jérôme LELEU](https://apereo.github.io/2020/10/14/gauthvuln/jerome@casinthecloud.com) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F10%2F14%2Fgauthvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Groovy Vulnerability Disclosure – Apereo Community Blog CAS Groovy Vulnerability Disclosure =================================== Wednesday, Aug 30, 2023 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS when using Groovy. If you are not using Groovy in your CAS deployment to process data, there is nothing for you to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by [Georgia Tech](https://www.gatech.edu/) ’s Enterprise Application and Identity teams. Georgia Tech was kind enough to thoroughly investigate the issue, discuss the problem and their research results in detail, finance the time spent on developing fixes and follow up with additional tests to verify fixes. Thank you! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.5.x - 6.6.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== The issue affects all uses of Groovy in CAS, but in particular, embedded/inline groovy scripts and specially those that create or release attributes. Because Groovy scripts are precompiled, cached and reused, under super heavy load and given concurrent requests, a groovy script can be interrupted half way through its processing, and change its context from one request/payload to another. In other words, two simultaneous concurrent requests may cause a Groovy script to start off with one batch of input attributes and data, and finish up with another batch that belongs to a second request/user. As a result, it’s possible (depending on the app) that user X might log into application A and be recognized as user Y because X and Y were processed by the same Groovy script (that produces attributes) at the same exact time, down to the (milli/nano)second. Timeline ======== The issue was originally reported on August 23rd, 2023 and upon confirmation, CAS releases were patched and published on August 30th, 2023. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.5.x Modify your CAS overlay to point to the version `6.5.9.3`. ### 6.6.x Modify your CAS overlay to point to the version `6.6.11`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Groovy+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&title=CAS+Groovy+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&title=CAS+Groovy+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&name=CAS+Groovy+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&title=CAS+Groovy+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&title=CAS+Groovy+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2023%2F08%2F30%2Fgroovy-vuln%2F&t=CAS+Groovy+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Log4J Vulnerability Disclosure – Apereo Community Blog CAS Log4J Vulnerability Disclosure ================================== Saturday, Dec 11, 2021 3 minute read Overview ======== A new zero-day exploit has been reported against the Log4J2 library which can allow an attacker to remotely execute code. The vulnerability has been reported with [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) against the `log4j-core` jar. This has been fixed in [Log4J v2.17.0](https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.17.0/) . While updating third-party libraries for patch releases is generally not the project policy, an exception is warranted in this case given the nature of this vulnerability. CAS security releases are now made available to ensure the Log4J library is upgraded to a more secure version. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.3.x - 6.4.x If your CAS version is not listed above and is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , you _might_ need to take manual action to ensure the Log4J library is upgraded to a more recent acceptable version. Examine the Log4J library version found in your CAS build to determine its vulnerability status, and then substitute as necessary. Severity ======== See [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) . Also see [this post](https://logging.apache.org/log4j/2.x/security.html) . > It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to true **do NOT mitigate this specific vulnerability**. Then, per [CVE-2021-45105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105) , > Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack. Timeline ======== The issue was originally reported on December 9th, 2021 and CAS releases were patched on October 10th-11th, 2021 and released. The original patch releases for this issue upgraded relevant CAS versions to Log4J `2.15.0`. In light of [this post](https://logging.apache.org/log4j/2.x/security.html) , additional patch releases were published on December 15th 2021 to upgrade Log4J to `2.16.0`. Then, following [this announcement](https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2321524) , additional patch releases were published to upgrade Log4J to `2.17.0` on December 17th, 2021. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- **Note** Patch releases below upgrade the affected Log4J dependency to `2.17.0`. If you do not wish to upgrade, the safest thing to do is to upgrade Log4J to a safe version, or remove the `JndiLookup` class from the `log4j-core` JAR file. Other mitigation measures are **insufficient**. ### 6.3.x Modify your CAS overlay to point to the version `6.3.7.4`. ### 6.4.x Modify your CAS overlay to point to the version `6.4.4.2`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Log4J+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&title=CAS+Log4J+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&title=CAS+Log4J+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&name=CAS+Log4J+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&title=CAS+Log4J+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&title=CAS+Log4J+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2021%2F12%2F11%2Flog4j-vuln%2F&t=CAS+Log4J+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Simple Multifactor Authentication Vulnerability Disclosure – Apereo Community Blog CAS Simple Multifactor Authentication Vulnerability Disclosure ============================================================== Tuesday, Aug 19, 2025 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as a simple multifactor authentication provider. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by Mr. Jérôme Leleu, who is a project member and an active committer. Jérôme was kind enough to thoroughly investigate the issue, discuss the problem in detail, provide steps to reproduce the problem and offer insight to diagnose the root cause. Thank you Jérôme! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.1.x - 7.2.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== You are effected by this security vulnerability if your CAS deployment is acting as a multifactor authentication provider and is using the CAS Simple MFA module. Simple MFA in CAS generates its own codes using a secure random strategy to ensure generated IDs cannot collide with previously generated codes. One controlling factor here is the code length (6 by default). In scenarios where the code length is lowered to smaller lengths and typically under high traffic and load, it’s quite possible for one to run into code collisions and duplicates. As a result, two separate different users might be sharing the same code and may be able to log in as one another. Fixes in this area force CAS to never a generate a code that was already generated and remains valid. The generate function should take this rule into account and will attempt to re-generate the code if it runs into a collision. If your deployment does not pass the noted condition(s) above, there is nothing for you to do here. Keep calm and carry on. Timeline ======== The issue was originally reported on August 18th, 2025 and upon confirmation, CAS releases were patched and eventually published on August 19th, 2025. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Affected Versions ----------------- ### 7.1.x Modify your CAS overlay to point to the version `7.1.6.1`. ### 7.2.x Modify your CAS overlay to point to the version `7.2.6`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the approriate release by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&title=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&title=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&name=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&title=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&title=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2025%2F08%2F19%2Fsimplemfa-vuln%2F&t=CAS+Simple+Multifactor+Authentication+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OAuth/OpenID Connect & WebAuthN Vulnerability Disclosure – Apereo Community Blog CAS OAuth/OpenID Connect & WebAuthN Vulnerability Disclosure ============================================================ Friday, Apr 11, 2025 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as an OAuth/OpenID Connect provider or as a multifactor authentication provider utilizing FIDO2/WebAuthN. See below for details. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= The problems outlined in this security vulnerability were originally reported, researched and tested by Lucile RAZÉ and Jean-Léon CUSINATO from AMOSSYS, a cybersecurity consulting firm. They were kind enough to investigate the issue, offer insight to diagnose the root cause and took steps to verify the fix for various patch releases privately. Thank you! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.0.x - 7.1.x - 7.2.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== You are effected by this security vulnerability if your CAS deployment passes one of the following requirements: * Your CAS server is acting as an OpenID Connect identity provider. * Your CAS server is using WebAuthN as a multifactor authentication provider, responsible for FIDO2 passwordless device registration and authentication. If your deployment does not pass one of the noted conditions above, there is nothing for you to do here. Keep calm and carry on. Denial of Service via OIDC Webfinger Endpoint --------------------------------------------- The vulnerability is a denial of service (DoS) attack based on a regular expression vulnerability in the OIDC webfinger endpoint. An attacker can send a specifically crafted request to the endpoint, which causes excessive and uncontrolled CPU usage (CWE-400). With the fix, no more DOS could be triggered manually or through a small fuzzing campain. Unauthorized Access to User Account via FIDO2 Authentication ------------------------------------------------------------ This vulnerability allows an attacker to gain unauthorized access to another user’s account on a service that uses CAS for authentication. The attcker can register a FIDO2 device while modifying the username in the request to that of the victim. This can be done by replacing the register function in the javascript. Then the attacker can use a registered FIDO2 device to log in to the victim’s account with the compromissed password, directly through the FIDO main connection. With fixes in place, CAS should validate the username in the FIDO2 registration request and ensure that it matches the authenticated user’s username. Timeline ======== The issue was originally reported on March 17th, 2025 and upon confirmation, CAS releases were patched and eventually published on April 11th, 2025. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Affected Versions ----------------- ### 7.0.x Modify your CAS overlay to point to the version `7.0.10.1`. ### 7.1.x Modify your CAS overlay to point to the version `7.1.6`. ### 7.2.x Modify your CAS overlay to point to the version `7.2.1`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the approriate release by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&name=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2025%2F04%2F11%2Foidc-webauthn-vuln%2F&t=CAS+OAuth%2FOpenID+Connect+%26+WebAuthN+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OAuth/OpenID Connect Vulnerability Disclosure ================================================= Thursday, Sep 25, 2025 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as an OAuth/OpenID Connect provider. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported by Luca Famà and was later corroborated by the team at [Coop (Switzerland)](https://www.coop.ch/) , namely Artur Stoecklin and David Roth. The group was kind enough to thoroughly investigate the issue, discuss the problem in detail, provide steps to reproduce the problem and offer insight to diagnose the root cause. Thank you everyone! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.1.x - 7.2.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== You are effected by this security vulnerability if your CAS deployment is acting as an OAuth/OpenID Connect identity provider. The issue primarily presents itself when CAS receives an OAuth or OpenID Connect authorization request, and in the absense of an SSO session, attempts to route the request to the login endpoint, constructing a special _callback_ URL that is passed as the `service` parameter to the login endpoint. This callback URL essentially points back to CAS itself and restarts the flow once the login attempt is completed. The attacker could somehow hijack this callback URL and modify it in such a way that would fool CAS into redirecting to an unauthorized URL. This is caused given the fact that the callback URL is registered with CAS as an internal service whose matching policy is based on regular expressions and pattern matching, and as a result, the attacker could manipulate the `service` parameter such that the pattern enforced is bypassed. In summary, this is an “Open Redirect” security vulnerability. We believe this is fairly low risk, and does not allow one to cause any major material damage to the CAS server. If your deployment does not pass the noted condition(s) above, there is nothing for you to do here. Keep calm and carry on. Timeline ======== The issue was originally reported on September 17th, 2025 and upon confirmation, CAS releases were patched and eventually published on September 25th, 2025. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Affected Versions ----------------- ### 7.1.x Modify your CAS overlay to point to the version `7.1.6.2`. ### 7.2.x Modify your CAS overlay to point to the version `7.2.7`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the approriate release by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&name=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2025%2F09%2F25%2Foauth-oidc-vuln%2F&t=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Wednesday, May 27, 2026 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting and running as an OpenID Connect provider. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported to the team at [Coop (Switzerland)](https://www.coop.ch/) , namely Artur Stoecklin and David Roth, via the _YesWeHack_ platform, which is a _“global crowdsourced security and bug bounty platform that connects organizations with a vetted community of tens of thousands of ethical (white-hat) hackers to identify and report vulnerabilities in websites, mobile apps, and infrastructure”_. Both the original reporter as well as the team at YesWeHack shared complete and thorough instructions on how this vulnerability can be observed and exercised. The team at [Coop (Switzerland)](https://www.coop.ch/) further validated and tested the fix. Thank you everyone! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== You are affected by this security vulnerability **IF AND ONLY IF** your CAS deployment is acting and running as _an OpenID Connect identity provider_. If your deployment does not pass the noted condition(s) above, there is nothing for you to do here. Keep calm and carry on. Exposure -------- A security vulnerability was identified in Apereo CAS when operating as an OpenID Connect Provider with support for Pushed Authorization Requests, which is on and available by default. In the affected behavior, CAS accepted a PAR request without properly validating the supplied `redirect_uri` against the relying party’s registered redirect URI configuration. Because PAR requests move authorization parameters into a back-channel request and later reference them by `request_uri`, validation must occur when the request is pushed, not deferred or assumed safe simply because the request was stored by the server. The impact is that a malicious or misconfigured client could submit an authorization request containing an unauthorized `redirect_uri`, potentially causing the resulting authorization response, including an authorization code or related OIDC response parameters, to be delivered to a location not approved for that client. Timeline ======== The issue was originally reported to the team at [Coop (Switzerland)](https://www.coop.ch/) on May 5th, 2026 and was shared with the CAS project on May 22nd, 2026. Upon confirmation, CAS releases were patched and eventually published on May 27th, 2026. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Affected Versions ----------------- ### 7.3.x Modify your CAS overlay to point to the version `7.3.7.1`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the approriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F27%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS JWT Authentication Vulnerability Disclosure – Apereo Community Blog CAS JWT Authentication Vulnerability Disclosure =============================================== Friday, Mar 6, 2026 3 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS while using a token-based _JWT Authentication_ feature. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by Mr. Jérôme Leleu, who is a project member and an active committer. Jérôme was kind enough to thoroughly investigate the issue, discuss the problem in detail, provide steps to reproduce the problem and offer insight to diagnose the root cause. Thank you Jérôme! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.2.x - 7.3.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== You are effected by this security vulnerability if your CAS deployment has specifically enabled a feature called _JWT Authentication_, sometimes also referred to as _token-based non-interactive authN_ and accepts credentials as JWTs for non-interactive authentication attempts. Note that this has nothing to do with any other CAS functionality that deals with JWTs. For better details, see: * [Pac4j advisory](https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html) * [CVE-2026-29000](https://nvd.nist.gov/vuln/detail/CVE-2026-29000) . > When `JwtAuthenticator` decrypts a JWE, it attempts to parse the inner token as a `SignedJWT`. If the inner token is a `PlainJWT` (`alg=none`), the `SignedJWT` object is null and the signature verification path is skipped due to a logic error. The code then builds a user profile from unverified claims, enabling full impersonation. Impacted deployments are those using RSA-based JWE together with `JwtAuthenticator` configured with both `EncryptionConfiguration` and `SignatureConfiguration`. If your deployment does not pass the noted condition(s) above, there is nothing for you to do here. Keep calm and carry on. Timeline ======== The issue was originally reported on March 2nd 2026, and upon confirmation, CAS releases were patched and eventually published on March 6th, 2026. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Affected Versions ----------------- ### 7.2.x Modify your CAS overlay to point to the version `7.2.7.1`. ### 7.3.x Modify your CAS overlay to point to the version `7.3.5`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the approriate release by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+JWT+Authentication+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&title=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&title=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&name=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&title=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&title=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F03%2F06%2Fjwt-vuln%2F&t=CAS+JWT+Authentication+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS 2019 Survey Results – Apereo Community Blog Apereo CAS 2019 Survey Results ============================== Wednesday, Oct 9, 2019 6 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . A [while ago](https://groups.google.com/a/apereo.org/d/msg/cas-user/U-35VSV4JlY/UTSff3s_AwAJ) the CAS project management committee prepared a survey to request feedback from CAS deployers. The goal of the survey was to help clarify specific areas in the CAS software ecosystem that need attention and improvement, understand user demographics and common use cases and attempt to explore routes and opportunities to better support and prioritize funding of development activities. This post presents a summarized view of the survey results. Before We Start =============== On behalf of the [Apereo CAS project management committee](https://apereo.github.io/cas/developer/Project-Commitee.html) , I’d like to thank all survey participants who graciously took time out to provide focused, constructive and detailed feedback. Your engagement and involvement in the CAS community are very much appreciated. I’d like to send a shout-out to all contributors who continuously and actively have tried out, shared constructive feedback and contributed to the development **and** support of the CAS software. We will continue to make the [path to contributions](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) easier and as always, your time, patience and efforts are noted and appreciated by the CAS project management committee and the community overall, regardless of the type or impact of the contribution. Please, keep’em coming! Finally, a much-deserved thank you to all members of the Apereo Foundation who take concrete action beyond words to financially sponsor and support the CAS project. We appreciate your support and membership and hope to see more institutions join and contribute to the development of free and open-source software in more sustainable ways. Apereo Membership ================= If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Statistics ========== Demographics ------------ There were approx. `70` responses to the survey from both individuals and institutions. Some responses were submitted by consulting firms or contractors who provide CAS services or support which indicates the actual number of deployers may be larger. Participants reported affiliations with a variety of industry sectors most notable of which are Higher Education (`46%`), Finance (`5%`), Travel (`5%`), R & S (`3%`), Healthcare (`7%`), Government (`8%`), etc. Versions -------- The following CAS release lines were reported to be in active production: | Release | Adoption | Notes | | --- | --- | --- | | `4.x` | `12%` | | | `5.x` | `59%` | | | `6.x` | `22%` | | | Other | `7%` | `3.x` or non-standard/forked versions | Traffic ------- The statistics below indicate the active user population of CAS deployments in production: | Volume | Percentage | Notes | | --- | --- | --- | | `50K`\-`200K` | `6%` | | | `10K`\-`50K` | `34%` | | | `5K`\-`10K` | `19%` | | | `1K-5K` | `17%` | | | Other | `24%` | Less than `1K` or more than `200K`. | Features & Improvements ======================= Participants were asked to propose a single new feature or improvement to an existing feature, given assumed availability of one week’s development time (5 days - 40 hours) and funding of 10,000 USD. What follows is a summary of reported ideas and suggestions: * UI to manage personal account activity log, possibly in CAS management * AWS deployment configuration templates * Built-in Duo Security enrollment for first-time users * Extensible self-service user portal used to update account security questions, passwords, etc. * Dynamic configuration of delegated reconfiguration (i.e add a SAML IdP at runtime) * Web AuthN / FIDO2 as a multifactor provider * Documentation improvements with better examples and guides * Built-in solutions to prevent spoofing; rotating images, beacons, etc. * AUP configurable on a per-service basis * Multitenancy, combining a medley of CAS server deployments and configurations into one. Suggestions and feedback on improving the state of the Apereo CAS software will certainly be taken into consideration and possible action over time. Please note that the CAS project does not have an official roadmap, as in, there is no piece of literature foretelling promises of fame and fortune as commitments based on volunteer activity tend to, disappointingly and understandably, be premature and go awry. Instead, we recommend that you consider the roadmap to be that which _you intend to work on and contribute_. Therefore and as guestimated previously, if you have an idea that could be done in a week’s worth of time with about $10,000, the very best next thing to do would be to pursue the concept and allocate the estimated time, money and resources to get the job done. Learn, find someone to teach you or find someone to do it for you. Remember that [help is available](https://apereo.github.io/cas/Support.html) to get you to the finish line successfully, and by all means, feel free to contribute or share the results with the rest of the community if time and policy allow. You’d be most welcome. Support ======= Channels -------- | Percentage | Type | | --- | --- | | `90%` | In-house or Apereo’s free community support | | `10%` | Contracted with a commercial entity. | A large number of participants indicated: 1. No adequate funding to join the Apereo foundation or contract with a commercial support provider. 2. (Surprisingly) Unaware that membership or commercial support providers were possible and available. Budgets ------- | Percentage | Type | | --- | --- | | `40%` | 0 to 25 million USD | | `6%` | 25 to 50 million USD | | `22%` | 100 to 750 million USD | | `32%` | Uncertain, more than 750 million, etc. | Activity -------- | Percentage | Type | | --- | --- | | `39%` | Supporter, via mailing lists, chatrooms, etc. | | `20%` | Developer, contributor of code and documentation | | `75%` | User, quietly monitoring activity | Note that participants were allowed to select more than one category. So… === We suggest that you reconsider support options for funding Apereo CAS more sustainably, if possible at all. Most, if not all, CAS development is advanced by volunteers whose time and contribution are supported by a supporting member of the Apereo Foundation, a gracious employer or a loving family. While code contributions, documentation improvements, etc. are always very much welcomed, having institutions join the Apereo Foundation to support the CAS project financially will allow the developer community to continue and further sustain CAS development, extend and allow for longer maintenance periods and better support the user community overall. As indicated by the survey and for those who might have missed it, [support is available](https://apereo.github.io/cas/Support.html) . Finally ======= Once again, thanks for sharing. We invite you to [engage and contribute](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) as best as you can. On behalf of the [Apereo CAS project management committee](https://apereo.github.io/cas/developer/Project-Commitee.html) , [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+2019+Survey+Results&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&title=Apereo+CAS+2019+Survey+Results "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&title=Apereo+CAS+2019+Survey+Results "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&name=Apereo+CAS+2019+Survey+Results "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&title=Apereo+CAS+2019+Survey+Results "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&title=Apereo+CAS+2019+Survey+Results "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F09%2Fcas-survey-results2019%2F&t=Apereo+CAS+2019+Survey+Results "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Shibbolizing Apereo CAS – Apereo Community Blog Shibbolizing Apereo CAS ======================= Friday, May 26, 2017 3 minute read This is a brief overview that explains how to _shibbolize_ the Apereo CAS server; that is to let the CAS server be _protected_ by an instance of the [Shibboleth Service Provider](https://shibboleth.net/products/service-provider.html) , where the SP is then tasked to delegate authentication requests to a remote SAML2 identity provider. The entire SAML2 interaction is kept between the SP and the IdP while CAS on the return trip eventually picks up the user profile from the SP in form of special headers, etc. But…Why? ======== This is a very elaborate setup, yes. The goal originally was to let CAS simply and directly delegate authentication requests to the SAML2 identity provider. [This can very easily be done](https://apereo.github.io/2017/03/22/cas51-delauthn-tutorial/) , _except_ that in this particular case the SAML2 identity provider only supported a very specific and rather complicated variation of the SAML2 protocol, whose support is absent in CAS today. Convincing the identity provider to provide support for the more-mainstream _SAML2 WebSSO Browser Profile_ led to a path riddled with uncertainties. After further analysis, we came to the conclusion that implementing built-in support for the IdP-supported SAML2 profile variation in CAS is unnecessarily complicated, needlessly expensive and possibly soon-to-be obsolete. Of course, [it is certainly possible to do](https://apereo.github.io/2017/02/18/onthe-theoryof-possibility/) . If you have to ask: all you need is love, coffee and access to decent hair conditioning products. So the path to least resistance turned out to be a deployment with a few additional components and with a clear separation of boundaries. Thanks to Docker and outstanding help from colleagues, we managed to get this working. Read on. How === Starting out with a proof of concept, we came up with a dockerized deployment as such: * CAS Server `5.1.0-SNAPSHOT`, running inside an embedded Apache Tomcat * [Shibboleth Service Provider for Apache](https://wiki.shibboleth.net/confluence/display/SHIB2/Installation) * Apache Web Server * A sample CASified PHP application * [Shibboleth Identity Provider](https://wiki.shibboleth.net/confluence/display/IDP30) `3.4.x` running inside Jetty Shy of a pretty sequence diagram, here’s how the interaction between the above components works: 1. Client browser attempts to access the sample CASified PHP application. 2. Requests to the CAS `/login` endpoint are intercepted by the SP and Apache. 3. The SP, configured to speak the special SAML2 protocol, routes the request to the IdP. 4. The IdP accepts user credentials and posts back the response to the SP. 5. The SP _passes_ the response back to the CAS `/login` endpoint. 6. CAS is configured to _trust_ the response and proceeds to extract user profile data from the request. 7. CAS proceeds to issue an `ST` for the PHP application that initiated the request. 8. Having received and validated the `ST`, user is granted entry to the PHP application. CAS === We also applied a few minor patches to CAS: * Ensure CAS could easily lend itself to be intercepted by Apache when running in embedded mode. * Ensure user profile data can correctly be recognized from the SP. * Ensure attributes collected from the SP can be merged and combined with CAS’ own, in cases where supplementary attribute sources are directly defined inside CAS. The _trusted_ authentication piece [is already handled by CAS](https://apereo.github.io/cas/development/installation/Trusted-Authentication.html) today. How Do I…? ========== All patches are contributed back to the CAS project. You are most welcome! :-) So… === Special thanks to [@jtgasper3](https://github.com/jtgasper3) for beautifully cementing the deployment foundation of each component via Docker, big kudos to [@scalding](https://github.com/scalding) for making the integration magic work seamlessly and to [@apetro](https://github.com/apetro) for having previously worked on the _trusted_ authentication piece in CAS. Of course, I intend to take all the credit. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Shibbolizing+Apereo+CAS&url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&title=Shibbolizing+Apereo+CAS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&title=Shibbolizing+Apereo+CAS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&name=Shibbolizing+Apereo+CAS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&title=Shibbolizing+Apereo+CAS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&title=Shibbolizing+Apereo+CAS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F05%2F26%2Fcas-shibsp-samlidp%2F&t=Shibbolizing+Apereo+CAS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # MyUW in 2016 - by the numbers – Apereo Community Blog MyUW in 2016 - by the numbers ============================= Tuesday, Jun 20, 2017 7 minute read This post considers MyUW in 2016 as framed by metrics. Unless otherwise stated, all numbers are about calendar 2016. Point in time numbers are about December 31, 2016. (See also [minimalist slide deck](https://www.icloud.com/keynote/0qw9oJfJU_Q1YX-1wCXQ8bKzg#MyUW_in_2016_by_the_numbers) . One use for this post is as notes to support presenting or consuming that deck.) MyUW as production service -------------------------- ### 10 million sessions Per Google Analytics, MyUW served around **ten million** user sessions. MyUW serves a lot of traffic. ### 8 million outbound links Users followed a link in MyUW out to something outside MyUW more than **8,000,000** times, including four million launches of Office365 and two million launches of the course dashboard. MyUW eases navigation to other systems. ### 100,000 notifications displays Users viewed their full notification page around 100,000 times. Besides helping users navigate to other applications, MyUW helps users understand what they need to do and where they might need to navigate. ### 100,000 searches and app directory browses MyUW presented the directory of applications around 100,000 times and provided search results in around 100,000 user sessions. Not all MyUW content relevant to all users can fit on default home pages, so MyUW supports users searching and browsing the available content. ### 100,000 home page modifications Once you’ve searched or browsed to something interesting, you can add it to your home page. Users modified their home pages almost 100,000 times, including adding the new Wiscard Balance widget almost 6,000 times. ### Releases every 7 days MyUW releases to production every 7 days, in our 5am to 7am Tuesday morning release window. We rarely incur downtime even during this service window. We aspire to release more often, with better automation and evolving local culture to support and sustain this. Still, we’re already releasing relatively frequently. Releasing frequently allows us to ship less change more often to get feedback sooner and to incur less release risk. We occasionally add additional release windows to ship urgent change. Our blue-green deployment practices allow us to do so without incurring service downtime – mostly no one notices. ### 5 tiers We have **5** tiers: * `predev`: Infrastructure and framework development. Content is relatively stable. * `test`: Content development. Infrastructure is relatively stable. * `qa`: Stable, tagged, versioned releases of all components. The purpose of this tier is to demonstrate specific, promotable versions working correctly together. * `stage` : Production in all ways except it runs the latest production build (the build “staged” for release) and no `my.wisc.edu` traffic is routed to it. Exactly the Docker image that’s running in `stage` is promoted to `prod` in the release process. * `prod` : Production. Runs a specific, deliberately-released version of the whole bundle. Typically a bundle precisely as it was validated in `stage`. Five tiers mean more opportunity for various development efforts to not step on one another’s toes, more opportunity for quality assurance and testing, and more opportunity to co-opt an environment to test e.g. a major upgrade of an external dependency. Five tiers also helps make breaking changes and complicated upgrade paths painful enough that we look for ways to avoid breaking change, to simplify upgrade paths, and to change gracefully. Components coping better with more versions of dependencies yields a more stable solution, gives us better options in the rare case where we do need to drop back to an older version of a module, and yields more adoptable and supportable software products. ### 4 production VMs We have **4** production VMs running 8 virtual MyUW nodes of which 4 are typically in service at any time. This provides sufficient capacity to handle peak load, allows one or typically even two nodes to fail without significant adverse effect to service experience, and allows blue-green deployments with zero service downtime. ### 160 apps We had ~160 “real” items in the app directory, including * ~50 apps for Madison students or applicants * ~25 administrative tools (both portal administration and some business function administration) * ~20 apps for Madison staff * ~20 apps for Madison constituents in general * ~5 apps supporting advising * ~5 apps supporting research We update this content frequently, with 261 changes to app directory content in 2016. ( `git log --since=2016-01-01 --before=2017-01-01 --oneline | wc -l` ). MyUW as complex system ---------------------- MyuW has **~50** items eligible to appear by default on the user’s home screen. (No real user sees 50 items by default. Group matching pares this down to items that may be relevant.) There are **~90** groups available for targeting in MyUW, including **13** managed in Manifest, UW-Madison’s Grouper instance. MyUW as growing and evolving ---------------------------- **5** new notifications in 2016. Lots of potential in this feature, as yet un-realized. MyUW as designed ---------------- MyUW implements responsive design, flexing across browser window sizes. This improves the experience across the breadth of devices using MyUW, including the **20%** tablet or mobile phone form-factor traffic. MyUW budgets for 0.75 FTE UX design from DoIT Communications. **~40** apps had interesting widgets, namely * [Badger Headlines](https://public.my.wisc.edu/web/apps/details/uw-badger-headlines) and [NCAA D1 News](https://public.my.wisc.edu/web/apps/details/ncaa-d1-news) * Benefit Information x2 * [Campus News](https://public.my.wisc.edu/web/apps/details/campus-news) * [Course Guide](https://public.my.wisc.edu/web/apps/details/CourseGuide-Browse-Courses) and its [help](https://public.my.wisc.edu/web/apps/details/CourseGuide-Help) * [Course Services](https://public.my.wisc.edu/web/apps/details/course-services) * DoIT [planned](https://public.my.wisc.edu/web/apps/details/doit-scheduled-outages) and [unplanned outages](https://public.my.wisc.edu/web/apps/details/doit-unplanned-outages) * [Email](https://public.my.wisc.edu/web/apps/details/wisc-mail) * [Google Apps](https://public.my.wisc.edu/web/apps/details/google-apps) * [Help desk notices](https://public.my.wisc.edu/web/apps/details/doit-help-desk-notices) * [HR, Payroll, and Benefit News](https://public.my.wisc.edu/web/apps/details/hr-payroll-benefits-news) x2 * [Learning and Talent Development](https://public.my.wisc.edu/web/apps/details/my-professional-development) * Local Contact Info * [Manager Time Approval](https://public.my.wisc.edu/web/apps/details/HRSManagerTimeApproval) * [My Courses](https://public.my.wisc.edu/web/apps/details/MyCourses) * [Payroll Information](https://public.my.wisc.edu/web/apps/details/earnings-statement) x2 * [Research Project Resource Guide](https://public.my.wisc.edu/web/apps/details/rprg) * [Scholarships@UW-Madison](https://public.my.wisc.edu/web/apps/details/scholarships-at-uw-madison) * UW-Extension CEOEL x11 * [UWP news](https://public.my.wisc.edu/web/apps/details/uwp-news-feed) , [UWRF news](https://public.my.wisc.edu/web/apps/details/uwrf-news-feed) * [UWRF resources](https://public.my.wisc.edu/web/apps/details/uwrf-employee-resources) * Weather x2 * [Wiscard Balance](https://public.my.wisc.edu/web/apps/details/wiscard-balance) * [Working at UW](https://public.my.wisc.edu/web/apps/details/uw-madison-working-at-uw) MyUW as teams ------------- ### Infrastructure team 5 dedicated staff * 3 full stack developers * 1 front end developer via ADI * 1 strategist and a wider cast, including * .75 User Experience consultant * partial Site Reliability Engineer * 0.25 Tier ~2 Help Desk * and a wider cast Dedicated, focused, invested staff in for the long term is key to MyUW success, to being a team, to delivering our quality, confident service. 0.25 FTE focused on escalated support cases, documenting known issues, digesting support into actionable product intelligence: working great, key to MyUW’s success. ### Development teams 4 teams active developing MyUW frame-based apps * MyUW Infrastructure * MyUW Academic Applications * ADI - Integrated Applications * UW-Extension - Continuing Education, Outreach & E-Learning ### Service team Infrastructure Scrum team, plus * Service team lead * Cybersecurity liaison * MyUW Academic Applications liaison * ADI - Integration Applications liaison * DoIT Communications liaison * UX * Help Desk * Site reliability engineer MyUW as serving the entire UW System ------------------------------------ ### 16 themes ### System-targeted 25 app directory entries * ~15 apps for System staff * ~10 apps for UW Extension CEOEL students MyUW and open source -------------------- ### Return on investment [The World Bank found](https://blogs.worldbank.org/opendata/leveraging-open-source-public-institution-new-analysis-reveals-significant-returns-investment-open) a **200%** return-on-investment in participating in open source. This is our strategy: build and collaborate on open source products in the hope of a positive return on this investment via collaboration, shared maintenance, and benefiting from the work of others. We develop more thoughtfully and more sustainably when we approach our work as building open source software products that are configured and adopted locally. ### 50 releases of 7 products MyUW posted [**50 releases** of **7** MyUW-led open source products in 2016](https://apereo.github.io/2017/01/19/myuw-2016/) . ### 1 Apereo board member MyUW team member Jim Helwig has long served on the [Apereo Board of Directors](https://www.apereo.org/content/leadership) . Taking a hand in the governance of Apereo is part of how we contribute to its sustainability and thus to the sustainability of the context in which we can realize a return on our open source investment. ### 2 uPortal steering committee members MyUW team members Jim Helwig and Andrew Petro serve on the Apereo uPortal steering committee. Taking a hand in the governance of uPortal is part of how MyUW contributes to its sustainability and thus to the sustainability of a context in which we can realize a return on our open source investment. ### 425 commits by others There were [425 commits in 2016 to `Jasig/uPortal` _not_ by University of Wisconsin employees](https://github.com/Jasig/uPortal/graphs/contributors?from=2016-01-30&to=2016-12-31&type=c) . In summary ---------- MyUW is * a high-usage production service * a complex system * growing and with not-yet-fully-realized potential * designed * a team * serving the entire University of Wisconsin system * practicing open source [Andrew Petro](http://apetro.ghost.io/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=MyUW+in+2016+-+by+the+numbers&url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&title=MyUW+in+2016+-+by+the+numbers "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&title=MyUW+in+2016+-+by+the+numbers "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&name=MyUW+in+2016+-+by+the+numbers "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&title=MyUW+in+2016+-+by+the+numbers "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&title=MyUW+in+2016+-+by+the+numbers "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F20%2Fmyuw-2016-numbers%2F&t=MyUW+in+2016+-+by+the+numbers "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - Password Management with JDBC – Apereo Community Blog Apereo CAS - Password Management with JDBC ========================================== Friday, Oct 25, 2019 6 minute read **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . Overview ======== In this tutorial, we are going to pull back the covers on the Password Management (PM) module in CAS and see what features are available! How fun is that?! I do want to state that the PM functionality included with CAS is rather modest and is not intended to be an all inclusive password management tool, but it does have some nice added functionality that can be taken advantage of when running CAS. When reviewing the CAS documentation for Password Management (PM) support, you will notice it supports several different implementation methods from JSON to LDAP to REST. Since I already have MySQL installed on my laptop, I am going to be using the JDBC implementation. Also, rather than setup a new LDAP test instance for user authentication, I will take advantage of the MySQL instance I have on my laptop and use that as my user authentication source as well. We will be taking advantage of the email support included with the PM module, as well as test the brand new feature Password History, woohoo! For the SMTP server, if you do not have access to one, please download the Fake SMTP Server from the link below. It is a nice handy tool for testing. Our starting position is based on: * CAS `6.1.x` * Java `11` * MySQL or another supported relational database * [Fake SMTP Server](http://nilhcem.com/FakeSMTP/) * [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) * [Database User Authentication](https://apereo.github.io/cas/development/installation/Database-Authentication.html) * [Password Management](https://apereo.github.io/cas/development/password_management/Password-Management.html) User Authentication =================== ### Modules We will begin by installing the modules needed to support Database User Authentication. Since there already is an excellent blog post named [Database Authentication Tutorial](https://apereo.github.io/2017/02/22/cas51-dbauthn-tutorial/) on the Apereo site, I will be summarizing my steps for User Authentication. dependencies { // Other CAS dependencies/modules may be listed here... compile "org.apereo.cas:cas-server-webapp-tomcat:${project.'cas.version'}" compile "org.apereo.cas:cas-server-support-jdbc:${project.'cas.version'}" } ### Database Settings For the database, we are going to be very creative and name it **cas\_auth**. Very original! ;-) Here is the MySQL SQL needed to generate the tables and also the users we will be testing: CREATE TABLE `Users` ( `id` int(11) unsigned NOT NULL AUTO_INCREMENT, `userid` varchar(255) NOT NULL DEFAULT '', `password` varchar(255) NOT NULL DEFAULT '', `email` varchar(255) NOT NULL DEFAULT '', `phone` varchar(255) DEFAULT NULL, `firstName` varchar(255) DEFAULT NULL, `lastName` varchar(255) DEFAULT NULL, `expired` int(11) NOT NULL DEFAULT '0', `disabled` int(11) NOT NULL DEFAULT '0', PRIMARY KEY (`id`) ); # Creating this table now, will be used for the PM section of the tutorial CREATE TABLE `Questions` ( `id` int(11) unsigned NOT NULL AUTO_INCREMENT, `userid` varchar(255) NOT NULL DEFAULT '', `question` varchar(255) NOT NULL DEFAULT '', `answer` varchar(255) NOT NULL DEFAULT '', PRIMARY KEY (`id`) ); INSERT INTO 'Users' ('userid', 'password', 'email', 'phone', 'firstName', 'lastName', 'expired', 'disabled') VALUES ('LegitUser', 'Password1', 'test1@test.net', '111-867-5309', 'Legit', 'User', 0, 0), ('ExpiredUser', 'Password2', 'test2@test.net', '111-867-5310', 'Expired', 'User', 1, 0); # Adding these questions now, will be used for the PM section of the tutorial INSERT INTO 'Questions' ('userid', 'question', 'answer') VALUES ('TestTwo', 'What is your favorite food?', 'Meat'), ('TestTwo', 'What is your favorite video game?', 'Fallout4'); ### CAS Settings Now we need to update our **cas.properties** file: cas.authn.jdbc.query[0].user= cas.authn.jdbc.query[0].password= cas.authn.jdbc.query[0].driverClass=com.mysql.jdbc.Driver cas.authn.jdbc.query[0].dialect=org.hibernate.dialect.MySQLDialect cas.authn.jdbc.query[0].url=jdbc:mysql://localhost:3306/cas_auth cas.authn.jdbc.query[0].passwordEncoder.type=NONE cas.authn.jdbc.query[0].sql=SELECT * FROM Users WHERE userid=? cas.authn.jdbc.query[0].fieldPassword=password cas.authn.jdbc.query[0].fieldExpired=expired cas.authn.jdbc.query[0].fieldDisabled=disabled As you can see, most of the fields are named accordingly and are referenced in the already noted [blog post](https://apereo.github.io/2017/02/22/cas51-dbauthn-tutorial/) above. ### Test Start your CAS instance and test! Now try and test authentication for **LegitUser** user. You should receive a CAS success page with the heading of **“Log In Successful”**. Restart your browser and now try **expiredUser**. Since this user was added with a **“1”** in the expired field, CAS should display a page with the heading of **“You must change your password.”** and shows a link to an external site. This is the basic Authentication available with the JDBC support for an expired user account, you can update the url within your message.properties file. Taking a user to a link is not very helpful since we want to use a backend database to manage passwords. This is where we can use the functionality of the PM module! Password Management =================== ### Modules Let’s update our build.gradle file by adding the new dependencies needed for PM support and PM JDBC support: dependencies { ... compile "org.apereo.cas:cas-server-support-pm-webflow:${project.'cas.version'}" compile "org.apereo.cas:cas-server-support-pm-jdbc:${project.'cas.version'}" } ### Database As you can see in the CAS online documentation for [PM JDBC Support](https://apereo.github.io/cas/development/password_management/Password-Management-JDBC.html) , there is a specific schema that needs to be followed for PM support. When we initially created our db tables, I incorporated those requirements, so no changes are needed. You’re Welcome! ### CAS Settings Now let’s update our **cas.properties** file: # Enable PM module and Password History cas.authn.pm.enabled=true cas.authn.pm.history.enabled=true # SMTP Settings spring.mail.host=localhost spring.mail.port=25 spring.mail.username= spring.mail.password= spring.mail.properties.mail.smtp.auth=false # Password Reset Email Info cas.authn.pm.reset.mail.from=CAS@test.net cas.authn.pm.reset.mail.subject=Password change cas.authn.pm.reset.mail.replyTo=CAS@test.net cas.authn.pm.reset.mail.html=false cas.authn.pm.reset.mail.attributeName=mail cas.authn.pm.reset.expirationMinutes=5 # Forgot Username Email Info cas.authn.pm.forgotUsername.mail.from=CAS@test.net cas.authn.pm.forgotUsername.mail.subject=Forgot User Name cas.authn.pm.forgotUsername.mail.replyTo=CAS@test.net cas.authn.pm.forgotUsername.mail.html=false cas.authn.pm.forgotUsername.mail.attributeName=userid # Password Management Database Connection Info cas.authn.pm.jdbc.user= cas.authn.pm.jdbc.password= cas.authn.pm.jdbc.driverClass=com.mysql.jdbc.Driver cas.authn.pm.jdbc.dialect=org.hibernate.dialect.MySQLDialect cas.authn.pm.jdbc.url=jdbc:mysql://localhost:3306/cas_auth cas.authn.pm.jdbc.passwordEncoder.type=NONE # Enable Questions and Answers for PM cas.authn.pm.reset.securityQuestionsEnabled=true # Queries Needed to Support PM functionality cas.authn.pm.jdbc.sqlSecurityQuestions=SELECT question, answer FROM Questions WHERE userid=? cas.authn.pm.jdbc.sqlFindEmail=SELECT email FROM Users WHERE userid=? cas.authn.pm.jdbc.sqlFindPhone=SELECT phone FROM Users WHERE userid=? cas.authn.pm.jdbc.sqlFindUser=SELECT userid FROM Users WHERE email=? cas.authn.pm.jdbc.sqlChangePassword=UPDATE Users SET password=?, expired=0 WHERE userid=? # Password Requirements Policy # Minimum 8 and Maximum 10 characters at least 1 Uppercase Alphabet, 1 Lowercase Alphabet, 1 Number and 1 Special Character cas.authn.pm.policyPattern=^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[$@$!%*?&])[A-Za-z\\d$@$!%*?&]{8,10} Wow! That is a lot of settings! Hopefully you find them to be self-explanatory. I did try to group and add headings to relevant sections for a better explanation. ### Test Restart you CAS instance and test! Verify you can still login with **legitUser**, then try **expiredUser**. For **expiredUser**, instead of a link, you should now get a password change screen! Nice! Now, turn on your Fake STMP Server and test the two links below the **Login** button, **“Reset your password”** and **“Forgot your username?”**. Did you get the emails?? Pretty cool, huh? Password History ================ When we added the new PM settings to our **cas.properties** file, we added this setting `cas.authn.pm.history.enabled=true`. This setting gave CAS the green light to create a new table in our **cas\_auth** database on our last startup. The table is named **Password\_History\_Table** and CAS will use it to store all password changes made by the CAS users. Do not worry, CAS will not store the password in the clear, but a hash of the password as well as the userId and date of the change. We can test this by changing the password of one of the test accounts several times and then try reusing one of the previous password on the password change screen. You should receive an error message of **“Could not update the account password”** and it will not be accepted by CAS. Cool! So… === That wraps up our peek into the PM functionality of CAS! I hope you enjoyed it! Finally, if you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem and care about its long-term success and sustainability, this is a viable option to consider. As [Misagh Moayyed](https://fawnoos.com/) says ‘Happy Coding’! [Axel Stohn](https://github.com/astohn) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+Password+Management+with+JDBC&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&title=Apereo+CAS+-+Password+Management+with+JDBC "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&title=Apereo+CAS+-+Password+Management+with+JDBC "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&name=Apereo+CAS+-+Password+Management+with+JDBC "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&title=Apereo+CAS+-+Password+Management+with+JDBC "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&title=Apereo+CAS+-+Password+Management+with+JDBC "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F25%2Fcas61x-password-management-jdbc%2F&t=Apereo+CAS+-+Password+Management+with+JDBC "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Thursday, Jun 18, 2026 5 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , which describes a security vulnerability that affects how the CAS server manages state for authentication flows. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Exposure ======== You are affected by this security vulnerability if your CAS deployment manages its state for authentication webflows using the client browser. This is the default setup and configuration for almost all deployments. A vulnerability in CAS client-side Spring Webflow state encryption caused `AES-GCM` to reuse a deterministic initialization vector with the same encryption key. This allowed unauthenticated attackers to collect chosen webflow state ciphertexts and recover portions of the encryption keystream. If an attacker obtained another user’s webflow execution token, the recovered keystream could be used to disclose corresponding portions of that user’s serialized webflow state. The issue primarily affects confidentiality of client-side webflow state; integrity remains protected when CAS webflow signing is enabled. Timeline & Credits ================== The issue was originally reported to the CAS project on June 16th, 2026 and fixed on June 17th, 2026. The reporter decided to remain anonymous. Thank you anyway! Patching ======== Patch releases were published on June 18th, 2026. Upgrades to the next patch version for each release should be a drop-in replacement. **Drop-in Replacement?** For the most part, a drop-in replacement release (as is the case for almost all security patch releases) does not require you to change platform requirements, Java versions, application registration records, user interface, CAS configuration, logging semantics, etc. For most deployments, this should be closer to _“upgrade and verify”_ than _“cancel your weekend.”_, unless explicitly (and uncommonly) noted otherwise. The only serious exception to this rule would be in scenarios where you have modified Java code and CAS server internal components and your changes directly overwrite upstream's fixes. While we do our best to ensure fixes are non-intrusive with a low footprint as much as possible, we cannot guarantee that your custom Java components that entirely overwrite and overlay on top of CAS remain fully functional or compatible with CAS APIs and implementations. The risk with owning code is that you own the code. Review and assess carefully. Versions -------- **Forward Ports** Any CAS version that is still in development and considered a work-in-progress automatically receives any and all fixes. All changes are expected to be carried forward and released in due time. ### 7.3.x Modify your CAS overlay to point to the version `7.3.7.3`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the appropriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Security In The AI Era ====================== We are beginning to see a clear trend in how security issues are researched and reported: AI is playing a much larger role in analyzing, documenting, explaining, and submitting potential vulnerability reports. This is not unique to CAS. It is happening across open source. The same productivity gains that AI gives developers and maintainers are also changing how code is reviewed, assessed, challenged, and patched. As [this article](https://spring.io/blog/2026/06/01/spring_and_security_in_the_times_of_ai) puts it: > _It’s one thing for a development team of 4-10 engineers to use generative AI to build new features faster. It’s a whole other situation when, for each engineer on the team, there are dozens in our community using generative AI to create issues, pull requests, and security reports._ AI did not just learn to write code. It also learned to open security reports, explain them confidently, attach a proof of concept, and then politely ask why nobody has fixed it yet! This trend is likely to accelerate. With that in mind, we would like to highlight two practical points: * **Maintainer capacity is a real constraint.** Human resources and available maintainer time matter a great deal here. It is very likely that time-to-fix expectations will need to stretch, not just for CAS but for many open source projects. If the volume of security reports becomes difficult to manage, our response may be slower than usual. There are only a few of us, and many of you, them, and possibly a small army of extremely confident, polite autocomplete machines. Please set expectations accordingly, and [review the vulnerability response process](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) to understand how reports are handled and what commitments, if any, can realistically be made. * **Automated verification and deployment are no longer optional luxuries.** It is becoming increasingly important for adopters of open source projects, especially CAS, to invest in tooling and processes that support automated release verification, automated integration testing, reliable CI/CD pipelines, and fast production deployment. If your current deployment process depends on manual steps, delayed approvals, synchronous coordination, or one heroic person remembering the exact production checklist from 2019, you may start to feel the pain. As security fixes and patches appear more frequently, teams with slow or manual deployment practices will have a harder time consuming updates quickly and safely. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F18%2Fvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Tuesday, Aug 18, 2026 5 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , which describes a security vulnerability that affects how the CAS server manages application authentication requests. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x - 8.0.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Exposure ======== The issue is not tied to a specific feature of the CAS software and is an [Open Redirect](https://owasp.org/www-community/attacks/open_redirect) type of vulnerability. You are affected by this security vulnerability if you simply run CAS. A request parameter whose name equals the FQCN of the internal service attribute key `org.apereo.cas.authentication.principal.Service` overrides the CAS response target after login. CAS issues the Service Ticket (ST) for the legitimate registered service, but redirects the victim to the attacker-controlled URL with the ST appended. Timeline & Credits ================== The issue was originally reported to the CAS project on August 16th, 2026 and fixed on August 17th, 2026. The reporter decided to remain anonymous. Thank you anyway! Patching ======== Patch releases were published on August 17th, 2026. Upgrades to the next patch version for each release should be a drop-in replacement. **Drop-in Replacement?** For the most part, a drop-in replacement release (as is the case for almost all security patch releases) does not require you to change platform requirements, Java versions, application registration records, user interface, CAS configuration, logging semantics, etc. For most deployments, this should be closer to _“upgrade and verify”_ than _“cancel your weekend.”_, unless explicitly (and uncommonly) noted otherwise. The only serious exception to this rule would be in scenarios where you have modified Java code and CAS server internal components and your changes directly overwrite upstream's fixes. While we do our best to ensure fixes are non-intrusive with a low footprint as much as possible, we cannot guarantee that your custom Java components that entirely overwrite and overlay on top of CAS remain fully functional or compatible with CAS APIs and implementations. The risk with owning code is that you own the code. Review and assess carefully. Versions -------- **Forward Ports** Any CAS version that is still in development and considered a work-in-progress automatically receives any and all fixes. All changes are expected to be carried forward and released in due time. ### 7.3.x Modify your CAS overlay to point to the version `7.3.8.1`. ### 8.0.x Modify your CAS overlay to point to the version `8.0.1.1`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the appropriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Security In The AI Era ====================== We are beginning to see a clear trend in how security issues are researched and reported: AI is playing a much larger role in analyzing, documenting, explaining, and submitting potential vulnerability reports. This is not unique to CAS. It is happening across open source. The same productivity gains that AI gives developers and maintainers are also changing how code is reviewed, assessed, challenged, and patched. As [this article](https://spring.io/blog/2026/06/01/spring_and_security_in_the_times_of_ai) puts it: > _It’s one thing for a development team of 4-10 engineers to use generative AI to build new features faster. It’s a whole other situation when, for each engineer on the team, there are dozens in our community using generative AI to create issues, pull requests, and security reports._ AI did not just learn to write code. It also learned to open security reports, explain them confidently, attach a proof of concept, and then politely ask why nobody has fixed it yet! This trend is likely to accelerate. With that in mind, we would like to highlight two practical points: * **Maintainer capacity is a real constraint.** Human resources and available maintainer time matter a great deal here. It is very likely that time-to-fix expectations will need to stretch, not just for CAS but for many open source projects. If the volume of security reports becomes difficult to manage, our response may be slower than usual. There are only a few of us, and many of you, them, and possibly a small army of extremely confident, polite autocomplete machines. Please set expectations accordingly, and [review the vulnerability response process](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) to understand how reports are handled and what commitments, if any, can realistically be made. * **Automated verification and deployment are no longer optional luxuries.** It is becoming increasingly important for adopters of open source projects, especially CAS, to invest in tooling and processes that support automated release verification, automated integration testing, reliable CI/CD pipelines, and fast production deployment. If your current deployment process depends on manual steps, delayed approvals, synchronous coordination, or one heroic person remembering the exact production checklist from 2019, you may start to feel the pain. As security fixes and patches appear more frequently, teams with slow or manual deployment practices will have a harder time consuming updates quickly and safely. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F18%2Fvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Tuesday, Aug 25, 2026 7 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , which describes a security vulnerability that mainly affects how the CAS server operates as an OAuth or OpenID Connect identity provider. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x - 8.0.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Exposure ======== You are affected if your CAS deployment qualifies for **ANY** of the following conditions: 1. CAS is configured to act as an OAuth identity provider. 2. …or, CAS is configured to act as an OpenID Connect identity provider. There are also changes in place to protect against a few other variations of [this issue](https://apereo.github.io/2026/08/18/vuln/) . These fixes apply to the CAS server as a whole and are not connected to a particular feature or extension module. Finally the `8.0.x` security patch release, described below, also presents small and yet important changes to strengthen delegated authentication requests particularly for external SAML2 and OpenID Connect identity providers. For `7.3.x` deployments that use delegated authentication features routing requests to external SAML2 and OpenID Connect identity providers, the recommendation is to upgrade to the `8.0.x` line to benefit from these security fixes. The fixes mainly cover the following areas: * Carry-over from [here](https://apereo.github.io/2026/08/18/vuln/) to fix a few more affected areas: A request parameter whose name equals the FQCN of the internal service attribute key `org.apereo.cas.authentication.principal.Service` overrides the CAS response target after login. CAS issues the Service Ticket (ST) for the legitimate registered service, but redirects the victim to the attacker-controlled URL with the ST appended. * CAS corrected an issue where percent-encoded OAuth and OpenID Connect endpoint paths could be interpreted differently by request routing and security filters. For example, an encoded character in an endpoint name could cause CAS to route the request normally while an access-control or throttling filter failed to recognize the endpoint. In affected configurations, this could bypass protections for endpoints such as (but not limited to) OIDC dynamic client registration and client configuration retrieval, potentially allowing unauthorized registration or disclosure of client information. The fix normalizes percent-encoded request paths before applying OAuth/OIDC security and throttling rules. Regression tests now cover all relevant OAuth and OIDC endpoints. Timeline & Credits ================== The issues were originally reported to the CAS project on August 23rd, 2026 and fixed on August 24th, 2026. The issues were reported to the project by third-parties researchers and adopters and were then further validated and tested by Mr. Jérôme Leleu, who is a long-time project member and an active committer. Thank you everyone! Patching ======== Patch releases were published on August 25th, 2026. Upgrades to the next patch version for each release should be a drop-in replacement. **Drop-in Replacement?** For the most part, a drop-in replacement release (as is the case for almost all security patch releases) does not require you to change platform requirements, Java versions, application registration records, user interface, CAS configuration, logging semantics, etc. For most deployments, this should be closer to _“upgrade and verify”_ than _“cancel your weekend.”_, unless explicitly (and uncommonly) noted otherwise. The only serious exception to this rule would be in scenarios where you have modified Java code and CAS server internal components and your changes directly overwrite upstream's fixes. While we do our best to ensure fixes are non-intrusive with a low footprint as much as possible, we cannot guarantee that your custom Java components that entirely overwrite and overlay on top of CAS remain fully functional or compatible with CAS APIs and implementations. The risk with owning code is that you own the code. Review and assess carefully. Versions -------- **Forward Ports** Any CAS version that is still in development and considered a work-in-progress automatically receives any and all fixes. All changes are expected to be carried forward and released in due time. ### 7.3.x Modify your CAS overlay to point to the version `7.3.8.2`. ### 8.0.x Modify your CAS overlay to point to the version `8.0.1.2`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the appropriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Security In The AI Era ====================== We are beginning to see a clear trend in how security issues are researched and reported: AI is playing a much larger role in analyzing, documenting, explaining, and submitting potential vulnerability reports. This is not unique to CAS. It is happening across open source. The same productivity gains that AI gives developers and maintainers are also changing how code is reviewed, assessed, challenged, and patched. As [this article](https://spring.io/blog/2026/06/01/spring_and_security_in_the_times_of_ai) puts it: > _It’s one thing for a development team of 4-10 engineers to use generative AI to build new features faster. It’s a whole other situation when, for each engineer on the team, there are dozens in our community using generative AI to create issues, pull requests, and security reports._ AI did not just learn to write code. It also learned to open security reports, explain them confidently, attach a proof of concept, and then politely ask why nobody has fixed it yet! This trend is likely to accelerate. With that in mind, we would like to highlight two practical points: * **Maintainer capacity is a real constraint.** Human resources and available maintainer time matter a great deal here. It is very likely that time-to-fix expectations will need to stretch, not just for CAS but for many open source projects. If the volume of security reports becomes difficult to manage, our response may be slower than usual. There are only a few of us, and many of you, them, and possibly a small army of extremely confident, polite autocomplete machines. Please set expectations accordingly, and [review the vulnerability response process](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) to understand how reports are handled and what commitments, if any, can realistically be made. * **Automated verification and deployment are no longer optional luxuries.** It is becoming increasingly important for adopters of open source projects, especially CAS, to invest in tooling and processes that support automated release verification, automated integration testing, reliable CI/CD pipelines, and fast production deployment. If your current deployment process depends on manual steps, delayed approvals, synchronous coordination, or one heroic person remembering the exact production checklist from 2019, you may start to feel the pain. As security fixes and patches appear more frequently, teams with slow or manual deployment practices will have a harder time consuming updates quickly and safely. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F08%2F25%2Fvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Tuesday, Sep 8, 2026 6 minute read Overview ======== This is sn [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , which describes a security vulnerability that mainly affects how the CAS server accepts and processes UI. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Exposure ======== The issue addressed here is not tied or connected to a specific feature or extension of the CAS software, and ultimately will lead to **remote code execution** attempts. While the affected area largely has to do with UI, the specific nature of the issue has nothing to do with whether the CAS deployment has customized the user interface or runs with a custom theme. **You are affected if you simply run CAS**. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on a CAS server by sending a crafted `theme` header to the public login endpoint. The attack requires no credentials, secrets, user interaction, optional CAS modules, writable files, or outbound connection. This special header value reaches Thymeleaf as part of a view name and can invoke Thymeleaf’s Webflow expression parser. This turns a template expression into unrestricted Spring expression evaluation and ultimately command execution with the privileges of the CAS service account. Timeline & Credits ================== The issues were originally reported to the CAS project on September 4th, 2026 and fixed on September 8th, 2026. The issues (almost entirely driven by AI analysis) were reported to the CAS project by third-party researchers (who decided to remain anonymous) and were then further validated and tested by the CAS security team. Thank you everyone! Patching ======== Patch releases were published on September 8th, 2026. Upgrades to the next patch version for each release should be a drop-in replacement. **Drop-in Replacement?** For the most part, a drop-in replacement release (as is the case for almost all security patch releases) does not require you to change platform requirements, Java versions, application registration records, user interface, CAS configuration, logging semantics, etc. For most deployments, this should be closer to _“upgrade and verify”_ than _“cancel your weekend.”_, unless explicitly (and uncommonly) noted otherwise. The only serious exception to this rule would be in scenarios where you have modified Java code and CAS server internal components and your changes directly overwrite upstream's fixes. While we do our best to ensure fixes are non-intrusive with a low footprint as much as possible, we cannot guarantee that your custom Java components that entirely overwrite and overlay on top of CAS remain fully functional or compatible with CAS APIs and implementations. The risk with owning code is that you own the code. Review and assess carefully. Versions -------- **Forward Ports** Any CAS version that is still in development and considered a work-in-progress automatically receives any and all fixes. All changes are expected to be carried forward and released in due time. ### 7.3.x Modify your CAS overlay to point to version `7.3.8.3`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the appropriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Security In The AI Era ====================== We are beginning to see a clear trend in how security issues are researched and reported: AI is playing a much larger role in analyzing, documenting, explaining, and submitting potential vulnerability reports. This is not unique to CAS. It is happening across open source. The same productivity gains that AI gives developers and maintainers are also changing how code is reviewed, assessed, challenged, and patched. As [this article](https://spring.io/blog/2026/06/01/spring_and_security_in_the_times_of_ai) puts it: > _It’s one thing for a development team of 4-10 engineers to use generative AI to build new features faster. It’s a whole other situation when, for each engineer on the team, there are dozens in our community using generative AI to create issues, pull requests, and security reports._ AI did not just learn to write code. It also learned to open security reports, explain them confidently, attach a proof of concept, and then politely ask why nobody has fixed it yet! This trend is likely to accelerate. With that in mind, we would like to highlight two practical points: * **Maintainer capacity is a real constraint.** Human resources and available maintainer time matter a great deal here. It is very likely that time-to-fix expectations will need to stretch, not just for CAS but for many open source projects. If the volume of security reports becomes difficult to manage, our response may be slower than usual. There are only a few of us, and many of you, them, and possibly a small army of extremely confident, polite autocomplete machines. Please set expectations accordingly, and [review the vulnerability response process](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) to understand how reports are handled and what commitments, if any, can realistically be made. * **Automated verification and deployment are no longer optional luxuries.** It is becoming increasingly important for adopters of open source projects, especially CAS, to invest in tooling and processes that support automated release verification, automated integration testing, reliable CI/CD pipelines, and fast production deployment. If your current deployment process depends on manual steps, delayed approvals, synchronous coordination, or one heroic person remembering the exact production checklist from 2019, you may start to feel the pain. As security fixes and patches appear more frequently, teams with slow or manual deployment practices will have a harder time consuming updates quickly and safely. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F08%2Fvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS Codebase Overview – Apereo Community Blog CAS Codebase Overview ===================== Monday, Jun 12, 2017 6 minute read Over the past couple of weeks, I have received a lot of positive feedback on CAS codebase organization and management. This blog post attempts to provide an overview of the current codebase status and offers to explain the supporting rationale and the decisions made to cleanup, break down and decompose the monolithic structure of the CAS project whose latest release as of today is [available here](https://github.com/apereo/cas/releases/tag/v5.1.0) . The 1000-Foot View ================== If you were to clone [the CAS project on Github](https://github.com/apereo/cas/) and count the provided subprojects, as of this writing you might see something like the following snippet: > cd cas-server > gradlew projects | wc -l 221 That’s a lot of projects! How is this managed and who can make sense of this beast? At a very high-level, the project is broken into the following categories: | Module | Description | | --- | --- | | `api` | CAS APIs that generically define the outline of a given behavior, such as authentication. | | `core` | Implementations of said APIs. The presence of _almost everything_ under this category is absolutely required for the CAS runtime to function correctly. | | `docker` | Build configuration for automatic builds invoked by [Docker Cloud](https://cloud.docker.com/)
. | | `docs` | [Project documentation](https://apereo.github.io/cas)
artifacts managed by [Github Pages](https://pages.github.com/)
. | | `etc` | Miscellaneous configuration files used by the build or the documentation site. | | `gradle` | Houses [the gradle wrapper](https://docs.gradle.org/current/userguide/gradle_wrapper.html)
used for internal builds. | | `style` | Guidelines and rules enforced and consumed by project’s various static analysis checkers, such as Checkstyle and Findbugs. | | `support` | Extensions that enrich one’s CAS experience with lots and lots of functionality and integrations. (i.e. LDAP, MFA, etc) | | `travis` | Configuration artifacts used by [Travis CI](https://apereo.github.io/2017/06/12/cas-codebase-overview/travis-ci.org/apereo/cas/builds)
. | | `webapp-mgmt` | Artifacts that pertain to the configuration and deployment of the [CAS Service Management Web Application](https://apereo.github.io/cas/5.1.x/installation/Installing-ServicesMgmt-Webapp.html)
. | | `webapp` | Artifacts that pertain to the deployment of the core CAS web application and its many sisters. | As you drill into each category, you are presented with a hierarchy and a naming scheme that intends to explain what each project folder is all about. Note that the above organization is not only rather _pleasing_ to the eye, but it also tries to reduce the initial _scare factor_ to some degree. All visitors, friend and foe alike, who happen to step into the project space on Github are not immediately greeted with a structure that demonstrates 221+ things, forcing them to endlessly scroll downward to finally get to the actual `README.md` file. So, this model is a representation of the project’s organization and essential components, gently and without risk to gradually boil the proverbial frog and get one acclimated for contributions. After all, that is what we want we to do. No Feature Left Behind ====================== Core CAS components aside, there are a lot of other individual modules (i.e. `JAR` artifacts) which act as support modules or more accurately put, _intentions_. What is that about? In order to ease the maintenance burden of both code and documentation and to create a sustainable development environment for the project to grow and keep up with the times and additions of new \[more complicated\] features (i.e. multifactor authentication), CAS 5 took an orthogonal approach where most if not all CAS features are [automatically configured](https://apereo.github.io/2017/02/21/cas-autocfg-strategy/) by CAS itself, given deployer’s consent, relieving the deployer from having to deal with manual configuration. This is a model referred to as **Intention-driven configuration**. Each support module essentially focuses on a single feature or intention or a particular variation of one. It latches onto the runtime and does what it should, inserting itself in all the right places dynamically in order to provide the intended functionality in an automated way. It’s nice that one can fiddle with a variety of configuration files to make something work. It’s a whole lot better though ambitious to _automate once, run everywhere_. Modules are super cheap and modest. Sometimes they only provide the necessary dependencies to provide functionality. Sometimes they provide a specific implementation for an existing feature, such as the ability to store device registrations into a relational database during multifactor authentication flows. Sometimes they actually provide essential functionality, such as multifactor authentication support via Google Authenticator. Whatever it may be, the question ultimately for the deployer is: > I intend to do X with the software and there is a module that lets me. You want the feature? Drop the module in and it does stuff. You don’t want the feature? Remove the module and it will stop doing that. Is it perfect? Surely not, but it should be THAT simple. **Not OSGi** The project structure might seemingly have you suppose that this all somehow stemmed from or was inspired by OSGi principals. While that claim is not entirely false, you should know that CAS today does \[and has\] nothing to do with OSGi. Delete: Such Joy ================ One of the more important advantages of such decomposition is that it allows one to write code that is very easy, nay, a joy to delete. If the configuration and logic of a given behavior are all housed inside a subproject, you should be able to press delete at any given time without causing mass chaos in other parts of the codebase. This is the concept of encapsulation and self-containment. With proper design and organization, removing cruft should be as easy as striking the appropriate key on the keyboard. Challenges ========== Of course, not everything is peachy all the time. There are a number of concerns that one needs to take into account. Summarily, here are a few: Circular Dependencies --------------------- As the codebase is broken apart, it will slowly become apparent that certain modules require a dependency on other modules. If not done carefully, these relationships very quickly turn into an unending cat-and-mouse game. Tread lightly. When Enough Is Enough --------------------- In certain literatures, it is argued that managing one big thing is much easier, conceptually, than managing 100 small things. That’s not entirely false. It, decomposition, requires not only skill and command but also capacity, availability and self-control. All good things are usually done in moderation; so do not overdo. The boundaries of where one module stops and another begins should be designed and apparent at reasonable granular levels and no more, where you decide what _reasonable_ and _granular_ mean. Talk Is Cheap; Show Me The Code ------------------------------- > Don’t suggest code improvements. Code your suggested improvements. Remember that nothing is perfect; Improve and iterate as often as possible. There will always be better ways. There will always be better ideas. Jot them down and encourage friend and foe to starting executing on such ideas rather than merely suggesting them. So… === I hope this brief overview was of some assistance to you. If you happen to come across other ideas and innovative solutions that would make all our CAS lives easier, by all means and without hesitation, [please get involved](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Codebase+Overview&url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&title=CAS+Codebase+Overview "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&title=CAS+Codebase+Overview "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&name=CAS+Codebase+Overview "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&title=CAS+Codebase+Overview "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&title=CAS+Codebase+Overview "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F12%2Fcas-codebase-overview%2F&t=CAS+Codebase+Overview "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS Vulnerability Disclosure – Apereo Community Blog CAS Vulnerability Disclosure ============================ Saturday, Jun 6, 2026 9 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , which describes a _series_ of security vulnerabilities that affect different features and aspects of the CAS server. Additional details will be made public once the security grace window has passed. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 7.3.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you are (or your institution is) a member of the Apereo foundation with _an active support subscription_ supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Exposure ======== You are affected by this security vulnerability **IF ANY** of the following separate conditions apply to your CAS deployment: 1. Your CAS server is using Google Authenticator for multifactor authentication and storing user device records in Redis. 2. Your CAS server is using Redis to store tickets, complemented with a local cache. 3. Your CAS server is acting as an OpenID Connect identity provider. These conditions are separate from one another and operate independently. Again, your CAS deployment is considered vulnerable **IF ANY** of the above conditions are true for your CAS deployment. **THIS IS SERIOUS!** Our initial analysis of issue #3, where CAS acts as an OpenID Connect identity provider in a vulnerable state, indicates that the impact may extend beyond OpenID Connect provider functionality. The issue may affect broader CAS server behavior and could potentially lead to remote code execution. Even if you do not believe you are affected by any of the above conditions, we **VERY STRONGLY** recommend that you upgrade anyway. Timeline & Credits ================== Issue: Google Authenticator with Redis -------------------------------------- The issue was originally reported to the CAS project on May 28th, 2026 and fixed on June 1st, 2026. The reporter declined to be listed in this advisory. Thank you anyway! ### Exposure This issue affects deployments that use a dedicated Redis backend to manage Google Authenticator accounts and scratch codes. When using a scratch code to authenticate, instead of updating the original account and the owner of the scratch code, CAS would instead create a new record for the account with the updated list of scratch codes and thus leaving the original in place as an orphaned account. This meant that the scratch code assigned now to the orphaned account could be used indefinitely to authenticate. Issue: Redis Ticket Registry ---------------------------- This issue was originally reported to the CAS project on May 30th, 2026 by **[Georgia Tech](https://www.gatech.edu/) **’s Enterprise Application and Identity teams and a candidate fix was offered on June 1st, 2026. While final reporter confirmation is still pending, our analysis gives us reasonable confidence that the issue has been addressed. We may iterate further if additional testing identifies gaps. As ever, we appreciate Georgia Tech’s cooperation and willingness to report and verify the fixes. ### Exposure With crypto operations enabled for the Redis ticket registry coupled with a local cache that is backed by Redis messaging, the publisher CAS node would capture the ticket in its local cache using a `SHA-512` of the ticket id to publish a message using Redis messaging to other CAS nodes. The receiver nodes would then receive a signal that is composed of the op type (`ADD`, `DELETE`, etc) as well as the ticket object itself, when available/relevant. The bug here was that the receiver node attempted to remove the ticket from its own local cache using the plain ticket id as the key; not its `SHA-512` equivalent. This of course meant that receiver nodes will end up carrying a cached ticket that is effectively removed from Redis itself, which would then pose a problem for logout operations, specially those that are admin-forced for disabled or compromised accounts. Issue: OpenID Connect --------------------- This issue was originally reported to the CAS project on June 2nd, 2026 by **Richard Gašparík**, an ethical hacker at [Citadelo](https://citadelo.com/) and was fixed on June 3rd, 2026. Citadelo is _a European cybersecurity company that focuses primarily on penetration testing and offensive security, helping organizations across Europe find and fix vulnerabilities before attackers do_. We also wish to credit Richard’s colleague, **Josef Korbel**, who worked on the penetration test with Richard and helped to find the vulnerabilities. We appreciate Richard’s and Josef’s time and effort who shared complete and thorough instructions on how this vulnerability can be observed and exercised and were able to ultimately verify the fix. Thank you both very much! **CVEs** The Citadelo team has reserved CVEs for this issue. We'll notify them to publish the records and make CVEs public, once the security grace period has passed. ### Exposure 1. Authentication bypass of OIDC dynamic client registration. The authentication interceptor is registered for the OIDC base endpoint plus a single path segment while the registration endpoint also maps a multi-segment wildcard. A request with one extra path segment reaches the registration handler without the required initial access token. 2. Expression-language injection in `jwks_uri` or `jwks` leading to RCE in OIDC dynamic client registration requests. The client-supplied `jwks` or `jwks_uri` can be passed as a Spring expression which evaluates using a standard non-sandboxed evaluation context. A registered `jwks_uri` such as `${T(java.lang.Runtime)...}` can execute arbitrary code. Patching ======== Patch releases were published on June 5th, 2026. Upgrades to the next patch version for each release should be a drop-in replacement. **Drop-in Replacement?** For the most part, a drop-in replacement release (as is the case for almost all security patch releases) does not require you to change platform requirements, Java versions, application registration records, user interface, CAS configuration, logging semantics, etc. For most deployments, this should be closer to _“upgrade and verify”_ than _“cancel your weekend.”_, unless explicitly (and uncommonly) noted otherwise. The only serious exception to this rule would be in scenarios where you have modified Java code and CAS server internal components and your changes directly overwrite upstream's fixes. While we do our best to ensure fixes are non-intrusive with a low footprint as much as possible, we cannot guarantee that your custom Java components that entirely overwrite and overlay on top of CAS remain fully functional or compatible with CAS APIs and implementations. The risk with owning code is that you own the code. Review and assess carefully. Versions -------- Given the timeline and severity of the reported issues, we decided to publish one security patch release for affected versions [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , rather than individual releases for every fix and issue. This was a rather unusual event where we received multiple security reports all around the same timeframe and _one release to rule them all_ helps us reduce maintenance burden and release churn, as the fixes are quite targeted and surgical. **Forward Ports** Any CAS version that is still in development and considered a work-in-progress automatically receives any and all fixes. All changes are expected to be carried forward and released in due time. ### 7.3.x Modify your CAS overlay to point to the version `7.3.7.2`. How to upgrade -------------- * Locate your `gradle.properties` file in your CAS overlay, found at the root of the project. * Modify your CAS version to point to the appropriate release version noted above by updating the `cas.version` property. * Follow the instructions in the `README.md` file to build the server, i.e. `./gradlew[.bat] clean build`. Security In The AI Era ====================== We are beginning to see a clear trend in how security issues are researched and reported: AI is playing a much larger role in analyzing, documenting, explaining, and submitting potential vulnerability reports. This is not unique to CAS. It is happening across open source. The same productivity gains that AI gives developers and maintainers are also changing how code is reviewed, assessed, challenged, and patched. As [this article](https://spring.io/blog/2026/06/01/spring_and_security_in_the_times_of_ai) puts it: > _It’s one thing for a development team of 4-10 engineers to use generative AI to build new features faster. It’s a whole other situation when, for each engineer on the team, there are dozens in our community using generative AI to create issues, pull requests, and security reports._ AI did not just learn to write code. It also learned to open security reports, explain them confidently, attach a proof of concept, and then politely ask why nobody has fixed it yet! This trend is likely to accelerate. With that in mind, we would like to highlight two practical points: * **Maintainer capacity is a real constraint.** Human resources and available maintainer time matter a great deal here. It is very likely that time-to-fix expectations will need to stretch, not just for CAS but for many open source projects. If the volume of security reports becomes difficult to manage, our response may be slower than usual. There are only a few of us, and many of you, them, and possibly a small army of extremely confident, polite autocomplete machines. Please set expectations accordingly, and [review the vulnerability response process](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) to understand how reports are handled and what commitments, if any, can realistically be made. * **Automated verification and deployment are no longer optional luxuries.** It is becoming increasingly important for adopters of open source projects, especially CAS, to invest in tooling and processes that support automated release verification, automated integration testing, reliable CI/CD pipelines, and fast production deployment. If your current deployment process depends on manual steps, delayed approvals, synchronous coordination, or one heroic person remembering the exact production checklist from 2019, you may start to feel the pain. As security fixes and patches appear more frequently, teams with slow or manual deployment practices will have a harder time consuming updates quickly and safely. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&name=CAS+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&title=CAS+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F06%2F06%2Fvuln%2F&t=CAS+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # Link CAS OIDC user to existing Database user – Apereo Community Blog Link CAS OIDC user to existing Database user ============================================ Friday, Feb 2, 2018 9 minute read **Contributed Content** Francis Le Coq was kind enough to share this guide. **Collaborate** This blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . This example is here to show an example of our try to use CAS in order to authenticate users via France Connect, by registering them to our own database linked with an user that is already registered. What we want ============ The first thing is that the user register only internally via our own services, not via a public page but via our private system. That means that the user on first usage already has an account and can log into CAS via the Login Form. The second thing is that we want to give the possibility for the user to connect an OIDC, in our example it would be France Connect, but only if the user has already access to our website via Login Form. In conclusion, on first connect via France Connect, the user will have to log onto France Connect and log onto Login Form in second in order to be recognized as the owner of the France Connect account used. On next France Connect login, the user will directly have access. Form Login is the basic, login and password form from CAS. Our environment =============== * CAS `5.2.2` * [CAS Maven WAR Overlay](https://github.com/apereo/cas-overlay-template) What is our configuration ========================= We use an LDAP server and an OIDC CAS configuration. Not more than that. The user has two choices when on the CAS interface, the Login Form and the France Connect button. We will use “cas.authn.pac4j.oidc” for configuring our OIDC to authenticate our user using France Connect. We will use “cas.authn.ldap” to authenticate our user using LDAP database. We will use “cas.authn.attributeRepository.ldap” to retrieve some attributes after user authentication. What do we need =============== We need to : * Connect to France Connect on the behalf of the user (when the user click on the button) and get the OIDC ID * Take this ID and store it * Ask the user to identify via Login Form * Link the UserId and OIDC ID and store into our LDAP database * Send back the user to its final destination which is the asked service Simple ! How to do it ============ Define our first service ------------------------ We will use CAS services, by asking a “requiredAttributes” Create a file into your [service folder](https://apereo.github.io/cas/5.2.x/installation/Configuration-Properties.html#json-service-registry) or equivalent, https-01.json : //On any service, it will ask for UID, if not redirect { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^(https|imaps)://.*", "name" : "default", "id" : 9997, "description" : "Welcome in here", "evaluationOrder" : 9998, // The usernameAttribute is always uid attribute for this service "usernameAttributeProvider" : { "@class" : "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider", "usernameAttribute" : "uid" }, "accessStrategy": { // We created and changed the AccessStrategy, see below why "@class" : "org.esupportail.cas.services.ClaExternalIDRegisteredServiceAccessStrategy", // If doesn't find 'uid' it will redirect to URL that will link and store IDs "unauthorizedRedirectUrl" : "https://my-jetty-server/claExternalID/", "requiredAttributes" : { "@class" : "java.util.HashMap", "uid" : [ "java.util.HashSet", [ ".*" ] ] } } } On first OIDC authentication, France Connect transmit some attributes, but none of them are named ‘uid’, so at this moment CAS redirect the user to `"unauthorizedRedirectUrl": "https://my-jetty-server/claExternalID/"`. In this simple URL we are missing some information that we need in our use case, the OIDC Id and the service target. It is not implemented into CAS to add those parameters automatically to the URL. The second service configuration is { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https?://.*/claExternalID/associate/.*", "name" : "Votre identité FranceConnect n'est pas connu dans l'établissement", "id" : 55, "theme": "cla", "description" : "Veuillez vous authentifier auprès de l'université pour confirmer votre identité", "evaluationOrder" : 55, "usernameAttributeProvider" : { "@class" : "org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider", "usernameAttribute" : "uid" }, "attributeReleasePolicy" : { "@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy", "principalAttributesRepository" : { "@class" : "org.apereo.cas.authentication.principal.cache.CachingPrincipalAttributesRepository", "mergingStrategy" : "ADD" } } } This is when your standalone server send back to the second login Form, you need to give the theme. Force CAS to give OIDC ID ------------------------- When CAS check “requiredAttributes”, if an attribute is missing it will throw an Exception and a handler will catch this exception in order to redirect to the URL we added inside our service configuration. So we will add a new Exception inside the StrategyAccess and the ExceptionHandler will customize the Url. For that part we need to add our new `ClaExternalIDPrincipalException` that will store the attributes coming from our `ClaExternalIDRegisteredServiceAccessStrategy`. Second part, we need to override the handler `AuthenticationExceptionHandlerAction` and replace it by our own `ClaExternalIDAuthenticationExceptionHandlerAction`. First our `ClaExternalIDRegisteredServiceAccessStrategy`, this class is used into service configuration. It allows us to throw the exception, it needs as well to store the attributes needed later on. public class ClaExternalIDRegisteredServiceAccessStrategy extends DefaultClaExternalIDRegisteredServiceAccessStrategy { private static final Logger LOGGER = LoggerFactory.getLogger(ClaExternalIDRegisteredServiceAccessStrategy.class); //this function is used to check "requiredAttributes" public boolean doPrincipalAttributesAllowServiceAccess(final String principal, final Map principalAttributes) { if (!enoughAttributesAvailableToProcess(principal, principalAttributes)) { LOGGER.debug("Access is denied. enoughAttributesAvailableToProcess"); return false; } if (doRejectedAttributesRefusePrincipalAccess(principalAttributes)) { LOGGER.debug("Access is denied. doRejectedAttributesRefusePrincipalAccess"); return false; } if (!doRequiredAttributesAllowPrincipalAccess(principalAttributes, this.requiredAttributes)) { LOGGER.debug("Access is denied. doRequiredAttributesAllowPrincipalAccess"); principalAttributes.put("principal", principal); //We throw our exception, it will be intercepted by the Handler inside the Webflow throw new ClaExternalIDPrincipalException("ClaExternalIDPrincipalException", new HashMap<>(), new HashMap<>(), principalAttributes); } LOGGER.debug("Access is authorized"); return true; } } As you saw above, a new class appear `ClaExternalIDPrincipalException`, the handler will need it to recognize the situation. public class ClaExternalIDPrincipalException extends PrincipalException { public ClaExternalIDPrincipalException( final String message, final Map> handlerErrors, final Map handlerSuccesses, final Map principalAttributes) { super(message, handlerErrors, handlerSuccesses); setPrincipalAttributes(principalAttributes); } public void setPrincipalAttributes(Map principalAttributes){ this.principalAttributes = principalAttributes; } public Map getPrincipalAttributes(){ return this.principalAttributes; } } To finish this part, the handler that will modify the Url public class ClaExternalIDAuthenticationExceptionHandlerAction extends AuthenticationExceptionHandlerAction { protected String handleAuthenticationException(final AuthenticationException e, final RequestContext requestContext) { final URI url = WebUtils.getUnauthorizedRedirectUrlIntoFlowScope(requestContext); if (e.getHandlerErrors().containsKey(UnauthorizedServiceForPrincipalException.class.getSimpleName())) { if (url != null) { LOGGER.warn("Unauthorized service access for principal; CAS will be redirecting to [{}]", url); return CasWebflowConstants.STATE_ID_SERVICE_UNAUTHZ_CHECK; } } //We add this part to catch the exception thrown and we customize the url, // adding the attributes from OIDC and the url service asked if (e instanceof ClaExternalIDPrincipalException) { if (url != null) { final ClaExternalIDPrincipalException eClaExternalID = (ClaExternalIDPrincipalException) e; final URI url2 = getUrl(url, eClaExternalID.getPrincipalAttributes(), WebUtils.getService(requestContext).getOriginalUrl()); WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(requestContext, url2); LOGGER.warn("Unauthorized service access for principal; CAS will be redirecting to [{}]", url2); return CasWebflowConstants.STATE_ID_SERVICE_UNAUTHZ_CHECK; } } final String handlerErrorName = getErrors() .stream() .filter(e.getHandlerErrors().values()::contains) .map(Class::getSimpleName) .findFirst() .orElseGet(() -> { LOGGER.debug("Unable to translate handler errors of the authentication exception [{}]. Returning [{}]", e, UNKNOWN); return UNKNOWN; }); final MessageContext messageContext = requestContext.getMessageContext(); final String messageCode = DEFAULT_MESSAGE_BUNDLE_PREFIX + handlerErrorName; messageContext.addMessage(new MessageBuilder().error().code(messageCode).build()); return handlerErrorName; } /** * Create an URI object with attributes as paramaters in it */ protected URI getUrl(final URI uri, final Map principalAttributes, final String target){ MultiValueMap queryParams = new LinkedMultiValueMap(); principalAttributes.forEach((key, i) -> { if(i instanceof Iterable){ for (Object y : (Iterable) i) { queryParams.add(key, (String) y); } } else { queryParams.add(key, (String) i); } }); queryParams.add("target", target); UriComponents uriComponents = UriComponentsBuilder.newInstance() .fromUri(uri).queryParams(queryParams).build(); try { return uriComponents.toUri(); } catch(Exception e) { LOGGER.debug(e.toString()); } throw new RuntimeException("Failed to create the URL"); } } At this moment, everything is good but our handler is not registered to be used by Spring. Register the newly created handler ---------------------------------- It is pretty simple, we will override the Bean `authenticationExceptionHandler` by creating our own customized configuration class. @Configuration("ClaExternalIDConfiguration") @EnableConfigurationProperties(CasConfigurationProperties.class) public class ClaExternalIDConfiguration { @Autowired private CasConfigurationProperties casProperties; @RefreshScope @Bean /** * This bean has the same name that the CAS "CasCoreWebflowConfiguration", so it will * overwrite that class, it will work only because it is implemeted inside * the gradle overlay in our example */ public Action authenticationExceptionHandler() { return new ClaExternalIDAuthenticationExceptionHandlerAction(handledAuthenticationExceptions()); } public Set> handledAuthenticationExceptions() { /* * Order is important here; We want the account policy exceptions to be handled * first before moving onto more generic errors. In the event that multiple handlers * are defined, where one failed due to account policy restriction and one fails * due to a bad password, we want the error associated with the account policy * to be processed first, rather than presenting a more generic error associated */ final Set> errors = new LinkedHashSet<>(); errors.add(javax.security.auth.login.AccountLockedException.class); errors.add(javax.security.auth.login.CredentialExpiredException.class); errors.add(javax.security.auth.login.AccountExpiredException.class); errors.add(AccountDisabledException.class); errors.add(InvalidLoginLocationException.class); errors.add(AccountPasswordMustChangeException.class); errors.add(InvalidLoginTimeException.class); errors.add(javax.security.auth.login.AccountNotFoundException.class); errors.add(javax.security.auth.login.FailedLoginException.class); errors.add(UnauthorizedServiceForPrincipalException.class); errors.add(PrincipalException.class); errors.add(UnsatisfiedAuthenticationPolicyException.class); errors.add(UnauthorizedAuthenticationException.class); errors.addAll(casProperties.getAuthn().getExceptions().getExceptions()); return errors; } } A last file for the configuration is needed in order to declare the configuration file into Spring. org.springframework.boot.autoconfigure.EnableAutoConfiguration=org.esupportail.cas.config.ClaExternalIDConfiguration Linking the OIDC Id and UID --------------------------- This part can be manage by a simple jetty server. Or with some work a spring Webflow implemented yourself. In our side we choose the first case. As explained above, the server will need to receive the first call with the url we constructed and store the OIDC id into the session for example. Next it will send back to a new page implementing a CAS client, that will ask for a new login form authentication. When that authentication is done and granted, it will send back to this page and receive the UID. At this moment, the server link both OIDC id and UID together into the database. And on next login, CAS will get automatically the UID based on the OIDC id received by the OIDC supplier and grant the access. Make disappear the button on second login ----------------------------------------- For that, a theme has to be used via the service configuration, in our code we just replaced the casLoginView.html by one that `
` has been removed. Conclusion ========== This solution is not perfect and could be maybe improved by using the webflow in order to make the linking possible. As well it has been only tested via an java overlay and will need some improvements if that is transformed into a module. I hope it was instructive and it helped you to do what you wanted to do :) The source are available on Github of course ! Find here our [Example source code](https://github.com/EsupPortail/cas-server-support-claExternalID/tree/5.2.x) Plus our simple [Standalone LDAP linking server](https://github.com/EsupPortail/claExternalID/tree/5.2.x) [Francis Le Coq](https://github.com/cifren) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Link+CAS+OIDC+user+to+existing+Database+user&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&title=Link+CAS+OIDC+user+to+existing+Database+user "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&title=Link+CAS+OIDC+user+to+existing+Database+user "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&name=Link+CAS+OIDC+user+to+existing+Database+user "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&title=Link+CAS+OIDC+user+to+existing+Database+user "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&title=Link+CAS+OIDC+user+to+existing+Database+user "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F02%2FOIDC-link-account%2F&t=Link+CAS+OIDC+user+to+existing+Database+user "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Java CAS Client JWT Vulnerability Disclosure – Apereo Community Blog Java CAS Client JWT Vulnerability Disclosure ============================================ Wednesday, May 20, 2026 1 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in the Java CAS Client while validating tickets issued as JWT. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was reported to the project by a third-party researcher and was then further validated and tested by Mr. Jérôme Leleu, who is a project member and an active committer. Thank you everyone! Affected Deployments ==================== If you have an application that uses the Java CAS client to intergrate with a CAS server and is configured to accept and validate JWTs from that server, you are affected and do need to upgrade. If this condition does not pass for your application deployments, there is nothing for you to do here. Keep calm and carry on. If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Timeline ======== The issue was originally reported on May 2nd 2026, and upon confirmation, Java CAS client releases were patched and eventually published on May 20th, 2026. Patching ======== Upgrade your applications to use Java CAS client’s version `4.1.1`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) * [CAS Mailing Lists](https://apereo.github.io/cas/Mailing-Lists.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Java+CAS+Client+JWT+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&title=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&title=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&name=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&title=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&title=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F05%2F20%2Fcasc-jwt-vuln%2F&t=Java+CAS+Client+JWT+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # OpenID Federation with pac4j and CAS – Apereo Community Blog OpenID Federation with pac4j and CAS ==================================== Tuesday, Sep 1, 2026 7 minute read As CAS v8.1.0 will support the three roles of the OpenID federation protocol: trust anchor, intermediate and OP, this is the perfect opportunity to present a live demo. The setup consists of three components: * a client, referred to as the Relying Party (RP) in OIDC, implemented with pac4j * a server, referred to as the OpenID Provider (OP) in OIDC, implemented with the CAS server * a Trust Anchor (TA), also implemented with the CAS server, responsible for establishing trust between the other two components. Although we use the CAS server for the OP and the TA, we can’t use a single CAS node: we have two separate nodes of the CAS server, each supporting an exclusive role. The following URLs are used: * the OP runs on `http://localhost:8080/cas` * the RP runs on `http://localhost:8081` * the TA runs on `http://localhost:8082/cas`. For the CAS server nodes, we use this basic Maven overlay: [https://github.com/casinthecloud/cas-overlay-demo](https://github.com/casinthecloud/cas-overlay-demo) . Both our CAS servers have a similar `pom.xml` file: 4.0.0 com.casinthecloud cas-overlay-demo 8.1.0-SNAPSHOT war org.apereo.cas cas-server-webapp${tomcat.properties} ${cas.version} war runtime org.apereo.cas cas-server-support-oidc-federation ${cas.version} org.apache.maven.plugins maven-war-plugin 3.3.1 false false false ${project.build.directory}/war/work/org.apereo.cas/cas-server-webapp${tomcat.properties}/META-INF/MANIFEST.MF org.apereo.cas cas-server-webapp${tomcat.properties} org.apache.maven.plugins maven-compiler-plugin 3.8.1 ${java.version} org.springframework.boot spring-boot-maven-plugin 4.2.0-M1 org.apereo.cas.web.CasWebApplication org.apereo.cas cas-server-webapp-tomcat repackage cas 8.1.0-RC1 25 -tomcat UTF-8 The OP has one more CAS dependency though (compared to the TA): org.apereo.cas cas-server-support-oidc ${cas.version} And the configuration specific to each server changes. For the pac4j application, we use this simple demo: [https://github.com/pac4j/simple-spring-boot-pac4j-demos/tree/oidc/src/main/java/org/pac4j/demos](https://github.com/pac4j/simple-spring-boot-pac4j-demos/tree/oidc/src/main/java/org/pac4j/demos) . 1) Setup a CAS server as the OP ------------------------------- In the `application.yml` file, let’s set up the CAS server to act as the trust anchor: server.ssl.enabled: false server.port: 8080 cas.tgc.secure: false cas.tgc.same-site-policy: Lax cas.tgc.crypto.enabled: false cas.webflow.crypto.enabled: false cas.server.name: http://localhost:${server.port} cas.server.prefix: ${cas.server.name}/cas cas.host.name: casop cas.authn.oidc.jwks.file-system.jwks-file: file:./metadata/oidc.jwks cas.authn.oidc.federation.role: OPENID_PROVIDER cas.authn.oidc.federation.jwks-file: file:./metadata/federation.jwks cas.authn.oidc.federation.authority-hints: - http://localhost:8082/cas/oidc cas.authn.oidc.core.issuer: ${cas.server.prefix}/oidc The configuration is quite easy: we set up the CAS server to run on `http://localhost:8080/cas` (no SSL, `Lax` policy, no cookie/webflow encryption, **this is for development only**). For OIDC, we define its OIDC base URL (`issuer`) and its JWKS (`./metadata/oidc.jwks`). And for the federation part, we set the `OPENID_PROVIDER` role, the specific JWKS (`./metadata/federation.jwks`) and the trust anchor: cas.authn.oidc.federation.authority-hints: - http://localhost:8082/cas/oidc 2) Setup the pac4j application as the RP ---------------------------------------- In the pac4j ecosystem, Spring Boot is the most popular web stack, so we use the `spring-webmvc-pac4j` implementation in this simple demo: [https://github.com/pac4j/simple-spring-boot-pac4j-demos/tree/oidc/src/main/java/org/pac4j/demos](https://github.com/pac4j/simple-spring-boot-pac4j-demos/tree/oidc/src/main/java/org/pac4j/demos) : * the `SpringBootDemo` class runs the Spring Boot demo * the `SecurityConfig` class defines the security configuration (OIDC + URL protection) * the `Application` class is a simple controller with two URLs: one public and the other one protected. ### a) Dependencies We need the following dependencies: org.springframework.boot spring-boot-starter-web org.pac4j spring-webmvc-pac4j 8.0.3 org.pac4j pac4j-oidc 6.5.6 ### b) Properties We run it on port 8081 thanks to the `application.properties` file: server.port=8081 app.base-url=http://localhost:8081 ### c) `SecurityConfig` class We update the `SecurityConfig` class to change the configuration for the federation: package org.pac4j.demos; import com.nimbusds.jose.JWSAlgorithm; import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod; import org.pac4j.core.config.Config; import org.pac4j.oidc.client.OidcClient; import org.pac4j.oidc.config.OidcConfiguration; import org.pac4j.oidc.config.method.PrivateKeyJwtClientAuthnMethodConfig; import org.pac4j.oidc.federation.config.OidcTrustAnchorProperties; import org.pac4j.springframework.config.Pac4jSecurityConfig; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.InterceptorRegistry; import java.util.List; @Configuration public class SecurityConfig extends Pac4jSecurityConfig { @Value("${app.base-url:http://localhost:8080}") private String baseUri; @Bean public Config config() { final var config = new OidcConfiguration(); config.setAllowUnsignedIdTokens(true); final var rpJwks = config.getRpJwks(); rpJwks.setJwksPath("file:./metadata/rpjwks.jwks"); rpJwks.setKid("defaultjwks26"); config.setClientAuthenticationMethod(ClientAuthenticationMethod.PRIVATE_KEY_JWT); final var privateKeyJwtConfig = new PrivateKeyJwtClientAuthnMethodConfig(rpJwks); config.setPrivateKeyJWTClientAuthnMethodConfig(privateKeyJwtConfig); config.setRequestObjectSigningAlgorithm(JWSAlgorithm.RS256); final var federation = config.getFederation(); federation.setTargetOp("http://localhost:8080/cas/oidc"); final var trust = new OidcTrustAnchorProperties(); trust.setIssuer("http://localhost:8082/cas/oidc"); trust.setJwksPath("classpath:trustanchor.jwks"); federation.getTrustAnchors().add(trust); federation.getJwks().setJwksPath("file:./metadata/oidcfede.jwks"); federation.getJwks().setKid("mykeyoidcfede26"); federation.setContactName("RP with CAS"); federation.setContactEmails(List.of("jerome@casinthecloud.com")); federation.setEntityId("http://localhost:8081"); return new Config(baseUri + "/callback", new OidcClient(config)); } @Override public void addInterceptors(final InterceptorRegistry registry) { addSecurity(registry, "OidcClient").addPathPatterns("/protected/**"); } } The configuration is more complicated here. We define a global JWKS for the RP that is also used for the `private_key_jwt` authentication method: final var rpJwks = config.getRpJwks(); rpJwks.setJwksPath("file:./metadata/rpjwks.jwks"); rpJwks.setKid("defaultjwks26"); config.setClientAuthenticationMethod(ClientAuthenticationMethod.PRIVATE_KEY_JWT); final var privateKeyJwtConfig = new PrivateKeyJwtClientAuthnMethodConfig(rpJwks); config.setPrivateKeyJWTClientAuthnMethodConfig(privateKeyJwtConfig); For federation, we use: config.setRequestObjectSigningAlgorithm(JWSAlgorithm.RS256); final var federation = config.getFederation(); federation.setTargetOp("http://localhost:8080/cas/oidc"); final var trust = new OidcTrustAnchorProperties(); trust.setIssuer("http://localhost:8082/cas/oidc"); trust.setJwksPath("classpath:trustanchor.jwks"); federation.getTrustAnchors().add(trust); The target OP is of course the CAS server acting as an OP. For the trust anchor, it’s the other CAS node (on port 8082) for which we retrieve the JWKS from `http://localhost:8082/cas/oidc/.well-known/openid-federation` and save it in the `trustanchor.jwks` file. _Example:_ { "keys": [\ {\ "kty": "RSA",\ "e": "AQAB",\ "use": "sig",\ "kid": "19f7aaaa-c4d3-4c26-a26e-3ce4b8ab1beb",\ "n": "uXgnb...SEdSw"\ }\ ] } We also have a specific JWKS configuration dedicated to federation (displayed on the `.well-known/openid-federation` endpoint): federation.getJwks().setJwksPath("file:./metadata/oidcfede.jwks"); federation.getJwks().setKid("mykeyoidcfede26"); federation.setContactName("RP with CAS"); federation.setContactEmails(List.of("jerome@casinthecloud.com")); federation.setEntityId("http://localhost:8081"); ### d) `Application` class We also need to update the `Application` class to add the mapping for the OpenID federation endpoint: @Controller public class Application { @Autowired private Config config; @RequestMapping(value = "/.well-known/openid-federation", produces = DefaultEntityConfigurationGenerator.CONTENT_TYPE) @ResponseBody public String oidcFederation() throws HttpAction { final var oidcClient = (OidcClient) config.getClients().findClient("OidcClient").get(); return oidcClient.getConfiguration().getFederation().getEntityConfigurationGenerator().generateEntityStatement(); } ... } 3) Setup a CAS server as the trust anchor ----------------------------------------- In the `application.yml` file, let’s set up the CAS server as the trust anchor this time: server.ssl.enabled: false server.port: 8082 cas.tgc.secure: false cas.tgc.same-site-policy: Lax cas.tgc.crypto.enabled: false cas.webflow.crypto.enabled: false cas.server.name: http://localhost:${server.port} cas.server.prefix: ${cas.server.name}/cas cas.host.name: casta cas.authn.oidc.federation.role: TRUST_ANCHOR cas.authn.oidc.federation.jwks-file: file:./metadata/trustanchor.jwks cas.authn.oidc.core.issuer: ${cas.server.prefix}/oidc cas.authn.oidc.federation.subordinate-directory: ./subordinates The configuration is close to that of the other CAS node, except that we define the `TRUST_ANCHOR` role as well as the file directory in which we will define its subordinates. The subordinates are the entities for which the CAS server provides trust. They must be defined upfront with their metadata and their federation key(s). Here, it will be the RP (the pac4j client, Spring Boot demo) and the OP (the other CAS server). For the RP (pac4j), we call the URL: `http://localhost:8081/.well-known/openid-federation`. An entity statement is returned by the Spring Boot demo and we can decode it via any JWT tool or the `jwt.io` website. The `metadata` and the `keys` from the `jwks` property (not in the `metadata` property) are the ones we use to build the subordinate `rp.json` file (placed in the `./subordinates` directory): { "entityId": "http://localhost:8081", "metadata": { "openid_relying_party": { "redirect_uris": [\ "http://localhost:8081/callback?client_name=OidcClient"\ ], "application_type": "web", "response_types": [\ "code"\ ], "grant_types": [\ "authorization_code"\ ], "scope": "openid email profile", "token_endpoint_auth_method": "private_key_jwt", "token_endpoint_auth_signing_alg": "RS256", "request_object_signing_alg": "RS256", "jwks": { "keys": [\ {\ "kty": "RSA",\ "e": "AQAB",\ "use": "sig",\ "kid": "defaultjwks26",\ "n": "v-zf7...G2tyw"\ }\ ] }, "client_registration_types": [\ "explicit",\ "automatic"\ ], "client_name": "RP with CAS", "contacts": [\ "jerome@casinthecloud.com"\ ] } }, "federationKeys": [\ {\ "kty": "RSA",\ "e": "AQAB",\ "use": "sig",\ "kid": "mykeyoidcfede26",\ "n": "uaov...EpbZQ"\ }\ ] } For the OP (CAS server), we do something similar and call the URL: `http://localhost:8080/cas/oidc/.well-known/openid-federation` to get the metadata and the federation keys and create the `op.json` file (in the `./subordinates` directory). { "entityId": "http://localhost:8080/cas/oidc", "metadata": { "openid_provider": { "DPopSigningAlgValuesSupported": [\ "RS256",\ "RS384",\ "RS512",\ "ES256",\ "ES384",\ "ES512"\ ], "request_parameter_supported": true, "pushed_authorization_request_endpoint": "http://localhost:8080/cas/oidc/oidcPushAuthorize", "introspection_signing_alg_values_supported": [\ "none",\ "RS256",\ "RS384",\ "RS512",\ "PS256",\ "PS384",\ "PS512",\ "ES256",\ "ES384",\ "ES512",\ "HS256",\ "HS384",\ "HS512"\ ], ...[TRUNCATED]... "registration_endpoint": "http://localhost:8080/cas/oidc/register", "request_object_signing_alg_values_supported": [\ "none",\ "RS256",\ "RS384",\ "RS512",\ "PS256",\ "PS384",\ "PS512",\ "ES256",\ "ES384",\ "ES512",\ "HS256",\ "HS384",\ "HS512"\ ], "request_object_encryption_alg_values_supported": [\ "RSA1_5",\ "RSA-OAEP",\ "RSA-OAEP-256",\ "A128KW",\ "A192KW",\ "A256KW",\ "A128GCMKW",\ "A192GCMKW",\ "A256GCMKW",\ "ECDH-ES",\ "ECDH-ES+A128KW",\ "ECDH-ES+A192KW",\ "ECDH-ES+A256KW"\ ] }, "federation_entity": { "organization_name": "Apereo CAS", "contacts": [] } }, "federationKeys": [\ {\ "kty": "RSA",\ "e": "AQAB",\ "use": "sig",\ "kid": "0bf6c36e-1cba-41d3-a50e-a11881fd85e7",\ "n": "xoP5Q...3EkRw"\ }\ ] } 4) Final test ------------- With the RP, OP and TA started, we call `http://localhost:8081` in the browser: ![pac4j home page](https://www.pac4j.org/img/blog/2026_10/pac4j_before.png) Then, we click on the “Protected area” link. On the CAS server login page, we use the pre-defined user: `casuser` / `Mellon` to log in: ![CAS login page](https://www.pac4j.org/img/blog/2026_10/cas_login.jpg) and we validate the authorizations: ![CAS authorization page](https://www.pac4j.org/img/blog/2026_10/cas_authorize.jpg) And it works: ![pac4j authenticated page](https://www.pac4j.org/img/blog/2026_10/pac4j_after.jpg) We are finally logged in to the pac4j application thanks to the OpenID Federation protocol and the two CAS server nodes. > So the CAS server can now act as a federated OP and as a trust anchor _with_ the pac4j RP client. [Jerome LELEU](https://www.casinthecloud.com/index-en.html) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=OpenID+Federation+with+pac4j+and+CAS&url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&title=OpenID+Federation+with+pac4j+and+CAS "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&title=OpenID+Federation+with+pac4j+and+CAS "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&name=OpenID+Federation+with+pac4j+and+CAS "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&title=OpenID+Federation+with+pac4j+and+CAS "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&title=OpenID+Federation+with+pac4j+and+CAS "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2026%2F09%2F01%2Fopenidfederation%2F&t=OpenID+Federation+with+pac4j+and+CAS "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) [#### CAS JWT Authentication Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software using JWT non-interactive authentication.](https://apereo.github.io/2026/03/06/jwt-vuln/) --- # CAS 5.1.0 RC1 Feature Release – Apereo Community Blog CAS 5.1.0 RC1 Feature Release ============================= Friday, Dec 23, 2016 17 minute read The official CAS `5.0.0` GA [was released about 6 weeks ago](https://github.com/apereo/cas/releases/tag/v5.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.1.0`. This post intends to highlight some of the improvements and enhancements packed into the first release candidate in the `5.1.0` series. The in-development documentation of CAS `5.1.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . * [Log Levels via CAS Properties](https://apereo.github.io/2016/12/23/51rc1/#log-levels-via-cas-properties) * [Name Authentication Handlers](https://apereo.github.io/2016/12/23/51rc1/#name-authentication-handlers) * [JWS/JWE Compression](https://apereo.github.io/2016/12/23/51rc1/#jwsjwe-compression) * [Security Filters Enabled by Default](https://apereo.github.io/2016/12/23/51rc1/#security-filters-enabled-by-default) * [CORS Security Filter](https://apereo.github.io/2016/12/23/51rc1/#cors-security-filter) * [Database AuthN BCrypt Encoder](https://apereo.github.io/2016/12/23/51rc1/#database-authn-bcrypt-encoder) * [Duration as Unit of Measure](https://apereo.github.io/2016/12/23/51rc1/#duration-as-unit-of-measure) * [Risk-Based Authentication](https://apereo.github.io/2016/12/23/51rc1/#risk-based-authentication) * [AuthN Events in Audit Log](https://apereo.github.io/2016/12/23/51rc1/#authn-events-in-audit-log) * [Duo Security Account Checking](https://apereo.github.io/2016/12/23/51rc1/#duo-security-account-checking) * [Duo Security Multiple Configurations _\[1\]_](https://apereo.github.io/2016/12/23/51rc1/#duo-security-multiple-configurations-sup1sup) * [Embedded Container Version](https://apereo.github.io/2016/12/23/51rc1/#embedded-container-version) * [Redis Ticket Registry](https://apereo.github.io/2016/12/23/51rc1/#redis-ticket-registry) * [Code Cleanup and Optimization](https://apereo.github.io/2016/12/23/51rc1/#code-cleanup-and-optimization) * [Registered Service Legacy Definitions](https://apereo.github.io/2016/12/23/51rc1/#registered-service-legacy-definitions) * [LDAP Search Filter Parametrization](https://apereo.github.io/2016/12/23/51rc1/#ldap-search-filter-parametrization) * [LDAP Connection Strategies](https://apereo.github.io/2016/12/23/51rc1/#ldap-connection-strategies) * [MongoDb Authentication: Password Encoding](https://apereo.github.io/2016/12/23/51rc1/#mongodb-authentication-password-encoding) * [Service Registry Performance](https://apereo.github.io/2016/12/23/51rc1/#service-registry-performance) * [LDAP Principal Attributes Merged with Attribute Repositories](https://apereo.github.io/2016/12/23/51rc1/#ldap-principal-attributes-merged-with-attribute-repositories) * [Internal Auto Configuration _\[1\]_](https://apereo.github.io/2016/12/23/51rc1/#internal-auto-configuration-sup1sup) * [Multiple Attribute Repositories _\[1\]_](https://apereo.github.io/2016/12/23/51rc1/#multiple-attribute-repositories-sup1sup) * [Attribute Repositories Order](https://apereo.github.io/2016/12/23/51rc1/#attribute-repositories-order) * [Service UI Info on Login Screen](https://apereo.github.io/2016/12/23/51rc1/#service-ui-info-on-login-screen) * [SAML2 ECP](https://apereo.github.io/2016/12/23/51rc1/#saml2-ecp) * [SAML2 InCommon Metadata](https://apereo.github.io/2016/12/23/51rc1/#saml2-incommon-metadata) * [SAML2/OAuth/OIDC Multifactor Authentication](https://apereo.github.io/2016/12/23/51rc1/#saml2oauthoidc-multifactor-authentication) * [SAML2 IdP Metadata Signature Validation](https://apereo.github.io/2016/12/23/51rc1/#saml2-idp-metadata-signature-validation) * [SAML2 IdP Metadata Location URI](https://apereo.github.io/2016/12/23/51rc1/#saml2-idp-metadata-location-uri) * [Service Registry JSON Auto-Init](https://apereo.github.io/2016/12/23/51rc1/#service-registry-json-auto-init) * [Embedded Container HTTP2 Support](https://apereo.github.io/2016/12/23/51rc1/#embedded-container-http2-support) * [Internet2 Grouper MFA Trigger](https://apereo.github.io/2016/12/23/51rc1/#internet2-grouper-mfa-trigger) * [REST API Performance](https://apereo.github.io/2016/12/23/51rc1/#rest-api-performance) * [LDAP Validator Configuration](https://apereo.github.io/2016/12/23/51rc1/#ldap-validator-configuration) * [Logging Panel](https://apereo.github.io/2016/12/23/51rc1/#logging-panel) * [Improved Hazelcast Configuration](https://apereo.github.io/2016/12/23/51rc1/#improved-hazelcast-configuration) * [SAML2 IdP Handling of RelayState](https://apereo.github.io/2016/12/23/51rc1/#saml2-idp-handling-of-relaystate) * [JSON Enhancements to CAS APIs](https://apereo.github.io/2016/12/23/51rc1/#json-enhancements-to-cas-apis) * [Multifactor Authentication Bypass Per Service](https://apereo.github.io/2016/12/23/51rc1/#multifactor-authentication-bypass-per-service) * [OIDC Delegated AuthN Scope](https://apereo.github.io/2016/12/23/51rc1/#oidc-delegated-authn-scope) * [LinkedIn Delegated AuthN](https://apereo.github.io/2016/12/23/51rc1/#linkedin-delegated-authn) * [Management Webapp Authorization Roles _\[1\]_](https://apereo.github.io/2016/12/23/51rc1/#management-webapp-authorization-roles-sup1sup) * [OIDC Dynamic Client Registration](https://apereo.github.io/2016/12/23/51rc1/#oidc-dynamic-client-registration) * [JWTs as Service Tickets](https://apereo.github.io/2016/12/23/51rc1/#jwts-as-service-tickets) * [Delegated AuthN Auto Redirect](https://apereo.github.io/2016/12/23/51rc1/#delegated-authn-auto-redirect) * [Library Upgrades](https://apereo.github.io/2016/12/23/51rc1/#library-upgrades) * [What’s Next?](https://apereo.github.io/2016/12/23/51rc1/#whats-next) * [Get Involved](https://apereo.github.io/2016/12/23/51rc1/#get-involved) * [Das Ende](https://apereo.github.io/2016/12/23/51rc1/#das-ende) Log Levels via CAS Properties ----------------------------- The configuration of CAS logging levels is traditionally done directly inside the `log4j2.xml` file. As an easier option and thanks to Spring Boot, log levels may also be specified via the normal CAS properties: logging.level.org.springframework.web=DEBUG logging.level.org.apereo.cas=DEBUG Name Authentication Handlers ---------------------------- Additional CAS properties are exposed for all authentication handlers so they can individually be named. By default, handler names are set to the name of the defining Java class. Given the class name might change, it’s preferred if each adopter defines unique/custom names for each scheme. You generally do NOT have to worry about this behavior at all; It’s only relevant if you, for instance, have defined multifactor authentication bypass rules based on authentication handler names. JWS/JWE Compression ------------------- CAS ciphers that deal with signing/encryption based on JWEs are now by default configured to force compression via the `zip` claim. Security Filters Enabled by Default ----------------------------------- CAS has long had options to enforce a number of request headers to enable XSS/HSTS/etc protection. These filters are turned on by default, starting from this release candidate. CORS Security Filter -------------------- Much like the above option, CAS adds support for enabling a CORS filter that should help more with CAS enabled applications which are accessed via XHR/Ajax requests. This filter is off by default and needs to be explicitly configured by the adopter. Database AuthN BCrypt Encoder ----------------------------- Thanks to community contributions, minor changes are made to the internal CAS authentication API to ensure password encoding can execute correctly specially when the `BCrypt` encoder is defined. Duration as Unit of Measure --------------------------- Thanks to community contributions, all CAS settings that deal with time units should start to support the duration syntax for full clarity on unit of measure: "PT20S" -- parses as "20 seconds" "PT15M" -- parses as "15 minutes" "PT10H" -- parses as "10 hours" "P2D" -- parses as "2 days" "P2DT3H4M" -- parses as "2 days, 3 hours and 4 minutes" Risk-Based Authentication ------------------------- CAS is able to track and examine authentication requests for suspicious behavior. Risk-based authentication allows CAS to detect suspicious and seemingly-fraudulent authentication requests based on past user behavior and collected authentication events, statistics, etc. Once and after primary authentication where the principal is identified, the authentication transaction is analyzed via a number of configurable criteria and fences to determine how risky the attempt may be. The result of the evaluation step is a cumulative risk score that is then weighed against a risk threshold set by the CAS operator. In the event that the authentication attempt is considered risky well beyond the risk threshold, CAS may be allowed to take action and mitigate that risk. You can learn more about this feature [here](https://apereo.github.io/cas/development/installation/Configuring-RiskBased-Authentication.html) . At this point, the changeset and accompanying modules are fairly experimental and are going through rounds of testing and patching. If this functionality interests you, by all means give it a trial run and share feedback as much as possible. AuthN Events in Audit Log ------------------------- CAS events are now routed to the CAS audit logs. This allows one, for instance, to learn when an MFA event is triggered and to note if MFA was successfully honored and executed: ============================================================= WHO: audit:unknown WHAT: [event=mfa-duo,timestamp=Mon Nov 14 12:01:17 MST 2016,source=RankedAuthenticationProviderWebflowEventResolver] ACTION: AUTHENTICATION_EVENT_TRIGGERED APPLICATION: CAS WHEN: Mon Nov 14 12:01:17 MST 2016 CLIENT IP ADDRESS: 110.5.75.1 SERVER IP ADDRESS: 110.2.75.1 ============================================================= Duo Security Account Checking ----------------------------- Presently, if users are unregistered with Duo Security or allowed through via a direct bypass, CAS puts the user through multifactor authentication and simply validates the response internally and somewhat invisibly, allowing the application to receive an authentication context that indicates multifactor authentication did actually commence. In this release, CAS starts to [query the user account](https://apereo.github.io/cas/development/installation/DuoSecurity-Authentication.html) apriori to learn whether user is registered or configured for direct bypass. If the account status matches either of those conditions or the user account is not registered yet the new-user enrollment policy allows folks to skip registration, CAS will bypass Duo Security altogether and will **NOT** report back a multifactor-enabled authentication context back to the application. Duo Security Multiple Configurations _\[1\]_ -------------------------------------------- CAS is now able to support [different configuration blocks](https://apereo.github.io/cas/development/installation/DuoSecurity-Authentication.html) for multiple Duo Security instances: # cas.authn.mfa.duo[0].duo-secret-key= # cas.authn.mfa.duo[0].duo-application-key= # cas.authn.mfa.duo[0].duo-integration-key= # cas.authn.mfa.duo[0].duo-api-host= # cas.authn.mfa.duo[0].id=mfa-duo ... # cas.authn.mfa.duo[1].duo-secret-key= # cas.authn.mfa.duo[1].duo-application-key= # cas.authn.mfa.duo[1].duo-integration-key= # cas.authn.mfa.duo[1].duo-api-host= # cas.authn.mfa.duo[1].id=mfa-second-duo ... By default, a Duo Security provider in CAS is registered under `mfa-duo` noted by the above id. However, additional providers can now be registered with arbitrary identifiers. All MFA triggers shall function exactly as before and as long as they are configured to produce the right match for the right provider id, CAS will activate MFA for the Duo Security configuration that is linked to the selected identifier. At this point in time, Duo Security is the only provider in CAS whose configuration can be specified in blocks. However, \[and this turned out to be a VERY non-trivial task\], adjustments are made internally to ensure other providers can be configured in much the same way should there be demands. Embedded Container Version -------------------------- The embedded container version now shows up in the CAS banner on startup: CAS Version: 5.1.0-SNAPSHOT ... Container Version: Apache Tomcat/8.5.x Redis Ticket Registry --------------------- Thanks to community contributions, CAS gains support for Redis as a storage machenism for its ticket registry backend. Redis is an open source in-memory data structure store, used as a database, cache and message broker. You can learn more about the registry behavior via [this guide](https://apereo.github.io/cas/development/installation/Redis-Ticket-Registry.html) . Code Cleanup and Optimization ----------------------------- Thanks to community contributions, the CAS codebase is revitalized ever more to make sure most if not all underlying components adhere to proper coding standards and design practices. Changes in this area include adjustments to style guidelines, constructor-based dependency injections and navigating from Guava Collections to the native Java 8 Collections/Lambda APIs. Registered Service Legacy Definitions ------------------------------------- Thanks to community contributions, CAS’ handling of [legacy service registry definitions](https://apereo.github.io/cas/development/installation/JSON-Service-Management.html) that are backed by JSON are now slightly improved to preserve backwards compatibility with prior CAS versions whose service definition was based on the old `org.jasig` namespace. LDAP Search Filter Parametrization ---------------------------------- A number of LDAP search filters for SPNEGO and attribute repository configurations are relaxed to be more consistent with other parameter names via supporting both `{user}` and `{0}` for both named and index parameter values. LDAP Connection Strategies -------------------------- Additional configuration options are now made available to allow users to define a connection strategy of their own choosing, should multiple LDAP urls be specified in the configuration. MongoDb Authentication: Password Encoding ----------------------------------------- Minor bug fix; Improper construction of password encoders caused MongoDb authentication attempts to reject all user credentials, failing to apply proper hashing/encoding on the password for validation. This should now be fixed. Service Registry Performance ---------------------------- Thanks to community contributions, there have been a number of performance improvement applied to the way CAS saves, updates and locates services internally. Likewise, improvements are applied to the way CAS services handle regex pattern matching when responding to requests. LDAP Principal Attributes Merged with Attribute Repositories ------------------------------------------------------------ LDAP authentication in CAS can be made to directly resolve attributes without involving external attribute repositories via Person Directory. While simple, this isn’t always the use case. For instance, if there is ever a requirement to additionally resolve attributes from a JDBC source, the adopter is to abandon attribute resolution directly as part of LDAP authentication and is then forced to define a separate LDAP attribute repository source alongside a JDBC source so the final result from both can be merged. This is now improved such that attributes retrieved as part of LDAP authentication are now merged with all other attributes retrieved from attribute repository sources, if any. Internal Auto Configuration _\[1\]_ ----------------------------------- CAS 5 took the auto-configuration strategy to the next level, thanks to Spring Boot and Spring Cloud. The approach was to component-scan the application context under `org.apereo.cas` and load components and beans that were declared via the housing `@Configuration`s. In this release, CAS entirely turns off component scanning and switches to Spring Boot’s auto-configure style. The strategy is more or less the same where `@Configuration` classes still register CAS components as `@Bean`s. The difference is that each CAS module provides a `spring.factories` file in which configuration classes and application context initializers are placed. This strategy allows CAS to exactly control the set of configurations that are loaded very explicitly for each mdule and also helps with deterministic load behavior where configurations for instance can register themselves to be loaded before or after a particular component to accommodate runtime behavioral dependencies. This may partially help with start-up times as well when CAS is run via the embedded container, but so far tests show that performance more or less remains the same. Note that while this isn’t generally something that the average adopter needs to worry about, this is nonetheless a breaking change **IIF** you have designed Java components/classes that are auto-scanned under `org.apereo.cas`. Those will NO LONGER be picked up by CAS automatically and you will need to either manually register them as CAS does via your own `spring.factories` or set up a auto-scanning configuration under your own package names via `@ComponentScan`, etc. Multiple Attribute Repositories _\[1\]_ --------------------------------------- Attribute repository sources that are controlled and managed via Person Directory have now turned into lists. This allows you to create more than one source if necessary and then have all sources be merged into a single repository automatically to resolve CAS principals and attributes. # cas.authn.attribute-repository.ldap[0].ldap-url=ldaps://ldap1.example.edu,... ... # cas.authn.attribute-repository.ldap[1].ldap-url=ldaps://ldap2.example.edu,... ... Attribute Repositories Order ---------------------------- You have to consider that when you have more than one attribute repository source defined, there may be cases where two sources end up colliding as they both may produce the same attribute. In such cases, CAS already provides capabilities to merge the final result and take action to either add, replace or ignore subsequent attempts at producing an attribute, if one already is found and fixed. This becomes important as it directly impacts the execution order of sources. For instance, consider that you have sources `S1` and `S2` defined both of which are configured to produce an attribute `A1`. Policies are configured to note that if `A1` is already found via one source, no other source should attempt to overwrite it. The question then really becomes: which source should execute and query for data first? To handle this, CAS allows you to order attribute repositories. Those with a lower order execute first and take priority in querying for attributes: # cas.authn.attribute-repository.ldap[0].ldap-url=ldaps://ldap1.example.edu,... # cas.authn.attribute-repository.ldap[0].order=1 ... # cas.authn.attribute-repository.ldap[1].ldap-url=ldaps://ldap2.example.edu,... # cas.authn.attribute-repository.ldap[1].order=10 ... Service UI Info on Login Screen ------------------------------- In situations where CAS ends up playing proxy behind a protocol such as SAML2, OAuth or OIDC, the login screen wrongly displayed the UI metadata (i.e. logo, description, etc) about the proxying (callback) service. This is now corrected so relevant UI information about the real service/destination is displayed on the screen per the SAML metadata or the CAS service registry. SAML2 ECP --------- CAS starts to support a rather modest implementation of the SAML2 ECP profile. At this point, the changeset and accompanying modules are fairly experimental and are going through rounds of testing and patching. If this functionality interests you, by all means give it a trial run and share feedback as much as possible. SAML2 InCommon Metadata ----------------------- A number of improvements are applied to the way CAS handles the retrieval and resolution of large SAML metadata files that are downloaded over the web. The download strategy is now handled over a multi-part multi-threaded connection which should boost performance and startup times quite a bit. InCommon SPs are now supported directly via the usual CAS configuration settings, while in the past adopters expicitly had to register InCommon in the CAS service registry. SAML2/OAuth/OIDC Multifactor Authentication ------------------------------------------- CAS triggers for multifactor authentication have all been reorganized in much the same way as the above item to ensure that authentication requests via SAML2, OAuth or OpenID Connect may all go through multifactor authentication based on the real service and not the proxying (callback) url. SAML2 IdP Metadata Signature Validation --------------------------------------- Metadata signature validation can now be done both via public keys and certificate files. SAML2 IdP Metadata Location URI ------------------------------- A trivial bug fix; the location of the metadata for CAS’ SAML2 IdP functionality can now be specified in URI format as well. (i.e. `file://etc/cas/somewhere`) Service Registry JSON Auto-Init ------------------------------- Service registries can now take advantage of the auto-initialization feature in a more direct manner. The previous behavior only populated a given registry if it was left empty by the adopter. However, in certain cases CAS modules auto-insert service definitions into the registry and interfere with this auto-initialization behavior. This is now corrected to ensure the service registry, if permitted, can forcefully be populated regardless of size while gracefully ignoring duplicate entries that may already be present. Embedded Container HTTP2 Support -------------------------------- The [embedded container](https://apereo.github.io/cas/development/installation/Configuring-Servlet-Container.html) is now configured to automatically upgrade the protocol and support HTTP2. Note that activation of this feature for an external Apache Tomcat instance requires Apache Tomcat `8.5.6` or above. Internet2 Grouper MFA Trigger ----------------------------- As an extra option, CAS can now integrate with [Grouper](http://www.internet2.edu/grouper/software.html) and use a subject \[CAS principal\] groups’ to [learn whether MFA should be triggered](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html#triggers) . As an example, you could devise a use case where all subjects who are assigned to an `mfa-duo` groups may be asked to execute MFA via Duo Security. If you have deployed Grouper, this may be a much more immediate option than to pick up changes based on a given principal attribute once after provisioning has had a chance to process. REST API Performance -------------------- Thanks to community contributions, improvements have gone into the implementation of CAS REST APIs to ensure best coding practices are in-place, performance-wise. LDAP Validator Configuration ---------------------------- Additional properties are now exposed to allow configuration of LDAP validators for ALL operations that deal with LDAP functionality. CAS supports both `SEARCH` and `COMPARE` modes. Logging Panel ------------- CAS provides an administrative screen to manage and review logs. This screen is now improved to allow one to update logger levels immediately from the UI and observe better CAS diagnostics data. ![image](https://cloud.githubusercontent.com/assets/1205228/20279208/d9e43d12-aa64-11e6-903e-acb559d4882b.png) Note that at present, changes applied to the configuration UI are only persisted in memory since the underlying framework does not yet provide a way to save changes back out to disk, etc. This means, once you restart the CAS server node all changes applied to logs via the configuration panel are lost. Improved Hazelcast Configuration -------------------------------- Minor adjustments are made to the Hazelcast configuration to stop using deprecated settings for internal eviction policies. SAML2 IdP Handling of RelayState -------------------------------- Thanks to community contributions, the SAML2 functionality of CAS is now able to properly retain the `RelayState` parameter. JSON Enhancements to CAS APIs ----------------------------- Thanks to community contributions, CAS APIs are now slightly massaged to handle JSON serialization of core ticketing components. This is useful for ticket registry implementations that are based on NoSQL databases such as Apache Cassandra, which as a [pending pull request](https://github.com/apereo/cas/pull/2111) may also soon become a first-class CAS ticket registry feature. Multifactor Authentication Bypass Per Service --------------------------------------------- In this release CAS starts to provide options to selectively [exclude a set of applications](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html#triggers) from multifactor authentication. This is useful in cases where you have turned on multifactor authentication globally. A number of other bugs also in this area have been fixed to ensure handler/authentication attribute names can correctly be defined to bypass multifactor authentication. OIDC Delegated AuthN Scope -------------------------- Having upgraded to early snapshots of Pac4J, additional CAS configurtion options are now made available to allow for providing `scope` when delegating authentication to an external OIDC provider. LinkedIn Delegated AuthN ------------------------ Thanks to the early Pac4J upgrade, CAS now starts to support delegating authentication to LinkedIn in addition to a variety of other social providers. Management Webapp Authorization Roles _\[1\]_ --------------------------------------------- The authorization roles for the management webapp and the administrative user interfaces are now modified to allow distinct roles for access without the need for extra data parsing: # cas.adminPagesSecurity.adminRoles[0]=ROLE_ADMIN ... # cas.mgmt.adminRoles[0]=ROLE_ADMIN # cas.mgmt.adminRoles[1]=ROLE_SUPER_USER OIDC Dynamic Client Registration -------------------------------- [OpenId Connect in CAS](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) is now starting to support modest implementations of the [dynamic client registration](https://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-management-01) protocol. JWTs as Service Tickets ----------------------- Starting with this release candidate, CAS gains the ability to issue [JWTs as service tickets](https://apereo.github.io/cas/development/installation/JWT-Authentication.html) . JWTs are entirely self-contained and include enough information about the authenticated principal and available claims for given application integration. Delegated AuthN Auto Redirect ----------------------------- In the event that you have configured CAS to delegate authentication to an external \[social\] identity provider, options are now made available to automatically redirect the authentication flow to the provider bypassing the CAS login screen. This option today is only relevant and active if there is a single provider available. Library Upgrades ---------------- * Spring * Spring Boot * Spring Cloud * Spring Security * Thymeleaf * Commons Lang * Guava * Pac4J * Ldaptive * MongoDb * OpenSAML * FindBugs * Checkstyle * Joda Time * Couchbase * Hibernate * MySQL, MaridaDb and PostgreSQL Drivers * Kryo What’s Next? ------------ The development team is working to make sure the CAS `5.1.0` release is on [schedule](https://github.com/apereo/cas/milestones) . Additional release candidates and more updates will likely be released prior to the official GA release. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende -------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) * \[1\] This is a breaking configuration change. Please consult the [CAS docs](https://apereo.github.io/cas/development/) to learn more. Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&title=CAS+5.1.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&title=CAS+5.1.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&name=CAS+5.1.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&title=CAS+5.1.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&title=CAS+5.1.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2016%2F12%2F23%2F51rc1%2F&t=CAS+5.1.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Wednesday, Aug 3, 2022 2 minute read Overview ======== This is the version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS that when it’s acting as an OAuth **OR** OpenID Connect identity provider. If you are not using CAS as an OAuth **OR** OpenID Connect Provider, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.4.x - 6.5.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== When CAS is acting as an OAuth **OR** OpenID Connect identity provider, the underlying issue allows an attacker to bypass the CAS service registry and application registrations by crafting a special URL and ultimately force CAS to open-redirect to a supplied URL. Timeline ======== The issue was originally reported on August 2nd, 2022 and upon confirmation, CAS releases were patched on August 3rd, 2022. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.4.x Modify your CAS overlay to point to the version `6.4.6.6`. ### 6.5.x Modify your CAS overlay to point to the version `6.5.8`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2022%2F08%2F03%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS X.509 Vulnerability Disclosure – Apereo Community Blog CAS X.509 Vulnerability Disclosure ================================== Monday, Feb 20, 2023 2 minute read Overview ======== This is the initial version of an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS deployment that supports accepting X.509 credentials as part of the CAS REST API where the X.509 functionality is configured to handle revocation via LDAP. If you are not using the X.509 workflow or CAS REST API, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= The issue was originally reported by Michael Stepankin, a member of the the GitHub Security Lab team. Michael was also kind enough to supply a fix, which was incorporated into the published releases. Thank you! Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.5.x - 6.6.x If your CAS version is not listed above _AND_ is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied._. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== When the CAS REST API is turned on and is configured to accept X.509 credentials and CAS is configured to handle CRL revocation via LDAP, the underlying issue allows an attacker to gain insight into the configuration of the running CAS instance by crafting a special malicious certificate. If Apereo CAS is placed behind a reverse proxy, which checks the validity of certificate, this vulnerability can still be exploited, but an attacker needs to somehow craft a signed and yet malicious certificate. Timeline ======== The issue was originally reported on Monday February 21st, 2023 and upon confirmation, CAS releases were patched and published on Monday February 21st, 2023. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.5.x Modify your CAS overlay to point to the version `6.5.9.1`. ### 6.6.x Modify your CAS overlay to point to the version `6.6.6`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+X.509+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&title=CAS+X.509+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&title=CAS+X.509+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&name=CAS+X.509+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&title=CAS+X.509+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&title=CAS+X.509+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2023%2F02%2F20%2Fx509-vuln%2F&t=CAS+X.509+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OpenID Connect Vulnerability Disclosure =========================================== Friday, Jul 21, 2023 2 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS when it’s acting as an OpenID Connect identity provider. If you are not using CAS as an OpenID Connect Provider, there is nothing to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= The issue was originally reported by [Jérôme Leleu](https://www.linkedin.com/in/jleleu/?locale=en_US) , a fellow CAS committer and long-time supporter. Jérôme was also kind enough to supply the fix and follow up with tests and confirmations, all of which were ultimately incorporated into the published releases. Thank you! Affected Deployments ==================== The security issue described here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.5.x - 6.6.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== The problem affects CAS deployments that are configured to act as an OAuth or OpenID Connect identity provider and it appears when the authorization endpoint receives a request that contains an unknown, unregistered, invalid value for the `scope` parameter. This unknown scope forces CAS, once authentication flow is completed, to mistakenly bypass claim/attribute release rules and build ID/access tokens that contain all available user claims rather than those explicitly authorized and allowed for the request and relying party. In other words, the security issue can be classified as data leak where the OpenID Connect _caller_ (or relying party) is allowed to receive more information about the _caller_, when claim release rules say otherwise. Timeline ======== The issue was originally reported on July 19th, 2023 and upon confirmation, CAS releases were patched and published on July 21st, 2023. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.5.x Modify your CAS overlay to point to the version `6.5.9.2`. ### 6.6.x Modify your CAS overlay to point to the version `6.6.10`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&name=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&title=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2023%2F07%2F21%2Foidc-vuln%2F&t=CAS+OpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OAuth/OpenID Connect Vulnerability Disclosure ================================================= Thursday, Sep 14, 2023 2 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as an OAuth/OpenID Connect provider. If your CAS server is not acting as an OAuth/OpenID Connect provider producing claims and attributes, there is nothing for you to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by Mr. Terry Appleby, who is a senior developer at [wicket.io](https://wicket.io/) Terry was kind enough to thoroughly investigate the issue, discuss the problem in detail, provide steps to reproduce the problem with an actual CAS overlay and puppeteer test and offer insight to diagnose the root cause. Thank you! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.5.x - 6.6.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== CAS incorrectly returns and releases a number of internal data structures and attributes in response to OAuth or OpenID Connect requests sent to the _User Profile_ endpoint. Such internal data structures often tend to contain sensitive data such as the application policy record, details and metadata describing the authentication attempt, client secret assigned to the relying party, geo-location details when activated and more in plain JSON. This mistake is corrected in the patch releases described below. Timeline ======== The issue was originally reported on September 13th, 2023 and upon confirmation, CAS releases were patched and published on September 14th, 2023. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.5.x Modify your CAS overlay to point to the version `6.5.9.4`. ### 6.6.x Modify your CAS overlay to point to the version `6.6.12`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation, supported by community volunteers and enthusiasts. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a member of the Apereo foundation with an active subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&name=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2023%2F09%2F14%2Foauth-vuln%2F&t=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OAuth/OpenID Connect Vulnerability Disclosure ================================================= Saturday, May 18, 2024 2 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as an OAuth/OpenID Connect provider. If your CAS server is not acting as an OAuth/OpenID Connect provider, there is nothing for you to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by Mr. Jérôme Leleu, who is a project member and an active committer. Jérôme was kind enough to thoroughly investigate the issue, discuss the problem in detail, provide steps to reproduce the problem with an actual puppeteer test and offer insight to diagnose the root cause. Thank you Jérôme! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.6.x - 7.0.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== CAS presnts the ability to pin the single sign-on cookie to an authentication session that typically is linked to the user’s environment such as the browser user agent or the IP address. This behavior would, for example, prevent the single sign-on session to be recognized and accepted if the user’s IP address changes between authentication attempts. However, this behavior was not correctly handled for OpenID Connect authentication requests and cookie session-pinning was effectively bypassed. Session pinning is typically controlled via: cas.tgc.pin-to-session=true|false So, * If you have cookie session pinning turned off, this vulnerability and the listed patch releases do not apply to you. * If you have cookie session pinning turned on, (which usually is the default CAS behavior), you may upgrade to the patch releases listed below. Timeline ======== The issue was originally reported on May 15th, 2024 and upon confirmation, CAS releases were patched and published on May 17th, 2023. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.6.x Modify your CAS overlay to point to the version `6.6.15.1`. ### 7.0.x Modify your CAS overlay to point to the version `7.0.4.1`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&name=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2024%2F05%2F18%2Foauth-vuln%2F&t=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS OAuth/OpenID Connect Vulnerability Disclosure – Apereo Community Blog CAS OAuth/OpenID Connect Vulnerability Disclosure ================================================= Wednesday, Jun 26, 2024 2 minute read Overview ======== This is an [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) , describing an issue in CAS acting as an OAuth/OpenID Connect provider. If your CAS server is not acting as an OAuth/OpenID Connect provider, there is nothing for you to do here. Keep calm and carry on. For additional details on how security issues, patches and announcements are handled, please read the [Apereo CAS project vulnerability disclosure](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) process. Credits ======= This issue was originally reported, researched and tested by Dürr Systems AG. Dürr was kind enough to investigate the issue, offer insight to diagnose the root cause and took steps to verify the fix for various patch releases. Thank you! Affected Deployments ==================== The problem addressed here, [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , affects the Apereo CAS server for the following versions: - 6.6.x - 7.0.x If your CAS version is not listed above **AND** is still part of an active maintenance cycle [per the CAS maintenance policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) , then best effort (analysis or confirmation from reporters/testers) indicates that the version is not affected by this issue. That said, please note that per the project’s Apache2 license, _software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied_. For additional information, please [see the project license](https://github.com/apereo/cas/blob/master/LICENSE) . If you or your institution is a member of the Apereo foundation with an active support subscription supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability report. Severity ======== If your CAS server is functioning as an OAuth or OpenID Connect identity provider **AND** you have configured the system to create and share **access tokens as JWTs**, you are affected by this issue, which mistakenly allows CAS to ignore the attribute/claim release policies assigned to the application definition and to release all possible claims to the application as part of the JWT access token. The patch releases listed below should help CAS re-evaluate the claim release policy of the application before building and sharing a JWT access token. There are also smaller measures in place to ensure CAS selects the correct _indexed_ service definition during request processing, particularly if and when the service definition record is modified dynamically at runtime. Timeline ======== The issue was originally reported on June 11th, 2024 and upon confirmation, CAS releases were patched and eventually published on June 19th, 2024 and June 26th, 2024. Patching ======== Patch releases are available to address CAS deployments. Upgrades to the next patch version for each release should be a drop-in replacement. Procedure --------- ### 6.6.x Modify your CAS overlay to point to the version `6.6.15.2`. ### 7.0.x Modify your CAS overlay to point to the version `7.0.5.1`. Support ======= Apereo CAS is Apache v2 open source software under the sponsorship of the Apereo Foundation. Support options may be [found here](https://apereo.github.io/cas/Support.html) . If you or your institution is a **member** of the Apereo foundation with an **active CAS subscription** supporting the CAS project, please [contact the CAS subs working group](https://apereo.github.io/cas/Mailing-Lists.html) to learn more about this security vulnerability. Resources ========= * [CAS Security Vulnerability Response Model](https://apereo.github.io/cas/developer/Sec-Vuln-Response.html) * [CAS Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) On behalf of the CAS Application Security working group, [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure&url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&name=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&title=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2024%2F06%2F26%2Foidc-vuln%2F&t=CAS+OAuth%2FOpenID+Connect+Vulnerability+Disclosure "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP) – Apereo Community Blog Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP) =========================================================================================== Monday, Feb 18, 2019 13 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . CAS --- Apereo CAS can authenticate users in many ways, including by delegating to other authentication providers, and it can get attributes about those users from many places, and finally it can communicate that identity along with those attributes to applications (aka services) via various protocols such as the CAS Protocol, SAML, and OpenID Connect. Exercise Outline ---------------- In this exercise, we configure CAS to authenticate users via username/password against LDAP, we retrieve attributes from LDAP and we then we communicate the identity and attributes to Gitlab via the SAML2 protocol. While not required, we run both CAS and Gitlab behind HAProxy and we run LDAP, Gitlab, and HAProxy in Docker containers. Everything should be able to run on a workstation (Windows/Mac/Linux) if you have >8GB of memory with 4GB available to Docker but it has only been tested on a Windows computer with an Intel I7-860 (from circa 2009) with 16GB and an SSD drive. There are some scripts for use on Mac and Linux that haven’t been tested on either OS. The starting position is based on the following: * CAS `6.1.0-RC1` * [Java 11](https://adoptopenjdk.net/?variant=openjdk11&jvmVariant=hotspot) * Docker (Available for Linux, [Windows](https://download.docker.com/win/stable/Docker%20for%20Windows%20Installer.exe) , or [Mac](https://download.docker.com/mac/stable/Docker.dmg) ) - On Windows and Mac, make sure you adjust Docker settings to share your host hard drive with docker and increase the memory available to Docker to 3 or 4 GB. * [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) - `git clone https://github.com/apereo/cas-overlay-template.git` * Gitlab Community Edition - [Docker Image](https://hub.docker.com/r/gitlab/gitlab-ce) (No need to download, scripts provided) * openssl 1.1.1+ (for creating certificates, on Windows it comes with [Git Bash](https://git-scm.com/downloads) ) * [Forked CAS War Overlay](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo) - `gitlab-demo` branch contains extra material for this demo * Host File Entry - Cookies and SSL certificate checks work better when using a domain name rather than an IP address or localhost so please make the following entry in your hosts file: (c:\\windows\\system32\\drivers\\etc\\hosts on Windows, /etc/hosts otherwise) 192.168.1.123 example.org where `192.168.1.123` is replaced with the main IP address of your workstation. Initial CAS Setup ----------------- After cloning the [CAS Overlay Template](https://github.com/apereo/cas-overlay-template) , we need to add modules for SAML2, LDAP and a service registry. A service in the CAS context is an application that authenticates against CAS and it allows for service specific configurations (such as what protocol that service uses and what attributes to release). CAS supports several back-ends for storing the service definitions but in this exercise we will use the JSON service registry which is just a folder containing JSON formatted service definitions. #### Adding CAS Modules Adding modules to our CAS installation involves adding the following to the dependencies section in the build.gradle file: // https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html compile "org.apereo.cas:cas-server-support-saml-idp:${casServerVersion}" // https://apereo.github.io/cas/development/installation/LDAP-Authentication.html compile "org.apereo.cas:cas-server-support-ldap:${casServerVersion}" // https://apereo.github.io/cas/development/services/JSON-Service-Management.html#json-service-registry compile "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}" // https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html#saml-sp-integrations compile "org.apereo.cas:cas-server-support-saml-sp-integrations:${casServerVersion}" Optional: rather than be on the bleeding edge of the 6.1.x development, change the cas version to the a recent release rather than the current snapshot. Modify the `cas.version` property in the `gradle.properties` file to: cas.version=6.1.0-RC1 #### Starting Up CAS After you have added the module dependencies, make sure you have [Java 11](https://adoptopenjdk.net/?variant=openjdk11&jvmVariant=hotspot) in your path and run: gradlew run CAS fails to start up because we don’t have any configuration set and some directories and files referenced by the default configuration don’t exist yet. CAS can read configurations from many sources supported by [Spring Cloud Config](https://spring.io/projects/spring-cloud-config) but in this exercise we use the [Standalone](https://apereo.github.io/cas/development/configuration/Configuration-Server-Management.html#standalone) configuration method which consists of property files (or yaml files) in /etc/cas/config outside of the overlay project. In order to copy the configuration to that location, run the following task: gradlew copyCasConfiguration When you started CAS it should have failed because it couldn’t find the default folder where it reads its SAML Identity Provider (IDP) metadata. CAS, as usual, supports [several options](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html) for storing SAML metadata but the default is to read it from `/etc/cas/saml`. Since there is no gradle task to create that folder for you, just create it and CAS should generate metadata in that location the next time you start up CAS. mkdir c:\etc\cas\saml mkdir /etc/cas/saml CAS also looks for an SSL certificate for the default built-in Tomcat server. In this case there is a gradle task to generate a key store: gradlew createKeyStore gradlew copyCasConfiguration Before running CAS again, the following properties are important to set in cas.properties before CAS generates the SAML IDP metadata: # Tell CAS what it's name is cas-host=example.org cas.server.name=https://${cas-host} cas.server.prefix=https://${cas-host}/cas Now if you do `gradlew copyCasConfiguration` and `gradlew run`, CAS should start up and generate metadata for the SAML IDP. The metadata contains URLs based on the `cas.server.prefix` property. Before doing further CAS configuration we need to create a source of users and attributes and we need to suppress the big STOP warning by turning off the “[accept users](https://apereo.github.io/cas/development/configuration/Configuration-Properties.html#accept-users-authentication) ” authentication provider. #### Setting up LDAP While most of this exercise relies on the default [cas-overlay-template](https://github.com/apereo/cas-overlay-template) , the docker containers and the scripts to run them are located in the [github.com/hdeadman/cas-overlay-template](https://github.com/hdeadman/cas-overlay-template) fork on a [gitlab-demo](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo) branch in a [docker](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo/docker) folder. Look at the [README.md](https://github.com/hdeadman/cas-overlay-template/blob/gitlab-demo/docker/ldap/README.md) for instructions on building and running the ldap container. It is essentially running `build.[sh|bat]` and `run.[sh|bat]` from the `docker/ldap` folder. To configure CAS to use the local LDAP server, add the following properties to etc\\config\\cas.properties in the CAS overlay. # don't allow login of built-in users cas.authn.accept.users= # set some properties we can re-use in authn and attributeRepository configuration ldap-url=ldap://localhost:10389 ldap-binddn=cn=Directory Manager ldap-bindpw=password ldap-auth-type=DIRECT ldap-basedn=ou=People,DC=example,DC=edu ldap-dnformat=uid=%s,ou=people,DC=example,DC=edu ldap-user-filter=(uid={user}) ldap-max-pool-size=20 # configure ldap authentication cas.authn.ldap[0].base-dn=${ldap-basedn} cas.authn.ldap[0].bind-credential=${ldap-bindpw} cas.authn.ldap[0].bind-dn=${ldap-binddn} cas.authn.ldap[0].dn-format=${ldap-dnformat} cas.authn.ldap[0].ldap-url=${ldap-url} cas.authn.ldap[0].max-pool-size=${ldap-max-pool-size} cas.authn.ldap[0].min-pool-size=0 cas.authn.ldap[0].subtree-search=true cas.authn.ldap[0].type=${ldap-auth-type} cas.authn.ldap[0].searchFilter=${ldap-user-filter} cas.authn.ldap[0].use-ssl=false cas.authn.ldap[0].use-start-tls=false # configure ldap attribute repository cas.authn.attributeRepository.ldap[0].ldap-url=${ldap-url} cas.authn.attributeRepository.ldap[0].order=0 cas.authn.attributeRepository.ldap[0].useSsl=false cas.authn.attributeRepository.ldap[0].useStartTls=false cas.authn.attributeRepository.ldap[0].baseDn=${ldap-basedn} cas.authn.attributeRepository.ldap[0].searchFilter=${ldap-user-filter} cas.authn.attributeRepository.ldap[0].subtreeSearch=true cas.authn.attributeRepository.ldap[0].bindDn=${ldap-binddn} cas.authn.attributeRepository.ldap[0].bindCredential=${ldap-bindpw} cas.authn.attributeRepository.ldap[0].minPoolSize=0 cas.authn.attributeRepository.ldap[0].maxPoolSize=${ldap-max-pool-size} cas.authn.attributeRepository.ldap[0].validateOnCheckout=true # configure validator for attribute repository cas.authn.attributeRepository.ldap[0].validator.type=SEARCH cas.authn.attributeRepository.ldap[0].validator.baseDn=${ldap-basedn} cas.authn.attributeRepository.ldap[0].validator.searchFilter=(objectClass=*) cas.authn.attributeRepository.ldap[0].validator.scope=OBJECT cas.authn.attributeRepository.ldap[0].validator.attributeName=objectClass cas.authn.attributeRepository.ldap[0].validator.attributeValues=top # Map ldap attributes to names Gitlab wants # Gitlab also allows for mapping attributes on its side cas.authn.attributeRepository.ldap[0].attributes.mail=email cas.authn.attributeRepository.ldap[0].attributes.givenName=first_name cas.authn.attributeRepository.ldap[0].attributes.sn=last_name cas.authn.attributeRepository.ldap[0].attributes.uid=name At this point, with the LDAP container running you should be able to `gradlew copyCasConfiguration` and `gradlew run` and then browse to https://localhost:8443/cas/login and login via LDAP authentication as `casuser`/`password`. #### Clearing up warning messages There are still several warning messages on CAS startup and in order to get rid of those we can add some secrets to `cas.properties` that CAS will use for signing and encrypting various things: # CAS encryption and signing keys cas.tgc.crypto.encryption.key=zTYaxglyeSbSZASejncaSW6T8MfdB9Vt7w3g-XbAI0M cas.webflow.crypto.signing.key=4AlA6_fVQ-Dl4qQbVFBu3FkQnyvXB9pHNiGSIQHynf9Wffe3-bfJgDRvdGjniQVk6YqIIZ9oN-ysFv_-Dhom3g cas.webflow.crypto.encryption.key=dq-Fv33AMUSM7bKVrbcxboKxx7qJaq_M1pmJAiNmztuSaLLY-Tq2DOvtO8dQ-m213T3I2b1lz5QnX_QzHsnd8w cas.webflow.crypto.encryption.key=QRPKUXy8zCdk6CB94JOlkA cas.tgc.crypto.signing.key=aAyzadftnelaY_Af6fR1kaf-314aYklTqH-cLuZymWvsZneimPEw3AsdJbSaTN3jUIygcAiS3laFeb6CuTSfQA Generating values for these secrets later can be done with the CAS Shell. To run the CAS shell from the overlay, run the following (adjusted for the version of CAS in `gradle.properties`): gradlew downloadShell java -jar build\libs\cas-server-support-shell-6.1.0-RC1.jar #### Configure JSON Service Registry In order to resolve a warning about using the default in memory service registry, create a directory based JSON registry: mkdir \etc\cas\services mkdir /etc/cas/services And add a property to `cas.properties` that references the location: # Configure CAS JSON service registry cas.service-registry.json.location=file:/etc/cas/services Gitlab Container Setup ---------------------- When running Gitlab as a container, one typically volume maps in three folders from the host (or via Docker Volumes): * data - contains sub-directories for git repository data, postgresql data, etc) * config - contains the main configuration file `gitlab.rb` along with ssh host keys, nginx ssl certificates, and other secrets that need to survive container image upgrades intact * logs - if you want logs to survive removing the container then map in the logs folder Gitlab can be started by running the scripts in the CAS overlay [github.com/hdeadman/cas-overlay-template](https://github.com/hdeadman/cas-overlay-template) fork on a [gitlab-demo](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo) branch in a [docker/gitlab](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo/docker/gitlab) folder. **Please review scripts before you run. The `run.[bat|sh]` scripts create a base folder on your computer (`c:\gitlab-demo` or `/opt/gitlab-demo`) so adjust that if you want the folder somewhere else. (They also download gitlab image and remove and start up “gitlab” container, listen on a host port, etc)** The `gitlab.rb` configuration is pre-populated with the configuration for this exercise, but you need to modify it with the fingerprint for the CAS SAML IDP signing key that was generated when CAS was started. The fingerprint can be generated by openssl using the `fingerprint_idp.sh` script. ### Gitlab External URL Config Note that the `external_url 'https://example.org'` configuration setting in `gitlab.rb` is packed with non-obvious configuration magic. If you added a port, Nginx in the gitlab container would listen on that port. If you added a context (e.g. `https://example.org/gitlab`) then Gitlab would be deployed under that context. If you changed the protocol to http then Nginx would listen on port 80 and not use SSL configuration. The URL should match the URL that users are going to use taking into account the reverse proxy that will be in front of Gitlab. Even though Gitlab is listening on port 443 inside the container, from the host we use the host port specified in the docker run command (e.g. `https://localhost:8444/`). ### Gitlab LDAP Config The `gitlab.rb` file contains LDAP configuration which isn’t strictly necessary to authenticate via CAS SAML but since we are using the LDAP server with CAS, it is easy to point at it from the gitlab container. The LDAP host is configured as `host.docker.internal` which should allow the gitlab container to talk to the ldap container if using Docker for Windows/Mac. If you are running Docker on Linux you will need to set that to the host IP or a DNS name that resolves to the host where LDAP is running. ### Gitlab SAML Config Make sure you have started CAS per the instructions above and that you have SAML metadata (generated by CAS) in the /etc/cas/saml folder. Run the `fingerprint_idp.sh` script (found in gitlab folder) and replace the fingerprint in `gitlab.rb` on the line that looks like: "idp_cert_fingerprint" => '71:ED:B7:CC:92:1E:B6:D7:80:33:6D:E3:D8:0B:E1:81:34:D7:58:2D', Gitlab needs that fingerprint in order to verify that the SAML response it receives was signed with the correct identity provider. The SAML protocol requires signed responses because the SAML responses may travel through the browser where they could be manipulated were they not signed. ### Gitlab Login The Gitlab you are running should prompt you to set a password the first time you browse to it (`https://localhost:8444/`). The admin username is `root` and the password is whatever you choose. After you set a root password, on the Login page you should have tabs for LDAP and Standard. If the LDAP container is running you should be able to login as `casuser/password` on the LDAP tab and `root` on the Standard tab. ### Gitlab - Starting Over If you ever feel the need to start over with your local gitlab (e.g. you forgot your root password), do a `docker stop gitlab` and `docker rm gitlab` to remove the container and then clean up the mapped in data folders or docker volumes. The windows script uses a docker volume that you can delete with `docker volume rm gitlab-data`. HAProxy Container Setup ----------------------- Why HAProxy? It’s more realistic that applications will be behind a reverse proxy and in this exercise it allows everything to be accessible behind the standard HTTPS port (even though CAS and Gitlab are listening on different ports). Could this be done without HAProxy? Yes, but having a proxy better simulates a real deployment. It also means that when dealing with SSL trust, we only have to worry about the certificate on HAProxy and not the ones used by CAS and Gitlab. HAProxy can be started as a container by running the scripts in the CAS overlay [github.com/hdeadman/cas-overlay-template](https://github.com/hdeadman/cas-overlay-template) fork on a [gitlab-demo](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo) branch in a [docker/haproxy](https://github.com/hdeadman/cas-overlay-template/tree/gitlab-demo/docker/haproxy) folder. The `haproxy` container is configured to listen on port 443 using a certificate that is already checked-in (`site.pem`). The script to generate the key & cert with `openssl` is in the `docker/haproxy` folder. The container is also configured with a statistics port and you should be able to browse to `http://localhost:1936/haproxy?stats` to see whether the CAS and Gitlab backends are accessible. The statistics login is `admin/password`. SAML Gitlab Service Provider Configuration in CAS ------------------------------------------------- With SAML authentication, the Identity Provider and the Service Provider need to exchange metadata. In this case the Service Provder is Gitlab and it really just needs a URL from CAS and the fingerprint of the signing certificate CAS uses. Gitlab provides a URL that will return Gitlab’s SAML service provider metadata. (See Gitlab’s SAML configuration [documentation](https://docs.gitlab.com/ee/integration/saml.html) ) https://localhost:8444/users/auth/saml/metadata Note that if you browse to that in Firefox, be sure to “view source” before copying the XML because the displayed XML doesn’t show the namespace declarations and CAS won’t be happy without them. Use curl to be safe (e.g. from Git Bash on Windows): curl -k https://localhost:8444/users/auth/saml/metadata -o gitlab_sp.xml The service provider metadata XML looks something like this: urn:oasis:names:tc:SAML:2.0:nameid-format:transient Required attributes Put that XML in a file called `gitlab_sp.xml` and store it in the `/etc/cas/saml` folder along with your SAML IDP metadata (because the folder is already there). Add the following entry to `cas.properties` in your overlay: cas.samlSp.gitlab.metadata=file:/etc/cas/saml/gitlab_sp.xml That property relies on some built-in support CAS has for Gitlab as a service provider and it requires the `cas-server-support-saml-sp-integrations` module already added to build.gradle which also supports [many other applications](https://apereo.github.io/cas/development/configuration/Configuration-Properties.html#saml-sps) . Copy the configuration and re-start CAS to get it to pick up the change: gradlew copyCasConfiguration gradlew run When CAS starts up it will use information in the service provider metadata to generate a CAS service definition for Gitlab in the JSON service provider repository located at `/etc/cas/services`. During the course of the Gitlab/CAS/SAML login progress, CAS will make an HTTPS callback through HAProxy and it will do so through https://example.org/. The java that is running CAS will need to trust the certificate that HAProxy is using. From the `haproxy` folder containing the `example.org.crt` file, run the following (Must be run as administrator on Windows, assuming JAVA\_HOME set to the same Java 11 that CAS is using.): keytool -importcert -noprompt -cacerts -storepass changeit -file example.org.crt -alias example.org Login to Gitlab Via SAML ------------------------ * If you want to see SAML messages that traverse your browser, use the Chrome browser and install the `"SAML Chrome Panel"` extension from the Chrome store. It will add a SAML tab to the developer tools that will display SAML messages. * Make sure CAS is running along with the Gitlab, LDAP and HAProxy containers. * Browse to `https://example.org/` and arrive at Gitlab Login page. * Click the `"CAS Login"` button and arrive at `https://example.org/cas/login` * Login to CAS as `casuser/password` which CAS will authenticate against LDAP and send identity back to Gitlab via SAML * Arrive at Gitlab logged-in as `casuser`. Finale ------ Hopefully this helped you learn about using CAS’s support for SAML to authenticate to Gitlab and provided enough detail that you could set it up and see it working before setting it up in a real environment. Note: If one were setting up Gitlab behind HAProxy then the haproxy config would need to include a tcp proxy that forwarded SSH traffic to gitlab but HAProxy is certainly capable of doing that: https://jonnyzzz.com/blog/2017/05/24/ssh-haproxy/ [Hal Deadman](https://github.com/hdeadman) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&name=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&title=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F18%2Fcas61-saml2-idp-gitlab%2F&t=Apereo+CAS+-+SAML2+Identity+Provider+Integration+w%2F+Gitlab+%28also+starting+HAProxy+and+LDAP%29 "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC6 Feature Release – Apereo Community Blog CAS 6.1.0 RC6 Feature Release ============================= Friday, Oct 4, 2019 3 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **sixth** release candidate in the `6.1.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2019/09/02/610rc5-release/) . * [Get Involved](https://apereo.github.io/2019/10/04/610rc6-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2019/10/04/610rc6-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2019/10/04/610rc6-release/#resources) * [Overlay](https://apereo.github.io/2019/10/04/610rc6-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2019/10/04/610rc6-release/#new--noteworthy) * [Registered Service Expiration Policy](https://apereo.github.io/2019/10/04/610rc6-release/#registered-service-expiration-policy) * [Password Reset Notification via REST](https://apereo.github.io/2019/10/04/610rc6-release/#password-reset-notification-via-rest) * [Groovy WS-Federation Claims](https://apereo.github.io/2019/10/04/610rc6-release/#groovy-ws-federation-claims) * [Oracle JDBC Driver](https://apereo.github.io/2019/10/04/610rc6-release/#oracle-jdbc-driver) * [Other Stuff](https://apereo.github.io/2019/10/04/610rc6-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/10/04/610rc6-release/#library-upgrades) * [Credits](https://apereo.github.io/2019/10/04/610rc6-release/#credits) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC6 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### Registered Service Expiration Policy Services in the registry that are [deemed expired](https://apereo.github.io/cas/development/services/Configuring-Service-Expiration-Policy.html) can now send a notification out to contacts separately from removal notifications. ### Password Reset Notification via REST Password reset URLs can now be [sent via SMS text messages](https://apereo.github.io/cas/development/password_management/Password-Management.html) as well as email. ### Groovy WS-Federation Claims Claims released to WS-Federation relying parties can now be mapped using [inline and external Groovy scripts](https://apereo.github.io/cas/development/protocol/WS-Federation-Protocol.html) . ### Oracle JDBC Driver The [Oracle JDBC Driver](https://apereo.github.io/cas/development/installation/JDBC-Drivers.html) is now available as part of Maven Central and is available to CAS automatically when configured. Other Stuff ----------- * Added Travis CI smoke tests for embedded application servers (tomcat, jetty, undertow) that run CAS. * Added script to semi-automate the CAS release process. * Additional test categories to for JDBC and ActiveMQ are now included in Travis CI. * Added additional settings to control SAML2 assertion conditions produced by WS-FED. * Small number of improvements to OAuth and OIDC functionality around scope management and attribute release. * Bug fixes to properly execute the single logout sequence for WS-FED relying parties. * Small number of improvements to the CAS command-line shell. * Groovy scripts can now be loaded from the classpath. * When using the OAUTH PKCE flow, `client_secret` parameters are forcibly validated. * YAML file name formats are corrected when using the YAML service registry. * A few small bug fixes to the authentication engine regarding construction and behavior of authentication policies. Library Upgrades ---------------- * Spring * Spring Boot * Eureka * Twilio * Lombok * Apache Tomcat * SemVer * Apache Syncope * JavaParser * OpenSAML * Amazon SDK * Google Maps * TextMagic * BouncyCastle * Hibernate * Insepktr * HikariCP * MariaDb Driver * Gradle * PostgreSQL Driver * Spring Data * Spring Security * Jackson Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC6+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&title=CAS+6.1.0+RC6+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&title=CAS+6.1.0+RC6+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&name=CAS+6.1.0+RC6+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&title=CAS+6.1.0+RC6+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&title=CAS+6.1.0+RC6+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F10%2F04%2F610rc6-release%2F&t=CAS+6.1.0+RC6+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.0 RC1 Feature Release – Apereo Community Blog CAS 6.2.0 RC1 Feature Release ============================= Friday, Nov 29, 2019 5 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.1.0` GA was released in [October 2019](https://github.com/apereo/cas/releases) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.2.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **first** release candidate in the `6.2.0` series. * [Apereo Membership](https://apereo.github.io/2019/11/29/620rc1-release/#apereo-membership) * [Get Involved](https://apereo.github.io/2019/11/29/620rc1-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2019/11/29/620rc1-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2019/11/29/620rc1-release/#resources) * [Overlay](https://apereo.github.io/2019/11/29/620rc1-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2019/11/29/620rc1-release/#new--noteworthy) * [Service Redirection URLs](https://apereo.github.io/2019/11/29/620rc1-release/#service-redirection-urls) * [Google Apps Integration](https://apereo.github.io/2019/11/29/620rc1-release/#google-apps-integration) * [LDAP Health Monitoring](https://apereo.github.io/2019/11/29/620rc1-release/#ldap-health-monitoring) * [SAML2 Identity Provider Discovery](https://apereo.github.io/2019/11/29/620rc1-release/#saml2-identity-provider-discovery) * [Spring Expression Language Support](https://apereo.github.io/2019/11/29/620rc1-release/#spring-expression-language-support) * [OAuth JWT Access Tokens](https://apereo.github.io/2019/11/29/620rc1-release/#oauth-jwt-access-tokens) * [Cipher Strategy Types](https://apereo.github.io/2019/11/29/620rc1-release/#cipher-strategy-types) * [Microsoft Azure Active Directory](https://apereo.github.io/2019/11/29/620rc1-release/#microsoft-azure-active-directory) * [SAML2 Metadata Per Service](https://apereo.github.io/2019/11/29/620rc1-release/#saml2-metadata-per-service) * [Other Stuff](https://apereo.github.io/2019/11/29/620rc1-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/11/29/620rc1-release/#library-upgrades) * [Credits](https://apereo.github.io/2019/11/29/620rc1-release/#credits) Apereo Membership ----------------- If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: cas.version=6.2.0-RC1 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### Service Redirection URLs The redirect URL of authentication responses can now be [customized and overridden](https://apereo.github.io/cas/development/services/Service-Management.html#registered-services) for each registered application. ### Google Apps Integration The [CAS integration with Google Apps](https://apereo.github.io/cas/development/integration/Google-Apps-Integration.html) is now deprecated, scheduled to be removed in the future. ### LDAP Health Monitoring Monitoring [LDAP server status](https://apereo.github.io/cas/development/monitoring/Configuring-Monitoring.html#ldap) for health can now support multiple LDAP servers. **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust your settings accordingly to refer to `cas.monitor.ldap[0]` instead. ### SAML2 Identity Provider Discovery Carry-over from CAS `6.1.x`, [SAML2 identity provider discovery](https://apereo.github.io/cas/development/integration/Delegate-Authentication-SAML.html) allows CAS to embed and present a discovery service as part of delegated authentication. ### Spring Expression Language Support Certain number of components in CAS, primarily attribute release policies that are script-based, are now configurable based on the [Spring Expression Language](https://apereo.github.io/cas/development/installation/Configuring-Spring-Expressions.html) syntax. ### OAuth JWT Access Tokens A dedicated setting is now available to create [OAuth access tokens as JWTs](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html#jwt-access-tokens) by default, globally for all applications. ### Cipher Strategy Types Relevant cipher operations in CAS can now define the [cipher strategy and type](https://apereo.github.io/cas/development/configuration/Configuration-Properties-Common.html#signing--encryption) , mainly to indicate the order of signing and encryption operations. ### Microsoft Azure Active Directory CAS is now able to contruct attribute repositories to fetch user attributes and properties from Microsoft Azure Active Directory using the Microsoft Graph API. ### SAML2 Metadata Per Service [SAML2 service definitions](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) can now provide an override for the signing key algorithm used. Furthermore, metadata artifacts and keys/certificates may also be specified as overrides on a per-service basis for all metadata storage services. This continues to be a work-in-progress and will likely be further enhanced in future releases. Furthermore, SAML2 metadata documents and artifacts can now be correctly stored in Oracle databases. Other Stuff ----------- * The Gradle build is now able to enforce and verify licenses that are approved by the Apereo Foundation. * SAML2 metadata caching is switched to use the metadata file location as the cache key. * Additional test cases for JDBC password history management against PostgreSQL. * The `fields` property has been removed from LinkedIn delegated authentication. * Minor tweaks to ensure U2F configuration can correctly be processed on CAS startup. * Transaction management is now enforced when using JDBC-backed password management. * CAS Continuous Integration tests on Travis CI now include support for Apache ZooKeeper. * Additional test cases for JDBC SAML2 metadata management based on Oracle, MySQL and PostgreSQL databases. * CAS `simple-mfa` multifactor integration is now enforcing token ownership for the authenticated user. * Internal cleanup to ensure duplicate test configurations are removed for CAS tests. * Replicating session information backed by CAS ticket registry can now detect sessions using a configurable cookie. * Acting as a mini firewall, CAS can now reject authentication requests from suspicious URLs via [a regular expression pattern](https://apereo.github.io/cas/development/configuration/Configuration-Properties.html#http-web-requests) . Library Upgrades ---------------- * Gradle * Apache Cassandra * TextMagic * JavaParser * Spring * Spring Security * JavaParser * Spring Integration * Spring Data * Pac4j * Twilio * Hibernate * Shiro * Apache Tomcat * Hazelcast * SonarQube * Oshi * Eureka * Spring Boot * Nimbus Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&title=CAS+6.2.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&title=CAS+6.2.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&name=CAS+6.2.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&title=CAS+6.2.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&title=CAS+6.2.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F11%2F29%2F620rc1-release%2F&t=CAS+6.2.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.0.0 RC3 Feature Release – Apereo Community Blog CAS 6.0.0 RC3 Feature Release ============================= Friday, Oct 26, 2018 6 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.3.0` GA was released on [June 29th, 2018](https://github.com/apereo/cas/releases/tag/v5.3.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.0.0`. Note that this is a **major release** of the CAS software which _may_ present significant changes in architecture, configuration or behavior. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **third** release candidate in the `6.0.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2018/09/14/600rc2-release/) . Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.0.0-RC3 Changes ------- * [New & Noteworthy](https://apereo.github.io/2018/10/26/600rc3-release/#new--noteworthy) * [JDK 11](https://apereo.github.io/2018/10/26/600rc3-release/#jdk-11) * [CouchDb Support](https://apereo.github.io/2018/10/26/600rc3-release/#couchdb-support) * [SAML2 IdP Single Logout](https://apereo.github.io/2018/10/26/600rc3-release/#saml2-idp-single-logout) * [Delegated AuthN via HiOrg-Server](https://apereo.github.io/2018/10/26/600rc3-release/#delegated-authn-via-hiorg-server) * [SAML2 Encryptable Attributes](https://apereo.github.io/2018/10/26/600rc3-release/#saml2-encryptable-attributes) * [Multifactor Authentication & Duo Security](https://apereo.github.io/2018/10/26/600rc3-release/#multifactor-authentication--duo-security) * [RADIUS Multifactor Authentication](https://apereo.github.io/2018/10/26/600rc3-release/#radius-multifactor-authentication) * [Spring Boot Administration Server](https://apereo.github.io/2018/10/26/600rc3-release/#spring-boot-administration-server) * [SAML2 IdP Metadata via Amazon S3](https://apereo.github.io/2018/10/26/600rc3-release/#saml2-idp-metadata-via-amazon-s3) * [Smaller Stuff](https://apereo.github.io/2018/10/26/600rc3-release/#smaller-stuff) * [Library Upgrades](https://apereo.github.io/2018/10/26/600rc3-release/#library-upgrades) * [Resources](https://apereo.github.io/2018/10/26/600rc3-release/#resources) * [Get Involved](https://apereo.github.io/2018/10/26/600rc3-release/#get-involved) * [Credits](https://apereo.github.io/2018/10/26/600rc3-release/#credits) ### New & Noteworthy #### JDK 11 Starting with this version and continuing the effort from previous releases, CAS requires and builds against JDK 11. [Travis CI](https://travis-ci.org/apereo/cas/builds) has switched over to use OpenJDK 11 to build and publish CAS server `SNAPSHOT` releases, and the entire distribution has also been tested using Oracle JDK 11. **Important changes in Oracle JDK 11 License** With JDK 11 Oracle has updated the license terms on which Oracle JDK is offered. The new Oracle Technology Network License Agreement for Oracle Java SE is substantially different from the licenses under which previous versions of the JDK were offered. **Please review** the new terms carefully before downloading and using this product. Oracle also offers this software under the GPL License on jdk.java.net/11. The key part of the license is as follows: > You may not: use the Programs for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application. So, do NOT download or use the Oracle JDK unless you intend to pay for it. **Use an OpenJDK build instead.** #### CouchDb Support Extensive CouchDb support is now provided by CAS to handle storage concerns when it comes to [ticketing](https://apereo.github.io/cas/development/installation/CouchDB-Ticket-Registry.html) , [authentication](https://apereo.github.io/cas/development/installation/Couchbase-Authentication.html) , [audit and throttling](https://apereo.github.io/cas/development/installation/Audits.html#couchbase-audits) , multifactor authentication, and more. #### SAML2 IdP Single Logout Basic functionality is now included to have CAS submit [SAML2 logout requests](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) to SAML2 service providers, who currently have a registered a session with CAS. This will continue to be a work-in-progress item, to be improved and finalized prior to the final GA release. #### Delegated AuthN via HiOrg-Server [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) is now able to support HiOrg-Server. #### SAML2 Encryptable Attributes Configuration for [SAML2 registered services](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) can now specify attributes that should be optionally included in or excluded from encryption in the final SAML2 response. #### Multifactor Authentication & Duo Security Significant changes in the multifactor authentication API and modules are incorporated in this release to better handle failure modes across all providers. The integration with Duo Security is also greatly improved internally to reduce API noise when it comes to registering multiple Duo configurations with CAS. #### RADIUS Multifactor Authentication RADIUS authentication is now able to honor the `AccessChallenge` response from the radius server, and properly prompt for multifactor authentication. This capability was best tested against [CensorNet’s](https://www.censornet.com/) RADIUS server functionality. #### Spring Boot Administration Server The CAS integration with the [Spring Boot Administration Server](https://apereo.github.io/cas/development/installation/Configuring-Monitoring-Administration.html) is now brought up to speed to be compatible with the latest Spring Boot release. #### SAML2 IdP Metadata via Amazon S3 Metadata artifacts that belong to CAS as a SAML2 identity provider may also be managed and stored via [Amazon S3 buckets](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html#amazon-s3) . ### Smaller Stuff * Additional settings to support _fallback_ principal attributes when dealing with X.509 principal resolution. * Delegated authentication is improved to execute the authentication step only once. * SAML2 delegated authentication is now capable of virtually renaming SAML2 attributes. * Service access strategy for SAML2 service providers and other service types can now handle the `unauthorizedRedirectUrl` setting. * Radius authentication now attempts to also submit the client IP address to the radius server. * Small fixes to the SAML2 callback url pattern construction. * New attribute renderer components are introduced to enhance the CAS v1 validation response, if needed. * CAS internal Gradle build should continue to work against IDEA `2018.3 EAP`. * SAML2 responses can optionally include a `NameID` for `SubjectConfirmation` blocks, on a per-service basis. * SAML2 responses can populate the `Destination` field. * The background job responsible for cleaning trusted expired MFA records is now scheduled correctly on startup. * Attribute resolution via external groovy scripts, handled by [PersonDirectory](https://github.com/apereo/person-directory) , can now properly recognize the engine name. * Hazelcast health monitoring imports its reporting of memory statistics. * Registration of `PrincipalResolver` and `AuditPrincipalIdProvider` is now refactored to use `*Configurer` type of strategies as callbacks. * Loading CAS configuration files is modified to better match Spring Boot behavior. * Performance improvements to HTTP calls and caching of responses. * Small number of dependency fixes that deal with auto configuration of Spring Cloud Config, Spring Cloud Config Bus and Spring Cloud Config Watch. * Detection of the SAML2 SLO url location in metadata is now changed to locate the right binding (See SAML2 SLO support above). * A new setting is now introduced to force CAS to restrict the authentication handler selection via source attached to the credential and provided via the login form. * A new authentication policy is now included to force all authentication handlers to validate the given credential. * The default RADIUS authentication strategy is switched to use the _send-and-receive_ asynchronous model in anticipation of `AccessChallenge` RADIUS server responses. ### Library Upgrades * Spring * Spring Boot * Spring Boot Admin * Hazelcast * OpenSAML * Jackson * Mockito * Spotbugs * Person Directory * Pac4j * Spring Data * Spring Cloud * Amazon SDK * Micrometer * UnboundID * Twilio * Nexmo * Spring Security * Google Maps * Apache Groovy Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.0.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&title=CAS+6.0.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&title=CAS+6.0.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&name=CAS+6.0.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&title=CAS+6.0.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&title=CAS+6.0.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F10%2F26%2F600rc3-release%2F&t=CAS+6.0.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.0 RC5 Feature Release – Apereo Community Blog CAS 6.2.0 RC5 Feature Release ============================= Friday, May 29, 2020 8 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.1.0` GA was released in [October 2019](https://github.com/apereo/cas/releases) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.2.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **fifth** release candidate in the `6.2.0` series. If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2020/04/17/620rc4-release/) . * [Apereo Membership](https://apereo.github.io/2020/05/29/620rc5-release/#apereo-membership) * [Get Involved](https://apereo.github.io/2020/05/29/620rc5-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2020/05/29/620rc5-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2020/05/29/620rc5-release/#resources) * [Overlay](https://apereo.github.io/2020/05/29/620rc5-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2020/05/29/620rc5-release/#new--noteworthy) * [Test Coverage via CodeCov](https://apereo.github.io/2020/05/29/620rc5-release/#test-coverage-via-codecov) * [Couchbase Driver v3](https://apereo.github.io/2020/05/29/620rc5-release/#couchbase-driver-v3) * [Apache Cassandra Driver v4](https://apereo.github.io/2020/05/29/620rc5-release/#apache-cassandra-driver-v4) * [MongoDb Driver v4](https://apereo.github.io/2020/05/29/620rc5-release/#mongodb-driver-v4) * [Passwordless Authentication w/ MongoDb](https://apereo.github.io/2020/05/29/620rc5-release/#passwordless-authentication-w-mongodb) * [Travis CI to GitHub Actions](https://apereo.github.io/2020/05/29/620rc5-release/#travis-ci-to-github-actions) * [Performance Tests](https://apereo.github.io/2020/05/29/620rc5-release/#performance-tests) * [Releasing Encrypted Attributes](https://apereo.github.io/2020/05/29/620rc5-release/#releasing-encrypted-attributes) * [Encryptable Attribute Definitions](https://apereo.github.io/2020/05/29/620rc5-release/#encryptable-attribute-definitions) * [Password Management & reCAPTCHA Integration](https://apereo.github.io/2020/05/29/620rc5-release/#password-management--recaptcha-integration) * [Configuration Syntax](https://apereo.github.io/2020/05/29/620rc5-release/#configuration-syntax) * [Other Stuff](https://apereo.github.io/2020/05/29/620rc5-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2020/05/29/620rc5-release/#library-upgrades) * [Credits](https://apereo.github.io/2020/05/29/620rc5-release/#credits) Apereo Membership ----------------- If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: cas.version=6.2.0-RC5 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### Test Coverage via CodeCov CAS test coverage across all modules in the codebase has now reached `76%` and continues to climb. Additional validation rules are also applied to fail all pull requests that fall below this threshold. This area will be closely monitored and improved as progress is made with the goal of hopefully reaching at least `80%` before the final GA release. Of course, this will not be a blocker for the final release. ### Couchbase Driver v3 Support for Couchbase, as it affects service, ticket, attribute, authentication and audit management in CAS, is now upgraded to use the latest Couchbase Java client. As part of this upgrade, the property namespaces for couchbase are revamped to align with the Couchbase client library. Please review the CAS documentation to see a list of available settings and adjust your changes accordingly. ### Apache Cassandra Driver v4 Support for Apache Cassandra, as it affects service, ticket, and authentication management in CAS, is now upgraded to use the latest Couchbase Java client. As part of this upgrade, the property namespaces for Apache Cassandra are revamped to align with the Cassandra client library. This is made possible via upgrading to the latest Spring Data release. Please review the CAS documentation to see a list of available settings and adjust your changes accordingly. ### MongoDb Driver v4 Upgrades to the latest Spring Data release (`3.0.0.RELEASE`) also bumps the MongoDb integrations in CAS to use the MongoDb driver v4. As part of this upgrade, the property namespaces for MongoDb are revamped to align with the MongoDb client library. Please review the CAS documentation to see a list of available settings and adjust your changes accordingly. ### Passwordless Authentication w/ MongoDb Support for Passwordless Authentication is now extended to MongoDb to locate qualifying accounts and policies. ### Travis CI to GitHub Actions The CAS build and continuous integration environment has now moved off of Travis CI and onto [GitHub Actions](https://github.com/apereo/cas/actions) . The new environment is much more flexible in terms of available hardware resources, number of concurrent jobs and the general configuration and syntax when it comes caching, different versions of JDKs, etc. The new environment also presents CAS builds on three separate platforms for both JDK 11 and JDK 14, allowing the project to continually test new JDK releases as they come out to prepare for platform upgrades in the future. ### Performance Tests Following the move, [GitHub Actions environment](https://github.com/apereo/cas/actions) now includes modest [Locust-based performance tests](https://apereo.github.io/cas/development/high_availability/Performance-Testing-Locust.html) against CAS-provided embedded application servers such as Apache Tomcat, Jetty and Undertow. This is mainly done to validate the Locust setup and configuration that is provided by CAS as dependencies are updated and to allow for basic benchmarks between releases. A similar batch of tests based on [Apache JMeter](https://apereo.github.io/cas/development/high_availability/Performance-Testing-JMeter.html) may be added in the future. ### Releasing Encrypted Attributes A new [attribute release policy](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html) is now available that is able to encrypt and encode allowed attributes using the public key assigned to the registered service definition. ### Encryptable Attribute Definitions Similar to the above item, [attribute definitions](https://apereo.github.io/cas/development/integration/Attribute-Definitions.html) can also be marked as encryptable so they can be ciphered and encoded using the public key assigned to the registered service definition. ### Password Management & reCAPTCHA Integration The [password management](https://apereo.github.io/cas/development/password_management/Password-Management.html) facility in CAS is now able to \[optionally\] integrate with Google reCAPTCHA for password reset requests. reCAPTCHA must be specified in CAS properties, and the password management component should be taught to turn on the integration via the `enable-captcha` property. ### Configuration Syntax CAS properties, as managed by Spring Boot and Spring Cloud, can be specified using a _relaxed_ binding in a variety of formats such as: # Kebab Case (Recommended) cas.my-project.person.first-name=... # Camel Case cas.myProject.person.firstName=... # Underscore Case cas.my_project.person.first_name=... # Upper Case CAS_MYPROJECT_PERSON_FIRSTNAME=... While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc. The general recommendation is this: > When possible, properties should be stored in lower-case kebab format, such as cas.property-name=value. Most if not all CAS properties in the reference documentation are updated to use and show this format. While we do not anticipate this to be a breaking change for upgrades, we do recommend that you stick to the format outlined above and change syntax where appropriate, specially to allow proper activation of components and features whose behavior is controlled via `@ConditionalOnProperty`. As an example, your old confguration might look like: # cas.serviceRegistry.initFromJson=true # cas.serviceRegistry.json.location=file:/etc/cas/config/services # cas.authn.mfa.duo[0].duoSecretKey=... # cas.authn.mfa.duo[0].duoApplicationKey=... # cas.authn.mfa.duo[0].duoIntegrationKey=... # cas.authn.mfa.duo[0].duoApiHost=... Following the above recommendation, your configuration is preferred to be: # cas.service-registry.init-from-json=true # cas.service-registry.json.location=file:/etc/cas/config/services # cas.authn.mfa.duo[0].duo-secret-key=... # cas.authn.mfa.duo[0].duo-application-key=... # cas.authn.mfa.duo[0].duo-integration-key=... # cas.authn.mfa.duo[0].duo-api-host=... Other Stuff ----------- * Configuration of Redis Pooling is now conditionally activated using an `enabled` property. * Configuration settings for Google Authenticator can now be refreshed and reloaded. * Person Directory is now able to properly resolve and understand binary attributes from LDAP/AD directories. * Delegated authentication is now able to auto-configure the cookie path used for session distribution. * Loaded database drivers are now properly shutdown once the CAS web application context is destroyed. * CAS overlay is updated to use the latest Gradle and Spring Boot version. * A comprehensive effort to ensure all LDAP-related components properly clean up and close connection factories. Library Upgrades ---------------- * SpotBugs * MongoDb Driver * Amazon SDK * H2 Driver * Spring Boot * Spring Security * Spring Integration * InfluxDb * HikariCP * Gradle * Couchbase Java Client * MongoDb Java Client * Dom4j * Yubico U2F Server * Checkstyle * Person Directory * Spring Boot * Hibernate * Infinispan * Nimbus * Guava * Pac4j * Spring Session * jQuery Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.0+RC5+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&title=CAS+6.2.0+RC5+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&title=CAS+6.2.0+RC5+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&name=CAS+6.2.0+RC5+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&title=CAS+6.2.0+RC5+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&title=CAS+6.2.0+RC5+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F05%2F29%2F620rc5-release%2F&t=CAS+6.2.0+RC5+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.0 RC3 Feature Release – Apereo Community Blog CAS 6.2.0 RC3 Feature Release ============================= Tuesday, Mar 3, 2020 7 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.1.0` GA was released in [October 2019](https://github.com/apereo/cas/releases) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.2.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **third** release candidate in the `6.2.0` series. If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2019/12/27/620rc2-release/) . * [Apereo Membership](https://apereo.github.io/2020/03/03/620rc3-release/#apereo-membership) * [Get Involved](https://apereo.github.io/2020/03/03/620rc3-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2020/03/03/620rc3-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2020/03/03/620rc3-release/#resources) * [Overlay](https://apereo.github.io/2020/03/03/620rc3-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2020/03/03/620rc3-release/#new--noteworthy) * [CAS Overlay](https://apereo.github.io/2020/03/03/620rc3-release/#cas-overlay) * [Passwordless Authentication](https://apereo.github.io/2020/03/03/620rc3-release/#passwordless-authentication) * [WebAuthn Support](https://apereo.github.io/2020/03/03/620rc3-release/#webauthn-support) * [Groovy Multifactor Authentication Trigger Per Service](https://apereo.github.io/2020/03/03/620rc3-release/#groovy-multifactor-authentication-trigger-per-service) * [Google Apps Integration](https://apereo.github.io/2020/03/03/620rc3-release/#google-apps-integration) * [Open ID Protocol](https://apereo.github.io/2020/03/03/620rc3-release/#open-id-protocol) * [Not-So Passwordless Authentication](https://apereo.github.io/2020/03/03/620rc3-release/#not-so-passwordless-authentication) * [Attribute Definitions Store](https://apereo.github.io/2020/03/03/620rc3-release/#attribute-definitions-store) * [Material Design](https://apereo.github.io/2020/03/03/620rc3-release/#material-design) * [Multifactor Authentication Bypass](https://apereo.github.io/2020/03/03/620rc3-release/#multifactor-authentication-bypass) * [Hazelcast v4](https://apereo.github.io/2020/03/03/620rc3-release/#hazelcast-v4) * [Passwordless Authentication Integrations](https://apereo.github.io/2020/03/03/620rc3-release/#passwordless-authentication-integrations) * [Spring Cloud Configuration via REST](https://apereo.github.io/2020/03/03/620rc3-release/#spring-cloud-configuration-via-rest) * [Thymeleaf Views](https://apereo.github.io/2020/03/03/620rc3-release/#thymeleaf-views) * [Other Stuff](https://apereo.github.io/2020/03/03/620rc3-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2020/03/03/620rc3-release/#library-upgrades) * [Credits](https://apereo.github.io/2020/03/03/620rc3-release/#credits) Apereo Membership ----------------- If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: cas.version=6.2.0-RC3 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### CAS Overlay The `bootRun` Gradle build task is now restored and made functional for the [CAS overlay](https://github.com/apereo/cas-overlay-template) . ### Passwordless Authentication [Passwordless Authentication](https://apereo.github.io/cas/development/installation/Passwordless-Authentication.html) is now broken down to dedicated modules for LDAP, JPA, etc to handle user and/or token management. ### WebAuthn Support Initial baseline work on [WebAuthn Support](https://webauthn.io/) has begun, and while the changes are still in progress and have not landed in the codebase yet, there is a fair amount of progress made to make WebAuthn available as another form of multifactor authentication in CAS. It is expected for this feature to finalize before the final GA release. ### Groovy Multifactor Authentication Trigger Per Service A more advanced and easier-to-configure multifactor authentication is now available in form of a [Groovy script](https://apereo.github.io/cas/development/mfa/Configuring-Multifactor-Authentication-Triggers.html#groovy-per-application) to determine the multifactor authentication policy for a registered service. The old strategy using the `GroovyRegisteredServiceMultifactorPolicy` is now deprecated and will be removed in future releases. ### Google Apps Integration Integration with [Google Apps](https://apereo.github.io/cas/development/integration/Google-Apps-Integration.html) is now deprecated and scheduled to be removed in future releases. ### Open ID Protocol The [Open ID](https://apereo.github.io/cas/development/protocol/OpenID-Protocol.html) protocol is now deprecated and scheduled to be removed in future releases. ### Not-So Passwordless Authentication [Passwordless Authentication](https://apereo.github.io/cas/development/installation/Passwordless-Authentication.html) can now conditionally skip the normal passwordless flow and fallback onto the usual cas authentication flow, challenging the user for a password. ### Attribute Definitions Store [Attribute definitions](https://apereo.github.io/cas/development/integration/Attribute-Definitions.html) can now be defined centrally with additional metadata relevant for each protocol. ### Material Design Thymeleaf templates and all other CAS views in general are transformed to use Material Design. ![cas-login](https://user-images.githubusercontent.com/506821/74975849-f4a00c80-53e4-11ea-9be5-d29096093b2d.png) ![cas-login-success](https://user-images.githubusercontent.com/506821/74975876-fc5fb100-53e4-11ea-8b0b-dd5f421e6c21.png) ![cas-logout-sidebar](https://user-images.githubusercontent.com/506821/74975884-008bce80-53e5-11ea-8ad2-db4db624561e.png) ![cas-duo](https://user-images.githubusercontent.com/506821/74975895-0386bf00-53e5-11ea-9be2-a6126aedd32d.png) ![cas-oidc-confirm](https://user-images.githubusercontent.com/506821/74975903-0681af80-53e5-11ea-9d9a-7b4ae70d3c0a.png) ![cas-error](https://user-images.githubusercontent.com/506821/74975910-097ca000-53e5-11ea-8da7-00c62ec29c17.png) ### Multifactor Authentication Bypass A [new multifactor authentication bypass strategy](https://apereo.github.io/cas/development/mfa/Configuring-Multifactor-Authentication-Bypass.html#bypass-per-principal-attribute--service) is now available, where multifactor bypass can be activated for the registered application if the authenticated principal contains an attribute with the specified value(s). ### Hazelcast v4 The Hazelcast library mainly used a [ticket registry](https://apereo.github.io/cas/development/ticketing/Hazelcast-Ticket-Registry.html) is now upgraded to version 4. Take a look at the [release notes](https://docs.hazelcast.org/docs/rn/index.html#4-0) published by Hazelcast to learn more available features. The upgrade mainly affects the CAS configuration schema for Hazelcast features, specially when it comes to integrations with the Hazelcast management center. ### Passwordless Authentication Integrations [Passwordless Authentication](https://apereo.github.io/cas/development/installation/Passwordless-Authentication.html) can now be combined with multifactor authentication and delegated authentication flows in CAS using standard multifactor triggers that are already available. ### Spring Cloud Configuration via REST The [configuration server](https://apereo.github.io/cas/development/configuration/Configuration-Server-Management.html) available in CAS and backed by Spring Cloud is now also able to fetch CAS settings using a REST API. ### Thymeleaf Views Thymeleaf views and related message bundles are moved onto a new dedicated module for `cas-server-support-thymeleaf` to allow for maximum reuse and modularization. This is purely an internal change and should not affect deployments or overlays. Other Stuff ----------- * Audit actions are given the ability to be excluded from CAS audit logs via configuration. * The `testcas` script is altered to accept more than one test category type. * Bug fix to ensure OAuth’s `state` and `nonce` parameters are returned back to relying parties in their original value. * Small number of fixes to delegated authentication, specially when combined with follow-up multifactor flows. * Additional tests and validations across the codebase modules to try to reach 70% test coverage. * Fixes to the distributed session store facility to better handle logout ops. * Multifactor authentication tests are refactored into their own test category for better parallelism. * The Thymeleaf templating engine is now refactored and extracted from the codebase into its own sepa0rate module. * Token expiration value reported by OAuth/OIDC introspection is now correctly calculated. * Small fixes to expiration policies based on idle timeouts to work nicely with JWT-enabled tickets. * Small UI enhancements to allow _Show Password_ functionality for input fields marked with `type=password`. * Corrections to service resolution strategies when dealing with SAML2 Unsolicited SSO flows. * Small API improvements to CAS Event tracking facilities to allow for filtering of events. * OAuth2 PKCE `code_challenge` is now corrected to use a SHA2 digest. * The hibernate framework is removed as a transitive dependency from modules, preventing it from sneaking out where unnecessary. * Small improvements to delegated authentication to SAML2 identity providers. * Integration with Duo Security for multifactor authentication can now conditionally be enabled/included only when relevant settings are defined. * Small internal improvements to allow the selection strategy of multiple multifactor authentication triggers to support both logical disjunction and conjunction (i.e. `OR` vs `AND`). Library Upgrades ---------------- * Guava * Checkstyle * Nimbus * Amazon SDK * Micrometer * Apache CXF * Commons Codec * Eureka Client * Oshi * Person Directory * Java Melody * Bucket4j * Azure DocumentDb * Apache Tomcat * Hazelcast * Google Maps * Twilio * Spring Data * Spring Integration * Spring Boot * Lombok * Cryptacular * Grouper Client * JUnit * ByteBuddy * Azure KeyVault * Gradle * Groovy Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&title=CAS+6.2.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&title=CAS+6.2.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&name=CAS+6.2.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&title=CAS+6.2.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&title=CAS+6.2.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F03%2F03%2F620rc3-release%2F&t=CAS+6.2.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.0 RC4 Feature Release – Apereo Community Blog CAS 6.2.0 RC4 Feature Release ============================= Friday, Apr 17, 2020 11 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.1.0` GA was released in [October 2019](https://github.com/apereo/cas/releases) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.2.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **fourth** release candidate in the `6.2.0` series. If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2020/03/03/620rc3-release/) . * [Apereo Membership](https://apereo.github.io/2020/04/17/620rc4-release/#apereo-membership) * [Get Involved](https://apereo.github.io/2020/04/17/620rc4-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2020/04/17/620rc4-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2020/04/17/620rc4-release/#resources) * [Overlay](https://apereo.github.io/2020/04/17/620rc4-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2020/04/17/620rc4-release/#new--noteworthy) * [WebAuthn Support](https://apereo.github.io/2020/04/17/620rc4-release/#webauthn-support) * [JPA Implementations](https://apereo.github.io/2020/04/17/620rc4-release/#jpa-implementations) * [SAML2 Metadata Management](https://apereo.github.io/2020/04/17/620rc4-release/#saml2-metadata-management) * [Deprecation of Script Engines](https://apereo.github.io/2020/04/17/620rc4-release/#deprecation-of-script-engines) * [REST Service Registry Entity Mapping](https://apereo.github.io/2020/04/17/620rc4-release/#rest-service-registry-entity-mapping) * [Test Coverage via CodeCov](https://apereo.github.io/2020/04/17/620rc4-release/#test-coverage-via-codecov) * [Global Multifactor Provider Selection Menu](https://apereo.github.io/2020/04/17/620rc4-release/#global-multifactor-provider-selection-menu) * [Webflow Auto configuration](https://apereo.github.io/2020/04/17/620rc4-release/#webflow-auto-configuration) * [Updated Integration Tests](https://apereo.github.io/2020/04/17/620rc4-release/#updated-integration-tests) * [Principal Resolution via Person Directory](https://apereo.github.io/2020/04/17/620rc4-release/#principal-resolution-via-person-directory) * [Acceptable Usage Policy](https://apereo.github.io/2020/04/17/620rc4-release/#acceptable-usage-policy) * [Authentication Policy Per Service](https://apereo.github.io/2020/04/17/620rc4-release/#authentication-policy-per-service) * [SAML2 AssertionConsumerService Handling](https://apereo.github.io/2020/04/17/620rc4-release/#saml2-assertionconsumerservice-handling) * [OAuth / OpenID Connect Token Revocation](https://apereo.github.io/2020/04/17/620rc4-release/#oauth--openid-connect-token-revocation) * [JDK 14 Compatibility](https://apereo.github.io/2020/04/17/620rc4-release/#jdk-14-compatibility) * [OpenSAML v4](https://apereo.github.io/2020/04/17/620rc4-release/#opensaml-v4) * [REST-based Authentication Policy](https://apereo.github.io/2020/04/17/620rc4-release/#rest-based-authentication-policy) * [Multifactor Authentication with Trusted Device](https://apereo.github.io/2020/04/17/620rc4-release/#multifactor-authentication-with-trusted-device) * [OpenID Connect Single Logout](https://apereo.github.io/2020/04/17/620rc4-release/#openid-connect-single-logout) * [OpenID Connect JWKS Configuration](https://apereo.github.io/2020/04/17/620rc4-release/#openid-connect-jwks-configuration) * [Other Stuff](https://apereo.github.io/2020/04/17/620rc4-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2020/04/17/620rc4-release/#library-upgrades) * [Credits](https://apereo.github.io/2020/04/17/620rc4-release/#credits) Apereo Membership ----------------- If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: cas.version=6.2.0-RC4 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### WebAuthn Support [WebAuthn Support](https://webauthn.io/) continues to progress at a slow and steady pace. While the changes are still in progress and have not landed in the codebase yet, there is a fair amount of progress made to make WebAuthn available as another form of multifactor authentication in CAS. It is expected for this feature to finalize before the GA release. ### JPA Implementations The Hibernate framework has always been the default JPA implementation in CAS, and an assumed dependency for most JPA-related modules. In this release candidate, Hibernate support is extracted out into its own module, allowing alternative JPA implementations to be provided at runtime via `JpaBeanFactory` instances. As a result, support is now provided for both Hibernate and EclipseLink while Hibernate continues to be the default. ### SAML2 Metadata Management Managing [SAML2 metadata via REST](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html#rest) is now given the ability to manage identity provider metadata and keys as well, for the CAS server itself globally or a given service definition if necessary. ### Deprecation of Script Engines Support for Script Engines provided by the Java platform is deprecated and scheduled to be removed. Native support for Groovy, independent of the JDK platform continues to be available and a viable choice for scripting options. Support for Ruby has also been removed, while Javascript, Python and Groovy are still available though deprecated as part of the JDK’s `ScriptEngine` capability. ### REST Service Registry Entity Mapping When interacting with an external REST API, instances of `RegisteredServiceEntityMapper` can now be injected into the runtime to translate CAS `RegisteredService` objects back and forth between CAS and APIs. The mapping should simplify the integration, allowing CAS to handle POJO transforms rather than expecting external APIs to be aware of CAS data models and API changes, if any. ### Test Coverage via CodeCov CAS test coverage across all modules in the codebase has now reached `70%` and continues to climb. Additional validation rules are also applied to fail all pull requests that fall below this threshold. This area will be closely monitored and improved as progress is made with the goal of hopefully reaching at least `80%` before the final GA release. Of course, this will not be a blocker for the final release. ### Global Multifactor Provider Selection Menu Multifactor provider selection menus can now be activated using global triggers in addition to activation options using the per-service approach. As an example, users may be allowed to choose between Google Authenticator and CAS SimpleMFA for multifactor, regardless of affiliation, application, etc using `cas.authn.mfa.globalProviderId=mfa-simple,mfa-gauth`. ### Webflow Auto configuration Auto configuration of webflow components that prepare the CAS runtime for multifactor authentication can now be further customized by instances of `CasMultifactorWebflowCustomizer` by other participating or candidate modules to further augment the state of webflow. ### Updated Integration Tests The integration tests executed by the Travis CI environment are updated to run against the following components: * MongoDb `4.2.x` * Apache CouchDb `3.0.x` * Couchbase `6.5.x` * MariaDb `10.5.x` * Postgres `12` * Microsoft SQL Server `2019-CU4-ubuntu-16.04` * Apache Cassandra `3.11.6` ### Principal Resolution via Person Directory Principal resolution handled by Person Directory is now able to pass along query attributes to the underlying attribute repository that contain not only the query identifier as the username, but also principal attributes collected from authentication sources. The collection of attributes can particularly be passed down to Groovy scripts that need to cascade execution of queries. As part of this change, the aggregation of query results when multiple attribute repositories are in use can now also be cascaded across repositories, in additional to the previous and still-default merging approach. Please note that in general, ldap search filters would be better off specifying the attribute name to use in the query (e.g. `{username}`) rather than `{0}` or `{user}`. This allows one to do complex multi-attribute queries as long as you don’t use `{0}` and `{user}`. Additionally, attribute repository sources that are bootstrapped and managed by Person Directory are now marked as `@Conditional` only to picked up and created if the appropriate CAS configuration is defined (LDAP url, database connection strings, etc). ### Acceptable Usage Policy [Acceptable usage policy support](https://apereo.github.io/cas/development/webflow/Webflow-Customization-AUP.html) is given a face-lift to be able to properly load policy terms and text from CAS language bundles, or via external sources such as Groovy or REST APIs. Additionally, policy sources and storage services are now marked as `@Conditional` only to picked up and created if the appropriate CAS configuration is defined (LDAP url, database connection strings, etc). **WATCH OUT!** This may be a breaking change specially if you were using Groovy to manage terms of use decisions. Consult the CAS documentation and adjust your script accordingly to match the manual. ### Authentication Policy Per Service The `required_handlers` field for service definition has been deprecated in favor of `authenticationPolicy`, to allow one to define richer configuration and metadata and instruct the CAS authentication engine more forcefully when it comes to processing application definitions. As of this re-design, authentication policies [can be assigned to service definitions](https://apereo.github.io/cas/development/services/Configuring-Service-AuthN-Policy.html) to override the global defaults. **WATCH OUT!** While the old field is not removed, and CAS should attempt to seamlessly transition old configuration into the new equivalent, it's best to take explicit action and migrate the setting now to the new syntax and format. The `required_handlers`field will be removed at some point in a future CAS version. ### SAML2 AssertionConsumerService Handling An important improvement to the handling of in SAML2 authentication requests to better align the CAS implementation with the SAML2 specification; if the `` is not authenticated and/or integrity protected, the information in it MUST NOT be trusted except as advisory. Whether the request is signed or not, the identity provider MUST ensure that any `` or `` elements in the request are verified as belonging to the service provider to whom the response will be sent. Failure to do so can result in a man-in-the-middle attack. ### OAuth / OpenID Connect Token Revocation A fairly significant change; Token revocation support is now extended supported for both OAuth and OpenID Connect protocols. Additionally, support for public OAuth clients has been added, and refresh token revocation can now revoke all related access tokens. ### JDK 14 Compatibility Now part of [Oracle’s Quality Outreach Program](https://wiki.openjdk.java.net/display/quality/Quality+Outreach) , CAS is able to build and run successfully against the latest versions of JDK 14. The JDK baseline requirement continues to be set at JDK 11, and we are simply keeping up with JDK releases to ensure CAS can correctly switch the baseline requirement when deemed necessary. ### OpenSAML v4 The SAML functionality of the CAS server that handles support for SAML 1.1 and SAML 2 as an identity provider is now upgraded to use OpenSAML v4. Likewise, delegating authentication to external SAML2 identity providers via the Pac4j library has also been upgraded. As a result, a number of dependencies and components in these areas have been cleaned up and removed to make the upgrade possible. ### REST-based Authentication Policy The properties structure for the RESTful authentication policy are revamped slightly to match other REST-based features in CAS. As a result, the authentication policy is now given the ability to support basic authentication. ### Multifactor Authentication with Trusted Device Support for [multifactor authentication with trusted devices](https://apereo.github.io/cas/development/mfa/Multifactor-TrustedDevice-Authentication.html) has improved to allow the user to select the expiration date/time of the device. ![image](https://user-images.githubusercontent.com/1205228/78547105-c3a05d80-7813-11ea-8eb1-4a716b0f7395.png) Records that are used to track devices are also modified to keep track of the device expiration date/time. As a result of this change, the strategy for generating device record keys is altered to make sure records can be successfully tracked, stored and fetched for all storage options. You can restore the old key generation strategy using `cas.authn.mfa.trusted.keyGeneratorType=legacy`. ### OpenID Connect Single Logout Support for OpenID Connect Single Logout based for [back-channel](https://openid.net/specs/openid-connect-backchannel-1_0.html) and [front-channel](https://openid.net/specs/openid-connect-frontchannel-1_0.html) are now made available. Back and front channel logouts are implemented with the use of the session id (which is the SHA of the ticket-granting ticket id). ### OpenID Connect JWKS Configuration JWKS-related settings for OpenID Connect support in CAS are moved to their own configuration namespace under `cas.authn.oidc.jwks`: # cas.authn.oidc.jwks.jwks-file # cas.authn.oidc.jwks.jwks-cache-in-minutes # cas.authn.oidc.jwks.jwks-key-size # cas.authn.oidc.jwks.jwks-type Furthermore, generating and managing the JWKS resource can now be externalized and outsourced to a REST API, while the file-based JWKS strategy continues to be the default. Other Stuff ----------- * Support for `client_secret_basic` authentication is now available for OAuth/OpenID Connect refresh token requests. * Handling of OpenID Connect’s `max_age` request parameters is now corrected. * Italian message bundles are now refreshed to match the latest expected language keys. * CAS discovery profile is now set to correctly produce output in JSON format. * Throttling authentication requests using Bucket4j is now corrected to consume buckets only once. Library Upgrades ---------------- * Spring Security * Twilio * Spring Boot * Hazelcast Azure * Pac4j * Hibernate * Person Directory * Apache Tomcat * Mockito * Spring * JUnit * JavaParser * Okio * Swagger * Oshi * JUnit * Micrometer * Google Authenticator * Amazon SDK * Nimbus * Infinispan * SQLServer Driver * PostgreSQL Driver Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&title=CAS+6.2.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&title=CAS+6.2.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&name=CAS+6.2.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&title=CAS+6.2.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&title=CAS+6.2.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2020%2F04%2F17%2F620rc4-release%2F&t=CAS+6.2.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC2 Feature Release – Apereo Community Blog CAS 6.1.0 RC2 Feature Release ============================= Friday, Mar 1, 2019 4 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **second** release candidate in the `6.1.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2019/02/01/610rc1-release/) . Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC2 **System Requirements** There are no changes to the minimum system/platform requirements for this release. Changes ------- * [New & Noteworthy](https://apereo.github.io/2019/03/01/610rc2-release/#new--noteworthy) * [SAML2 Attribute Value Types](https://apereo.github.io/2019/03/01/610rc2-release/#saml2-attribute-value-types) * [OAuth2 JWT Access Tokens](https://apereo.github.io/2019/03/01/610rc2-release/#oauth2-jwt-access-tokens) * [Groovy Acceptable Usage Policy](https://apereo.github.io/2019/03/01/610rc2-release/#groovy-acceptable-usage-policy) * [OpenID Connect WebFinger](https://apereo.github.io/2019/03/01/610rc2-release/#openid-connect-webfinger) * [Cassandra Ticket Registry](https://apereo.github.io/2019/03/01/610rc2-release/#cassandra-ticket-registry) * [Redis Audit Manager](https://apereo.github.io/2019/03/01/610rc2-release/#redis-audit-manager) * [Custom Login Fields](https://apereo.github.io/2019/03/01/610rc2-release/#custom-login-fields) * [Cassandra Service Registry](https://apereo.github.io/2019/03/01/610rc2-release/#cassandra-service-registry) * [Other Stuff](https://apereo.github.io/2019/03/01/610rc2-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/03/01/610rc2-release/#library-upgrades) * [Resources](https://apereo.github.io/2019/03/01/610rc2-release/#resources) * [Get Involved](https://apereo.github.io/2019/03/01/610rc2-release/#get-involved) * [Credits](https://apereo.github.io/2019/03/01/610rc2-release/#credits) ### New & Noteworthy #### SAML2 Attribute Value Types Attribute values put into a SAML2 response can now carry specific type information if necessary on a per-service basis. Complex attribute values that are formatted as POJO objects are conditionally serialized into their XML representation using Jackson’s `XmlMapper`. [See this](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#saml-services) for more info. #### OAuth2 JWT Access Tokens OAuth or OpenID Connect Access tokens can now be [produced as JWTs](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) on a per-service basis. #### Groovy Acceptable Usage Policy Handling [acceptable usage policy](https://apereo.github.io/cas/development/webflow/Webflow-Customization-AUP.html) decisions can now be managed using a Groovy script. #### OpenID Connect WebFinger Support for OpenID Connect WebFinger Issuer Discovery [is now available](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) . #### Cassandra Ticket Registry As yet another storage option, CAS tickets can now be stored in [Apache Cassandra](https://apereo.github.io/cas/development/ticketing/Cassandra-Ticket-Registry.html) . #### Redis Audit Manager As yet another storage option, CAS audit logs can now be stored in [Redis](https://apereo.github.io/cas/development/installation/Audits.html) . #### Custom Login Fields The CAS login form/view can now accept and bind dynamic [custom fields](https://apereo.github.io/cas/development/ux/User-Interface-Customization-Views.html) to the authentication process where fields are made available to authentication handlers for additional processing. #### Cassandra Service Registry As yet another storage option, CAS registered service definitions can now be stored in [Apache Cassandra](https://apereo.github.io/cas/development/services/Cassandra-Service-Management.html) . ### Other Stuff * Small improvements affect multifactor authentication bypass during validation events. * Health indicators, that report status to the `health` actuator endpoint, can be conditionally enabled via CAS settings. * The process of publishing and releasing CAS has switched to use the `maven-publishing` Gradle plugin. * The `status` actuator endpoint is able to operate partially without the presence of the `health` actuator endpoint. * Fixes to OAuth2 claim release, honoring the attribute release policy for relying parties. * Continued effort to ensure CAS unit/integration tests are upgraded to use the JUnit 5 framework. * Minor documentation fixes regarding Redis-related properties. * OAuth2 scopes in the access token response produced by CAS are now flattened to be more friendly to most OAuth2 clients. * Hazelcast ticket registry bug fix related to object serialization when impersonation is turned on. * Small fixes related to triggering multifactor authentication based on principal attributes. * Attribute release policies for OpenID Connect relying parties can operate without a defined scope. * Adjustments to dependency management to ensure the CAS overlay and the command-line shell remain functional. * CAS audit managers may only record a selection of audit actions, configured in CAS settings. * A number of bug fixes that improve management and handling of impersonation session expiration policies. * Audit logs for OAuth user profile requests attempt to record client identifiers and recipients better. * A new actuator endpoint is available to report back on the availability of [Duo Security](https://apereo.github.io/cas/development/mfa/DuoSecurity-Authentication.html) using its `ping` API. ### Library Upgrades * Gradle * Ribbon * Apache HttpClient * Mockito * Nimbus * Spring Boot * Spring Security * Spring Session * Spring Boot Admin * Apache jClouds * JUnit * Lombok * Twillio * BouncyCastle * Apache Tomcat * MongoDB Driver * MYSQL Driver * Slf4j * MariaDB Driver * MSSQL Driver * Byte-Buddy Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&title=CAS+6.1.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&title=CAS+6.1.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&name=CAS+6.1.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&title=CAS+6.1.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&title=CAS+6.1.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F03%2F01%2F610rc2-release%2F&t=CAS+6.1.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC4 Feature Release – Apereo Community Blog CAS 6.1.0 RC4 Feature Release ============================= Friday, Jun 7, 2019 7 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **fourth** release candidate in the `6.1.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2019/04/29/610rc3-release/) . * [Get Involved](https://apereo.github.io/2019/06/07/610rc4-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2019/06/07/610rc4-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2019/06/07/610rc4-release/#resources) * [Overlay](https://apereo.github.io/2019/06/07/610rc4-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2019/06/07/610rc4-release/#new--noteworthy) * [Required Services for Single SignOn](https://apereo.github.io/2019/06/07/610rc4-release/#required-services-for-single-signon) * [Acceptable Usage Policy Audits](https://apereo.github.io/2019/06/07/610rc4-release/#acceptable-usage-policy-audits) * [Jasypt Configuration Security](https://apereo.github.io/2019/06/07/610rc4-release/#jasypt-configuration-security) * [Multifactor Provider Selection](https://apereo.github.io/2019/06/07/610rc4-release/#multifactor-provider-selection) * [Jasypt Encryption with CAS Commandline Shell](https://apereo.github.io/2019/06/07/610rc4-release/#jasypt-encryption-with-cas-commandline-shell) * [SAML2 Skew Allowance per Service](https://apereo.github.io/2019/06/07/610rc4-release/#saml2-skew-allowance-per-service) * [DynamoDb Audit Logs](https://apereo.github.io/2019/06/07/610rc4-release/#dynamodb-audit-logs) * [Registered Services Actuator Endpoint](https://apereo.github.io/2019/06/07/610rc4-release/#registered-services-actuator-endpoint) * [Acceptto Multifactor Integration](https://apereo.github.io/2019/06/07/610rc4-release/#acceptto-multifactor-integration) * [Java 12 Compatibility](https://apereo.github.io/2019/06/07/610rc4-release/#java-12-compatibility) * [Graal Compiler Compatibility](https://apereo.github.io/2019/06/07/610rc4-release/#graal-compiler-compatibility) * [Dependency Updates via Renovate](https://apereo.github.io/2019/06/07/610rc4-release/#dependency-updates-via-renovate) * [SAML2 Encryption Configuration per Service](https://apereo.github.io/2019/06/07/610rc4-release/#saml2-encryption-configuration-per-service) * [OpenID Connect Dynamic Registration](https://apereo.github.io/2019/06/07/610rc4-release/#openid-connect-dynamic-registration) * [Access Strategy for Delegated Authentication](https://apereo.github.io/2019/06/07/610rc4-release/#access-strategy-for-delegated-authentication) * [SAML2 Signing Configuration per Service](https://apereo.github.io/2019/06/07/610rc4-release/#saml2-signing-configuration-per-service) * [OpenID Connect UserInfo Response Signing & Encryption](https://apereo.github.io/2019/06/07/610rc4-release/#openid-connect-userinfo-response-signing--encryption) * [OAuth Token Expiration Policy](https://apereo.github.io/2019/06/07/610rc4-release/#oauth-token-expiration-policy) * [Redis Authentication Throttling](https://apereo.github.io/2019/06/07/610rc4-release/#redis-authentication-throttling) * [OpenID Connect Discovery Response](https://apereo.github.io/2019/06/07/610rc4-release/#openid-connect-discovery-response) * [CAS Docker Deployments](https://apereo.github.io/2019/06/07/610rc4-release/#cas-docker-deployments) * [Other Stuff](https://apereo.github.io/2019/06/07/610rc4-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/06/07/610rc4-release/#library-upgrades) * [Credits](https://apereo.github.io/2019/06/07/610rc4-release/#credits) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC4 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### Required Services for Single SignOn CAS may be configured to require the user to authenticate from an application before access can be granted to all other registered services. [See this](https://apereo.github.io/cas/development/installation/Configuring-SSO-Session-Cookie.html) for more info. ### Acceptable Usage Policy Audits Acceptable Usage Policy choices and results are now passed to the [Audit Log](https://apereo.github.io/cas/development/installation/Audits.html) . ### Jasypt Configuration Security **WATCH OUT!** This is a breaking change. You will need to make sure relevant configuration values are updated to remain functional. Configuration properties secured and encrypted via Jasypt are required to be prefixed with `{cas-cipher}` instead of `{cipher}` so as to avoid conflicts with Spring Cloud way of encrypting and decrypting values. ### Multifactor Provider Selection In the event that more than [multifactor authentication provider](https://apereo.github.io/cas/development/mfa/Configuring-Multifactor-Authentication.html) qualifies to satisfy the authentication request, CAS may be configured to present a choice and menu to the user where one would interactively pick the provider that works best at a given time. This mode is off by default, and complements existing selection strategies that are based on ranking strategies and weights or custom logic implemented in Groovy scripts, etc. ### Jasypt Encryption with CAS Commandline Shell A new `decrypt-value` command is added to [CAS Commandline Shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) to verify encrypted values. ### SAML2 Skew Allowance per Service SAML2 registered services can now define a `skew-allowance` value in seconds used to skew dates in the final response, such as valid-from, issue-instant, etc. ### DynamoDb Audit Logs Audit data can now be routed to and stored in [DynamoDb](https://apereo.github.io/cas/development/installation/Audits.html#dynamodb-audits) . ### Registered Services Actuator Endpoint The `registeredServices` actuator endpoint gains a `DELETE` operation to remove registered services from CAS. ### Acceptto Multifactor Integration [Acceptto](https://apereo.github.io/cas/development/mfa/Acceptto-Authentication.html) is now supported as a CAS multifactor authentication provider. The integration adds support for both multifactor authentication and QR login codes. ### Java 12 Compatibility Though not required, CAS is able to build and run successfully against the latest versions of JDK 12. ### Graal Compiler Compatibility Additional tests are carried out to ensure CAS can remain functional while running with the Graal Compiler. If you’d like to experiment with this to gain possible performance improvements, start your CAS deployment with the following VM options: * `-XX:+UnlockExperimentalVMOptions` * `-XX:+EnableJVMCI` * `-XX:+UseJVMCICompiler` ### Dependency Updates via Renovate The process of updating CAS dependencies is somewhat automated through Travis CI, taking advantage of the [renovate bot](https://github.com/renovatebot) . ### SAML2 Encryption Configuration per Service CAS, running as a [SAML2 identity provider](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#name-id-selection) , gains a few extra settings to control and override the encryption configuration of objects on a per service provider. Services can also be tagged to consider encryption as optional in case compatible keys are not found in the service provider metadata. ### OpenID Connect Dynamic Registration Many incremental improvements to support OpenID Connect dynamic registration of RPs with richer metadata in the registration request, such as handling of `policy_uri`, `tos_uri`, `logo_uri`, etc. ### Access Strategy for Delegated Authentication The access strategy for delegated authentication events can now enforce the collection of allowed providers even in the presence of an existing single signon session. The strategy also gains an _exclusive_ mode to limit the authentication methods to only those providers allowed. ### SAML2 Signing Configuration per Service CAS, running as a [SAML2 identity provider](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#name-id-selection) , gains a few extra settings to control and override the signing configuration of objects on a per service provider. Additional documentation improvements are also available in this space to provide more examples for signing configuration, name id selection, etc. ### OpenID Connect UserInfo Response Signing & Encryption User profiles produced by CAS as an OpenID Connect Provider can now optionally be signed and/or encrypted on a per-relying party basis. This capability may also be defined during dynamic registration of a relying party. ### OAuth Token Expiration Policy The expiration policy of OAuth tokens (code, access token, etc) can now conditionally be defined on a per relying-party basis, when CAS is running as an [OAuth identity provider](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) . ### Redis Authentication Throttling Audit logs could certainly be stored in Redis databases; in this release candidate, the same database could also be used for [throttling authentication attempts](https://apereo.github.io/cas/development/installation/Configuring-Authentication-Throttling.html) . ### OpenID Connect Discovery Response The OpenID Connect Discovery Response is beefed up a bit to outline all supported modes and values when it comes to signing and encryption of tokens, as well as handling and management of subject types, display values, etc. ### CAS Docker Deployments In addition to the `jib` plugin built into the CAS overlay to produce docker images, the overlay project now also presents a `Dockerfile` with some additional notes to build a CAS image via native Docker tooling. The build script is optimized slightly to take advantage of multi-stage builds and leaner `alpine` base images. The [CAS Docker repository](https://github.com/apereo/cas-webapp-docker) is now deprecated and archived Other Stuff ----------- * Assigning identifiers to registered services is modified to not produce negative numeric ids. * Password policy warning messages should now be recognized by Memcached and the Kryo serialization engine. * Trivial fix to CAS commandline shell ensure the runtime can recognize CAS configuration settings internally. * Password management functionality is correct to properly pass along the policy patten into webflow. * Hazelcast integrations with CAS can now be connected to the Hazelcast management center via additional settings. * The Google Analytics cookie gains an extra setting to filter out attributes values before they are put into the cookie. * WebJARs included in CAS to provide jQuery and other JS libraries are modified to exclude unwanted transitive dependencies. Library Upgrades ---------------- * OpenSAML * JavaParser * Oshi * Spring * MongoDb Driver * Ribbon * Spring Boot * Lombok * Spring Data * Apache Tomcat * Jetty * Twilio * Groovy * Jackson * Spring Data MongoDb Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&title=CAS+6.1.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&title=CAS+6.1.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&name=CAS+6.1.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&title=CAS+6.1.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&title=CAS+6.1.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F06%2F07%2F610rc4-release%2F&t=CAS+6.1.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.0.0 RC2 Feature Release – Apereo Community Blog CAS 6.0.0 RC2 Feature Release ============================= Friday, Sep 14, 2018 5 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.3.0` GA was released on [June 29th, 2018](https://github.com/apereo/cas/releases/tag/v5.3.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.0.0`. Note that this is a **major release** of the CAS software which _may_ present significant changes in architecture, configuration or behavior. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **second** release candidate in the `6.0.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2018/08/03/600rc1-release/) . Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.0.0-RC2 Changes ------- * [New & Noteworthy](https://apereo.github.io/2018/09/14/600rc2-release/#new--noteworthy) * [JDK 10](https://apereo.github.io/2018/09/14/600rc2-release/#jdk-10) * [WAR Overlay](https://apereo.github.io/2018/09/14/600rc2-release/#war-overlay) * [OAuth2 UMA](https://apereo.github.io/2018/09/14/600rc2-release/#oauth2-uma) * [Authentication Source Selection](https://apereo.github.io/2018/09/14/600rc2-release/#authentication-source-selection) * [Forgot Username](https://apereo.github.io/2018/09/14/600rc2-release/#forgot-username) * [OAuth2 Token Management](https://apereo.github.io/2018/09/14/600rc2-release/#oauth2-token-management) * [Hazelcast Discovery Strategies](https://apereo.github.io/2018/09/14/600rc2-release/#hazelcast-discovery-strategies) * [Small Stuff](https://apereo.github.io/2018/09/14/600rc2-release/#small-stuff) * [Library Upgrades](https://apereo.github.io/2018/09/14/600rc2-release/#library-upgrades) * [Resources](https://apereo.github.io/2018/09/14/600rc2-release/#resources) * [Get Involved](https://apereo.github.io/2018/09/14/600rc2-release/#get-involved) * [Credits](https://apereo.github.io/2018/09/14/600rc2-release/#credits) ### New & Noteworthy #### JDK 10 Work continues to ensure CAS can support and build on top of JDK 11. At this time, a number of supporting libraries that handle code generation, test coverage and static analysis are not quite ready for JDK 11, and a few more foundational frameworks such as Spring and Spring Boot have yet to be upgraded to a release friendly to JDK 11. In this release, the JDK requirement continues to stay at `10` with the _hopes_ that said core components would be ready for JDK 11 around the time of the next release candidate. Note that this release candidate builds on top of Spring framework `5.1` and Spring Boot `2.1`. The upgrade should provide improvements for CAS startup time and be ready in anticipation of the upcoming JDK `11` release. #### WAR Overlay The Maven WAR overlay template is now deprecated and moved aside. The reference overlay project simply resides [here](https://github.com/apereo/cas-overlay-template) and is transformed to use the Gradle build tool instead. This is done to reduce maintenance overhead and simplify the deployment strategy while allowing future attempts to make auto-generation of the overlay as comfortable as possible. #### OAuth2 UMA A first pass at OAuth2 User-Managed Access is [now available](https://apereo.github.io/cas/development/protocol/OAuth-UMA-Protocol.html) . This is very much a rough take and will require some fine-tuning and tweaking in future iterations to fully make it spec-compliant and functional. #### Authentication Source Selection In the event that there is more than one (primary) authentication source defined, CAS is given the ability to present the user with a choice in the login screen to select the appropriate credential source before authenticating. This capability can also be automated using credential predicates if a pattern can formulated and linked to a specific authentication source. This variation here is the less-automated way of selecting an authentication source, taking into account user input directly. #### Forgot Username The _Forgot your username?_ scenario is now supported by the CAS password management facility. #### OAuth2 Token Management Specific endpoints are provided as part of [CAS monitoring toolkit](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) to manage and revoke OAuth2 access and refresh tokens. #### Hazelcast Discovery Strategies CAS is now able to take advantage of Kubernetes for [Hazelcast auto discovery of nodes](https://apereo.github.io/cas/development/installation/Hazelcast-Ticket-Registry.html) . Support for discovery strategies based on Docker Swarm is also included and available. ### Small Stuff * Expired registered service definitions are now blocked by CAS as always, but are not strictly modified in the service registry as disabled services. * A ton of improvements to the Travis CI integration tests to ensure performance and compliance. This area continues to improve. * Release of authentication-level attributes, typically those related to protocols or those captured by metadata populators is now controlled via a central policy. * Generation of [CAS configuration metadata](https://apereo.github.io/cas/development/installation/Configuration-Metadata-Repository.html) is massaged to take into account enumerations and nested inner classes. * [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) now attempts to check for SSO status before handing off the request to a provider. * REST API authentication using X509 is now capable of TLS client authentication. * [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) gains the ability to use path variables for client names instead of query parameters, for identity providers such as Azure. * CAS documentation integrates with Angolia for its search capabilities. * [SAML2 support in CAS](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) begins to support encrypted attributes as well as name ids. * Minor bug fixes to database schema handling, log messages, MFA context validation, ticket serialization, and OATH validations. * CAS [OpenID Connect support](https://apereo.github.io/cas/development/protocol/OIDC-Protocol.html) gains a better handle on logout and session management. * OAuth2 grant type selection is now enforced for relying parties, etc. * [Kryo for memcached](https://apereo.github.io/cas/development/installation/Memcached-Ticket-Registry.html) continues to auto-register a few more components, specially with CAS has turned on MFA or delegated authentication. * [Session replication](https://apereo.github.io/cas/development/installation/Webflow-Customization-Sessions.html#jdbc-session-replication) can now be done using a JDBC backend. * [Yaml Service Registry](https://apereo.github.io/cas/development/installation/YAML-Service-Management.html) is able to recognize both `.yml` and `.yaml` files. * [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) to SAML identity providers gains a few bug fixes when resolving SP or IdP metadata over URLs. The service provider metadata generated by CAS can now optionally be signed using metadata signing keys. ### Library Upgrades * Inspektr * Pac4j * Spring * Spring Boot * Spring Security * Spring Security RSA * Spring Data * Spring Session * Spring Cloud * Oshi * ActiveMQ * jClouds * JavaParser * Commons Lang * Commons Configuration * Amazon AWS * Google Maps * UnboundID LDAP * Twilio * Nexmo * Gradle * Nimbus * Apache Tomcat * Hibernate Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.0.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&title=CAS+6.0.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&title=CAS+6.0.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&name=CAS+6.0.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&title=CAS+6.0.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&title=CAS+6.0.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F09%2F14%2F600rc2-release%2F&t=CAS+6.0.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.0.0 RC4 Feature Release – Apereo Community Blog CAS 6.0.0 RC4 Feature Release ============================= Friday, Nov 30, 2018 5 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.3.0` GA was released on [June 29th, 2018](https://github.com/apereo/cas/releases/tag/v5.3.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.0.0`. Note that this is a **major release** of the CAS software which _may_ present significant changes in architecture, configuration or behavior. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **fourth** release candidate in the `6.0.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2018/10/26/600rc3-release/) . Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.0.0-RC4 Changes ------- * [Known Issues](https://apereo.github.io/2018/11/30/600rc4-release/#known-issues) * [New & Noteworthy](https://apereo.github.io/2018/11/30/600rc4-release/#new--noteworthy) * [Actuator Endpoint Ids](https://apereo.github.io/2018/11/30/600rc4-release/#actuator-endpoint-ids) * [SMS via Groovy & REST](https://apereo.github.io/2018/11/30/600rc4-release/#sms-via-groovy--rest) * [Dockerized CAS Overlay](https://apereo.github.io/2018/11/30/600rc4-release/#dockerized-cas-overlay) * [Command-line Shell](https://apereo.github.io/2018/11/30/600rc4-release/#command-line-shell) * [Service Environments](https://apereo.github.io/2018/11/30/600rc4-release/#service-environments) * [reCAPTCHA v3](https://apereo.github.io/2018/11/30/600rc4-release/#recaptcha-v3) * [Bucket4j Integration](https://apereo.github.io/2018/11/30/600rc4-release/#bucket4j-integration) * [Amazon Cognito Authentication](https://apereo.github.io/2018/11/30/600rc4-release/#amazon-cognito-authentication) * [SOAP Authentication](https://apereo.github.io/2018/11/30/600rc4-release/#soap-authentication) * [JDBC Naming Strategy](https://apereo.github.io/2018/11/30/600rc4-release/#jdbc-naming-strategy) * [Consent Review Endpoint](https://apereo.github.io/2018/11/30/600rc4-release/#consent-review-endpoint) * [Small Stuff](https://apereo.github.io/2018/11/30/600rc4-release/#small-stuff) * [Library Upgrades](https://apereo.github.io/2018/11/30/600rc4-release/#library-upgrades) * [Resources](https://apereo.github.io/2018/11/30/600rc4-release/#resources) * [Get Involved](https://apereo.github.io/2018/11/30/600rc4-release/#get-involved) * [Credits](https://apereo.github.io/2018/11/30/600rc4-release/#credits) ### Known Issues The `cas.admin-pages-security.ip` property has been renamed to `cas.monitor.endpoints.endpoint.defaults.access[0]` but due to an issue, a NullPointerException will occur on startup if you use that property (in canonical form or relaxed, etc) rather than pointing at the new property name. Change the property name or don’t use the property in order to avoid the issue. ### New & Noteworthy #### Actuator Endpoint Ids CAS [actuator endpoints](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) are named to be more consistent with Spring Boot guidelines, to remove startup warnings and prevents errors in future upgrades to Spring Boot `2.2.x`. Previous endpoints that were created using _kebab-case_ identifiers such as `spring-webflow` are now switched over to use _camel-case_ instead, such as `springWebflow`. #### SMS via Groovy & REST [Sending SMS messages](https://apereo.github.io/cas/development/installation/SMS-Messaging-Configuration.html) is now also possible via Groovy scripts or a REST API. #### Dockerized CAS Overlay The [CAS WAR Overlay](https://github.com/apereo/cas-overlay-template) is equipped to build Docker images using `jib`. #### Command-line Shell The [CAS Command-line Shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) gets a few upgrades to stay compatible with the most recent changes to the build, as well as a few new commands to generate crypto keys or encrypt/sign data, etc. #### Service Environments Each registered application in the registry may be assigned a set of [environment names](https://apereo.github.io/cas/development/services/Configuring-Service-Environments.html) . #### reCAPTCHA v3 Support for [reCAPTCHA v3](https://apereo.github.io/cas/development/integration/Configuring-Google-reCAPTCHA.html) is now added to CAS. #### Bucket4j Integration Authentication throttling support can now integrate with [Bucket4j](https://apereo.github.io/cas/development/installation/Configuring-Authentication-Throttling.html) to handle capacity throttling for authentication requests. #### Amazon Cognito Authentication CAS is able to leverage [Amazon Cognito](https://apereo.github.io/cas/development/installation/AWS-Cognito-Authentication.html) for authentication. #### SOAP Authentication CAS is able to leverage [SOAP APIs](https://apereo.github.io/cas/development/installation/SOAP-Authentication.html) for authentication. #### JDBC Naming Strategy Additional options are exposed to help remap database _virtual_ table names to logical names either via static settings or Groovy scripts, when database schemas and queries are created. This allows one to translate CAS-provided table names to those that might work better with older or less forgiving database platforms that have restrictions on naming, etc. #### Consent Review Endpoint Reviewing consent decisions is now possible using the new `consentReview` endpoint that acts as a Spring Boot actuator endpoint. ### Small Stuff * Small number of bug fixes to handle authorization correctly for [delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) . * The configuration settings for Spring Cloud configuration modules for MongoDb, DynamoDb, JDBC, etc should properly be recognized by CAS again. * The background job to reload CAS registered service is made conditional to only execute in case a reloadable storage option is registered. * A number of additional test cases for AWS S3 functionality. * Improvements to the crypto algorithm selection used to generate secure random numbers. * CAS configuration can now be recognized via Groovy closures. * Security response headers can support all CAS registered service definition types. * Minor improvements to database attribute fetching and processing of SQL `Array` objects. * CAS configuration watch can operate on both the configuration directory and the standalone _direct_ configuration file. * CAS multifactor authentication via RADIUS gains the ability to enforce a limit on the number of allowed authentication attempts. * Secret keys used for various signing and encryption operations can now properly be recognized via CAS settings. * SAML2 SLO functionality receives a number of improvements to handle various forms of bindings. * CAS configuration properties that are renamed or moved to a new location should be reported on startup when used. * Most if not all custom shell commands used by the CAS overlay are moved into the Gradle build script. * Authentication throttling backed by Hazelcast gains its own independant set of properties. ### Library Upgrades * Spring Boot * Spring * Gradle * Lombok * Micrometer * Spring Integration * Apache Tomcat * Person Directory * CAS Security Filter * Amazon SDK * JUnit * Nexmo * Spring Data Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.0.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&title=CAS+6.0.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&title=CAS+6.0.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&name=CAS+6.0.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&title=CAS+6.0.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&title=CAS+6.0.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F11%2F30%2F600rc4-release%2F&t=CAS+6.0.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.2.0 RC2 Feature Release – Apereo Community Blog CAS 6.2.0 RC2 Feature Release ============================= Friday, Dec 27, 2019 7 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.1.0` GA was released in [October 2019](https://github.com/apereo/cas/releases) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.2.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **second** release candidate in the `6.2.0` series. If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2019/11/29/620rc1-release/) . * [Apereo Membership](https://apereo.github.io/2019/12/27/620rc2-release/#apereo-membership) * [Get Involved](https://apereo.github.io/2019/12/27/620rc2-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2019/12/27/620rc2-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2019/12/27/620rc2-release/#resources) * [Overlay](https://apereo.github.io/2019/12/27/620rc2-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2019/12/27/620rc2-release/#new--noteworthy) * [CAS Overlay](https://apereo.github.io/2019/12/27/620rc2-release/#cas-overlay) * [Okta Authentication](https://apereo.github.io/2019/12/27/620rc2-release/#okta-authentication) * [LDAP Password Management](https://apereo.github.io/2019/12/27/620rc2-release/#ldap-password-management) * [Ehcache v3 Ticket Registry](https://apereo.github.io/2019/12/27/620rc2-release/#ehcache-v3-ticket-registry) * [Configuration Unknown Fields](https://apereo.github.io/2019/12/27/620rc2-release/#configuration-unknown-fields) * [Configuration Validation](https://apereo.github.io/2019/12/27/620rc2-release/#configuration-validation) * [Azure Active Directory Authentication](https://apereo.github.io/2019/12/27/620rc2-release/#azure-active-directory-authentication) * [Ldaptive v2 Upgrade](https://apereo.github.io/2019/12/27/620rc2-release/#ldaptive-v2-upgrade) * [Surrogate Authentication via REST](https://apereo.github.io/2019/12/27/620rc2-release/#surrogate-authentication-via-rest) * [Multifactor Authentication via YubiKey](https://apereo.github.io/2019/12/27/620rc2-release/#multifactor-authentication-via-yubikey) * [Authentication Handler Resolution](https://apereo.github.io/2019/12/27/620rc2-release/#authentication-handler-resolution) * [LDAP Acceptable Usage Policy](https://apereo.github.io/2019/12/27/620rc2-release/#ldap-acceptable-usage-policy) * [YubiKey Device Storage via Redis](https://apereo.github.io/2019/12/27/620rc2-release/#yubikey-device-storage-via-redis) * [Other Stuff](https://apereo.github.io/2019/12/27/620rc2-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/12/27/620rc2-release/#library-upgrades) * [Credits](https://apereo.github.io/2019/12/27/620rc2-release/#credits) Apereo Membership ----------------- If you benefit from Apereo CAS as free and open-source software, we invite you to [join the Apereo Foundation](https://www.apereo.org/content/apereo-membership) and financially support the project at a capacity that best suits your deployment. Note that all development activity is performed _almost exclusively_ on a voluntary basis with no expectations, commitments or strings attached. Having the financial means to better sustain engineering activities will allow the developer community to allocate _dedicated and committed_ time for long-term support, maintenance and release planning, especially when it comes to addressing critical and security issues in a timely manner. Funding will ensure support for the software you rely on and you gain an advantage and say in the way Apereo, and the CAS project at that, runs and operates. If you consider your CAS deployment to be a critical part of the identity and access management ecosystem, this is a viable option to consider. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: cas.version=6.2.0-RC2 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### CAS Overlay The [CAS overlay](https://github.com/apereo/cas-overlay-template) is updated to use Gradle `6`. The most notable difference is that dependencies in the build are now recommended to use the `implementation` syntax instead of the `compile` configuration, which is set to be removed in Gradle `7`. The CAS documentation is also modified to reflect this change for the appropriate CAS versions. While this is not a breaking change (yet), you should begin to use and prefer the `implementation` syntax to avoid surprises in the future and reduce build warnings. ### Okta Authentication CAS is now able to validate credentials and fetch user attributes [from Okta](https://apereo.github.io/cas/development/installation/Okta-Authentication.html) . ### LDAP Password Management [LDAP Password Management](https://apereo.github.io/cas/development/password_management/Password-Management-LDAP.html) is now given the ability to support multiple LDAP servers to locate and update accounts or to fetch security questions. **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust your settings accordingly to refer to `cas.authn.pm.ldap[0]` instead. ### Ehcache v3 Ticket Registry The [Ehcache integration](https://apereo.github.io/cas/development/ticketing/Ehcache-Ticket-Registry.html) is now updated to present support for Ehcache v3. The integration with Ehcache v2 is now deprecated and scheduled to be removed at a future date. Likewise, cache-based operations for X.509 authentication are also updated to use Ehcache v3. ### Configuration Unknown Fields The `ignoreUnknownFields = false` flag from CAS configuration validation has been removed in favor of Spring configuration metadata. This field is deprecated by the Spring Boot framework and will be eventually removed. We are taking preemptive action to stay compatible with future upgrades of Spring Boot, and also provide a more pleasant experience as far as migration of CAS properties is concerned, with reports on deprecations, replacements, etc on startup. ### Configuration Validation Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. ### Azure Active Directory Authentication Following up on the [previous release candidate](https://apereo.github.io/2019/11/29/620rc1-release/) , the Azure Active Directory integration is now moved to [a standalone module](https://apereo.github.io/cas/development/installation/Azure-ActiveDirectory-Authentication.html) that is capable of both authenticating users using Azure Active Directory and fetching attributes separately as an independent attribute repository. ### Ldaptive v2 Upgrade This release candidate bumps the ldaptive library version to `2.0.0-RC1`, which brings forward the following changes to impact CAS settings: * `useSSL` property removed; LDAPS scheme is used to specify SSL. * `providerClass` property removed. * `DEFAULT` connection strategy is removed. * `attributeValue` setting replaces `attributeValues` for LDAP validators. We are hoping to get test feedback before the final release of the ldaptive library, which will most likely ship with subsequent releases candidates. To provide feedback, please look for support options on the [ldaptive website](https://www.ldaptive.org/) . ### Surrogate Authentication via REST [Surrogate Authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) can now be activated and used as part of [CAS REST protocol](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) . ### Multifactor Authentication via YubiKey [Multifactor authentication with Yubikey](https://apereo.github.io/cas/development/mfa/YubiKey-Authentication.html) is now enhanced to be able to handle multiple devices per user account. **WATCH OUT!** This is a breaking change as the internal data structures used to track YubiKey device registrations are now modified to handle multiple device records. ### Authentication Handler Resolution [Resolution of authentication handlers](https://apereo.github.io/cas/development/installation/Configuring-Authentication-Components.html) can now be done using Groovy scripts to further narrow down the collection of candidate authentication handlers for transactions dynamically. ### LDAP Acceptable Usage Policy [Acceptable Usage Policy](https://apereo.github.io/cas/development/webflow/Webflow-Customization-AUP.html) backed by LDAP is now given the ability to support multiple LDAP servers to locate and update accounts with the results of the policy acceptance submission. **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust your settings accordingly to refer to `cas.acceptable-usage-policy.ldap[0]` instead. ### YubiKey Device Storage via Redis [YubiKey Authentication](https://apereo.github.io/cas/development/mfa/YubiKey-Authentication.html) can now manage device registrations inside a Redis database. Other Stuff ----------- * Better test coverage for components that automate Spring Webflow configuration. * Code cleanup and better maintenance of the codebase using an upgraded version of the error-prone compiler. * Minor fixes to OAuth functionality in handling conditions that decide whether refresh tokens should be issued. * Various documentation improvements and typo fixes. * Managing U2F devices via Groovy is given the ability to monitor and watch the Groovy script. * Auto-configuration of multifactor trusted devices is now fixed to properly activate and configure the webflow when enabled. * OAuth PKCE flows receive a fix to correctly calculate hashes for code verifications when using `S256` as the hash algorithm. * Several improvements to the distributed session store, when handling delegated authentication to external identity providers. * Annotation processing is turned on for Splunk and CloudWatch logging facilities to ensure CAS appenders are recognized in logging configurations. Library Upgrades ---------------- * ErrorProne * Spring * Spring Boot * Apache Tomcat * Spring Data * Micrometer * Bootstrap * Mockito * AspectJ * Bucket4j * Log4j * Azure KeyVault * Spring Retry * Nimbus SDK * Spring Integration * InfluxDb * Spring Kafka * Amazon SDK * MariaDb Driver * Apache Fortress * Jose4j * UnboundID LDAP * Google Maps * Apache Commons Pool * ByteBuddy * Twilio * FontAwesome * PostgreSQL Driver * Groovy * JGit * MongoDb Driver Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.2.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&title=CAS+6.2.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&title=CAS+6.2.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&name=CAS+6.2.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&title=CAS+6.2.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&title=CAS+6.2.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F12%2F27%2F620rc2-release%2F&t=CAS+6.2.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.1.0 RC2 Feature Release – Apereo Community Blog CAS 5.1.0 RC2 Feature Release ============================= Friday, Feb 24, 2017 11 minute read The official CAS `5.0.0` GA was released on [November 7th 2016](https://github.com/apereo/cas/releases/tag/v5.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.1.0`. This post intends to highlight some of the improvements and enhancements packed into the second release candidate in the `5.1.0` series. The in-development documentation of CAS `5.1.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2016/12/23/51rc1/) . * [Authentication Sequence](https://apereo.github.io/2017/02/24/rc2-release/#authentication-sequence) * [Monitoring/Status Protection with Spring Security](https://apereo.github.io/2017/02/24/rc2-release/#monitoringstatus-protection-with-spring-security) * [SAML IdP Metadata Generation](https://apereo.github.io/2017/02/24/rc2-release/#saml-idp-metadata-generation) * [Code Cleanup and Optimization](https://apereo.github.io/2017/02/24/rc2-release/#code-cleanup-and-optimization) * [XML Test Configuration](https://apereo.github.io/2017/02/24/rc2-release/#xml-test-configuration) * [MongoDb Ticket Registry](https://apereo.github.io/2017/02/24/rc2-release/#mongodb-ticket-registry) * [CAS Documentation Improvements](https://apereo.github.io/2017/02/24/rc2-release/#cas-documentation-improvements) * [Custom Password Encoders](https://apereo.github.io/2017/02/24/rc2-release/#custom-password-encoders) * [Management Webapp Authorization](https://apereo.github.io/2017/02/24/rc2-release/#management-webapp-authorization) * [FIDO U2F MFA](https://apereo.github.io/2017/02/24/rc2-release/#fido-u2f-mfa) * [Microsoft Azure MFA](https://apereo.github.io/2017/02/24/rc2-release/#microsoft-azure-mfa) * [Principal SCIM Provisioning](https://apereo.github.io/2017/02/24/rc2-release/#principal-scim-provisioning) * [Internal Support for Kotlin](https://apereo.github.io/2017/02/24/rc2-release/#internal-support-for-kotlin) * [Clearpass Internal Encryption](https://apereo.github.io/2017/02/24/rc2-release/#clearpass-internal-encryption) * [Database Audit Default Catalog/Schema](https://apereo.github.io/2017/02/24/rc2-release/#database-audit-default-catalogschema) * [OpenID Connect JWKS Caching](https://apereo.github.io/2017/02/24/rc2-release/#openid-connect-jwks-caching) * [OpenID Connect Scope-based Claim Release](https://apereo.github.io/2017/02/24/rc2-release/#openid-connect-scope-based-claim-release) * [Grouper Groups as Principal Attributes](https://apereo.github.io/2017/02/24/rc2-release/#grouper-groups-as-principal-attributes) * [OpenID Connect Encrypted ID Tokens](https://apereo.github.io/2017/02/24/rc2-release/#openid-connect-encrypted-id-tokens) * [Native Configuration Monitoring](https://apereo.github.io/2017/02/24/rc2-release/#native-configuration-monitoring) * [OpenID Connect Implicit Profile](https://apereo.github.io/2017/02/24/rc2-release/#openid-connect-implicit-profile) * [Dynamic Acceptable Usage Policy](https://apereo.github.io/2017/02/24/rc2-release/#dynamic-acceptable-usage-policy) * [X509 Authentication: LDAP CRL Fetching](https://apereo.github.io/2017/02/24/rc2-release/#x509-authentication-ldap-crl-fetching) * [Google Authenticator Token Tracking](https://apereo.github.io/2017/02/24/rc2-release/#google-authenticator-token-tracking) * [Delegated Authentication Providers](https://apereo.github.io/2017/02/24/rc2-release/#delegated-authentication-providers) * [Google Authenticator JSON Storage](https://apereo.github.io/2017/02/24/rc2-release/#google-authenticator-json-storage) * [CAS Banner & Git Commit Id](https://apereo.github.io/2017/02/24/rc2-release/#cas-banner--git-commit-id) * [Multifactor Authentication Trigger via Authentication Attribute](https://apereo.github.io/2017/02/24/rc2-release/#multifactor-authentication-trigger-via-authentication-attribute) * [LDAP Authentication Search Entry Resolvers](https://apereo.github.io/2017/02/24/rc2-release/#ldap-authentication-search-entry-resolvers) * [Domain Services Manager](https://apereo.github.io/2017/02/24/rc2-release/#domain-services-manager) * [SAML SP Integrations](https://apereo.github.io/2017/02/24/rc2-release/#saml-sp-integrations) * [Python/Javascript Attribute Release Policies](https://apereo.github.io/2017/02/24/rc2-release/#pythonjavascript-attribute-release-policies) * [Graphical User Authentication](https://apereo.github.io/2017/02/24/rc2-release/#graphical-user-authentication) * [SAML InCommon R&S Attribute Release](https://apereo.github.io/2017/02/24/rc2-release/#saml-incommon-rs-attribute-release) * [Database Password Policy Enforcement](https://apereo.github.io/2017/02/24/rc2-release/#database-password-policy-enforcement) * [REST Password Management](https://apereo.github.io/2017/02/24/rc2-release/#rest-password-management) * [Management Webapp](https://apereo.github.io/2017/02/24/rc2-release/#management-webapp) * [Minor Bug Fixes](https://apereo.github.io/2017/02/24/rc2-release/#minor-bug-fixes) * [Library Upgrades](https://apereo.github.io/2017/02/24/rc2-release/#library-upgrades) * [What’s Next?](https://apereo.github.io/2017/02/24/rc2-release/#whats-next) * [Get Involved](https://apereo.github.io/2017/02/24/rc2-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/02/24/rc2-release/#das-ende) Authentication Sequence ----------------------- At runtime, CAS maintains a collection of authentication handlers/strategies that typically execute one after another. Each CAS module that presents a form of authentication strategy will simply insert itself into this collection at bootstrap time. This means the sequence of authentication execution is very much non-deterministic upon server restarts. At the end of the process, the result of all authentication transactions is collected and optionally processed by an authentication policy where success/failure of certain strategies/sources may be taken into account to fully satisfy the authentication requirements. Starting with this feature release, the collection of authentication handlers tries to preserve order in a rather more deterministic way. Authentication handlers can be assigned a weight/order value thereby explicitly positioning themselves in the collection and controlling executionsequence. At this time, the LDAP and JDBC authentication handlers are the only ones that have qualified for an `order` setting via the usual CAS properties. Monitoring/Status Protection with Spring Security ------------------------------------------------- CAS endpoints that provide [monitoring and diagnostics](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html#spring-security) features are now able to support various modes of authorization/authentication backed by Spring Security. Additional modes now include backend authentication support via LDAP or JDBC storage facilities. SAML IdP Metadata Generation ---------------------------- The process of generating SAML2 metadata has been smoothened much better to ensure endpoints, ports and url in the metadata correctly match pre-defined CAS settings in order to reduce/remove manual work. Code Cleanup and Optimization ----------------------------- Thanks to community contributions, the CAS codebase is revitalized ever more to make sure most if not all underlying components adhere to proper coding standards and design practices. Changes in this area include adjustments to style guidelines, constructor-based dependency injections and navigating to the native Java 8 lambda APIs. XML Test Configuration ---------------------- CAS test infrastructure continues to move away from XML configuration files and towards the facilities provided by Spring Boot. This will allow the project to mirror the deployment runtime configuration as much as possible while troubleshooting and fixing regressions, if any. A number of small enhancements have also gone into the core build system to ensure tests can be built and run in parallel modes via Gradle, which would cut down a full build/release cycle in half (i.e. close to 20 minutes). This is rather helpful when adopters wish to be quick enough to try out `SNAPSHOT` releases during defect trials. MongoDb Ticket Registry ----------------------- CAS gains support for MongoDb as a storage mechanism for its ticket registry backend. You can learn more about the registry behavior via [this guide](https://apereo.github.io/cas/development/installation/MongoDb-Ticket-Registry.html) . CAS Documentation Improvements ------------------------------ Most if not all CAS documentation is reviewed to make sure various features properly point to their respective settings/properties via relevant anchor links. Additional work will be done on the settings as well to ensure all properties are properly explained as much as possible. Custom Password Encoders ------------------------ The collection of supported authentication password encoders now allows for the specification of a fully qualified `com.example.MyPasswordEncoder` implementation class to handle custom encoding use cases. Management Webapp Authorization ------------------------------- Authorized access to the management webapp via LDAP now allows for groups and roles in addition to a single search for the user and attributes. FIDO U2F MFA ------------ Another multifactor authentication option; basic support is added to provide [FIDO U2F](https://apereo.github.io/cas/development/installation/FIDO-U2F-Authentication.html) . Microsoft Azure MFA ------------------- As an extra multifactor authentication provider, CAS adds support for [Microsoft Azure](https://apereo.github.io/cas/development/installation/MicrosoftAzure-Authentication.html) . A limited number of options are available to verify credentials with Azure that today include: * A phone call to a predefined phone number, as an attribute, where user has to press `#` only. * A phone call to a predefined phone number, as an attribute, where user has to provide a CAS-generated token that is presented on the page. Integration with Azure mobile applications may be worked out in future releases based on interest and demand. Principal SCIM Provisioning --------------------------- CAS gains the ability to provision the authenticated principal via [SCIM](https://apereo.github.io/cas/development/integration/SCIM-Integration.html) . Internal Support for Kotlin --------------------------- The internal gradle build for the CAS codebase is adjusted to allow compilation of [Kotlin](https://kotlinlang.org/) ’s `.kt` files, if any. Clearpass Internal Encryption ----------------------------- Captures of credential password via Clearpass gain the option to encrypt the password internally via pre-defined keys. The credential upon release in decoded internally in memory and then encrypted with the service’s public key defined in the registry. Database Audit Default Catalog/Schema ------------------------------------- Database audits are now able to take advantage of new settings that control the default catalog and schema. OpenID Connect JWKS Caching --------------------------- Small improvements have been put in to ensure JWKS resource fetching can go through caching channels to help with processing keystores and performance. OpenID Connect Scope-based Claim Release ---------------------------------------- Additional attribute and claim release policies are now provided to ensure a given OpenID Connect service [can release attributes](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) based on pre-defined scope bundles. Grouper Groups as Principal Attributes -------------------------------------- Thanks to Person Directory’s built-in support of Internet2’s Grouper, CAS is now able to collect a Grouper subject’s groups as principal attributes and perhaps further use them in authorization decisions. OpenID Connect Encrypted ID Tokens ---------------------------------- ID tokens generated by CAS are now able to be encrypted, provided the client/service is configured appropriately in the registry. Native Configuration Monitoring ------------------------------- In the event that the `native` configuration profile is enabled, CAS is able to automatically monitor the relevant configuration directories and refresh the context upon change. Note that not all CAS components that process settings can be auto-reloaded. YMMV. OpenID Connect Implicit Profile ------------------------------- Support for OpenID Connect’s implicit workflow is worked into [this release](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) . Dynamic Acceptable Usage Policy ------------------------------- Sometimes deployments of CAS’ [Acceptable Usage Policy](https://apereo.github.io/cas/development/installation/Webflow-Customization-AUP.html) consist of several policies that may be shown to the user depending on membership, affiliation and even perhaps `objectclass`. In this release, CAS makes the fully resolved `Principal` available to AUP-related views and pages such that different views housing appropriate policies may be displayed depending on the resolved principal attributes. X509 Authentication: LDAP CRL Fetching -------------------------------------- A small improvement; an additional property is exposed to allow adopters the specification of the LDAP binary attribute that holds the certificate revocation list. Google Authenticator Token Tracking ----------------------------------- To prevent immediate OTP reuse while using [Google Authenticator](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) as the second authentication factor, CAS starts to track issued tokens that successfully were able to authenticate users. There are also built-in facilities that allow the underlying token-tracking repository to clean up after itself once the token’s expiration tag is removed. Delegated Authentication Providers ---------------------------------- Delegated authentication in CAS adds support for Bitbucket, Paypal, Wordpress and generic OAuth20 providers. Likewise, CAS should now allow delegating authentication to _multiple_ CAS, SAML, OIDC and OAuth2 servers where before only single instances were supported. Google Authenticator JSON Storage --------------------------------- To assist smaller deployments and to also allow for quicker testing and development, [Google Authenticator](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) gains support for a JSON storage facility that is able to quickly keep track of user registration records. CAS Banner & Git Commit Id -------------------------- To facilitate testing of `SNAPSHOT` versions, the CAS banner on startup attempts to demonstrate the Git commit id of the release so adopters and developers may exactly determine the version of the source code deployed. CAS Version: 5.1.0-RC2-SNAPSHOT CAS Commit Id: 0b75fabbb0f865c497327695e30ecf08b6f15e63 CAS Build Date/Time: 2017-01-09T21:27:28Z Spring Boot Version: 1.4.3.RELEASE Apache Tomcat Version: Apache Tomcat/8.5.9 Additionally, the set of diagnostics messages are also printed when one deploys the CAS Management web application. Multifactor Authentication Trigger via Authentication Attribute --------------------------------------------------------------- Title says it all. CAS has had a number of options for triggering multifactor authentication based on a principal attribute. This release adds an additional trigger that allows CAS to directly look into the authentication object to find metadata/attributes captured during the authentication event. This metadata in form of authentication attribute can be used to trigger multifactor authentication events. This is useful in scenarios where the underlying authentication machinery may signal back additional requirements in order for the authentication to fully succeed or, as another example, you may wish to trigger multifactor authentication if the captured `authenticationDate` matches a certain pattern of your own choosing, etc. LDAP Authentication Search Entry Resolvers ------------------------------------------ CAS adds support for configuring search entry resolvers for LDAP authentication. Additional properties are exposed to support the full range of resolvers that are made available to CAS. Domain Services Manager ----------------------- Thanks to [@tsschmidt](https://github.com/tsschmidt) , the default services manager implementation in CAS that acts as the orchestrator on top of the service registry has been switched out to group service definitions by domain. This is the first step in allowing not only making a more performant CAS when dealing with large collections of service definitions, but also presents a nice opportunity for the management webapp and its UIs to organize definitions in a more sane way. SAML SP Integrations -------------------- CAS adds support for a few additional built-in SAML SP integrations: [Zoom, Asana, Tableau and Evernote](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) . Python/Javascript Attribute Release Policies -------------------------------------------- Additional [attribute release policies](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html) are worked into CAS that allow one to filter attributes for applications based on external python or javascript files. Graphical User Authentication ----------------------------- There now exists basic/modest support for [GUA](https://apereo.github.io/cas/development/installation/GUA-Authentication.html) . SAML InCommon R&S Attribute Release ----------------------------------- There are dedicated [attribute release policies](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#attribute-release) now in CAS that allow one to release the required attribute bundle to InCommon’s R&S service providers. Database Password Policy Enforcement ------------------------------------ Thanks to community contributions, database authentication gains modest support for enforcing [password policy rules](https://apereo.github.io/cas/development/installation/Password-Policy-Enforcement.html) . REST Password Management ------------------------ [Password Management](https://apereo.github.io/cas/development/installation/Password-Management.html) capabilities of CAS begin to support REST APIs and endpoints that wish to take over the maintenance of the user account and updates to the password. Management Webapp ----------------- The service management web application is enhanced to support a few more additional settings added to the CAS service model for SAML2 and OpenID Connect services. Settings are also organized and grouped by categories that should be easier to find: ![capture](https://cloud.githubusercontent.com/assets/1205228/22838635/6867ef06-efc6-11e6-8b09-a6fdaa45bd16.PNG) Minor Bug Fixes --------------- A number of small bug fixes have been incorporated into this feature release: * Database schema update/generation accounts for more accurate column types and lengths. * Google Authenticator QR code generation is remapped in the Spring Boot configuration. * Expiration policy of OAuth refresh tokens is now taking into account the correct time unit of measure. * Credential validation failures in multifactor authentication scenarios prompt error messages back to the user. * Password change actions are now recorded in the CAS audit log. * Service ticket creation based on authentication sessions established via `renew` are now correctly honored. * Removed the need to re-create LDAP connection pools during LDAP authentication for entry resolution, etc. * SAML assertion encryption is now able to properly locate the encryption credential. * Added missing view for CAS responses that require `POST`. Library Upgrades ---------------- * Cryptacular * JodaTime * MongoDb Driver * Spring Boot * Apache Tomcat * Log4j2 * … What’s Next? ------------ The development team is working to make sure the CAS `5.1.0` release is on [schedule](https://github.com/apereo/cas/milestones) . Additional release candidates and more updates will likely be released prior to the official GA release. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende -------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&title=CAS+5.1.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&title=CAS+5.1.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&name=CAS+5.1.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&title=CAS+5.1.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&title=CAS+5.1.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F02%2F24%2Frc2-release%2F&t=CAS+5.1.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC1 Feature Release – Apereo Community Blog CAS 6.1.0 RC1 Feature Release ============================= Friday, Feb 1, 2019 4 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **first** release candidate in the `6.1.0` series. Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC1 **System Requirements** There are no changes to the minimum system/platform requirements for this release. Changes ------- * [New & Noteworthy](https://apereo.github.io/2019/02/01/610rc1-release/#new--noteworthy) * [Hazelcast WAN Replication](https://apereo.github.io/2019/02/01/610rc1-release/#hazelcast-wan-replication) * [SAML2 Metadata Management via JSON](https://apereo.github.io/2019/02/01/610rc1-release/#saml2-metadata-management-via-json) * [SAML2 Signing Credential Fingerprint](https://apereo.github.io/2019/02/01/610rc1-release/#saml2-signing-credential-fingerprint) * [SAML2 Attribute Release](https://apereo.github.io/2019/02/01/610rc1-release/#saml2-attribute-release) * [SAML2 Metadata Management](https://apereo.github.io/2019/02/01/610rc1-release/#saml2-metadata-management) * [Git Service Registry](https://apereo.github.io/2019/02/01/610rc1-release/#git-service-registry) * [Password Synchronization](https://apereo.github.io/2019/02/01/610rc1-release/#password-synchronization) * [TLS for REST Protocol](https://apereo.github.io/2019/02/01/610rc1-release/#tls-for-rest-protocol) * [SAML1 Validation Actuator Endpoint](https://apereo.github.io/2019/02/01/610rc1-release/#saml1-validation-actuator-endpoint) * [SAML2 Response Actuator Endpoint](https://apereo.github.io/2019/02/01/610rc1-release/#saml2-response-actuator-endpoint) * [Delegated Authentication Provisioning](https://apereo.github.io/2019/02/01/610rc1-release/#delegated-authentication-provisioning) * [Other Stuff](https://apereo.github.io/2019/02/01/610rc1-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/02/01/610rc1-release/#library-upgrades) * [Resources](https://apereo.github.io/2019/02/01/610rc1-release/#resources) * [Get Involved](https://apereo.github.io/2019/02/01/610rc1-release/#get-involved) * [Credits](https://apereo.github.io/2019/02/01/610rc1-release/#credits) ### New & Noteworthy #### Hazelcast WAN Replication Hazelcast WAN replication using static discovery is now [supported by CAS](https://apereo.github.io/cas/development/ticketing/Hazelcast-Ticket-Registry.html) . #### SAML2 Metadata Management via JSON SAML2 service provider integrations that do not necessarily provide metadata may be managed dynamically inside a [standalone JSON file](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#service-provider-metadata) . #### SAML2 Signing Credential Fingerprint [SAML services](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#saml-services) are given the ability to filter the signing credential used in the metadata by its `SHA-1` fingerprint. #### SAML2 Attribute Release [SAML2 Attribute Release](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Attribute-Release.html) policies are reorganized to provide distinct policies for both InCommon and REFEDS Research and Scholarship entity categories. #### SAML2 Metadata Management A [new endpoint](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html) is now exposed that allows one to administer the service provider metadata cache. Minor improvements to the metadata resolution are also in place to ensure metadata cached copies and backup files are maintained correctly. #### Git Service Registry Service registry files can now be [managed via Git-backed repositories](https://apereo.github.io/cas/development/services/Git-Service-Management.html) . #### Password Synchronization Support for [password synchronization](https://apereo.github.io/cas/development/installation/Password-Synchronization.html) is now available. #### TLS for REST Protocol [REST Protocol](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) is now able to support TLS for client authentication. #### SAML1 Validation Actuator Endpoint [SAML1 support](https://apereo.github.io/cas/development/protocol/SAML-Protocol.html#saml-11) presents a new actuator endpoint to output a SAML1 validation payload for a given authentication transaction, allowing one to examine what CAS would produce in such attempts. #### SAML2 Response Actuator Endpoint [SAML2 support](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) presents a new actuator endpoint to output a SAML2 response payloads for a given authentication transaction, allowing one to examine what CAS would produce in such attempts. #### Delegated Authentication Provisioning [Delegated Authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) gains small measures to handle provisioning tasks for profiles obtained from external identity providers. ### Other Stuff * A significant migration effort to ensure CAS unit/integration tests are upgraded to use the JUnit 5 framework. * The `com.unboundid:unboundid-ldapsdk` is now included by default when using CAS with LDAP to allow for confirmation of the `UnboundIDProvider` class as the LDAP connection provider and an alternative to JNDI. * [REST Authentication](https://apereo.github.io/cas/development/installation/Rest-Authentication.html) can now display warnings as part of the authentication flow. * [REST Password Management](https://apereo.github.io/cas/development/password_management/Password-Management-REST.html) may now support endpoints protected via Basic AuthN. * Security of actuator/admin endpoints protected by an IP address can now support regular expressions. * A number of Groovy-based components are internally improved to cache and monitor the Groovy script prior to execution. * Reduced LOC in favor of Lombok’s annotations such as `@Getter`, `@Setter`, etc. * Authentication pre/post processing can now be augmented via Groovy scripts. * Minor updates to CAS language bundles. * The internal Gradle build for the CAS codebase is set to enforce and validate the required Java version automatically before building modules. * [Acceptable Usage Policy](https://apereo.github.io/cas/development/webflow/Webflow-Customization-AUP.html) backed by JDBC gains a number of improvements to allow flexible controls over the construction of SQL queries and columns. * Internal reorganization of bypass components for multifactor authentication to ensure extensibility. * [WSFED Protocol](https://apereo.github.io/cas/development/protocol/WS-Federation-Protocol.html) is now able to release claims under custom namespaces. * Many broken links in the CAS documentation are fixed and automated processes for checking links is now included as part of the CAS build. * [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) for OIDC allows for specifying the response mode and type via CAS settings. * [Chaining attribute release policies](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html#chaining-policies) can now control the order and the merging behavior of attributes. ### Library Upgrades * Hibernate * Gradle * Azure KeyVault * OpenSAML * Spring Boot * HikariCP * Amazon SDK * Pac4j * JUnit Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&title=CAS+6.1.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&title=CAS+6.1.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&name=CAS+6.1.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&title=CAS+6.1.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&title=CAS+6.1.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F02%2F01%2F610rc1-release%2F&t=CAS+6.1.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.3.0 RC3 Feature Release – Apereo Community Blog CAS 5.3.0 RC3 Feature Release ============================= Friday, Mar 30, 2018 8 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.2.0` GA was released on [November 27th, 2017](https://github.com/apereo/cas/releases/tag/v5.2.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.3.0`. This post intends to highlight some of the improvements and enhancements packed into the **third** release candidate in the `5.3.0` series. The in-development documentation of CAS `5.3.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read about the previous release candidate [here](https://apereo.github.io/2018/02/09/530rc2-release/) . * [Shake Well Before Use](https://apereo.github.io/2018/03/30/530rc3-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2018/03/30/530rc3-release/#apache-maven) * [Gradle](https://apereo.github.io/2018/03/30/530rc3-release/#gradle) * [Minors](https://apereo.github.io/2018/03/30/530rc3-release/#minors) * [SAML Service Provider Metadata via REST](https://apereo.github.io/2018/03/30/530rc3-release/#saml-service-provider-metadata-via-rest) * [OAuth2 Audits](https://apereo.github.io/2018/03/30/530rc3-release/#oauth2-audits) * [SAML2 Service Providers](https://apereo.github.io/2018/03/30/530rc3-release/#saml2-service-providers) * [Couchbase 5 Compatibility](https://apereo.github.io/2018/03/30/530rc3-release/#couchbase-5-compatibility) * [Couchbase Authentication Attributes](https://apereo.github.io/2018/03/30/530rc3-release/#couchbase-authentication-attributes) * [Registered Service Access Strategy Audits](https://apereo.github.io/2018/03/30/530rc3-release/#registered-service-access-strategy-audits) * [Impersonation Audits](https://apereo.github.io/2018/03/30/530rc3-release/#impersonation-audits) * [Delegated Authentication Access Strategy Audits](https://apereo.github.io/2018/03/30/530rc3-release/#delegated-authentication-access-strategy-audits) * [Audit API Improvements](https://apereo.github.io/2018/03/30/530rc3-release/#audit-api-improvements) * [Impersonation Groovy Access Strategy](https://apereo.github.io/2018/03/30/530rc3-release/#impersonation-groovy-access-strategy) * [X.509 Authentication via Request Headers](https://apereo.github.io/2018/03/30/530rc3-release/#x509-authentication-via-request-headers) * [CAS Protocol Behavior](https://apereo.github.io/2018/03/30/530rc3-release/#cas-protocol-behavior) * [Bootstrap 4](https://apereo.github.io/2018/03/30/530rc3-release/#bootstrap-4) * [Google Authenticator Multifactor Account Registration](https://apereo.github.io/2018/03/30/530rc3-release/#google-authenticator-multifactor-account-registration) * [Multifactor Trusted Devices](https://apereo.github.io/2018/03/30/530rc3-release/#multifactor-trusted-devices) * [YubiKey Account Public ID Encryption](https://apereo.github.io/2018/03/30/530rc3-release/#yubikey-account-public-id-encryption) * [Service Registry Multiplicity](https://apereo.github.io/2018/03/30/530rc3-release/#service-registry-multiplicity) * [Embedded Apache Tomcat Session Clustering](https://apereo.github.io/2018/03/30/530rc3-release/#embedded-apache-tomcat-session-clustering) * [Delegated Authentication Non-Sticky Sessions](https://apereo.github.io/2018/03/30/530rc3-release/#delegated-authentication-non-sticky-sessions) * [Library Upgrades](https://apereo.github.io/2018/03/30/530rc3-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2018/03/30/530rc3-release/#get-involved) * [Das Ende](https://apereo.github.io/2018/03/30/530rc3-release/#das-ende) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . In order to start experimenting with release candidates, use the following strategies. At any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following tag to match below: 5.3.0-RC3 ### Gradle In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-gradle-overlay-template) , adjust the following setting to match below: cas.version=5.3.0-RC3 Minors ------ * CAS integration tests for Couchbase, DynamoDb and InfluxDb are now automated/enabled via relevant Docker images running as part of Travis CI. * Thanks to [@frett](https://github.com/frett) , TGC domain names are once more sanitized; an oversight that snuck into CAS after adopting Project Lombok. * Thanks to [@luis100](https://github.com/luis100) , delegating authentication to SAML IdPs now is able to handle `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` bindings. * Thanks to [@tsschmidt](https://github.com/tsschmidt) , loading CAS configuration properties is now made conditional. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , overflows when calculating ticket expirations in MongoDb are now prevented. * Thanks to [@frett](https://github.com/frett) , multifactor authentication triggers based on principal/authentication attributes are now allowed to proceed in the absence of a `service` parameter. * [CAS builds managed by Travis CI](https://travis-ci.org/apereo/cas/builds) are now broken into multiple jobs using a matrix to account for faster execution times. `SNAPSHOT` releases tend to publish around the 30 minute mark! * Thanks to [@dodok1](https://github.com/dodok1) , multiple RADIUS servers can now be specified in CAS properties, separated by comma. * Thanks to [@fmartelli](https://github.com/fmartelli) , delegated SAML2 authentication gains a new settings to allow for the specification of the `AttributeConsumingServiceIndex` exposed by Pac4j. * CAS proxy-granting ticket definitions are now correctly registered in the ticket catalog. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , a number of time units in CAS are now corrected to properly recognize seconds instead of milli-seconds. * CAS configuration metadata is corrected to properly generate the needed JSON metadata based on configuration settings. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , the embedded Apache Tomcat instance is tweaked using a _Customizer_ component provided by Spring Boot so that CAS implementations can override the factory themselves (eg to enable JNDI) whilst also benefitting from the CAS tomcat configuration properties. * Specification of [required authentication handlers for a service](https://apereo.github.io/cas/development/installation/Configuring-Service-Required-AuthN.html) now does not intefere with the execution of multifactor authentication. * Thanks to [@hdeadman](https://github.com/sbearcsiro) , the OpenID Connect discovery profile is now able to properly render all settings, and should be able to list all grant types supported by CAS. * Thanks to [@frett](https://github.com/frett) , the REST API responsible for generating service tickets can now correctly audit the authentication object. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , the embedded tomcat configuration is refactored and moved into its own component. * OAuth codes issued by CAS running as an OpenID Connect provider are now strictly scoped to the requesting service when exchanged for access tokens. * Thanks to [@swlyons](https://github.com/swlyons) , the table names for the [DynamoDb Ticket Registry](https://apereo.github.io/cas/development/installation/DynamoDb-Ticket-Registry.html) can now be customized in CAS settings. SAML Service Provider Metadata via REST --------------------------------------- SAML2 service provider metadata can now be fetched from more traditional REST endpoints, as an alternative to deploying an MDQ server. [See this guide](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html) for more info. OAuth2 Audits ------------- Thanks to [@dima767](https://github.com/dima767) , OAuth2 and OpenID Connect interactions (authentication requests and user profile responses) with CAS are now sent to the audit log. SAML2 Service Providers ----------------------- The following new [SAML2 service providers](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) are now supported by CAS out of the box: * Concur Solutions * PollEverywhere Couchbase 5 Compatibility ------------------------- Thanks to [@dima767](https://github.com/dima767) , CAS integration tests for service/ticket registries are now verified and made functional against Couchbase 5. Additional test cases are also added to verify Couchbase authentication. Couchbase Authentication Attributes ----------------------------------- Similar to above, authenticating credentials against a Couchbase data store in CAS now gains the ability to also fetch attributes as part of the returned data row. Registered Service Access Strategy Audits ----------------------------------------- Thanks to [@dima767](https://github.com/dima767) , [service access strategy](https://apereo.github.io/cas/development/installation/Configuring-Service-Access-Strategy.html) events are now sent to the audit log in the event that the principal does not carry enough attributes to be granted access. Impersonation Audits -------------------- Thanks to [@dima767](https://github.com/dima767) , [CAS impersonation attempts](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) . that were put through the access strategy rules are now audited as well. Delegated Authentication Access Strategy Audits ----------------------------------------------- While delegating authentication to an external identity provider, access strategy events that enforce the usage of the external identity provider are now sent to the audit log. Audit API Improvements ---------------------- In collaboration with [@dima767](https://github.com/dima767) , CAS components that are typically not managed as Spring `@Bean`s are now put through a mini _framework_ so that can become eligible for auditing purposes. The API changes in this area, while non-intrusive, allow CAS to audit the likes of the services access strategy events noted above. Impersonation Groovy Access Strategy ------------------------------------ Impersonation features of CAS gain access to a Groovy option to execute [authorization rules for surrogate authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html#surrogate-access-strategy) . X.509 Authentication via Request Headers ---------------------------------------- Thanks to [@hdeadman](https://github.com/hdeadman) , X509 authentication now optionally gains the ability to extract the certificate from a request header. CAS Protocol Behavior --------------------- Certain aspects of the CAS protocol such as proxy or renewed authentication [can be controlled](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#global-sso-behavior) via CAS settings. Bootstrap 4 ----------- Thanks to [@mindblender](https://github.com/mindblender) , CAS user interfaces begin to take advantage of Bootstrap v4 and FontAwesome v5. The thymeleaf templates are also transformed to be easier to maintain as natural/native views. Google Authenticator Multifactor Account Registration ----------------------------------------------------- Multifactor athentication provided by [Google Authenticator](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) in CAS has the ability to register users and devices as part of the authentication flow. In this release candidate, device registration records are by default signed/encrypted before they are stored in the registration store. **WATCH OUT!** This may be a breaking change. While the setting is on by default, you can certainly disable the signing/encryption operations of CAS that deal with device registration. Multifactor Trusted Devices --------------------------- Thanks to [@frett](https://github.com/frett) , [Multifactor Trusted Devices](https://apereo.github.io/cas/development/installation/Multifactor-TrustedDevice-Authentication.html) support has been extended to support custom [device fingerprinting](https://en.wikipedia.org/wiki/Device_fingerprint) strategies. **WATCH OUT!** This may be a breaking change. Adding custom device fingerprint support necessitated a schema update for trust records. Furthermore, this feature gains the ability to determine device fingerprints in order to distinguish trusted devices from each other. YubiKey Account Public ID Encryption ------------------------------------ Thanks to [@dima767](https://github.com/dima767) , the YubiKey authentication facility gains the ability to store account’s public key in target destination stores in the [encrypted form](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#yubikey-registration-records-encryption-and-signing) Service Registry Multiplicity ----------------------------- Interal improvements are in place to allow each module the capablity of hosting its own service registry, making CAS effectively able to work with more one service registry at the same time. In theory, this provides the option of having, for instance, both JSON and YAML service registries work together. The real motivation for this change is to allow the introduction of _internal_ _immutable_ service registries that may be ephemeral, specially in view of how CAS handles multiple protocol support with callback services that were, before this change, expected to be inserted and found in the service registry. Embedded Apache Tomcat Session Clustering ----------------------------------------- The embedded Apache Tomcat is now altered slightly using options to allow for session clustering and replication. Delegated Authentication Non-Sticky Sessions -------------------------------------------- [Delegated authentication in CAS](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) has been re-designed in certain areas to remove the requirement of sticky sessions specially in clustered deployments. The internal changes to accomodate this behavior are rather significant, so please be sure to test and contribute back lest issues are discovered. This behavior is also extended to include and support [delegating authentication to ADFS](https://apereo.github.io/cas/development/integration/ADFS-Integration.html) instances. Library Upgrades ---------------- * Couchbase Java Client * Amazon Java SDK * Mockito * SemVer * Swagger * Disruptor * Eureka * Ribbon * ActiveMQ * InfluxDb * Apache CXF * JavaParser * Guava * Azure KeyVault * Okio * Yubico * Authy * Google Zxing * Yubico U2F * Maxmind * Google Maps * UnboundID * Gradle * Twilio * Postgresql Driver * MariaDb Driver * Jose4j * Bootstrap & FontAwesome * Apache Cassandra Driver * Font Awesome * Hazelcast * Jackson * JQuery * Thymeleaf Dialect * HikariCP * Caffein Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.3.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&title=CAS+5.3.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&title=CAS+5.3.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&name=CAS+5.3.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&title=CAS+5.3.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&title=CAS+5.3.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F03%2F30%2F530rc3-release%2F&t=CAS+5.3.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.1.0 RC4 Feature Release – Apereo Community Blog CAS 5.1.0 RC4 Feature Release ============================= Friday, Apr 28, 2017 5 minute read The official CAS `5.0.0` GA was released on [November 7th 2016](https://github.com/apereo/cas/releases/tag/v5.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.1.0`. This post intends to highlight some of the improvements and enhancements packed into the fourth release candidate in the `5.1.0` series. The in-development documentation of CAS `5.1.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2017/03/31/rc3-release/) . * [SAML2 Service Providers](https://apereo.github.io/2017/04/28/rc4-release/#saml2-service-providers) * [CAS Demos](https://apereo.github.io/2017/04/28/rc4-release/#cas-demos) * [Surrogate Authentication](https://apereo.github.io/2017/04/28/rc4-release/#surrogate-authentiction) * [SAML2 NameID Qualifiers](https://apereo.github.io/2017/04/28/rc4-release/#saml2-nameid-qualifiers) * [Scripted Attribute Release](https://apereo.github.io/2017/04/28/rc4-release/#scripted-attribute-release) * [Distributed Tracing](https://apereo.github.io/2017/04/28/rc4-release/#distributed-tracing) * [Encrypted Service Usernames](https://apereo.github.io/2017/04/28/rc4-release/#encrypted-service-usernames) * [Automated Docker Cloud Builds](https://apereo.github.io/2017/04/28/rc4-release/#automated-docker-cloud-builds) * [Eureka Service Discovery](https://apereo.github.io/2017/04/28/rc4-release/#eureka-service-discovery) * [Spring Cloud w/ Apache ZooKeeper](https://apereo.github.io/2017/04/28/rc4-release/#spring-cloud-w-apache-zookeeper) * [Logging Enhancements](https://apereo.github.io/2017/04/28/rc4-release/#logging-enhancements) * [Spring Boot Administration Server](https://apereo.github.io/2017/04/28/rc4-release/#spring-boot-administration-server) * [Multifactor EntityID Trigger](https://apereo.github.io/2017/04/28/rc4-release/#multifactor-entityid-trigger) * [Principal ID As Attribute](https://apereo.github.io/2017/04/28/rc4-release/#principal-id-as-attribute) * [Groovy Attribute Value Filters](https://apereo.github.io/2017/04/28/rc4-release/#groovy-attribute-value-filters) * [Documentation](https://apereo.github.io/2017/04/28/rc4-release/#documentation) * [Minor Changes](https://apereo.github.io/2017/04/28/rc4-release/#minor-changes) * [Community Contributions](https://apereo.github.io/2017/04/28/rc4-release/#community-contributions) * [Others](https://apereo.github.io/2017/04/28/rc4-release/#others) * [Library Upgrades](https://apereo.github.io/2017/04/28/rc4-release/#library-upgrades) * [What’s Next?](https://apereo.github.io/2017/04/28/rc4-release/#whats-next) * [Get Involved](https://apereo.github.io/2017/04/28/rc4-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/04/28/rc4-release/#das-ende) SAML2 Service Providers ----------------------- A few more [SAML2 service providers](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) are added to this release namely Adobe Cloud, AcademicWorks, Infinite Campus, Slack, Gartner, Zendesk and more. CAS Demos --------- CAS demos are neatly organized and deployed on [Heroku](https://apereo.github.io/cas/development/#demos) . Surrogate Authentiction ----------------------- The ability to authenticate on behalf of another user, so called [Surrogate Authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) , is now included in this release. SAML2 NameID Qualifiers ----------------------- SAML2 service definitions are now allowed the option to override the name qualifiers for a given subject’s name id. Scripted Attribute Release -------------------------- Scripted [attribute release policies](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html) are now able to accept an inlined groovy script as well. Distributed Tracing ------------------- CAS embraces [Spring Cloud Sleuth](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html#distributed-tracing) which implements a distributed tracing solution for Spring Cloud. Encrypted Service Usernames --------------------------- CAS username providers are now able to [encrypt the resolved username](https://apereo.github.io/cas/development/integration/Attribute-Release-PrincipalId.html) using the service public key. Applications are expected to decrypt of course using their paired private key. Automated Docker Cloud Builds ----------------------------- CAS is now taking advantage of [Docker Cloud’s automated builds](https://docs.docker.com/docker-cloud/builds/automated-build/) to auto-publish CAS images for the `latest` and all other relevant tagged releases. Eureka Service Discovery ------------------------ Thanks to Spring Cloud, CAS provides integration support for [Eureka Service Discovery](https://apereo.github.io/cas/development/installation/Service-Discovery-Guide.html) . Spring Cloud w/ Apache ZooKeeper -------------------------------- More of a documentation enhancement and thanks to community contributions and expertise, the CAS Spring Cloud configuration server is now able to use [Apache ZooKeeper](https://apereo.github.io/cas/development/installation/Configuration-Server-Management.html#apache-zookeeper) as the backend storage service to house CAS settings. Logging Enhancements -------------------- Another documentation improvement, the [CAS logging guide](https://apereo.github.io/cas/development/installation/Logging.html) introduces a few new sections to explain logging layouts. There is also some verbiage that describes how to integrate CAS logs with Papertrail. Spring Boot Administration Server --------------------------------- Starting with this release, the actuator endpoints provided by Spring Boot can be managed remotely via the [Spring Boot Admin server dashboard](https://apereo.github.io/cas/development/installation/Configuring-Monitoring-Administration.html) . Multifactor EntityID Trigger ---------------------------- In cases where authentication is delegated to CAS most commonly from a [Shibboleth Identity Provider](https://apereo.github.io/cas/development/integration/Shibboleth.html) , the `entityId` is passed to CAS as an extra request parameter to indicate the service provider. In this release, CAS begins to recognize the `entityId` parameter and treat it as a normal `service` that is linked to the CAS service registry which can then be assigned different access strategy and [multifactor authentication policies](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication-Triggers.html) . Principal ID As Attribute ------------------------- A small enhancement to CAS [attribute release policies](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html) where now, the principal id itself can be released as a custom attribute of your own choosing on a per-service basis. Groovy Attribute Value Filters ------------------------------ Attribute values for release policies can now [take advantage of Groovy scripts](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html#groovy) to weed through the released collection dynamically. Documentation ------------- Additional docs are now available to explain: * [How to extend the CAS configuration](https://apereo.github.io/cas/development/installation/Configuration-Management-Extensions.html) * [How to extend the CAS webflow](https://apereo.github.io/cas/development/installation/Webflow-Customization-Extensions.html) * [How to design custom triggers for multifactor authentication](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication-Triggers.html#custom) * [How to design custom authentication strategies](https://apereo.github.io/cas/development/installation/Configuring-Custom-Authentication.html) Additionally, common CAS configuration settings that apply to more than one module are given [their own dedicated space](https://apereo.github.io/cas/development/installation/Configuration-Properties-Common.html) . Minor Changes ------------- A number of small bug fixes and improvements have been incorporated into this feature release: ### Community Contributions * Acceptable Usage Policy is now able to correctly accept and store user decisions. * Hazelcast ticket registry is now able to properly decode and find encrypted tickets. * Minor updates to CAS messages bundles for non-english languages. * Support for configuration of container-managed JDBC connections is added to this release candidate. * Minor fixes to how OAuth/OpenID Connect tickets are deserialized and stored in JSON-based ticket registries. * Google Apps integration correctly should handle the `inResponseTo` attribute. * X509 authentication should correctly route the user back to the login form in cases of authentication failures. * Google authenticator backed by JDBC should properly create and name databasse tables. * Minor fixes to OpenID module to ensure views can proper render for ticket validation and other requests. * Minor fixes to OpenID Connect module to ensure scopes can properly be filtered, and that clients are fully loaded and management via the services management web application. ### Others * MDC logging is now respecting nullable properties of the HTTP request. * Authy as a multifactor authentication provider gains the ability to specify the country code for the user phone number. * MFA flows are now able to correctly handle scenarios where authentication produces warnings. * OAuth2 `password` grant type is now correctly able to issue user profiles. * Ticket registry cleaner is no longer scheduled as a no-op if it’s disabled in the configuration. * A regression; CAS should resume supporting the duration syntax (i.e `PT20S`) for settings. * Documentation additions to explain how to generate various signing and encryption keys for CAS manually. Library Upgrades ---------------- * Apache Tomcat * Spring Cloud * Hazelcast * Thymeleaf * Log4j * Spring * Hibernate * HSQLDB * AWS SDK * Spring Boot What’s Next? ------------ The development team is working to make sure the CAS `5.1.0` release is on [schedule](https://github.com/apereo/cas/milestones) . This is the last release candidate in the `5.1.x` release and the project will gear up to perform a few more rounds of testing and validation before the official GA release is tagged and made available. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende -------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&title=CAS+5.1.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&title=CAS+5.1.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&name=CAS+5.1.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&title=CAS+5.1.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&title=CAS+5.1.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F04%2F28%2Frc4-release%2F&t=CAS+5.1.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC3 Feature Release – Apereo Community Blog CAS 6.1.0 RC3 Feature Release ============================= Monday, Apr 29, 2019 5 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **third** release candidate in the `6.1.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2019/03/01/610rc2-release/) . Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC3 **System Requirements** There are no changes to the minimum system/platform requirements for this release. Changes ------- * [New & Noteworthy](https://apereo.github.io/2019/04/29/610rc3-release/#new--noteworthy) * [OAuth `id_token` Response Type](https://apereo.github.io/2019/04/29/610rc3-release/#oauth-id_token-response-type) * [OpenID Connect Response Mode](https://apereo.github.io/2019/04/29/610rc3-release/#openid-connect-response-mode) * [Principal Attribute Repositories](https://apereo.github.io/2019/04/29/610rc3-release/#principal-attribute-repositories) * [GNU `libc crypt(3)` Password Encoding](https://apereo.github.io/2019/04/29/610rc3-release/#gnu-libc-crypt3-password-encoding) * [Duo Security Account Status Endpoint](https://apereo.github.io/2019/04/29/610rc3-release/#duo-security-account-status-endpoint) * [SAML2 Attribute Friendly Names](https://apereo.github.io/2019/04/29/610rc3-release/#saml2-attribute-friendly-names) * [Ticket Expiration Policy per Service](https://apereo.github.io/2019/04/29/610rc3-release/#ticket-expiration-policy-per-service) * [SAML2 Service Providers](https://apereo.github.io/2019/04/29/610rc3-release/#saml2-service-providers) * [Google Analytics Cookies](https://apereo.github.io/2019/04/29/610rc3-release/#google-analytics-cookies) * [Existing SSO Sessions & UI](https://apereo.github.io/2019/04/29/610rc3-release/#existing-sso-sessions--ui) * [JavaMelody Monitoring](https://apereo.github.io/2019/04/29/610rc3-release/#javamelody-monitoring) * [SSO Participation per Service](https://apereo.github.io/2019/04/29/610rc3-release/#sso-participation-per-service) * [Google Authenticator w/ Redis](https://apereo.github.io/2019/04/29/610rc3-release/#google-authenticator-w-redis) * [OAuth & OpenID Connect Sessions](https://apereo.github.io/2019/04/29/610rc3-release/#oauth--openid-connect-sessions) * [Other Stuff](https://apereo.github.io/2019/04/29/610rc3-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/04/29/610rc3-release/#library-upgrades) * [Resources](https://apereo.github.io/2019/04/29/610rc3-release/#resources) * [Get Involved](https://apereo.github.io/2019/04/29/610rc3-release/#get-involved) * [Credits](https://apereo.github.io/2019/04/29/610rc3-release/#credits) ### New & Noteworthy #### OAuth `id_token` Response Type CAS acting as an [OAuth identity provider](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) gains support for `id_token` as a new response type. #### OpenID Connect Response Mode CAS acting as an [OpenID Connect provider](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) is now able to support the `response_mode` parameter. #### Principal Attribute Repositories [Principal attribute repositories](https://apereo.github.io/cas/development/integration/Attribute-Release-Caching.html) assigned to a service definition can now narrow down the collection of attribute repositories to fetch attributes at release time. The [attribute resolution engine](https://apereo.github.io/cas/development/integration/Attribute-Resolution.html) backed by Person Directory is also tweaked to allow for additional filtering mechanisms. #### GNU `libc crypt(3)` Password Encoding Support for password encoding using a `crypt(3)` compatible way has been added through a special `GLIBC_CRYPT` encoder type. #### Duo Security Account Status Endpoint A new actuator endpoint for [Duo Security](https://apereo.github.io/cas/development/mfa/DuoSecurity-Authentication.html) to fetch and report back on user account status. #### SAML2 Attribute Friendly Names Attribute friendly names put into the [SAML2 response](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) can now be defined globally first, and then overridden on a per-service basis. #### Ticket Expiration Policy per Service Service and proxy ticket [expiration policies](https://apereo.github.io/cas/development/ticketing/Configuring-Ticket-Expiration-Policy.html) can optionally be decided on a per-service basis. #### SAML2 Service Providers The list of supported [SAML2 Service Providers](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) continues to grow with new additions such as ArmsSoftware, Academic HealthPlans, etc. #### Google Analytics Cookies Integration with [Google Analytics](https://apereo.github.io/cas/development/integration/Configuring-Google-Analytics.html) is extracted into its own module which _MUST_ be included in the overlay to activate the functionality. CAS also presents the ability to drop in a special cookie upon successful authentication events to be later process and consumed by Google Analytics. The value of this cookie is determined as a principal/authentication attribute. #### Existing SSO Sessions & UI Additional user interface work is done to detect existing a single sign-on session for a user and display modest warnings, in the event that re-authentication is being forced. #### JavaMelody Monitoring Integration with [JavaMelody Monitoring](https://apereo.github.io/cas/development/monitoring/Configuring-Monitoring-JavaMelody.html) is now provided out of the box. #### SSO Participation per Service SSO Participation of applications can now be controlled conditionally on a [per-service basis](https://apereo.github.io/cas/development/installation/Configuring-SSO-Session-Cookie.html) . #### Google Authenticator w/ Redis Multifactor authentication with [Google Authenticator](https://apereo.github.io/cas/development/mfa/GoogleAuthenticator-Authentication.html) gains support for Redis as a storage option to manage tokens and accounts/devices. #### OAuth & OpenID Connect Sessions [OAuth](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) and/or [OpenID Connect](https://apereo.github.io/cas/development/protocol/OIDC-Protocol.html) features in CAS should no longer have to rely on HTTP sessions and container session replication in clustered deployments. ### Other Stuff * Allow the OAuth `profile` endpoint to accept and produce claims and attributes with non-primitive complex object types. * Additional options to let CAS URL-decode authentication requests for relevant SAML2 profiles when running as a SAML2 identity provider. * A collection of _new_ object types (i.e. attribute release policies, etc) are now registered with Kryo to prevent serialization issues with Memcached. * Additional logging and instrumentation for throttled authentication attempts and expiration policies. * Preserve parameters in the CAS authentication flow, if the initial request to the `/login` endpoint is done via a `POST`. * Ensure all ticket types are recognized during object serialization for MongoDb and CouchDB ticket registries. * The caching strategy for principal attribute repositories is redesigned as a standalone Spring bean. * Registration of CAS views rendered upon service validation is redesigned and refactored internally. * Incremental improvements to delegated authentication to remove reliance on HTTP sessions. * Minor adjustments to ticket-granting ticket expiration policy based on throttled timeouts. * Dynamic construction of Hazelcast-backed maps can now specify their merging strategy when dealing with duplication. * Registration of CAS SSO participation strategies is redesigned and refactored internally. * Core components from the WS-Federation STS module are broken down and extracted into an `api` module for better extensibility. * Core components from the reports module are broken down and extracted into an `api` module for better extensibility. * Fetching dynamic metadata via MDQ should no longer require explicit entity ids in the SAML service definition. * Incremental improvements to delegated authentication so it can work correctly in concert with multifactor authentication. ### Library Upgrades * SpotBugs * Hazelcast AWS * Hazelcast * Couchbase Driver * Cassandra Driver * SnakeYAML * Twilio * Google Maps * Apache Tomcat * Amazon SDK * Nimbus OIDC * Commons Lang * Guava * Ribbon * Nexmo * Spring Boot * Spring Security * Spring * Gradle Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&title=CAS+6.1.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&title=CAS+6.1.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&name=CAS+6.1.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&title=CAS+6.1.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&title=CAS+6.1.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F04%2F29%2F610rc3-release%2F&t=CAS+6.1.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.1.0 RC5 Feature Release – Apereo Community Blog CAS 6.1.0 RC5 Feature Release ============================= Monday, Sep 2, 2019 7 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `6.0.0` GA was released on [December 28th, 2018](https://github.com/apereo/cas/releases/tag/v6.0.0) . Since then, the project has been moving forward with the development of the next feature release that is tagged as `6.1.0`. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **fifth** release candidate in the `6.1.0` series. You can read about the previous release candidate [here](https://apereo.github.io/2019/06/07/610rc4-release/) . * [Get Involved](https://apereo.github.io/2019/09/02/610rc5-release/#get-involved) * [Shake Well Before Use](https://apereo.github.io/2019/09/02/610rc5-release/#shake-well-before-use) * [Resources](https://apereo.github.io/2019/09/02/610rc5-release/#resources) * [Overlay](https://apereo.github.io/2019/09/02/610rc5-release/#overlay) * [New & Noteworthy](https://apereo.github.io/2019/09/02/610rc5-release/#new--noteworthy) * [Redis Authentication](https://apereo.github.io/2019/09/02/610rc5-release/#redis-authentication) * [Password History Tracking](https://apereo.github.io/2019/09/02/610rc5-release/#password-history-tracking) * [Scripting Authentication via Groovy](https://apereo.github.io/2019/09/02/610rc5-release/#scripting-authentication-via-groovy) * [Attribute Consent via Redis](https://apereo.github.io/2019/09/02/610rc5-release/#attribute-consent-via-redis) * [MFA Trusted Devices Bypass](https://apereo.github.io/2019/09/02/610rc5-release/#mfa-trusted-devices-bypass) * [U2F MFA Trusted Devices](https://apereo.github.io/2019/09/02/610rc5-release/#u2f-mfa-trusted-devices) * [Scripted Attribute Value Filters](https://apereo.github.io/2019/09/02/610rc5-release/#scripted-attribute-value-filters) * [Actuator Endpoint Exposure](https://apereo.github.io/2019/09/02/610rc5-release/#actuator-endpoint-exposure) * [Webflow Error Handling](https://apereo.github.io/2019/09/02/610rc5-release/#webflow-error-handling) * [U2F Redis Device Registration](https://apereo.github.io/2019/09/02/610rc5-release/#u2f-redis-device-registration) * [Shared Webapp Resources](https://apereo.github.io/2019/09/02/610rc5-release/#shared-webapp-resources) * [Acceptable Usage Policy via Redis](https://apereo.github.io/2019/09/02/610rc5-release/#acceptable-usage-policy-via-redis) * [JMX Integration](https://apereo.github.io/2019/09/02/610rc5-release/#jmx-integration) * [Fewer Bundled Webapp Modules](https://apereo.github.io/2019/09/02/610rc5-release/#fewer-bundled-webapp-modules) * [MFA Trusted Devices GeoLocation Fingerprint](https://apereo.github.io/2019/09/02/610rc5-release/#mfa-trusted-devices-geolocation-fingerprint) * [Ticket Registry Expiration Policies](https://apereo.github.io/2019/09/02/610rc5-release/#ticket-registry-expiration-policies) * [Other Stuff](https://apereo.github.io/2019/09/02/610rc5-release/#other-stuff) * [Library Upgrades](https://apereo.github.io/2019/09/02/610rc5-release/#library-upgrades) * [Credits](https://apereo.github.io/2019/09/02/610rc5-release/#credits) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. ### Shake Well Before Use We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Overlay ------- In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following setting: casVersion=6.1.0-RC5 **System Requirements** There are no changes to the minimum system/platform requirements for this release. New & Noteworthy ---------------- ### Redis Authentication User accounts can now be authenticated against [Redis](https://apereo.github.io/cas/development/installation/Redis-Authentication.html) . Likewise, the integration is also allowed to fetch attributes from Redis databases without or without authentication against Redis. ### Password History Tracking [Password Management](https://apereo.github.io/cas/development/password_management/Password-Management.html) in CAS gains the ability to also track password history and prevent recycling old passwords where appropriate. ### Scripting Authentication via Groovy Designing a new authentication handler can now be done via [a Groovy script](https://apereo.github.io/cas/development/installation/Groovy-Authentication.html) without having to tap into CAS internal APIs. ### Attribute Consent via Redis Attribute consent decisions can now be tracked and stored inside [Redis](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) . ### MFA Trusted Devices Bypass The [multifactor trusted device](https://apereo.github.io/cas/development/mfa/Multifactor-TrustedDevice-Authentication.html) capability gains the ability to specify bypass options per application. ### U2F MFA Trusted Devices The [multifactor trusted device](https://apereo.github.io/cas/development/mfa/Multifactor-TrustedDevice-Authentication.html) capability can now be automatically applied to U2F MFA flows. ### Scripted Attribute Value Filters [×](https://apereo.github.io/2019/09/02/610rc5-release/#) **Beware** This may be a breaking change. Please examine your external scripted attribute value filters to make sure the script body matches the structure required by the filter component. You may simply need to write the script around a `run` method with arguments passed as an `Object[]`. [Scripted attribute value filters](https://apereo.github.io/cas/development/integration/Attribute-Value-Release-Policies.html) are now pre-compiled and cached to deliver better performance when it comes to parsing and running Groovy scripts. Additionally, most if not all scripting functionality is revisited to ensure compiled scripts can be cached as efficiently as possible to improve execution performance. ### Actuator Endpoint Exposure Actuator endpoints provided by CAS and/or Spring Boot are now tagged with `@ConditionalOnAvailableEndpoint` instead of the now-deprecated `@ConditionalOnEnabledEndpoint`, which makes sure endpoints are both enabled and exposed. **WATCH OUT!** While we do not anticipate this to be a breaking change for CAS overlays, you do need to make sure the endpoints that are enabled are also exposed either via web or jmx before they can be functional. ### Webflow Error Handling Handling of webflow exceptions and errors is now generalized into implementations of `CasWebflowExceptionHandler` to allow modules in CAS and custom code outside CAS maximum flexibility when it comes to modifying error messages or handling exceptions. ### U2F Redis Device Registration [FIDO U2F devices](https://apereo.github.io/cas/development/mfa/FIDO-U2F-Authentication.html) can now be stored inside a Redis database/cluster. ### Shared Webapp Resources Shared web application resources such as configuration files and HTML views are now moved into a separate CAS module `cas-server-webapp-resources`. This should not require a change to how the overlay works. If the resources are in a jar then they can still be overridden by resources in the webapp’s `WEB-INF\classes` folder (i.e. `src\main\resources` of the overlay). This is possible because `WEB-INF\classes` is first in classpath before `WEB-INF\lib*.jar`. The CAS overlay is also modified to comply with this change, when asked to fetch resources from the exploded CAS web application. **WATCH OUT!** While we do not anticipate this to be a breaking change for CAS overlays, you do need to make sure the overlay is updated to match and include the provided task definitions that recognize the new module. ### Acceptable Usage Policy via Redis Acceptable Usage Policy decisions can now tracked and stored inside [Redis](https://apereo.github.io/cas/development/webflow/Webflow-Customization-AUP.html) . ### JMX Integration A number of CAS components can be [registered and exposed over JMX](https://apereo.github.io/cas/development/integration/JMX-Integration.html) to provide remote insight into the running CAS software. ### Fewer Bundled Webapp Modules **WATCH OUT!** This might be a breaking change. Consult the CAS documentation to verify details. The following CAS feature modules are extracted and moved out of the default CAS web application bundle to reduce configuration overhead and improve startup time. You will need to expressly list them in your CAS overlay build script to activate the feature: * `cas-server-support-pm-webflow`: Password Management Webflow configuration * `cas-server-support-throttle`: Authentication Throttling core configuration * `cas-server-support-geolocation`: Geolocation Core configuration; generally pulled in automatically depending on the method of geotracking. * `cas-server-support-reports`: CAS Actuator endpoints backed by Spring Boot; must be pulled in if you rely on the old `status` endpoint. * `cas-server-core-events`: Authentication Events tracking and configuration * `cas-server-core-events-configuration`: Core configuration and event listeners for rebinding CAS settings for hot reloads. * `cas-server-core-monitor`: Configuration for simple CAS `HealthIndicator`s on memory and ticket state. * `cas-server-core-configuration-metadata-repository`: CAS configuration metadata endpoint and repository. ### MFA Trusted Devices GeoLocation Fingerprint Device fingerprints may now also be calculated using geolocation data provided by browser, when working with the [multifactor trusted device](https://apereo.github.io/cas/development/mfa/Multifactor-TrustedDevice-Authentication.html) feature. ### Ticket Registry Expiration Policies Core refinements are made internally to the construction of ticket registry expiration policy components to allow values to become refreshable via `@RefreshScope` without interfering with object serialization with cache-based ticket registries such as Memcached, Hazelcast, etc. Other Stuff ----------- * [Cassandra as a ticket registry](https://apereo.github.io/cas/development/ticketing/Cassandra-Ticket-Registry.html) is improved to take advantage of distinct tables for ticket types per the CAS ticket catalog. * Principal transformation via Groovy can now detect and load changes to the external Groovy script automatically. * LDAP search queries can now process paged responses, instructed by CAS configuration, to fully obtain LDAP results from a query. * Minor fixes to properties and relevant documentation for typos, etc. * Incremental and performance improvements to MongoDb acting as a [service registry](https://apereo.github.io/cas/development/services/MongoDb-Service-Management.html) and a [ticket registry](https://apereo.github.io/cas/development/ticketing/MongoDb-Ticket-Registry.html) . * Minor fixes to [Passwordless AuthN](https://apereo.github.io/cas/development/installation/Passwordless-Authentication.html) in terms of error handling and webflow navigation. * Dynamic Spring Webflow Configurers are now made into conditional beans to provider an easier channel for overrides. * The `cas-server-support-validation` module is broken apart separate auto-configuration from core components. * Delegated authentication to SAML2 identity providers gains the ability to specify signed authentication requests, multiple context classes, etc. Library Upgrades ---------------- * BounctCastle * Amazon SDK * Gradle * Apache Tomcat * Spring Boot * Nexmo * Hazelcast * Spring * Spring Integration * Spring Security * Log4j * Infinispan * MariaDb Driver * Pac4j * Guava * FontAwesome * Nimbus * Apache Ignite Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.1.0+RC5+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&title=CAS+6.1.0+RC5+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&title=CAS+6.1.0+RC5+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&name=CAS+6.1.0+RC5+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&title=CAS+6.1.0+RC5+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&title=CAS+6.1.0+RC5+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2019%2F09%2F02%2F610rc5-release%2F&t=CAS+6.1.0+RC5+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.2.0 RC2 Feature Release – Apereo Community Blog CAS 5.2.0 RC2 Feature Release ============================= Friday, Aug 4, 2017 10 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.1.0` GA was released on [May 27th 2017](https://github.com/apereo/cas/releases/tag/v5.1.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.2.0`. This post intends to highlight some of the improvements and enhancements packed into the _second_ release candidate in the `5.2.0` series. The in-development documentation of CAS `5.2.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read more about the previous release candidate [here](https://apereo.github.io/2017/06/30/520rc1-release/) . * [Minors](https://apereo.github.io/2017/08/04/520rc2-release/#minors) * [Default Theme For Services](https://apereo.github.io/2017/08/04/520rc2-release/#default-theme-for-services) * [Authentication Plan Configurators](https://apereo.github.io/2017/08/04/520rc2-release/#authentication-plan-configurators) * [Authentication Graph](https://apereo.github.io/2017/08/04/520rc2-release/#authentication-graph) * [Dynamic Authentication Policies](https://apereo.github.io/2017/08/04/520rc2-release/#dynamic-authentication-policies) * [Configuration Documentation](https://apereo.github.io/2017/08/04/520rc2-release/#configuration-documentation) * [What does this mean for you?](https://apereo.github.io/2017/08/04/520rc2-release/#what-does-this-mean-for-you) * [Why not use plain markdown instead?](https://apereo.github.io/2017/08/04/520rc2-release/#why-not-use-plain-markdown-instead) * [Configuration Metadata Server](https://apereo.github.io/2017/08/04/520rc2-release/#configuration-metadata-server) * [Apache Fortress Integration](https://apereo.github.io/2017/08/04/520rc2-release/#apache-fortress-integration) * [SQRL Authentication Support](https://apereo.github.io/2017/08/04/520rc2-release/#sqrl-authentication-support) * [Encryption/Signing Log Messages](https://apereo.github.io/2017/08/04/520rc2-release/#encryptionsigning-log-messages) * [Clustered Service Replication](https://apereo.github.io/2017/08/04/520rc2-release/#clustered-service-replication) * [Gradle Build Performance](https://apereo.github.io/2017/08/04/520rc2-release/#gradle-build-performance) * [Service Definition File Checking](https://apereo.github.io/2017/08/04/520rc2-release/#service-definition-file-checking) * [Scripted Username Providers](https://apereo.github.io/2017/08/04/520rc2-release/#scripted-username-providers) * [Attribute Consent](https://apereo.github.io/2017/08/04/520rc2-release/#attribute-consent) * [SAML2 Metadata Expiration](https://apereo.github.io/2017/08/04/520rc2-release/#saml2-metadata-expiration) * [Swagger Documentation](https://apereo.github.io/2017/08/04/520rc2-release/#swagger-documentation) * [CAS Demos](https://apereo.github.io/2017/08/04/520rc2-release/#cas-demos) * [Multimapped Attributes](https://apereo.github.io/2017/08/04/520rc2-release/#multimapped-attributes) * [Password Management](https://apereo.github.io/2017/08/04/520rc2-release/#password-management) * [REST Attribute Repository](https://apereo.github.io/2017/08/04/520rc2-release/#rest-attribute-repository) * [Scripted Attribute Repositories](https://apereo.github.io/2017/08/04/520rc2-release/#scripted-attribute-repositories) * [Surrogate Authn via JDBC](https://apereo.github.io/2017/08/04/520rc2-release/#surrogate-authn-via-jdbc) * [Library Upgrades](https://apereo.github.io/2017/08/04/520rc2-release/#library-upgrades) * [What’s Next?](https://apereo.github.io/2017/08/04/520rc2-release/#whats-next) * [Get Involved](https://apereo.github.io/2017/08/04/520rc2-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/08/04/520rc2-release/#das-ende) Minors ------ * Service access strategies based on principal attributes should now correctly be enforced prior to jumping into subsequent factors of authentication. * Thanks to [@gbatalski](https://github.com/gbatalski) , JWT authentication in CAS is now able to support base64-encoded secrets. * Thanks to [@benht](https://github.com/benht) , expired tickets are now properly removed from CAS when using MongoDb ticket registry. * Thanks to [@klewczuk](https://github.com/klewczuk) , refresh tokens are no longer auto-generated when using grant type `refresh_token`. * Thanks to [@WhiteMarlin](https://github.com/WhiteMarlin) , a number of reference to `Jasig` are now removed from CAS language bundles. * Database drivers are now defined to be available at `runtime` via the published POM, so they can be included in the overlay. * Groovy/Scripting utilities are cleaned up to use a consistent strategy across the codebase where needed. * MongoDb Ticket/Service registry configuration is now able to take advantage of distinct unique group of settings. * YAML service registry bean is now properly renamed so it can honor `@Conditional` annotations. * Thanks to [@pdrados](https://github.com/pdrados) , throttled authentication attempts are better explained in the UI via a new http status code. * Service registry initialization from JSON is now able to honor service definitions found at the path specified via settings, rather than only loading those found on the classpath’s `services` directory. * Thanks to [@bbooth](https://github.com/bbooth) , password management flows now correctly register a password update state. * Thanks to [@swoeste](https://github.com/swoeste) , URL validation is now provided an option to support `localhost` type urls, when dealing with things such as SLO. * Thanks to [@tduehr](https://github.com/tduehr) , generating random strings that specially affect ticket ids and such are now improved to use more secure algorithms and strategies. Default Theme For Services -------------------------- Thanks to [@swoeste](https://github.com/swoeste) , the CAS default theme is now also consulted by registered services. Services still have the ability to define a specific theme and have it be resolved by the theme resolution machinery, but if no theme is defined, services are now given the ability to fall back onto the default theme specified by `cas.theme.defaultThemeName`. Authentication Plan Configurators --------------------------------- All configuration components in CAS that register authentication handlers into the runtime engine have now become their own `@Bean` marked as `@Conditional` for easier overrides. Authentication Graph -------------------- The CAS statistics page now boasts the ability to present authentication events as a chart. Dynamic Authentication Policies ------------------------------- Additional authentication policies are now made available to check account status and state via Groovy and REST endpoints. This is useful in the event that the underlying authentication scheme does not provide a way to check for account status and you wish to resort to more elaborate means of enforcing policies dynamically. [See this guide for more info](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#authentication-policy) . Configuration Documentation --------------------------- [×](https://apereo.github.io/2017/08/04/520rc2-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. The entire CAS configuration model is now annotated and documented using Javadocs. The build process is also augmented to scan the configuration model and produce a _repository_ of all settings, groups, etc along with their description, values, hints and documentation. This repository is then later used by the CAS configuration metadata server to allow deployers to query settings via REST or CLI tools. In future releases, GUIs will also be able to auto-initialize a module using relevant settings that are sorted and ranked from the same repository instance. ### What does this mean for you? In cleaning up the configuration model and in order to maximize reuse, a number of duplicate settings were moved around and refactored so as so to allow centralization of documentation items without having to duplicate notes and descriptions. At a high level, the following category of settings are cleaned up and made reusable: * Various `encryptionKey` and `signingKey` settings were duplicated throughout the codebase. These are now cleaned up so that for instance every component that requires access to crypto-related settings now hosts `crypto.encryption` and `crypto.signing` settings that house keys and settings in a reusable way. * The same strategy is also applied to scheduler-related tasks that define `repeatInterval` and `startUpDelay` where these are moved to a parent reusable component that is usually noted by the `schedule` key name (i.e. `cas.xyz.schedule.repeatInterval` rather than `cas.xyz.repeatInterval`). * Properties that referenced a Spring-managed resource prior to this release took the form of `cas.setting.config.location`. These are now cleaned up to simply define the resource as `cas.setting.location`. * Explicit properties are now made available for both JSON and YAML service registries in form of `cas.service-registry.json` and `cas.service-registry.yaml`. In your own local configuration, you will need to adjust key names to match the new locations. ### Why not use plain markdown instead? This all means that rather than documenting every single setting and key in the project documentation via markdown, the project documentation specially for settings and configuration now sits right beside the setting itself. This not only turns documentation into working code, and it not only provides additional processing power and querying to be done on the setting, it furthermore allows the codebase to automate the requirement of documentation for settings as well and fail the build in case something goes undocumented. Note that this is just a _very modest_ starting point and the field descriptions that now are available for settings will continually need to be improved, revised and expanded. Writing good documentation for adopters who step forward with varying levels of skill is a very difficult and delicate task and good-enough is usually never enough. You’re encouraged to continually improve the docs and explain things to the level you deem appropriate for your own audience. Configuration Metadata Server ----------------------------- The metadata server is an interactive CLI tool that allows one to query the CAS configuration metadata and learn more about propeties, groups, etc. The configuration metadata repository is built and generated for every CAS build and release and the metadata server is then simply tasked to query the database and respnd to commands. The server ships with both a CLI as well as interactive shell interface. [See this guide](https://apereo.github.io/cas/development/installation/Configuration-Metadata-Repository.html) for more info. Apache Fortress Integration --------------------------- Thanks to [@yudhik](https://github.com/yudhik) , CAS gains integration support with Apache Fortress. Apache Fortress is a standards-based access management system that provides role-based access control, delegated administration and password policy services with LDAP. Read more about the CAS integration [here](https://apereo.github.io/cas/development/integration/Configuring-Fortress-Integration.html) . SQRL Authentication Support --------------------------- Modest amount of work has been done to begin support for the [SQRL Protocol](https://apereo.github.io/cas/development/protocol/SQRL-Protocol.html) . This is very much in an experimental state as both the specification as well as client implementations today are rather incomplete and in flux. This will eventually be ironed out, provied the finalization of the protocol spec itself. Encryption/Signing Log Messages ------------------------------- In certain cases where CAS begins to generate keys for signing/encryption tasks, there are now additional log messages that indicate the setting name under which the newly generated key must be placed. 2017-07-24 07:29:26,249 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - 2017-07-24 07:29:26,259 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - Clustered Service Replication ----------------------------- CAS gains the ability to replicate and redistribute registered service definition files across the cluster via Hazelcast and more. [See this guide](https://apereo.github.io/cas/development/installation/Configuring-Service-Replication.html) to learn more. Gradle Build Performance ------------------------ Internally, the CAS Gradle build is readjusted to ensure required build repositories are only made available to submodules that need them for artifacts, which should allow for much faster load times when the project is loaded into a development environment in a non-offline mode manner. Service Definition File Checking -------------------------------- In the event that a resource-based service registry is employed (i.e. JSON, YAML), additional checks are now built in to ensure that the service files are named appropriately. Scripted Username Providers --------------------------- CAS gains the ability to use Java’s native scripting functionality for username attribute providers to support [Groovy, Javascript and Python](https://apereo.github.io/cas/development/integration/Attribute-Release-PrincipalId.html) scripts. Attribute Consent ----------------- At last, CAS provides the ability to enforce [user-informed consent](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) upon attribute release. SAML2 Metadata Expiration ------------------------- SAML2 services now gain the ability to define an expiration duration for their metadata. If left undefined, a global default will be used for all resolved metadata in the cache. Swagger Documentation --------------------- CAS is now able to auto-generate [API documentation](https://apereo.github.io/cas/development/integration/Swagger-Integration.html) for all endpoints, controllers and REST services, via Swagger. CAS Demos --------- [×](https://apereo.github.io/2017/08/04/520rc2-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. A number of URLs for [CAS demos](https://apereo.github.io/cas/development/#demos) running on Heroku have changed. Multimapped Attributes ---------------------- CAS gains the ability to map and rename the same attribute definition multiple times to different names. This can be done either as part of attribute retrieval or at release time. Password Management ------------------- [×](https://apereo.github.io/2017/08/04/520rc2-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. [Password management functionality](https://apereo.github.io/cas/development/installation/Password-Management.html) in CAS is now broken up into distinct modules depending on the backened storage service in use. REST Attribute Repository ------------------------- CAS gains the ability to [contact REST endpoints](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#rest) to resolve attributes. Scripted Attribute Repositories ------------------------------- CAS gains the ability to use Java’s native scripting functionality for attribute repository sources to support [Groovy, Javascript and Python](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#pythonjavascriptgroovy) scripts to resolve and retrieve attributes. Surrogate Authn via JDBC ------------------------ CAS gains the ability to support [surrogate authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) via JDBC resources. Library Upgrades ---------------- * Apache Tomcat * Eureka * Spring Boot admin * Spring * Spring Boot * Pac4J * Amazon SDK * Spring Cloud * Jose4J * Apache CXF * Postgresql driver * MariaDb driver * MySQL driver * Couchbase * Apache Cassandra * Gradle * Hazelcast * Ldaptive What’s Next? ------------ We are all working to make sure the CAS `5.2.0` release is on [schedule](https://github.com/apereo/cas/milestones) . Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.2.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&title=CAS+5.2.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&title=CAS+5.2.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&name=CAS+5.2.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&title=CAS+5.2.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&title=CAS+5.2.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F08%2F04%2F520rc2-release%2F&t=CAS+5.2.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.3.0 RC4 Feature Release – Apereo Community Blog CAS 5.3.0 RC4 Feature Release ============================= Friday, May 25, 2018 10 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.2.0` GA was released on [November 27th, 2017](https://github.com/apereo/cas/releases/tag/v5.2.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.3.0`. This post intends to highlight some of the improvements and enhancements packed into the **fourth** release candidate in the `5.3.0` series. The in-development documentation of CAS `5.3.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read about the previous release candidate [here](https://apereo.github.io/2018/03/30/530rc3-release/) . * [Shake Well Before Use](https://apereo.github.io/2018/05/25/530rc4-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2018/05/25/530rc4-release/#apache-maven) * [Gradle](https://apereo.github.io/2018/05/25/530rc4-release/#gradle) * [Minors](https://apereo.github.io/2018/05/25/530rc4-release/#minors) * [Delegated Authentication & MFA](https://apereo.github.io/2018/05/25/530rc4-release/#delegated-authentication-&-mfa) * [Password Management Email Notifications](https://apereo.github.io/2018/05/25/530rc4-release/#password-management-email-notifications) * [Interrupt Notifications](https://apereo.github.io/2018/05/25/530rc4-release/#interrupt-notifications) * [SAML2 Service Providers](https://apereo.github.io/2018/05/25/530rc4-release/#saml2-service-providers) * [Multifactor Authentication Trusted Devices](https://apereo.github.io/2018/05/25/530rc4-release/#multifactor-authentication-trusted-devices) * [Passwordless Authentication](https://apereo.github.io/2018/05/25/530rc4-release/#passwordless-authentication) * [Custom CAS Settings](https://apereo.github.io/2018/05/25/530rc4-release/#custom-cas-settings) * [AWS ElastiCache for Memcached](https://apereo.github.io/2018/05/25/530rc4-release/#aws-elasticache-for-memcached) * [AWS Simple Notification Service for SMS](https://apereo.github.io/2018/05/25/530rc4-release/#aws-simple-notification-service-for-sms) * [JWT Service Tickets](https://apereo.github.io/2018/05/25/530rc4-release/#jwt-service-tickets) * [AWS Secrets Manager](https://apereo.github.io/2018/05/25/530rc4-release/#aws-secrets-manager) * [RESTful View Resolution](https://apereo.github.io/2018/05/25/530rc4-release/#restful-view-resolution) * [AWS S3 Buckets](https://apereo.github.io/2018/05/25/530rc4-release/#aws-s3-buckets) * [Command-line Shell Commands](https://apereo.github.io/2018/05/25/530rc4-release/#command-line-shell-commands) * [SAML 1.1 Validations](https://apereo.github.io/2018/05/25/530rc4-release/#saml-11-validations) * [Library Upgrades](https://apereo.github.io/2018/05/25/530rc4-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2018/05/25/530rc4-release/#get-involved) * [Credits](https://apereo.github.io/2018/05/25/530rc4-release/#credits) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following tag to match below: 5.3.0-RC4 ### Gradle In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-gradle-overlay-template) , adjust the following setting to match below: cas.version=5.3.0-RC4 Minors ------ * Thanks to [@leleuj](https://github.com/leleuj) , validation of OAuth and OpenID Connect requests gain improvements in terms of protocol compatibility. * The rendering syntax of CAS attributes in the validation response can now be controlled using CAS settings to enable inline rendering. (i.e. ``) * Thanks to [@frett](https://github.com/frett) , the initialization of the login webflow is fixed to only execute once. * Refreshing CAS configuration should allow for re-initialization of the service registry, if CAS is configured to populate the service registry database from JSON service files. * Thanks to [@NgSekLong](https://github.com/NgSekLong) , the validation of the OAuth `client_secret` parameter is made optional if it’s left undefined for the OAuth service. * CAS test coverage has improved slightly with a number of additional tests where now coverage is at `67%` and growing. * Auditing a _password change_ operation using the [CAS password management](https://apereo.github.io/cas/development/installation/Password-Management.html) features is fixed to correctly catalog failures. * Static analysis is now turned on [CAS CI builds](https://travis-ci.org/apereo/cas/builds) using FindBugs by default as well as Checkstyle. The builds are also taking advantage of the OWASP Dependency Check plugin for Gradle to auto-scan libraries used by CAS and fail the build in case a relevant CVE is found in the CAS distribution. * Thanks to [@williame-uah](https://github.com/williame-uah) , the `encryptionSecretSize` parameter is fixed in CAS command-line shell to remove the duplicate name. * Handling LDAP account states to process warnings, etc can now be separately turned on via CAS configuration, as part of the password policy settings. * Thanks to [@tsschmidt](https://github.com/tsschmidt) , the strategy for calculating service registry file names can now be customized in a pluggable way. This in particular has a benefit of allowing the management web application to provide customized naming strategies for resources as they are tracked in source control and Git, etc. * A number of internal changes to SAML2 metadata resolution in order to improve performance and memory use. * Annotation processing behavior has been restored to account for CAS extensions of Log4j, as well as correctly generating configuration metadata. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , a number of bugs that affect Twitter’s OAuth1 requests and responses when dealing with delegated authentication in CAS are now fixed. * Logout management in CAS is modified to be able to internally handle submitting logout notifications to multiple URLs associated with a single application. * A Groovy implementation is now made available for `PrincipalFactory` objects that may be used inside custom configuration classes in areas where principal resolution needs unusual changes. * Thanks to [@tduehr](https://github.com/tduehr) , various number of improvements are applied to the CAS internal Gradle build to ensure tests can be run in categories. * Thanks to [@tsschmidt](https://github.com/tsschmidt) , the pattern to recognize domains in registered services is now improved. * Thanks to [@ringmaster217](https://github.com/ringmaster217) , the `iat` field in JWTs generated for OpenID Connect when tokens are introspected is fixed to be based on seconds instead of milliseconds. * A series of minor improvements to the [Surrogate authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) functionality when surrogate accounts are looked up from LDAP. * [SAML2 metadata resolution](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#dynamic-metadata) caching strategies are better improved in this release to improve performance and reduce memory use. * Thanks to [@fcrespel](https://github.com/fcrespel) , token revocation features of CAS running in OpenID Connect mode are made more compliant with the specification. * Delegated authentication can now directly build the final authenticated principal using an attribute from the provided user profile. * JAAS authentication is given the ability in settings to handle password policy enforcements. Furthermore, both JAAS and [Surrogate authentication](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) are given dedicated settings to control how a CAS authenticated principal should be constructed. This behavior was typically controlled more globally before via Person Directory settings. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , delegated authentication is able to properly reconstruct the service authentication request, once the flow has returned from the provider and CAS is getting ready to produce a response. * Special `CipherExecutor` components are added to handle signing and encryption decoding/encoding operations using RSA key-pairs. * Thanks to [@fcrespel](https://github.com/fcrespel) , french translations of the CAS message bundles are now made up-to-date. * The configuration file for JAAS-based authentications may now be loaded directly from CAS settings. * When preparing SAML2 responses, the subject locality field is fixed to include the address of the CAS server instead of the service provider. * Anonymous username identifiers are now set to correctly encode and digest values that may be used for persistent identifiers. * Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , delegated authentication to Twitter gains support to retrieve and process the profile email address. * Database authentication in [query mode](https://apereo.github.io/cas/development/installation/Database-Authentication.html) can now process and accept named sql parameters in the SQL query. * Thanks to [@bdavids1](https://github.com/bdavids1) , the Duo Security iframe is improved to display properly specially on mobile devices per the recommendations available [here](https://duo.com/docs/duoweb) . Delegated Authentication & MFA ------------------------------ [Delegating authentication events to ADFS](https://apereo.github.io/cas/development/integration/ADFS-Integration.html) as well as [all other external identity providers](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) are now revisited to handle multifactor authentication flows better, once the flow travels back from the identity provider to CAS after authentication. Password Management Email Notifications --------------------------------------- **WATCH OUT!** This is a breaking change. Review your settings and be sure to adjust. Settings that control email notifications for password reset operations are placed under a `mail` setting to be consistent with all other properties. As a result, the email notification operations of password reset gain small improvements to honor CC and BCC flags defined in configuration. Interrupt Notifications ----------------------- [CAS Interrupt Notifications](https://apereo.github.io/cas/development/installation/Webflow-Customization-Interrupt.html#regex-attribute) can now be triggered using authentication/principal attributes using regular expression patterns. Furthermore, notifications may now be skipped on a per-service basis by assigning tags and properties to the service definition. SAML2 Service Providers ----------------------- The following new [SAML2 service providers](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) are now supported by CAS out of the box: * WarpWire * BlackBaud * GiveCampus * RocketChat Multifactor Authentication Trusted Devices ------------------------------------------ **WATCH OUT!** You may need to adjust the underlying schema used to store trusted device records to handle the new date type. The change affects all storage options that support keeping track of trusted device records. Handling [trusted devices](https://apereo.github.io/cas/development/installation/Multifactor-TrustedDevice-Authentication.html) for multifactor authentication receives a number of fixed to handle device expiration time units better. As a result of this change, the trusted device record date is switched from `LocalDate` to `LocalDateTime` in order to support hours, minutes and seconds. Passwordless Authentication --------------------------- An initial draft of [Passwordless Authentication](https://apereo.github.io/cas/development/installation/Passwordless-Authentication.html) is now available. This is a form of authentication in CAS where passwords take the form of tokens that expire after a configurable period of time, and are sent to users using email, text messages, etc. Custom CAS Settings ------------------- In order to extend the collection of CAS settings, most adopters might have had to introduce a new configuration namespace into CAS and have it be recognized using a custom `@ConfigurationProperties` type of component. In this release candidate, a `custom` category is introduced as a `Map` that can house all arbitrary settings. Furthermore, the entire collection of CAS settings including the `custom` category of course is made available to all components, [webflow states and CAS views](https://apereo.github.io/cas/development/installation/Webflow-Customization.html#custom-settings) in particular, so that views can be customized or altered using any of the defined CAS configuration properties. AWS ElastiCache for Memcached ----------------------------- For [memcached integrations](https://apereo.github.io/cas/development/installation/Memcached-Ticket-Registry.html) , CAS is now able to provide a native module that is able to seamlessly integrate with AWS ElastiCache. This is mostly a drop-in replacement for the spymemcached. **WATCH OUT!** The memcached support modules in CAS no longer take the opinionated approach of presenting a memcached client library. The choices are now presented as separated modules that you are to choose and then stuff into your overlay. If you are unsure what to choose, choose spymemcached. AWS Simple Notification Service for SMS --------------------------------------- Support is now included to take advantage of [AWS SNS](https://apereo.github.io/cas/development/installation/SMS-Messaging-Configuration.html) for sending SMS messages. **WATCH OUT!** As par of this change, the configuration of various SMS providers is now moved into a parent `cas.smsProviders` category. Please review your settings and adjust. JWT Service Tickets ------------------- Encryption and signing keys use to allow CAS to encode a [JWT as a service ticket](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html) may now be defined on a per-service basis. Furthermore, extra test cases are added to ensure the generated JWT is not doubly encoded in base64 syntax. AWS Secrets Manager ------------------- CAS configuration settings may now be managed and located using [AWS Secrets Manager](https://apereo.github.io/cas/development/installation/Configuration-Server-Management.html#spring-cloud) . RESTful View Resolution ----------------------- CAS views can now be resolved using an external URL in [RESTful ways](https://apereo.github.io/cas/development/installation/User-Interface-Customization-Views.html) . AWS S3 Buckets -------------- CAS configuration properties can now also be fetched from [AWS S3 buckets](https://apereo.github.io/cas/development/installation/Configuration-Server-Management.html#amazon-s3) . Similarly, SAML metadata documents for various service providers may also be managed using [AWS S3 buckets](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html) . Command-line Shell Commands --------------------------- CAS [command-line shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) receives a few additional commands in order to verify connectivity to LDAP servers and to test connections to endpoints useful for verifying SSL configuration, etc. The endpoint validation is further enhanced by [@jtgasper3](https://github.com/jtgasper3) to include details that can be used to troubleshoot failed https client connection. SAML 1.1 Validations -------------------- SAML1.1 ticket validation is cleaned up to parse and extract the validation payload from the request body more accurately, relying less on manual parsing of input. The extraction logic also includes a small bit of caching of the request body in order to allow upstream components to process a given http request’s body for other types of functionality, essentially making the request body reusable and re-parseable for the entire transaction. Library Upgrades ---------------- * Amazon SDK * Commons Text * Mockito * AspectJ * JavaParser * Jool * CosmosDb * Jackson * Spring * HikariCP * Spring Boot * Apache Tomcat * Hibernate * Caffeine * Guava * Kryo * Pac4j * Apache Ignite * Log4j Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.3.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&title=CAS+5.3.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&title=CAS+5.3.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&name=CAS+5.3.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&title=CAS+5.3.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&title=CAS+5.3.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F05%2F25%2F530rc4-release%2F&t=CAS+5.3.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.2.x Deployment - WAR Overlays – Apereo Community Blog CAS 5.2.x Deployment - WAR Overlays =================================== Tuesday, Feb 6, 2018 14 minute read This is a short and sweet tutorial on how to deploy CAS via [the WAR Overlay method](https://apereo.github.io/cas/5.2.x/installation/Maven-Overlay-Installation.html) . This tutorial specifically requires and focuses on: * CAS `5.2.x` * Java 8 **Need Help?** If you ever get stuck and are in need of additional assistance, start by reviewing the suggestions [provided here](https://apereo.github.io/cas/5.2.x/installation/Troubleshooting-Guide.html) . You may also look at available support options [provided here](https://apereo.github.io/cas/Support.html) . Overlay…What? ============= Overlays are a strategy to combat repetitive code and/or resources. Rather than downloading the CAS codebase and building it from source, overlays allow you to download a pre-built vanilla CAS web application server provided by the project itself, override/insert specific behavior into it and then merge it all back together to produce the final (web application) artifact. You can find a lot more about how overlays work [here](https://apereo.github.io/cas/5.2.x/installation/Maven-Overlay-Installation.html) . The concept of the WAR Overlay is NOT a CAS invention. It’s specifically an Apache Maven feature and of course, there are techniques and plugins available to apply the same concept to Gradle-based builds as well.You are free to choose between Maven or Gradle. For this tutorial, I opted into the [Maven WAR overlay](https://github.com/apereo/cas-overlay-template) . Once you have forked and cloned the repository locally, you’re ready to begin. **Note** Remember to switch to the appropriate branch. Today, the `master` branch of the repository applies to CAS `5.2.x` deployments. That may not necessarily remain true when you start your own deployment. So examine the branches and make sure you `checkout` the one matching your intended CAS version. Overlay’s Anatomy ================= Similar to Grey’s, a _Maven_ WAR overlay is composed of several facets the most important of which is the `pom.xml` file. This is a build descriptor file whose job is to teach Apache Maven how to obtain, build, configure (and in certain cases deploy) artifacts. **KISS** You do not need to download Apache Maven separately. The project provides one for you automatically with the embedded Maven Wrapper. The `pom.xml` is composed of several sections. The ones you need to worry about are the following. Properties ---------- 5.2.2 1.5.8.RELEASE 1.8 1.8 -tomcat UTF-8 This is the bit that describes build settings, and specifically, here, what versions of CAS, Spring Boot, and Java are required for the deployment. You are in practice mostly concerned with the `` setting and as new (maintenance) releases come out, it would be sufficient to simply update that version and re-run the build. This might be a good time to review the CAS project’s [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) as well as [Maintenance Policy](https://apereo.github.io/cas/developer/Maintenance-Policy.html) . Dependencies ------------ The next piece describes the _dependencies_ of the overlay build. These are the set of components almost always provided by the CAS project that will be packaged up and put into the final web application artifact. At a minimum, you need to have the `cas-server-webapp-${app.server}` module available because that is the web application into which you intend to inject your settings and customizations if any. Also, note that the module declarations are typically configured to download the CAS version instructed by the property `${cas.version}`. Here is an example: org.apereo.cas cas-server-webapp${app.server} ${cas.version} war runtime Including a CAS module/dependency in the `pom.xml` simply advertises to CAS _your intention_ of turning on a new feature or a variation of a current behavior. Do NOT include something in your build just because it looks and sounds cool. Remember that the point of an overlay is to only keep track of things you actually need and care about, and no more. **Remember** Keep your build clean and tidy. A messy build often leads to a messy deployment, complicates your upgrade path and is a documented cause of early hair loss. Keep changes down to the absolute essentials and document their need for your deployment. If you review the configuration a year from now, you should have an idea of why things are the way they are. And What About…? ---------------- There are many other pieces in the `pom.xml`, such as repositories, profiles, plugins, etc that I skipped. For everything else, there is MasterCard…and of course the official [Apache Maven guides](http://maven.apache.org/guides/) . Enjoy! The Build ========= Now that you have a basic understanding of the build descriptor, it’s time to actually run the build. An Apache Maven build is often executed by passing specific goals/commands to Apache Maven itself, aka `mvn`. So for instance in the terminal and once inside the project directory you could execute things like: cd cas-overlay-template mvn clean …which may be a problem if you don’t have already have Apache Maven downloaded and installed. While you can do that separate install, the WAR Overlay project provides you with an embedded Apache Maven instance whose job is to first determine whether you have Maven installed and if not, download and configure one for you based on the project’s needs. So you can replace that command above with: cd cas-overlay-template mvnw clean …which may be a problem because, how are you supposed to know what commands/goals can be passed to the build? You can [study them](https://maven.apache.org/guides/introduction/introduction-to-the-lifecycle.html) for sure, but the project provides you with a shell script that wraps itself around the Maven wrapper and provides an easy facade for you to remember commands and their use. This is the `build.sh` file, which you can run as such: cd cas-overlay-template ./build.sh help Usage: build.sh [copy|clean|package|run|debug|bootrun] What do these commands do? | Type | Description | | --- | --- | | `copy` | Copies the configuration from the local `etc/cas/config` directory to `/etc/cas/config`. [See this guide](https://apereo.github.io/cas/5.2.x/installation/Configuration-Server-Management.html)
to learn more. | | `clean` | Deletes any previously-built and leftover artifacts from the `target` directory. | | `package` | Runs `clean` and `copy`. Then packages the CAS web application artifact and run through the overlay to inject local customizations. The outcome is a `target/cas.war` file which is ready to be deployed. | | `run` | Involves `package` and then deploys and runs the CAS web application via its own embedded server container. | | `debug` | Same thing as `run`, except that you can remote-debug the CAS web application over port `5000`. | | `bootrun` | Same thing as `run`, except the deployment is managed by the [Spring Boot Maven plugin](http://docs.spring.io/spring-boot/docs/current/reference/html/build-tool-plugins-maven-plugin.html)
. This command has very specialized and limited use cases. Please [review this issue](https://github.com/apereo/cas/issues/2334)
to learn more. | **Remember** Docs grow old. Always consult the overlay project's `README` file to keep to date. As an example, here’s what I see if I were to run the `package` command: ./build.sh copy package Creating configuration directory under /etc/cas Copying configuration files from etc/cas to /etc/cas/config etc/cas/config/application.yml -> /etc/cas/config/application.yml etc/cas/config/cas.properties -> /etc/cas/config/cas.properties etc/cas/config/log4j2.xml -> /etc/cas/config/log4j2.xml [INFO] Scanning for projects... [INFO] [INFO] Using the MultiThreadedBuilder implementation with a thread count of 5 [INFO] [INFO] ------------------------------------------------------------------------ [INFO] Building cas-overlay 1.0 [INFO] ------------------------------------------------------------------------ [INFO] [INFO] --- maven-clean-plugin:2.5:clean (default-clean) @ cas-overlay --- [INFO] [INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ cas-overlay --- [INFO] Using 'UTF-8' encoding to copy filtered resources. [INFO] skip non existing resourceDirectory /cas-overlay-template/src/main/resources [INFO] [INFO] --- maven-compiler-plugin:3.3:compile (default-compile) @ cas-overlay --- [INFO] No sources to compile [INFO] [INFO] --- maven-resources-plugin:2.6:testResources (default-testResources) @ cas-overlay --- [INFO] Using 'UTF-8' encoding to copy filtered resources. [INFO] skip non existing resourceDirectory /cas-overlay-template/src/test/resources [INFO] [INFO] --- maven-compiler-plugin:3.3:testCompile (default-testCompile) @ cas-overlay --- [INFO] No sources to compile [INFO] [INFO] --- maven-surefire-plugin:2.12.4:test (default-test) @ cas-overlay --- [INFO] No tests to run. [INFO] [INFO] --- maven-war-plugin:2.6:war (default-war) @ cas-overlay --- [INFO] Packaging webapp [INFO] Assembling webapp [cas-overlay] in [/cas-overlay-template/target/cas] [info] Copying manifest... [INFO] Processing war project [INFO] Processing overlay [ id org.apereo.cas:cas-server-webapp-tomcat] [INFO] Webapp assembled in [786 msecs] [INFO] Building war: /cas-overlay-template/target/cas.war [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------ ... You can see that the build attempts to download, clean, compile and package all artifacts, and finally, it produces a `/cas-overlay-template/target/cas.war` which you can then use for actual deployments. **Remember** You are allowed to pass any of Maven's native command-line arguments to the `build.sh` file. Things like `-U` or `-X` might be useful to have handy. Configuration ============= I am going to skip over the configuration of `/etc/cas/config` and all that it deals with. If you need the reference, you may always [use this guide](https://apereo.github.io/cas/5.2.x/installation/Configuration-Management.html) to study various aspects of CAS configuration. Suffice it to say that, quite simply, CAS deployment expects _the main_ configuration file to be found under `/etc/cas/config/cas.properties`. This is a key-value store that is able to dictate and alter the behavior of the running CAS software. As an example, you might encouter something like: cas.server.name=https://cas.example.org:8443 cas.server.prefix=https://cas.example.org:8443/cas logging.config=file:/etc/cas/config/log4j2.xml …which at a minimum, identifies the CAS server’s URL and prefix and instructs the running server to locate the logging configuration at `file:/etc/cas/config/log4j2.xml`. The overlay by default ships with a `log4j2.xml` that you can use to customize logging locations, levels, etc. Note that the presence of all that is contained inside `/etc/cas/config/` is optional. CAS will continue to fall back onto defaults if the directory and the files within are not found. Keep Track ---------- It is **VERY IMPORTANT** that you contain and commit the entire overlay directory (save the obvious exclusions such as the `target` directory) into some sort of source control system, such as `git`. Treat your deployment just like any other project with tags, releases, and functional baselines. Registering Applications ======================== Client applications that wish to use the CAS server for authentication must be registered with the server apriori. CAS provides a number of [facilities to keep track of the registration records](https://apereo.github.io/cas/5.2.x/installation/Service-Management.html#storage) and you may choose any that fits your needs best. In more technical terms, CAS deals with service management using two specific components: Individual implementations that support a form of a database are referred to as _Service Registry_ components and they are many. There is also a parent component that sits on top of the configured service registry as more of an orchestrator that provides a generic facade and entry point for the rest of CAS without entangling all other operations and subsystems with the specifics and particulars of a storage technology. In this tutorial, we are going to try to configure CAS with [the LDAP service regitry](https://apereo.github.io/cas/5.2.x/installation/LDAP-Service-Management.html) . Configuration ------------- First, ensure you have declared the appropriate module/intention in the build: org.apereo.cas cas-server-support-ldap-service-registry ${cas.version} Next, you must teach CAS how to contact the LDAP server to read and write registration records. This is done in the `cas.properties` file: cas.service-registry.initFromJson=false cas.service-registry.ldap.ldap-url=ldaps://ldap1.example.edu ldaps://ldap2.example.edu cas.service-registry.ldap.baseDn=dc=example,dc=org cas.service-registry.ldap.bindDn=cn=Directory Manager,dc=example,dc=org cas.service-registry.ldap.bindCredential=Password **LDAP Schema** Service definitions are by default stored inside the `description` attribute as JSON objects with the objectClass `casRegisteredService`. The numeric identifier for each service definition that is used for lookups and search operations is also kept under attribute `uid` all of which you can of course customize. The format and syntax of the JSON is identical to that of JSON Service Registry. That’s all, as far as the schema goes. That’s all. Next, you will need to pre-populate the LDAP server with registration records manually, or better yet, use the [CAS Management web application](https://apereo.github.io/cas/5.2.x/installation/Installing-ServicesMgmt-Webapp.html) ’s user interface to do so in more interactive terms. To populate the LDAP server manually, remember that there is no pre-defined fancy schema where a registration record in CAS would be broken apart and mapped to individual attributes one by one. The body of the registration record, sampled below, is stored in LDAP under the designated attribute: { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "https://app.example.org", "name" : "ApplicationName", "id" : 1001, "evaluationOrder" : 10 } Ticketing ========= A robust CAS deployment requires the presence and configuration of an _internal_ database that is responsible for [keeping track of tickets](https://apereo.github.io/cas/5.2.x/installation/Configuring-Ticketing-Components.html) issued by CAS. CAS itself comes by default with a memory-based node-specific cache that is often more than sufficient for smaller deployments or certain variations of a [clustered deployment](https://apereo.github.io/cas/5.2.x/planning/High-Availability-Guide.html) . Just like the service management facility, large variety of databases and storage options are supposed by CAS under the facade of a _Ticket Registry_. In this tutorial, we are going to configure CAS to use a [Hazelcast Ticket Registry](https://apereo.github.io/cas/5.2.x/installation/Hazelcast-Ticket-Registry.html) with the assumption that our deployment is going to be deployed in an AWS-sponsored environment. Hazelcast Ticket Registry is often a decent choice when deploying CAS in a cluster and can take advantage of AWS’s native support for Hazelcast in order to read node metadata properly and locate other CAS nodes in the same cluster in order to present a common, global and shared ticket registry. This is an ideal choice that requires very little manual work and/or troubleshoot, comparing to using options such as Multicast or manually noting down the address and location of each CAS server in the cluster. Configuration ------------- First, ensure you have declared the appropriate module/intention in the build: org.apereo.cas cas-server-support-hazelcast-ticket-registry ${cas.version} Next, the AWS-specific configuration of Hazelcast would go into our `cas.properties`: cas.ticket.registry.hazelcast.cluster.discovery.enabled=true cas.ticket.registry.hazelcast.cluster.discovery.aws.accessKey=... cas.ticket.registry.hazelcast.cluster.discovery.aws.secretKey=... cas.ticket.registry.hazelcast.cluster.discovery.aws.region=us-east-1 cas.ticket.registry.hazelcast.cluster.discovery.aws.securityGroupName=... # cas.ticket.registry.hazelcast.cluster.discovery.aws.tagKey= # cas.ticket.registry.hazelcast.cluster.discovery.aws.tagValue= That should do it. Of course, if you are working on a more modest CAS deployment in an environment that is more or less owned by you and you prefer more explicit control over CAS node registrations in your cluster, the following settings would be more ideal: # cas.ticket.registry.hazelcast.cluster.instanceName=localhost # cas.ticket.registry.hazelcast.cluster.port=5701 # cas.ticket.registry.hazelcast.cluster.portAutoIncrement=true cas.ticket.registry.hazelcast.cluster.members=123.321.123.321,223.621.123.521,... Overlay Customization ===================== If I `cd` into the `target/cas` directory, I can see an _exploded_ version of the `cas.war` file. This is the directory that contains the results of the overlay process. Since I have not actually customized and overlaid anything yet, all configuration files simply match their default and are packaged as such. So as an example, let’s change something. Digging further down, I notice there exists a `/target/cas/WEB-INF/classes/messages.properties` file, which is [the default message bundle](https://apereo.github.io/cas/5.2.x/installation/User-Interface-Customization-Localization.html) . I decided that I am going to change the text associated with `screen.welcome.instructions`. **Remember** Do NOT ever make changes in the `target` directory. The changesets will be cleaned out and set back to defaults every time you do a build. Follow the overlay process to avoid surprises. First, I will need to move the file to my project directory so that Apache Maven during the overlay process can use that instead of what is provided by default. Here we go: cd cas-overlay-template mkdir -p src/main/resources cp target/cas/WEB-INF/classes/messages.properties src/main/resources/ Then I’ll leave everything in that file alone, except the line I want to change. ... screen.welcome.instructions=Speak Friend and you shall enter. ... Then I’ll package things up as usual. ./build.sh package ... [INFO] --- maven-war-plugin:2.6:war (default-war) @ cas-overlay --- [INFO] Packaging webapp [INFO] Assembling webapp [cas-overlay] in [/cas-overlay-template/target/cas] [info] Copying manifest... [INFO] Processing war project [INFO] Processing overlay [ id org.apereo.cas:cas-server-webapp-tomcat] [INFO] Webapp assembled in [1005 msecs] [INFO] Building war: /cas-overlay-template/target/cas.war [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS ... If I look at `target/cas/WEB-INF/classes/messages.properties` after the build, I should see that the overlay process has picked and overlaid onto the default _my version_ of the file. **Remember** Only overlay and modify files you actually need and try to use externalized resources and configuration as much as possible. Just because you CAN override something in the default package, it doesn't mean that you should. Deploy ====== You have a number of options when it comes to deploying the final `cas.war` file. [This post](https://apereo.github.io/2016/10/04/casbootoverlay/) should help. What About…? ============ * [CAS Multifactor Authentication with Duo Security](https://apereo.github.io/2018/01/08/cas-mfa-duosecurity/) * [CAS 5 LDAP AuthN and Jasypt Configuration](https://apereo.github.io/2017/03/24/cas51-ldapauthnjasypt-tutorial/) * [CAS 5 SAML2 Delegated AuthN Tutorial](https://apereo.github.io/2017/03/22/cas51-delauthn-tutorial/) For more content, [please see this link](https://apereo.github.io/tags/#CAS) . So… === It’s important that you start off simple and make changes one step at a time. Once you have a functional environment, you can gradually and slowly add customizations to move files around. I hope this review was of some help to you and I am sure that both this post as well as the functionality it attempts to explain can be improved in any number of ways. Please feel free to [engage and contribute](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) as best as you can. [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.2.x+Deployment+-+WAR+Overlays&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&title=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&title=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&name=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&title=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&title=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F06%2Fcas52-gettingstarted-overlay%2F&t=CAS+5.2.x+Deployment+-+WAR+Overlays "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.2.0 RC3 Feature Release – Apereo Community Blog CAS 5.2.0 RC3 Feature Release ============================= Friday, Sep 15, 2017 11 minute read **Collaborate** The contents of this blog are managed and hosted on Github. If you wish to update the contents of this post, please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.1.0` GA was released on [May 27th 2017](https://github.com/apereo/cas/releases/tag/v5.1.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.2.0`. This post intends to highlight some of the improvements and enhancements packed into the _third_ release candidate in the `5.2.0` series. The in-development documentation of CAS `5.2.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read more about the previous release candidate [here](https://apereo.github.io/2017/08/04/520rc2-release/) . * [Shake Well Before Use](https://apereo.github.io/2017/09/15/520rc3-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2017/09/15/520rc3-release/#apache-maven) * [Gradle](https://apereo.github.io/2017/09/15/520rc3-release/#gradle) * [Minors](https://apereo.github.io/2017/09/15/520rc3-release/#minors) * [Management Web Application Redesign](https://apereo.github.io/2017/09/15/520rc3-release/#management-web-application-redesign) * [Authentication Events](https://apereo.github.io/2017/09/15/520rc3-release/#authentication-events) * [InfluxDb Storage](https://apereo.github.io/2017/09/15/520rc3-release/#influxdb-storage) * [Caffein for Guava Caching](https://apereo.github.io/2017/09/15/520rc3-release/#caffein-for-guava-caching) * [SAML2 Service Provider Integrations](https://apereo.github.io/2017/09/15/520rc3-release/#saml2-service-provider-integrations) * [Monitoring](https://apereo.github.io/2017/09/15/520rc3-release/#monitoring) * [MongoDb](https://apereo.github.io/2017/09/15/520rc3-release/#mongodb) * [Ehcache](https://apereo.github.io/2017/09/15/520rc3-release/#ehcache) * [Memcached](https://apereo.github.io/2017/09/15/520rc3-release/#memcached) * [Authentication Interrupt](https://apereo.github.io/2017/09/15/520rc3-release/#authentication-interrupt) * [JMeter Performance Testing](https://apereo.github.io/2017/09/15/520rc3-release/#jmeter-performance-testing) * [Attribute Consent](https://apereo.github.io/2017/09/15/520rc3-release/#attribute-consent) * [LDAP Storage](https://apereo.github.io/2017/09/15/520rc3-release/#ldap-storage) * [Policy Per Service](https://apereo.github.io/2017/09/15/520rc3-release/#policy-per-service) * [MongoDb Storage](https://apereo.github.io/2017/09/15/520rc3-release/#mongodb-storage) * [Schema Change](https://apereo.github.io/2017/09/15/520rc3-release/#schema-change) * [Time-based Multifactor Authentication Trigger](https://apereo.github.io/2017/09/15/520rc3-release/#time-based-multifactor-authentication-trigger) * [Protocol Attributes Release per Service](https://apereo.github.io/2017/09/15/520rc3-release/#protocol-attributes-release-per-service) * [OAuth & OpenID Connect](https://apereo.github.io/2017/09/15/520rc3-release/#oauth--openid-connect) * [Authorized Grant/Response Types](https://apereo.github.io/2017/09/15/520rc3-release/#authorized-grantresponse-types) * [Token Revocation](https://apereo.github.io/2017/09/15/520rc3-release/#token-revocation) * [Pairwise Subject Identifiers](https://apereo.github.io/2017/09/15/520rc3-release/#pairwise-subject-identifiers) * [Unique Principal Authentication Policy](https://apereo.github.io/2017/09/15/520rc3-release/#unique-principal-authentication-policy) * [MongoDb Configuration](https://apereo.github.io/2017/09/15/520rc3-release/#mongodb-configuration) * [Surrogate Authentication](https://apereo.github.io/2017/09/15/520rc3-release/#surrogate-authentication) * [FIDO U2F MFA](https://apereo.github.io/2017/09/15/520rc3-release/#fido-u2f-mfa) * [MongoDb Storage](https://apereo.github.io/2017/09/15/520rc3-release/#mongodb-storage-1) * [Audit Storage](https://apereo.github.io/2017/09/15/520rc3-release/#audit-storage) * [Acceptable Usage Policy](https://apereo.github.io/2017/09/15/520rc3-release/#acceptable-usage-policy) * [Memcached Ticket Registry](https://apereo.github.io/2017/09/15/520rc3-release/#memcached-ticket-registry) * [Performance](https://apereo.github.io/2017/09/15/520rc3-release/#performance) * [Connection Pooling](https://apereo.github.io/2017/09/15/520rc3-release/#connection-pooling) * [Redis Service Registry](https://apereo.github.io/2017/09/15/520rc3-release/#redis-service-registry) * [SAML2 Improvements](https://apereo.github.io/2017/09/15/520rc3-release/#saml2-improvements) * [SAML2 Artifact Resolution](https://apereo.github.io/2017/09/15/520rc3-release/#saml2-artifact-resolution) * [SAML2 Attribute Queries](https://apereo.github.io/2017/09/15/520rc3-release/#saml2-attribute-queries) * [SAML2 POST SimpleSign](https://apereo.github.io/2017/09/15/520rc3-release/#saml2-post-simplesign) * [Library Upgrades](https://apereo.github.io/2017/09/15/520rc3-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2017/09/15/520rc3-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/09/15/520rc3-release/#das-ende) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . In order to start experimenting with release candidates, use the following strategies. At any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of the overlay, adjust the following tag to match below: 5.2.0-RC3 ### Gradle In the `gradle.properties` of the overlay, adjust the following tag to match below: cas.version=5.2.0-RC3 Minors ------ * MongoDb authentication is improved to honor the MongoDb connection pool and threads which monitor that pool. * The default port for the management web application when run in embedded mode is now switched to `8444` to avoid conflicts with the main CAS web application server when both are run in the same environment. * Thanks to [@karlbanke](https://github.com/karlbanke) , MongoDb functionality gains a few new additional settings that control ssl, replicas, etc. * The default ability of defining Spring beans in XML inside the management web application has been removed. * Thanks to [@tsschmidt](https://github.com/tsschmidt) , the `/status` endpoint is now changed to run synchronous blocking mode to avoid side effects. * The default ability of defining Spring beans in XML/Groovy inside the CAS web application has been removed. * The management web application is now able to advertise readiness in logs via ascii art. * Thanks to [@scalding](https://github.com/scalding) , generating persistent ids in a Shibboleth-friendly way now correctly takes into account the salt and more. * Thanks to [@robertoschwald](https://github.com/robertoschwald) , generating primary keys for hibernate schemas is improved to take on a more `native` approach with some caveats documented that affect MySQL while running in a Galera cluster. * Thanks to [@tduehr](https://github.com/tduehr) , generating random secure strings falls back to a more performant though ever-so-slightly less secure strategy and algorithm until Java 9 is released. * The multifactor trusted device functionality for Google Authenticator and Swivel now correctly registers the relevant MFA flow into the CAS webflow engine at runtime. * Thanks to [@arbner](https://github.com/arbner) , SAML MDUI functionality is now able to parse fields based on localized values correctly. * Thanks to [@arbner](https://github.com/arbner) , consent functionality is now able to recognize the relevant service when used in SAML IdP mode. * Thanks to [@pdrados](https://github.com/pdrados) , the attribute name carrying the principal DN as part of LDAP authentication is now set to a static fixed name to avoid attribute encoding issues and easier release policies. * A number of small readjustments to schemas that deal with storing trusted device records in databases, in cases where a number of field names clashes with reserved database keywords. * Thanks to [@SRieckhoff](https://github.com/SRieckhoff) , a possible NPE with SPNEGO authentication is now prevented. * SAML1 validation response is now updated in the documentation to ensure it matches the structure produced by CAS. * Thanks to [@tduehr](https://github.com/tduehr) , Apache Ignite support is given the ability to run in client mode. * Thanks to [@kingjared](https://github.com/kingjared) , generating SAML1 assertions gains an `issueLength` property to set the interval between the `NotBefore` and `NotOnOrAfter` timestamps. * The JSON rendering performance of the CAS validation payload is significantly improved. Management Web Application Redesign ----------------------------------- Huge thanks to [@tsschmidt](https://github.com/tsschmidt) , the CAS management web application is given an entirely new facelift and redesign using Material UI and Angular 4 based on Typescript. Aside from the fantastic new looks, the application is now able to support and handle most if not all of the configuration knobs and tweaks one can apply to a given service definition. This is a huge milestone allowing for a more solid foundation to start building much fancier integrations and features, such as auto-expiring services, approval workflows and more. Here are a few sample screenshots: ![image](https://user-images.githubusercontent.com/1205228/30121747-b9349c62-9341-11e7-8c86-58dcc0d3bffc.png) ![image](https://user-images.githubusercontent.com/1205228/30121768-cb9abd3c-9341-11e7-8b23-0ad4e60bb6e9.png) ![image](https://user-images.githubusercontent.com/1205228/30121784-dccada38-9341-11e7-8a41-71b835b9c860.png) ![image](https://user-images.githubusercontent.com/1205228/30121802-e89c07f6-9341-11e7-85c4-7a3fb77ebdfb.png) ![image](https://user-images.githubusercontent.com/1205228/30121827-f67a42e8-9341-11e7-9326-c87faf4e2c73.png) ![image](https://user-images.githubusercontent.com/1205228/30121851-0337134e-9342-11e7-8059-14f1f8d42195.png) Authentication Events --------------------- ### InfluxDb Storage [CAS authentication events](https://apereo.github.io/cas/development/installation/Configuring-Authentication-Events.html) now gain the ability to use InfluxDb for storage. Caffein for Guava Caching ------------------------- Most if not all internal caching strategies and policies have switched from using the Guava library to Caffein. This is for the most part an invisible change, yet the swich allows CAS to dictate more granular expiration policies for caches that apply to each individual entry in the cache, rather than the cache itself as a whole. SAML2 Service Provider Integrations ----------------------------------- A number of new [SAML2 service provider integrations](https://apereo.github.io/cas/development/integration/Configuring-SAML-SP-Integrations.html) are added to settings that include New Relic, Egnyte and more. Monitoring ---------- ### MongoDb A [new monitor](https://apereo.github.io/cas/development/installation/Configuring-Monitoring.html) is now included that is able to report back status and statistics on a MongoDb instance. ### Ehcache The Ehcache monitor is now improved to ensure it can work correctly with its ticket registry, taking into account caches created dynamically by the ticket catalog. ### Memcached The configuration of the memcached monitor is now moved into a separate block in order to leverage and provide support for connection pooling. Authentication Interrupt ------------------------ CAS has the ability to pause and interrupt the authentication flow to reach out to external services and resources, querying for status and setings that would then dictate how CAS should manage and control the SSO session. Interrupt services are able to present notification messages to the user, provide options for redirects to external services, etc. A common use case of this functionality deals with presenting a bulletin board during the authentication flow to present messages and announcements to select users and then optionally require that audience to complete a certain task before CAS is able to honor the authentication request and establish a session. [See this guide](https://apereo.github.io/cas/development/installation/Webflow-Customization-Interrupt.html) for more info. JMeter Performance Testing -------------------------- Thanks to [@astohn](https://github.com/astohn) , JMeter scripts for performance and stress testing CAS are [now available](https://apereo.github.io/cas/development/planning/High-Availability-Performance-Testing.html#jmeter) . Attribute Consent ----------------- ### LDAP Storage Thanks to [@arbner](https://github.com/arbner) , attribute consent gains a new storage option to save decisions in LDAP. See [this guide](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html#ldap) for more info. ### Policy Per Service Handling attribute consent now takes on a more wholesome API approach where there exists a `consentPolicy` that can dictate how attribute are selected and qualified for consent. See [this guide](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) for more info. ### MongoDb Storage A new storage option is now added to include support for MongoDb. See [this guide](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) for more info. ### Schema Change [×](https://apereo.github.io/2017/09/15/520rc3-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. The structure of a consent decision is changed to rename the field `date` to `createdDate`, in to avoid collisions when the storage option is one of JDBC where `date` is considered a reserved keyword. You may need to readjust the schema manually in order to have CAS recognize existing records. Time-based Multifactor Authentication Trigger --------------------------------------------- Adaptive authentication can also be configured to trigger multifactor authentication based on specific days and times. See [this guide](https://apereo.github.io/cas/development/installation/Configuring-Adaptive-Authentication.html) for more info. Protocol Attributes Release per Service --------------------------------------- Attribute release policies gain a small setting to control whether the application is authorized and allowed to receive authentication/protocol attributes. [See this guide](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html) for more info. OAuth & OpenID Connect ---------------------- ### Authorized Grant/Response Types [OAuth](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html#register-clients) and [OpenID Connect](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html#register-clients) service definitions now get to specify the list of supported and authorized response and grant types. Note that for the time being, the absence of authorized response and grant types in the configration simply means the service is allowed to accept everything though this may change in the future. Additionally, some foundational work is done to allow for parsing of requested scopes so they can later be mapped to attribute and claim release policies. ### Token Revocation Support for revoking OpenID Connect access/refresh tokens is now included in this release. ### Pairwise Subject Identifiers OpenID Connect support in CAS now presents the ability to support different subject types. This specifically includes support for `pairwise` subject id generation. [See this guide](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) for more info. Unique Principal Authentication Policy -------------------------------------- An [additional authentication policy](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#authentication-policy) is now provided that can prevent an authentication event, if the user has already logged on and has a session with CAS. MongoDb Configuration --------------------- [×](https://apereo.github.io/2017/09/15/520rc3-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. In refactoring a number of configuration classes that deal with MongoDb settings, the [MongoDb service registry](https://apereo.github.io/cas/development/installation/MongoDb-Service-Management.html) is changed slightly to use a `collection` property rather than `collectionName` in order to keep things consistent across all settings. Similarly, a number of property placeholders have changed from `mongodb` to simply just `mongo` in order to again ensure a consistent naming strategy is used everywhere. Surrogate Authentication ------------------------ [×](https://apereo.github.io/2017/09/15/520rc3-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. Surrogate authentication (Impersonation) gains the ability to dictate an expiration policy assigned to a surrogate session. Additionally, surrogate account storage and querying can now be done via a REST resource as well. Access strategies for impersonation are also improved to allow per-service authorization rules. Note that the baseline module to include in the overlay has changed in this release candidate to clearly separate core and webflow functionality. [Consult this guide](https://apereo.github.io/cas/development/installation/Surrogate-Authentication.html) for more info. FIDO U2F MFA ------------ ### MongoDb Storage Device registration records for [FIDO U2F](https://apereo.github.io/cas/development/installation/FIDO-U2F-Authentication.html#registration) may now be saved inside a MongoDb instance. Audit Storage ------------- [Audit logs](https://apereo.github.io/cas/development/installation/Audits.html) are now given the ability to store audit records inside a MongoDb database. Acceptable Usage Policy ----------------------- [×](https://apereo.github.io/2017/09/15/520rc3-release/#) **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. [AUP support](https://apereo.github.io/cas/development/installation/Webflow-Customization-AUP.html) gains the ability store decisions via JDBC and REST. Note that the baseline module to include in the overlay has changed in this release candidate to clearly separate core and webflow functionality. Memcached Ticket Registry ------------------------- ### Performance The registry has long carried the behavior to execute blocking ticket operations. In this release candidate, the registry switches to a more asynchronous model to gain maximum performance. ### Connection Pooling Memcached client instances are now pooled and during ticket registry operations are borrowed from and then returned to the pool in order to ensure maximum performance. Redis Service Registry ---------------------- A new service registry implementation based on [Redis](https://apereo.github.io/cas/development/installation/Redis-Service-Management.html) is now available. SAML2 Improvements ------------------ **Federation Interoperability Profile** The CAS project strives to conform to the [SAML V2.0 Implementation Profile for Federation Interoperability](https://kantarainitiative.github.io/SAMLprofiles/fedinterop.html) . An evaluation of the requirements against the current CAS release is available [here](https://docs.google.com/spreadsheets/d/1NYN5n6AaNxz0UxwkzIDuXMYL1JUKNZZlSzLZEDUw4Aw/edit?usp=sharing) . It is **RECOMMENDED** that you view, evaluate and comment on functionality that is currently either absent or marked questionable where verification is needed. SAML2 capabilities of CAS in this release provide support for the following: * Metadata caching can be controlled via the `validUntil` element in the entity metadata. * A [new attribute release filter](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#entity-attributes-filter) is now available based on metadata entity attributes. * A [new attribute release filter](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html##requested-attributes-filter) is now available to release attributes based on requested attributes specified in the SP metadata. * All signing operations are now able to consult metadata in order to resolve signing keys and iterate through all to find a successful matching candidate. ### SAML2 Artifact Resolution SAML2 capabilities of CAS in this release add support for the Artifact Resolution profile. See [this guide](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) for more info. ### SAML2 Attribute Queries SAML2 capabilities of CAS in this release add support for the Attribute Query profile. See [this guide](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) for more info. ### SAML2 POST SimpleSign SAML2 capabilities of CAS in this release add support for the POST SimpleSign profile. See [this guide](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) for more info. Library Upgrades ---------------- * Spring Shell * Spring Cloud Sleuth * Apache Fediz * Apache Fortress * Spring Boot Admin * Hibernate Validator * MongoDb Driver * Guava * Caffein * Amazon SDK * Apache Tomcat * Google Maps * Twillio * Kryo * PostgreSQL * MariaDb Driver * Jose4J * Apache Ignite * Couchbase Driver * Thymeleaf * Infinispan * Dropwizard Metrics Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- A big hearty thanks to all who participate in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.2.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&title=CAS+5.2.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&title=CAS+5.2.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&name=CAS+5.2.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&title=CAS+5.2.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&title=CAS+5.2.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F09%2F15%2F520rc3-release%2F&t=CAS+5.2.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.3.0 RC1 Feature Release – Apereo Community Blog CAS 5.3.0 RC1 Feature Release ============================= Friday, Dec 29, 2017 10 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.2.0` GA was released on [November 27th, 2017](https://github.com/apereo/cas/releases/tag/v5.2.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.3.0`. This post intends to highlight some of the improvements and enhancements packed into the **first** release candidate in the `5.3.0` series. The in-development documentation of CAS `5.3.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . * [Shake Well Before Use](https://apereo.github.io/2017/12/29/530rc1-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2017/12/29/530rc1-release/#apache-maven) * [Gradle](https://apereo.github.io/2017/12/29/530rc1-release/#gradle) * [Minors](https://apereo.github.io/2017/12/29/530rc1-release/#minors) * [CosmosDb Service Registry](https://apereo.github.io/2017/12/29/530rc1-release/#cosmosdb-service-registry) * [SAML2 Service Providers](https://apereo.github.io/2017/12/29/530rc1-release/#saml2-service-providers) * [Delegated AuthN SAML2 Metadata Endpoints](https://apereo.github.io/2017/12/29/530rc1-release/#delegated-authn-saml2-metadata-endpoints) * [Groovy Access Strategy](https://apereo.github.io/2017/12/29/530rc1-release/#groovy-access-strategy) * [Service Replication via Hazelcast](https://apereo.github.io/2017/12/29/530rc1-release/#service-replication-via-hazelcast) * [Global Attribute Caching Policies](https://apereo.github.io/2017/12/29/530rc1-release/#global-attribute-caching-policies) * [Documentation CleanUp](https://apereo.github.io/2017/12/29/530rc1-release/#documentation-cleanup) * [Dynamic Metadata Management](https://apereo.github.io/2017/12/29/530rc1-release/#dynamic-metadata-management) * [Externalized Views](https://apereo.github.io/2017/12/29/530rc1-release/#externalized-views) * [Health Indicators & Monitors](https://apereo.github.io/2017/12/29/530rc1-release/#health-indicators--monitors) * [HashiCorp Consul](https://apereo.github.io/2017/12/29/530rc1-release/#hashicorp-consul) * [Hazelcast AWS EC2 Discovery](https://apereo.github.io/2017/12/29/530rc1-release/#hazelcast-aws-ec2-discovery) * [Multifactor Authentication Trigger Per Service Via Groovy](https://apereo.github.io/2017/12/29/530rc1-release/#multifactor-authentication-trigger-per-service-via-groovy) * [Microsoft Azure’s KeyVault Secrets](https://apereo.github.io/2017/12/29/530rc1-release/#microsoft-azures-keyvault-secrets) * [Response Type Per Service](https://apereo.github.io/2017/12/29/530rc1-release/#response-type-per-service) * [Delegated Authentication Access Policy](https://apereo.github.io/2017/12/29/530rc1-release/#delegated-authentication-access-policy) * [Shibboleth Attribute Resolver](https://apereo.github.io/2017/12/29/530rc1-release/#shibboleth-attribute-resolver) * [Splunk Logging](https://apereo.github.io/2017/12/29/530rc1-release/#splunk-logging) * [U2f Authentication Registration Record Encryption](https://apereo.github.io/2017/12/29/530rc1-release/#u2f-authentication-registration-record-encryption) * [Library Upgrades](https://apereo.github.io/2017/12/29/530rc1-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2017/12/29/530rc1-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/12/29/530rc1-release/#das-ende) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . In order to start experimenting with release candidates, use the following strategies. At any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of the overlay, adjust the following tag to match below: 5.3.0-RC1 ### Gradle In the `gradle.properties` of the overlay, adjust the following setting to match below: cas.version=5.3.0-RC1 Minors ------ 1. A boolean flag is now exposed in CAS settings to toggle [Google reCAPTCHA](https://apereo.github.io/cas/development/integration/Configuring-Google-reCAPTCHA.html) behavior. 2. Scratch codes for [Google Authenticator multifactor authentication](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) are now properly recognized as valid tokens. 3. A series of small bug fixes to ensure claims and scopes are properly recognized and released via the [OpenID Connect protocol](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html) . 4. Thanks to [@Thaslin](https://github.com/Thaslin) ,[delegating authentication to ADFS](https://apereo.github.io/cas/development/integration/ADFS-Integration.html) gains support for WCTX while handling concurrent requests. This problem manifests itself when multiple iframes redirect to CAS at nearly the same time. Since only one static session key was used for the CAS service, all requests were redirected to the same service URL after authentication success. Using the WCTX parameter as part of the session key solves this problem. 5. Thanks to [@pdrados](https://github.com/pdrados) , [risk-based authentication](https://apereo.github.io/cas/development/installation/Configuring-RiskBased-Authentication.html) gains a few new fixes when CAS begins to calculate the authentication risk factor based on date/time. 6. Thanks to [@robertoschwald](https://github.com/robertoschwald) , the CAS protocol specification is slightly revved to provide a few fixes to the XSD schema and to remove the `memberOf` attribute. 7. A number of improvements to URL validators by [@swoeste](https://github.com/swoeste) to support _unknown_ yet valid TLDs. Regex support is now added to CAS HTTP configuration to ensure URL authorities can be correctly verified based on that pattern. 8. Thanks to [@hdeadman](https://github.com/hdeadman) , the [command-line shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) is slightly improved when it’s asked to add properties for a configuration group that is not strictly controlled by CAS itself. (i.e. `add-property -group tomcat`). 9. LDAP support is slightly enhanced with a new setting to enable dereferencing aliases. 10. The CAS internal Gradle build is integrated with [Google’s error-prone plugin](https://github.com/google/error-prone) to detect anomalies and prevent bugs. 11. References to Spring’s `VelocityEngineFactory` are removed and CAS attempts to create its own `VelocityEngine` instance required and used to support SAML and friends. This is also a prepping move before CAS switches over to Spring 5 where Velocity functionality is now absent. 12. CAS startup banner details, such as CAS version or commit id, etc are now also included in the [`info` endpoint](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) . 13. The HTTP security filter is made more flexible by accepting values for `X-FRAME-OPTIONS` and `X-XSS-PROTECTION`. 14. The embedded Apache Tomcat container now supports a few additional filters such as CSRF and Remote-Address. 15. CAS audit logs see a few small improvements when data is formatted as JSON. Ticket validation events in the audit log are also able to show the authenticated principal and the collection of attributes released to the application as part of the assertion. 16. CAS is now able to inject arbitrary headers into the response where needed to account for custom workflows and security settings. 17. The configuration metadata is slightly improved to ensure metadata for inherited fields is properly generated. 18. When securing admin pages and dashboard in CAS via IP address, there is now the ability to determine the IP via alternative headers such as `X-Forwarded-For`. 19. A number of documentation improvements by [@dstepe](https://github.com/dstepe) , [@mac-reid](https://github.com/mac-reid) . 20. Thanks to [@dacurry-tns](https://github.com/dacurry-tns) , connections to MongoDb are now improved to better handle `clientUri` settings. 21. Thanks to [@mbenson](https://github.com/mbenson) , the CAS BOM is now improved to include all CAS modules. 22. Thanks to [@gledsonrabelo](https://github.com/gledsonrabelo) , the prefix for proxy tickets is now fixed to be `PT`. CosmosDb Service Registry ------------------------- CAS service definitions can now be managed and controlled via Microsoft Azure’s [CosmosDb](https://apereo.github.io/cas/development/installation/CosmosDb-Service-Management.html) . SAML2 Service Providers ----------------------- The following new SAML2 service providers are now supported by CAS out of the box: * GitLab * Hipchat * AppDynamics Delegated AuthN SAML2 Metadata Endpoints ---------------------------------------- When delegating authentication to external SAML2 identity providers, CAS is able to present both the SP (CAS) and the IdP metadata via [dedicated endpoints](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html#saml2-identity-providers) . Groovy Access Strategy ---------------------- [Service access strategy policies](https://apereo.github.io/cas/development/installation/Configuring-Service-Access-Strategy.html) can now take advantage of a Groovy script for more dynamic rules. Service Replication via Hazelcast --------------------------------- In the event that CAS service definitions are not managed globally via a centralized store, service definition files managed as JSON or YAML files can be replicated across the CAS cluster [via Hazelcast](https://apereo.github.io/cas/development/installation/Configuring-Service-Replication.html) in addition to the native tooling options of the CAS platform. Global Attribute Caching Policies --------------------------------- [Attribute release caching](https://apereo.github.io/cas/development/integration/Attribute-Release-Caching.html) in CAS may certainly be done on a per-service basis. In this release, CAS provides a strategy for caching attributes at a more global level specifically at release time. Documentation CleanUp --------------------- A large number of CAS settings that are [shared and common](https://apereo.github.io/cas/development/installation/Configuration-Properties-Common.html) across modules are cleaned up to only be referenced once in a common area, pointing to a specific configuration key. This is a gradual effort and will take some time to complete. For instance, when it comes to MongoDB support there are a large number of CAS modules and components that support and integrate with it whose settings, structurally, are very much shared. Consider the duplicated settings below for features `feature1` and `feature2`: cas.feature1.mongo.host=localhost1 cas.feature1.mongo.timeout=2000 cas.feature2.mongo.host=localhost2 cas.feature2.mongo.timeout=4000 Instead, the common settings such as `host`, `timeout`, etc are moved to a common block and take the form of: ${configurationKey}.mongo.host=localhost1 ${configurationKey}.mongo.timeout=2000 …where the `configurationKey` can either be `cas.feature1` or `cas.feature2`, etc. [×](https://apereo.github.io/2017/12/29/530rc1-release/#) **Beware** As part of the cleanup, the property `userFilter` that dealt with LDAP authentication filters and queries is now deprecated and replaced with `searchFilter` to be consistent with all other LDAP integration modules and features. Dynamic Metadata Management --------------------------- Managing service provider metadata documents, especially for bilateral integrations can now be done with the likes of MongoDB, SQL databases or Groovy, etc. [See this guide](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html#dynamic-metadata) for more info. Externalized Views ------------------ CAS UI pages and that of Thymeleaf can now be loaded from external locations outside the web application context. While this was always a possible, this release candidate provides the ability to conditionally load views from an external path when found, and otherwise fall back to the default location inside the web application. Health Indicators & Monitors ---------------------------- CAS for some time has had the ability to monitor external systems and data sources such as LDAP, Memcached, etc. In this release candidate, the legacy CAS `Monitor` API is removed in favor of Spring Boot’s native `HealthIndicator` components. CAS monitors are removed from the `/status` page and moved to the Spring Boot’s `/health` endpoint. Note that the new endpoint by default does not show details of the monitors configured unless the request is an _authenticated_ one with Spring Security. This behavior of course can be controlled via CAS settings. Note that as a result of this change, status codes that are returned by CAS have changed to include: `UNKNOWN`, `UP`, `DOWN`, `WARN` and `OUT_OF_SERVICE` many of which are by default provided by Spring Boot. HashiCorp Consul ---------------- Thanks to Spring Cloud, CAS can now be tightly integrated with HashiCorp’s Consul for service discovery, health checks as well as configuration management via Consul’s key-value store. See [this guide](https://apereo.github.io/cas/development/installation/Service-Discovery-Guide.html) for more info. Hazelcast AWS EC2 Discovery --------------------------- Hazelcast support in CAS is now equipped to handle AWS EC2 auto-discovery. It is useful when you do not want to provide or you cannot provide the list of possible IP addresses for the cluster members. Furthermore, you may now specify a partitioning group configuration that may be zone-aware. [See this guide](https://apereo.github.io/cas/development/installation/Hazelcast-Ticket-Registry.html) for more info. Multifactor Authentication Trigger Per Service Via Groovy --------------------------------------------------------- Multifactor authentication triggers per applications can now be more dynamically decided via a Groovy script. [See this guide](https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication-Triggers.html#applications) for more info. Microsoft Azure’s KeyVault Secrets ---------------------------------- Azure Key Vault Secrets can now act as a storage mechanism for CAS properties and settings in conjunction with Spring Cloud. See [this guide](https://apereo.github.io/cas/development/installation/Configuration-Server-Management.html#spring-cloud) for more info. Response Type Per Service ------------------------- The CAS protocol likely since its inception has provided support for a `method` parameter whose value would allow CAS to respond back to the service/application with a ticket via a redirect, a POST, etc. This behavior can now be applied to a registered service definition, controlling application behavior and expectations centrally. If you have a group of individual applications who all expected CAS to contact them back with a POST, you may group them together in a definition and set the `responseType` accordingly rather than having each individual application specify a `method=POST` in the authentication request. Delegated Authentication Access Policy -------------------------------------- In the event that CAS is allowed and configured to delegate the authentication request to an external provider such as a SAML2 IdP, you may now assign policies to registered service definitions in the CAS service registry to let each service control the set of authorized external identity providers. This behavior is enforced in the UI and while tickets are generated or validated. [See this guide](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) for more info. Shibboleth Attribute Resolver ----------------------------- Support for resolving attributes using a Shibboleth IdP’s `attribute-resolver.xml` is now removed. Splunk Logging -------------- Support for [publishing logs to Splunk](https://apereo.github.io/cas/development/installation/Logging-Splunk.html) is now included in this release. CAS is not quite taking advantage of native Splunk logging capabilities to format messages and that bit surely might receive more attention in future releases. U2f Authentication Registration Record Encryption ------------------------------------------------- Support for encryption/decryption of U2F authentication registration records stored in RDBMS as well as MongoDB repositories has been added via [new properties](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#fido-u2f) Library Upgrades ---------------- * Gradle * Hibernate * AspectJ * Spring * Spring Boot * Spring Cloud * AWS Java SDK * Hazelcast * HikariCP * Authy * Azure CosmosDb * Cassandra * Apache Commons * Apache CXF * Apache Tomcat * Eureka * Apache Fediz * Geo2IP * Maxmind * Google Maps * Apache HttpClient * Apache Ignite * Couchbase * Jose4J * Apache Log4j * MariaDB Driver * Mockito * Apache Velocity * OpenSAML * Pac4j * SemVer * Zipkin * Sleuth Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.3.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&title=CAS+5.3.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&title=CAS+5.3.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&name=CAS+5.3.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&title=CAS+5.3.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&title=CAS+5.3.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F12%2F29%2F530rc1-release%2F&t=CAS+5.3.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.2.0 RC1 Feature Release – Apereo Community Blog CAS 5.2.0 RC1 Feature Release ============================= Friday, Jun 30, 2017 8 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.1.0` GA was released on [May 27th 2017](https://github.com/apereo/cas/releases/tag/v5.1.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.2.0`. This post intends to highlight some of the improvements and enhancements packed into the first release candidate in the `5.2.0` series. The in-development documentation of CAS `5.2.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . * [0.1. Minors](https://apereo.github.io/2017/06/30/520rc1-release/#01-minors) * [0.2. Documentation](https://apereo.github.io/2017/06/30/520rc1-release/#02-documentation) * [0.3. WebJARs for Static Resources](https://apereo.github.io/2017/06/30/520rc1-release/#03-webjars-for-static-resources) * [0.4. Trusted Authentication Attributes](https://apereo.github.io/2017/06/30/520rc1-release/#04-trusted-authentication-attributes) * [0.5. Amazon Cloud Directory Authentication](https://apereo.github.io/2017/06/30/520rc1-release/#05-amazon-cloud-directory-authentication) * [0.6. CAS Protocol v2 Forward Compatibility](https://apereo.github.io/2017/06/30/520rc1-release/#06-cas-protocol-v2-forward-compatibility) * [0.7. JWTs for REST API](https://apereo.github.io/2017/06/30/520rc1-release/#07-jwts-for-rest-api) * [0.8. Dynamic Caches for Ticket Registries](https://apereo.github.io/2017/06/30/520rc1-release/#08-dynamic-caches-for-ticket-registries) * [0.9. Update Checking](https://apereo.github.io/2017/06/30/520rc1-release/#09-update-checking) * [0.10. HEADER Response Method](https://apereo.github.io/2017/06/30/520rc1-release/#010-header-response-method) * [0.11. ADFS Delegated Authentication](https://apereo.github.io/2017/06/30/520rc1-release/#011-adfs-delegated-authentication) * [0.12. ADFS SAML Integration](https://apereo.github.io/2017/06/30/520rc1-release/#012-adfs-saml-integration) * [0.13. Ticket Registry Encryption](https://apereo.github.io/2017/06/30/520rc1-release/#013-ticket-registry-encryption) * [0.14. Stormpath Support Removed](https://apereo.github.io/2017/06/30/520rc1-release/#014-stormpath-support-removed) * [0.15. Ticket Validator SSL Configuration](https://apereo.github.io/2017/06/30/520rc1-release/#015-ticket-validator-ssl-configuration) * [0.16. Registered Services Endpoint](https://apereo.github.io/2017/06/30/520rc1-release/#016-registered-services-endpoint) * [0.17. YubiKey MongoDb/JPA Storage](https://apereo.github.io/2017/06/30/520rc1-release/#017-yubikey-mongodbjpa-storage) * [0.18. Couchbase Authentication](https://apereo.github.io/2017/06/30/520rc1-release/#018-couchbase-authentication) * [0.19. Apache Cassandra Authentication](https://apereo.github.io/2017/06/30/520rc1-release/#019-apache-cassandra-authentication) * [0.20. Custom LDAP Password Policy](https://apereo.github.io/2017/06/30/520rc1-release/#020-custom-ldap-password-policy) * [0.21. FIDO U2F Device Registration](https://apereo.github.io/2017/06/30/520rc1-release/#021-fido-u2f-device-registration) * [0.22. JWTs As Service Tickets](https://apereo.github.io/2017/06/30/520rc1-release/#022-jwts-as-service-tickets) * [0.23. Swivel Secure Authentication](https://apereo.github.io/2017/06/30/520rc1-release/#023-swivel-secure-authentication) * [0.24. OpenID Connect Introspection](https://apereo.github.io/2017/06/30/520rc1-release/#024-openid-connect-introspection) * [0.25. OAuth Client Credentials Grant](https://apereo.github.io/2017/06/30/520rc1-release/#025-oauth-client-credentials-grant) * [0.26. Attribute Repository Merging](https://apereo.github.io/2017/06/30/520rc1-release/#026-attribute-repository-merging) * [0.27. Library Upgrades](https://apereo.github.io/2017/06/30/520rc1-release/#027-library-upgrades) * [0.28. What’s Next?](https://apereo.github.io/2017/06/30/520rc1-release/#028-whats-next) * [0.29. Get Involved](https://apereo.github.io/2017/06/30/520rc1-release/#029-get-involved) * [0.30. Das Ende](https://apereo.github.io/2017/06/30/520rc1-release/#030-das-ende) 0.1. Minors ----------- * Performance improvements to ensure service selection strategies are properly sorted at runtime. * A few bug fixes that affect the password management functionality and webflow handling of authentication failure events, thanks to [@pdrados](https://github.com/pdrados) . * Small regression in how URL-based SAML2 metadata resources are retrieved from `http` vs `https` resources. * Thanks to [@pavelhoral](https://github.com/pavelhoral) , ticket registries properly take into account the task of encoding tickets, if needed, before deleting them. * Thanks to [@jkacer](https://github.com/jkacer) , failed authentication attempts are improved to no longer be reported as throttled authentication attempts. Changes are backported as far as back as `5.0.x`. * Plenty of minor performance improvements to the CAS service registry as well as the overall ticket registry components and that of Hazelcast in particular, thanks to [@DavidRG13](https://github.com/DavidRG13) and [@tsschmidt](https://github.com/tsschmidt) . * Delegated authentication flows now gain support for naming the client, thanks to [@rrenomeron](https://github.com/rrenomeron) . * The Duo WebSDK has been upgraded to its most recent version. 0.2. Documentation ------------------ Thanks to [@mindblender](https://github.com/mindblender) , the [documentation site](https://apereo.github.io/cas/development/) for the CAS project is now equipped with a much better search user interface. 0.3. WebJARs for Static Resources --------------------------------- Targeting CAS deployments in environments that have no network access can be tricky. In this release candidate, CAS begins to beautifully bundle static UI resources (css, javascript, etc) into the build for offline access. These resources are turned into dependencies that the project stuffs into the build by default using WebJARs. The `org.webjars` project seems to package up most things that CAS needs in jars that are available in maven central and the servlet 3.0 specification makes the resources available to be served up by CAS. Huge thanks to [@hdeadman](https://github.com/hdeadman) for executing on this. 0.4. Trusted Authentication Attributes -------------------------------------- The [Trusted Authentication](https://apereo.github.io/cas/development/installation/Trusted-Authentication.html) features of CAS are now able to extract attributes from the remote request object, in cases where CAS is sitting behind a Shibboleth Service Provider, etc. Thanks to [@scalding](https://github.com/scalding) for the find and suggestions on how to improve this best. 0.5. Amazon Cloud Directory Authentication ------------------------------------------ Thanks to [@vulpayga](https://github.com/vulpayga) , CAS gains the ability to use [Amazon Cloud Directory for authentication](https://apereo.github.io/cas/development/installation/AWS-CloudDirectory-Authentication.html) . 0.6. CAS Protocol v2 Forward Compatibility ------------------------------------------ It is now possible to ensure CAS protocol `v2` views are forward compatible with CAS `v3`. The most significant change here is the ability to release attributes via `v2`. The behavior is controlled via a [setting](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#views) that can be turned on/off globally for the CAS deployment. You can read more about this behavior [here](https://apereo.github.io/2017/06/23/cas-protocol-compatibility/) . 0.7. JWTs for REST API ---------------------- The [CAS REST API/Protocol](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) is now equipped with the capability to issue JWTs for service tickets. 0.8. Dynamic Caches for Ticket Registries ----------------------------------------- The [Ehcache Ticket Registry](https://apereo.github.io/cas/development/installation/Ehcache-Ticket-Registry.html) now gains the option to split caches dynamically based on ticket types, rather than keeping every ticket inside a single statically created cache. The same changeset is also applied to the ticket registry based on [MongoDb](https://apereo.github.io/cas/development/installation/MongoDb-Ticket-Registry.html) as well as that of [Apache Ignite](https://apereo.github.io/cas/development/installation/Ignite-Ticket-Registry.html) . 0.9. Update Checking -------------------- CAS has been given the ability to check for newer released versions and report back as part of its banner. This behavior is off by default, and may be conditionally enabled via [the following guide](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#cas-banner) . 0.10. HEADER Response Method ---------------------------- CAS has for some time had the ability to redirect back to a requesting application providing the generated service ticket in form of a `GET` or `POST` via the `method` parameter. In this release, CAS adds an extra `HEADER` option, stuffing the ticket into a response header. This might be useful if you intend to execute non-interactive modes of authentication such as Basic Authentication. 0.11. ADFS Delegated Authentication ----------------------------------- [Delagating authentication to ADFS](https://apereo.github.io/cas/development/integration/ADFS-Integration.html) is now enhanced to support more than once ADFS instance. 0.12. ADFS SAML Integration --------------------------- A number of minor bugs have been fixed in this release to ensure ADFS acting as a SAML2 SP can be integrated with CAS acting as a SAML2 identity provider. 0.13. Ticket Registry Encryption -------------------------------- The ticket registry implementations based on [Apache Ignite](https://apereo.github.io/cas/development/installation/Ignite-Ticket-Registry.html) and [MongoDb](https://apereo.github.io/cas/development/installation/MongoDb-Ticket-Registry.html) are now enhanced to support ticket registry encryption. 0.14. Stormpath Support Removed ------------------------------- [Stormpath](https://stormpath.com/) support has been removed from the codebase. This feature will no longer be available, as Stormpath APIs are soon to be retired in mid August after the Okta acquisition. 0.15. Ticket Validator SSL Configuration ---------------------------------------- There are areas in CAS where a ticket is issued and validated internally to allow access to other downstream components. The configuration of ticket validation component is now exposed to the entire runtime and takes advantage of familiar CAS settings when it comes to SSL factories and hostname verifications. 0.16. Registered Services Endpoint ---------------------------------- A [new endpoint](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) is now exposed in CAS that can report back the collection of registered services with CAS. 0.17. YubiKey MongoDb/JPA Storage --------------------------------- [YubiKey multifactor authentication](https://apereo.github.io/cas/development/installation/YubiKey-Authentication.html) is now able to use MongoDb or a relational database for persisting device registration records. Improvements are in to also support new device registration workflows. 0.18. Couchbase Authentication ------------------------------ CAS gains the ability to use [Couchbase](https://apereo.github.io/cas/development/installation/Couchbase-Authentication.html) as an authentication store. Remember that Couchbase can also be used to [manage CAS services](https://apereo.github.io/cas/development/installation/Couchbase-Service-Management.html) and act as a [ticket store](https://apereo.github.io/cas/development/installation/Couchbase-Ticket-Registry.html) for HA deployments. 0.19. Apache Cassandra Authentication ------------------------------------- Thanks to [@vulpayga](https://github.com/vulpayga) , CAS gains the ability to use [Apache Cassandra](https://apereo.github.io/cas/development/installation/Cassandra-Authentication.html) as an authentication store. 0.20. Custom LDAP Password Policy --------------------------------- There is now support for implementing your own custom LDAP password policy handler based on Ldaptive. Your implementation [needs to be taught to CAS](https://apereo.github.io/cas/development/installation/Configuration-Properties.html#ldap-authentication) and should take on the following form: import org.ldaptive.auth.AuthenticationResponseHandler; public class MyPasswordPolicyAuthenticationResponseHandler implements AuthenticationResponseHandler { } 0.21. FIDO U2F Device Registration ---------------------------------- FIDO U2F support for multifactor authentication is now equipped with the ability to store device registration records inside a relational database and more. [See this](https://apereo.github.io/cas/development/installation/FIDO-U2F-Authentication.html#registration) for more info. 0.22. JWTs As Service Tickets ----------------------------- [×](https://apereo.github.io/2017/06/30/520rc1-release/#) **Beware** This may be a breaking configuration change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. The ability to issue [JWTs as service tickets](https://apereo.github.io/cas/development/installation/Configure-ServiceTicket-JWT.html#configuration) is now refactored and moved into its own dedicated module such that it can then become reusable as a pluggable extension point in other parts of the codebase. If you had this feature turned on, you may need to adjust the module definition in your build slightly to stay on course with the coolness. 0.23. Swivel Secure Authentication ---------------------------------- CAS can now take advantage of Swivel Secure’s image-based multifactor authentication. See [this guide](https://apereo.github.io/cas/development/installation/SwivelSecure-Authentication.html) to learn more. Special thanks to [@dacurry-tns](https://github.com/dacurry-tns) for contributing the baseline integration. 0.24. OpenID Connect Introspection ---------------------------------- Modest support is now added for OpenID Connect to allow for introspection of access tokens. 0.25. OAuth Client Credentials Grant ------------------------------------ Support for OAuth2’s `client_credentials` grant is now [included in this release](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) . 0.26. Attribute Repository Merging ---------------------------------- Attributes retrieved during the authentication phase are now given the ability to merge with attributes retrieved from separate attribute repository sources. This behavior previously was only available to select authentication strategies and is now globally applied to all. 0.27. Library Upgrades ---------------------- * Spring Data * Spring MongoDb * Spring Cloud * Spring Security * EhCache * Apache CXF * Thymeleaf * Sentry * Memcached * Apache Ignite * Gradle * Spring Boot * Couchbase * Infinispan * UnboundID SCIM 0.28. What’s Next? ------------------ We are all working to make sure the CAS `5.2.0` release is on [schedule](https://github.com/apereo/cas/milestones) . 0.29. Get Involved ------------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. 0.30. Das Ende -------------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.2.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&title=CAS+5.2.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&title=CAS+5.2.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&name=CAS+5.2.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&title=CAS+5.2.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&title=CAS+5.2.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F06%2F30%2F520rc1-release%2F&t=CAS+5.2.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.1.0 RC3 Feature Release – Apereo Community Blog CAS 5.1.0 RC3 Feature Release ============================= Friday, Mar 31, 2017 12 minute read The official CAS `5.0.0` GA was released on [November 7th 2016](https://github.com/apereo/cas/releases/tag/v5.0.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.1.0`. This post intends to highlight some of the improvements and enhancements packed into the third release candidate in the `5.1.0` series. The in-development documentation of CAS `5.1.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . If you are looking for additional info on the previous release candidate, [please see this post](https://apereo.github.io/2017/02/24/rc2-release/) . * [Embedded Container Modules](https://apereo.github.io/2017/03/31/rc3-release/#embedded-container-modules) * [Hazelcast Ticket Registry](https://apereo.github.io/2017/03/31/rc3-release/#hazelcast-ticket-registry) * [Embedded Tomcat SSL Valve](https://apereo.github.io/2017/03/31/rc3-release/#embedded-tomcat-ssl-valve) * [Administrative Endpoint Security](https://apereo.github.io/2017/03/31/rc3-release/#administrative-endpoint-security) * [Scripted Username Attribute Providers](https://apereo.github.io/2017/03/31/rc3-release/#scripted-username-attribute-providers) * [SPNEGO Webflow Authentication](https://apereo.github.io/2017/03/31/rc3-release/#spnego-webflow-authentication) * [JPA Ticket Registry](https://apereo.github.io/2017/03/31/rc3-release/#jpa-ticket-registry) * [Ticket Metadata and Catalog](https://apereo.github.io/2017/03/31/rc3-release/#ticket-metadata-and-catalog) * [Embedded Tomcat Default Connector Settings](https://apereo.github.io/2017/03/31/rc3-release/#embedded-tomcat-default-connector-settings) * [Code Cleanup and Optimization](https://apereo.github.io/2017/03/31/rc3-release/#code-cleanup-and-optimization) * [Configuration Panel](https://apereo.github.io/2017/03/31/rc3-release/#configuration-panel) * [Spring Cloud Configuration Server](https://apereo.github.io/2017/03/31/rc3-release/#spring-cloud-configuration-server) * [DynamoDb Ticket Registry](https://apereo.github.io/2017/03/31/rc3-release/#dynamodb-ticket-registry) * [CAS Heroku Demos](https://apereo.github.io/2017/03/31/rc3-release/#cas-heroku-demos) * [Attribute Repositories & Attributes](https://apereo.github.io/2017/03/31/rc3-release/#attribute-repositories--attributes) * [AWS CloudWatch Support](https://apereo.github.io/2017/03/31/rc3-release/#aws-cloudwatch-support) * [Sass Auto Compilation](https://apereo.github.io/2017/03/31/rc3-release/#sass-auto-compilation) * [REST Authentication via X.509](https://apereo.github.io/2017/03/31/rc3-release/#rest-authentication-via-x509) * [X.509 Principal Resolution](https://apereo.github.io/2017/03/31/rc3-release/#x509-principal-resolution) * [WS-Fed Protocol](https://apereo.github.io/2017/03/31/rc3-release/#ws-fed-protocol) * [Attribute Filtering Policies](https://apereo.github.io/2017/03/31/rc3-release/#attribute-filtering-policies) * [Jasypt Support](https://apereo.github.io/2017/03/31/rc3-release/#jasypt-support) * [DynamoDb Service Registry](https://apereo.github.io/2017/03/31/rc3-release/#dynamodb-service-registry) * [Minor Bug Fixes](https://apereo.github.io/2017/03/31/rc3-release/#minor-bug-fixes) * [Community Contributions](https://apereo.github.io/2017/03/31/rc3-release/#community-contributions) * [Others](https://apereo.github.io/2017/03/31/rc3-release/#others) * [Library Upgrades](https://apereo.github.io/2017/03/31/rc3-release/#library-upgrades) * [What’s Next?](https://apereo.github.io/2017/03/31/rc3-release/#whats-next) * [Get Involved](https://apereo.github.io/2017/03/31/rc3-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/03/31/rc3-release/#das-ende) Embedded Container Modules -------------------------- In previous feature releases, the CAS server web application module shipped automatically with an embedded Tomcat container. This presented a few difficulties to folks who wanted to step outside the box and get the CAS web application deployed in alternative containers such as WebSphere, JBoss, etc. Starting with this release candidate, the CAS server web application switches back to its original vanilla state where nothing is embedded by default. This should allow you to deploy CAS to any container that is servlet-spec compliant by CAS requirements. However, [additional modules are provided for embedded containers](https://apereo.github.io/cas/development/installation/Configuring-Servlet-Container.html) that are Apache Tomcat, Jetty and Undertow. If you had been previously working with the embedded container and running Apache Tomcat natively, you do need to switch the webapp module to one that contains an embedded container of your choice. Note that embedded-container modules may be deployed to externally-configured containers too. CAS should detect the external instance and auto-disable the embedded container from bootstrapping itself, regardless of container type. Hazelcast Ticket Registry ------------------------- Thanks to community contributions, the Hazelcast Ticket Registry is [reorganized](https://github.com/apereo/cas/pull/2361) to improve its performance, by splitting the underlying cache in half. Work is also done to ensure the registry is prepped to handle additional ticket types dynamically. Embedded Tomcat SSL Valve ------------------------- Thanks to community contributions, the embedded tomcat container gains support for configuration of the SSL Valve. This should be useful if you are trying to handle X.509 authentication at the servlet container level. Administrative Endpoint Security -------------------------------- Individual endpoints that are exposed by the CAS admin panels each have their own security settings. To make the configuration easier, there now exists a single block that may control the security of all settings globally, while still allowing individual overrides to take over. As an additional option, endpoints that are secured with Spring Security now can take advantage of JAAS authentication. Scripted Username Attribute Providers ------------------------------------- [Username attribute providers](https://apereo.github.io/cas/development/integration/Attribute-Release-PrincipalId.html) linked to a service definition are enhanced to accommodate further scripting techniques via Groovy. Also, a number of providers are now able to apply transformations on the final username returned back to the application, such as turning the id into all caps, etc. SPNEGO Webflow Authentication ----------------------------- The [SPNEGO functionality](https://apereo.github.io/cas/development/installation/SPNEGO-Authentication.html) still had a few references and instructions on how changes that needed to be manually applied to the webflow. Those are now removed and automated internally to match the manual steps. JPA Ticket Registry ------------------- The [JPA ticket registry](https://apereo.github.io/cas/development/installation/JPA-Ticket-Registry.html) no longer requests a hardcoded dependency link to the OAuth module. In the past, the registry simply auto-created OAuth tables and entities given the components were found and scanned automatically as a result of that dependency link. Today, that chain is removed and the registry shall only recognize and act upon OAuth functionality, if the functionality is explicitly turned on. Ticket Metadata and Catalog --------------------------- Traditionally, ticket types in CAS are mostly concerned with ticket-granting tickets, service tickets, proxy tickets, etc. These are distinct types that are defined as first-class citizens of the CAS public API. Over time, there have emerged additional tickets types that represent various other forms of _tokens_ to CAS, such as OAuth codes, access tokens, refresh tokens, etc. Each ticket type has its own lifespan and other settings too. How do ticket registries deal with additional types, given their presence and functionality can only be discovered at runtime dynamically? Some took shortcuts. For instance, the JPA ticket registry created a hard-link to the OAuth module (described above) so it could ensure OAuth tickets were stored in separate tables as distinct entities, etc. It asked for pre-authorized knowledge of the CAS API, even though the functionality controlled by that API may not even be in use at all. Is there a reason the registry should handle OAuth-related functionality _even when_ OAuth is not even enabled or required by the deployment? Not a trick question. So the target goal is that each registry implementation (and all of CAS really) should be able to dynamically realize what ticket types are used by the CAS runtime and what ticketing-related functionality is actually enabled by the deployer. The discovery mechanism should provide enough information, as a catalog, to the relevant modules about known types, their metadata and various other required properties so each registry can dynamically and generically look up that metadata and regroup itself to handle each unique type. Advantages of this approach are: 1. No need to establish static linkage between CAS modules to teach each about various ticket types exposed in the module API. As you can imagine, over time given new tickets types that have emerged and the list of registries supported by CAS, static linking is simply non-maintainable and core logic in each registry can get very messy if it were to deal with 8+ different ticket types, caches, storage requirements, etc. 2. Given no static linking, LOC will be reduced down to the bare minimum and what may be auto-discovered at runtime. 3. Given no static linking, maintenance and extensions to the CAS API can be done much more comfortably. 4. Given no static linking, the amount of extra \[yet needless\] work that would be carried out by each registry is only activated _IIF_ the feature is actually utilized by the deployment. So starting with this release candidate, modules that intend to provide their own special flavors of tickets when necessary register the relevant types into the “global ticket catalog” as it were. Registries are then freed up look into the catalog and reorganize themselves as needed to handle all ticket types. Embedded Tomcat Default Connector Settings ------------------------------------------ In the event that you decide to run CAS without any SSL configuration in _proxying_ mode and perhaps on a non-secure port, there are now additional settings exposed in the configuration that allow you to control the behavior of the connector linked to the port, to mark it as `secure` with a scheme of `https`, etc. Code Cleanup and Optimization ----------------------------- Thanks to community contributions, the CAS codebase is revitalized ever more to make sure most if not all underlying components adhere to proper coding standards and design practices. Changes in this area include adjustments to style guidelines, constructor-based dependency injections and better adherence to the native Java 8 Collections and Lambda APIs. Configuration Panel ------------------- A number of enhancements are applied to the CAS configuration panel to ensure it can detect properties that are changed manually in configuration sources (i.e `cas|application.properties`). The panel is also able to now immediately apply configuration changes. This item is closely related to the changes done, described below, to externalize the deployment of the Spring Cloud Configuration Server. ![image](https://cloud.githubusercontent.com/assets/1205228/23504845/60464f12-ff56-11e6-8c82-1e4107638dac.png) Spring Cloud Configuration Server --------------------------------- [×](https://apereo.github.io/2017/03/31/rc3-release/#) **Beware** This may be a breaking configuration change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. In previous versions and release candidates, CAS shipped with an embedded configuration server backed by Spring Cloud. While extremely powerful, this added a number of complications such as bootstrap start-up times and extra care around securing various endpoints, etc. In this release candidate, the [configuration server functionality](https://apereo.github.io/cas/development/installation/Configuration-Server-Management.html) is pulled out of the main CAS server web application and is produced as a separate project with its own overlay. Deployments may choose to run CAS in a _standalone_ mode or they may wish to let CAS become a client of the centralized configuration server consuming settings from multiple sources for a variety of profiles, etc. Note that if you’d deployed CAS with the understanding of reading configuration files from the default `/etc/cas/config`, then you should have very little, if anything, to worry about if and when you make the jump. If you have deviated from the defaults and decided to go your own way, please consult the documentation to learn about needed readjustments. DynamoDb Ticket Registry ------------------------ CAS gains [support for DynamoDb](https://apereo.github.io/cas/development/installation/DynamoDb-Ticket-Registry.html) as yet another option for its ticket registry. This feature might look more attractive for those who wish to use AWS as the deployment environment and take advantage of native platform services and offerings. CAS Heroku Demos ---------------- Demo instances of both the CAS server and CAS Management server web applications have been updated to run the latest versions of CAS 5. Attribute Repositories & Attributes ----------------------------------- [×](https://apereo.github.io/2017/03/31/rc3-release/#) **Beware** This may be a breaking configuration change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. A [requested improvement](https://github.com/apereo/cas/issues/2083) from the `5.0.x` days; Deployments that cannot not rely on the attribute retrieval mechanism done during the same authentication request/transaction typically use separate attribute repositories to define retrieval rules. This allows one to for instance say: _Authenticate against a JDBC source, but retrieve attributes from separate LDAP and Groovy sources._ Or a bit more advanced: _Authenticate against an LDAP source, but retrieve attributes from multiple LDAP repositories yet map attributes for each differently depending on the authentication source_. So long story short, attributes that were to be retrieved from such sources were all defined in one common block global to all repositories. In this release, the attributes are removed from the global common block in CAS configuration settings and made specific for each attribute repository instance that is defined. This provides a much more flexible configuration where one could for instance then say: _Authenticate against a JDBC source, but define two LDAP sources for attributes where one is only allowed to request/retrieve attributes A,B,C while the other can only request/retrieve X,Y,C. Oh…map these attributes for each source differently. Then merge it all together and resolve conflicts. Have fun while doing it!_ Fun times. AWS CloudWatch Support ---------------------- CAS gains support to route logs automatically to [AWS CloudWatch](https://aws.amazon.com/cloudwatch/) . You can review [this guide here](https://apereo.github.io/cas/development/installation/Logging.html) to learn more. You are also allowed to use other logging and monitoring tools such as Sentry, Syslog and Logstash to manage and route CAS logs in addition to all the usual options. Sass Auto Compilation --------------------- Sass files are now automatically and as part of the build compiled to `.css` files for the main CAS server web application. REST Authentication via X.509 ----------------------------- CAS [REST Protocol](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) gains the ability to authenticate credentials via X.509, thanks to community contributions. X.509 Principal Resolution -------------------------- Thanks to community contributions, X.509 principal resolution by serial number is now able to support HEX and other configurable radixes. WS-Fed Protocol --------------- Starting with this release candidate, CAS gains [modest support](https://apereo.github.io/cas/development/protocol/WS-Federation-Protocol.html) for the WS-Fed protocol, acting both as an identity provider and security token service. Attribute Filtering Policies ---------------------------- A number of [new attribute filters](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html#attribute-filters) are worked into this release that provide support for selectively applying patterns to attributes values to allow or disallow them. Jasypt Support -------------- Running CAS in standalone mode now allows you the option to place encrypted settings into the CAS configuration files and then have them be decoded automatically. This feature is brought to you by [CAS taking advantage of Jasypt](https://apereo.github.io/cas/development/installation/Configuration-Properties-Security.html) . DynamoDb Service Registry ------------------------- CAS gains [support for DynamoDb](https://apereo.github.io/cas/development/installation/DynamoDb-Service-Management.html) as yet another option for its service registry. This feature might look more attractive for those who wish to use AWS as the deployment environment and take advantage of native platform services and offerings. Minor Bug Fixes --------------- A number of small bug fixes have been incorporated into this feature release: ### Community Contributions * SAML2 `InResponseTo` field is now correctly set in response. * JDBC data sources are massaged to correctly handle the minimum number of idle connections. * YAML properties are now correctly loaded both from the embedded web application as well as externalized sources. * Regressions that made service properties in the CAS management webapp dysfunctional are now removed/fixed. * LDAP authentication removes the need for separate SASL authentication type option, folding it neatly into `AUTHENTICATED`. * Documentation improvements to explain the proper encoding used for `.properties` and `.yml` files. ### Others * OAuth services are now properly recognized during the logout process. * SAML2 authenication statements should now properly include a session index. * CAS cookies are set to `httpOnly` by default with options to control this behavior externally. * SAML2 attribute statements should now correctly use the SAML2 prefix when constructing attribute values. * SAML2 ECP functionality gets a brand new pass to resolve a series of issues with encodings and responses. Library Upgrades ---------------- * Spring * Hazelcast * Spring Boot * Apache Tomcat * Spring Cloud * Hibernate * Log4j * HJSON * Metrics * Groovy * JodaTime * … What’s Next? ------------ The development team is working to make sure the CAS `5.1.0` release is on [schedule](https://github.com/apereo/cas/milestones) . Additional release candidates and more updates will likely be released prior to the official GA release. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Review and suggest documentation improvements. * Review the release schedule and make sure you report your desired feature requests on the project’s issue tracker. Das Ende -------- A big hearty thanks to all who participated in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.1.0+RC3+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&title=CAS+5.1.0+RC3+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&title=CAS+5.1.0+RC3+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&name=CAS+5.1.0+RC3+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&title=CAS+5.1.0+RC3+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&title=CAS+5.1.0+RC3+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F03%2F31%2Frc3-release%2F&t=CAS+5.1.0+RC3+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.3.0 RC2 Feature Release – Apereo Community Blog CAS 5.3.0 RC2 Feature Release ============================= Friday, Feb 9, 2018 11 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.2.0` GA was released on [November 27th, 2017](https://github.com/apereo/cas/releases/tag/v5.2.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.3.0`. This post intends to highlight some of the improvements and enhancements packed into the **second** release candidate in the `5.3.0` series. The in-development documentation of CAS `5.3.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read about the previous release candidate [here](https://apereo.github.io/2017/12/29/530rc1-release/) . * [Shake Well Before Use](https://apereo.github.io/2018/02/09/530rc2-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2018/02/09/530rc2-release/#apache-maven) * [Gradle](https://apereo.github.io/2018/02/09/530rc2-release/#gradle) * [Minors](https://apereo.github.io/2018/02/09/530rc2-release/#minors) * [Hazelcast Discovery](https://apereo.github.io/2018/02/09/530rc2-release/#hazelcast-discovery) * [Apache Syncope Authentication](https://apereo.github.io/2018/02/09/530rc2-release/#apache-syncope-authentication) * [Operation Lombok](https://apereo.github.io/2018/02/09/530rc2-release/#operation-lombok) * [HTTP Security Headers per Service](https://apereo.github.io/2018/02/09/530rc2-release/#http-security-headers-per-service) * [Registered Services REST API](https://apereo.github.io/2018/02/09/530rc2-release/#registered-services-rest-api) * [Configuration Discovery](https://apereo.github.io/2018/02/09/530rc2-release/#configuration-discovery) * [SAML2 Service Providers](https://apereo.github.io/2018/02/09/530rc2-release/#saml2-service-providers) * [JSON Whitelist Authentication](https://apereo.github.io/2018/02/09/530rc2-release/#json-whitelist-authentication) * [REST Protocol Credential Extraction](https://apereo.github.io/2018/02/09/530rc2-release/#rest-protocol-credential-extraction) * [AWS Credential Fetching](https://apereo.github.io/2018/02/09/530rc2-release/#aws-credential-fetching) * [Mapped Attribute Value Filters](https://apereo.github.io/2018/02/09/530rc2-release/#mapped-attribute-value-filters) * [Authenticate Credentials via REST Protocol](https://apereo.github.io/2018/02/09/530rc2-release/#authenticate-credentials-via-rest-protocol) * [REST Protocol Enhancements](https://apereo.github.io/2018/02/09/530rc2-release/#rest-protocol-enhancements) * [REST-based Audits](https://apereo.github.io/2018/02/09/530rc2-release/#rest-based-audits) * [SAML2 Attribute Friendly Names](https://apereo.github.io/2018/02/09/530rc2-release/#saml2-attribute-friendly-names) * [Configuration Binding Behavior](https://apereo.github.io/2018/02/09/530rc2-release/#configuration-binding-behavior) * [New Command-line Shell Commands](https://apereo.github.io/2018/02/09/530rc2-release/#new-command-line-shell-commands) * [SAML2 Audits](https://apereo.github.io/2018/02/09/530rc2-release/#saml2-audits) * [OAuth2 Audits](https://apereo.github.io/2018/02/09/530rc2-release/#oauth2-audits) * [REST API Audits](https://apereo.github.io/2018/02/09/530rc2-release/#rest-api-audits) * [Audit Trail Management](https://apereo.github.io/2018/02/09/530rc2-release/#audit-trail-management) * [Authentication Throttling](https://apereo.github.io/2018/02/09/530rc2-release/#authentication-throttling) * [MongoDb Authentication Throttling](https://apereo.github.io/2018/02/09/530rc2-release/#mongodb-authentication-throttling) * [Library Upgrades](https://apereo.github.io/2018/02/09/530rc2-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2018/02/09/530rc2-release/#get-involved) * [Das Ende](https://apereo.github.io/2018/02/09/530rc2-release/#das-ende) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . In order to start experimenting with release candidates, use the following strategies. At any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of [the overlay](https://github.com/apereo/cas-overlay-template) , adjust the following tag to match below: 5.3.0-RC2 ### Gradle In the `gradle.properties` of [the overlay](https://github.com/apereo/cas-gradle-overlay-template) , adjust the following setting to match below: cas.version=5.3.0-RC2 Minors ------ 1. The embedded Apache Tomcat container is now given the ability to support basic authentication. 2. Caching attributes fetched from external attribute repositories is now corrected to handle caching more efficiently. 3. Thanks to [@leleuj](https://github.com/leleuj) , MFA bypass via REST is corrected to format parameters properly for the REST request. 4. Thanks to [@alexdp](https://github.com/alexdp) , the Apache Ignite cache is corrected to include the right cache names for proxy tickets. 5. Thanks to [@rrenomeron](https://github.com/rrenomeron) , better error handling is put into place while parsing YAML property files. 6. Thanks to [@leleuj](https://github.com/leleuj) , better error handling is put in place for email notifications specially when no principal attribute is found to indicate the target email address. 7. The DynamoDb table name used to [hold CAS’ registered service definitions](https://apereo.github.io/cas/development/installation/DynamoDb-Service-Management.html) can now be customized via CAS settings. 8. The logout webflow/view is now able to correctly recognize and activate the required code snippet for Google Analytics. 9. Thanks to [@marqc](https://github.com/marqc) ,the condition that controls the issuing of ticket-granting tickets is improved to take into account identical usernames found in multiple account sources. 10. Thanks to [@johnlister](https://github.com/johnlister) , better error handling is put in place during the password management reset flows when an invalid username is provided. 11. Thanks to [@plajko](https://github.com/plajko) , ordering of the authentication handlers selected for the current transaction is correctly enforced. 12. Thanks to [@deel77](https://github.com/deel77) , the Slovak language bundles are updated. 13. Thanks to [@3cdota](https://github.com/3cdota) ,delegated authentication using Pac4j will attempt to preserve the requested URL upon CAS logout. 14. Thanks to [@dima767](https://github.com/dima767) , the ranking logic that affected variegated multifactor providers such as Duo Security is now corrected. 15. Thanks to [@tienthanh2509](https://github.com/tienthanh2509) , a new language pack for Vietnamese is now included in CAS. 16. The LDAP service registry is able to correctly import JSON definition files where specified. 17. Thanks to [@dacurry-tns](https://github.com/dacurry-tns) , handling of MongoDb connection strings specified by client URIs is now improved. 18. Thanks to [@arbner](https://github.com/arbner) , consent view pages now have access to the authenticated principal. 19. Thanks to [@alexdp](https://github.com/alexdp) , Google Apps integration in CAS is improved to properly load the given certificates. 20. Thanks to [@hdeadman](https://github.com/hdeadman) , the SSL valve for the embedded Apache Tomcat is now correctly registered with the servlet container. 21. Thanks to [@dima767](https://github.com/dima767) , the log viewer available as part of the CAS dashboard gets a number of performance improvements internally. 22. Thanks to [@fjollberg](https://github.com/fjollberg) , authenticating to Couchbase buckets receives a number of bug fixes. 23. Thanks to [@plajko](https://github.com/plajko) , a number of MongoDb performance and configuration improvements are included in this release candidate. Additionally, the default size of the embedded Apache Tomcat’s thread pool is now increased. 24. Thanks to [@plajko](https://github.com/plajko) , JWT ids generated with CAS as OpenId Connect OP are set to the service ticket identifier to account for proper session mapping when dealing with SLO. 25. Minor bug fix in the way attributes are resolved and fetched from REST endpoints. Hazelcast Discovery ------------------- CAS is now able to leverage Apache jclouds and Microsoft Azure, when it comes to [Hazelcast and auto-discovery](https://apereo.github.io/cas/development/installation/Hazelcast-Ticket-Registry.html) . Apache Syncope Authentication ----------------------------- As yet another method of authentication, CAS is now able to [leverage Apache Syncope](https://apereo.github.io/cas/development/installation/Syncope-Authentication.html) to locate user accounts. Operation Lombok ---------------- CAS begins to adopt [Project Lombok](https://projectlombok.org/) in order to reduce noise and boilerplate code used to obtain logger objects, generate getter/setter methods, etc. This is part of a bigger gradual step at possibly converting the codebase relevant modules over to Kotlin to further improve readability and reduce LOC. Before the migration, total number of lines for Java classes stood at `207,002`. Today, after the migration the number of lines is reduced down to `190,398`. HTTP Security Headers per Service --------------------------------- Injection of HTTP security headers into the response can now be controlled on a per-service basis. See [this guide](https://apereo.github.io/cas/development/installation/Configuring-Service-Http-Security-Headers.html) for more info. Registered Services REST API ---------------------------- For some time, CAS has had support for a [REST-like API allowing one to add service definitions](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) into the registry. This API was quite limited in accepting different properties of a given service definition or different types of services for various protocols. In this release candidate, this API is improved slightly to accept all types of service definitions in the API request body and making it slightly easier to execute such requests with proper authentication and authorization enforcements. **Beware** This is a breaking change. Please revisit the API requests and reformulate them accordingly. Configuration Discovery ----------------------- The [Configuration Discovery](https://apereo.github.io/cas/development/installation/Configuration-Discovery.html) endpoint in CAS is now able to report back configured and supported clients used in the context of delegated authentication. SAML2 Service Providers ----------------------- The following new SAML2 service providers are now supported by CAS out of the box: * Amazon JSON Whitelist Authentication ----------------------------- A [JSON-based authentication strategy](https://apereo.github.io/cas/development/installation/Whitelist-Authentication.html) is now included that allows one to mimic user account details, mostly useful for development and testing. REST Protocol Credential Extraction ----------------------------------- The [CAS REST protocol](https://apereo.github.io/cas/development/protocol/REST-Protocol.html) in this release candidate is given the ability to extract multiple sets of credentials from the request body and prep them for authentication. In practice this means that various modules, such as [YubiKey](https://apereo.github.io/cas/development/installation/YubiKey-Authentication.html) and [Google Authenticator](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) , may be allowed to insert a special credential extractor into the REST engine automatically when detected in order to let the REST request achieve MFA. AWS Credential Fetching ----------------------- For components that tightly integrate with AWS such as [Cloud Directory Authentication](https://apereo.github.io/cas/development/installation/AWS-CloudDirectory-Authentication.html) or [CloudWatch](https://apereo.github.io/cas/development/installation/Logging-Cloudwatch.html) , etc CAS is now given the ability to fetch credentials from a variety of sources as part of an ordered chain. Sources include system properties, environment variables, EC2 instance metadata, etc. **Beware** This is a breaking change. As part of this change, a number of module names for CloudWatch logging, etc have changed their names to belong to the `support` category of CAS modules rather than `core`. Review the documentation and adjust accordingly. Mapped Attribute Value Filters ------------------------------ A [new attribute value filter](https://apereo.github.io/cas/development/integration/Attribute-Value-Release-Policies.html#mutant-mapped-regex) is added whose main ability is to filter attribute values by a collection of patterns and then supplant the value dynamically based on the results of the regex match. Authenticate Credentials via REST Protocol ------------------------------------------ [A new REST endpoint](https://apereo.github.io/cas/development/protocol/REST-Protocol.html#authenticate-credentials) is now exposed that is tasked to only verify the validity of the provided credentials without dealing with the ticket API. REST Protocol Enhancements -------------------------- The CAS REST protocol is now enhanced internally to be able to accept other types of protocols and parameters in order to issue a response (i.e. service ticket). As a first candidate, the REST protocol is now able to issue SAML1 tickets just as well as the normal web-based SSO flows. REST-based Audits ----------------- CAS audit data and logs may now be [POSTed to a REST endpoint](https://apereo.github.io/cas/development/installation/Audits.html) of your choosing. SAML2 Attribute Friendly Names ------------------------------ CAS [acting as a SAML2 identity provider](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) is given the ability to individually configure friendly names for attributes released to service providers. Configuration Binding Behavior ------------------------------ Starting with this release candidate, the configuration binding operations start to be a bit less forgiving when it comes to detecting _unknown_ CAS settings found in property sources such as the `cas.properties` file. If you have existing settings that are no longer accepted or recognized, CAS will present you with an error at runtime and on startup forcing you clean up the configuration and find the correct replacements where relevant. As part of this change, please note that the following settings that deal with CAS standalone configuration resolution have been renamed: * `cas.standalone.config` to `cas.standalone.configurationDirectory` * `cas.standalone.config.file` to `cas.standalone.configurationFile` * `cas.standalone.security` to `cas.standalone.configurationSecurity` **Beware** This is done to ensure configuration settings recognized by CAS are kept up-to-date, accurate and relevant throughout upgrades. As yet another reminder, it is unnecessary to copy an entire collection of CAS settings and values into property sources without fully knowing their application and impact. Per the usual recommendation, you are to keep the entire overlay construct clean, precise and laser-focused on behavior you do in fact need. New Command-line Shell Commands ------------------------------- The [CAS command-line shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) is now given the following capabilities: * Export database schemas and DDLs * Generate SAML IdP metadata and related keystores and certificates * Jasypt-related commands to test available cipher algorithms and providers used to secure CAS properties, thanks to [@hdeadman](https://github.com/hdeadman) . SAML2 Audits ------------ SAML2 requests and responses accepted and produced by CAS while [running as a SAML2 identity provider](https://apereo.github.io/cas/development/installation/Configuring-SAML2-Authentication.html) are now routed to the audit log. As part of this change, the auditing functionality in CAS is slightly improved to allow for dynamic registration of audit action and resource resolution events that may be carried out by any CAS module at runtime and typically on startup. OAuth2 Audits ------------- OAuth2 user profiles produced by CAS while [running as an OAuth2 identity provider](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) are now routed to the audit log. REST API Audits --------------- Interactions with the [CAS REST API](https://apereo.github.io/cas/development/protocol/REST-Protocol.html#authenticate-credentials) that would allow one to obtain ticket-granting tickets and/or service tickets are now also sent to the audit log. Audit Trail Management ---------------------- Audit record management in CAS is given the abllity to work with multiple managers, storing audit data in many destinations at the same time. The auditing library is also given the ablity to fetch audit data based on a starting date whose value may be controlled in CAS settings. **Beware** As part of this change, a number of settings that specifically controlled the behavior of audit functionality based on log files and Slf4j have changed location, moving over to a `slf4j` category. Review the documentation for all settings and adjust accordingly if you have included any of those settings in your property sources. Authentication Throttling ------------------------- Authentication throttling configuration is slightly simplified to skip creating NoOp throttlers when throttling is disabled. As part of this change, other components that take advantage of throttling such as REST and OAuth protocols are affected to use the same throttler and configuration that would is used for other areas of the system namely the usual login endpoints. **Beware** As part of this change, the `throttler` setting that REST and OAuth module settings carried is now removed in favor of the default throttler functionality. MongoDb Authentication Throttling --------------------------------- In addition to recording audit records in [MongoDb databases](https://apereo.github.io/cas/development/installation/Audits.html#mongodb-audits) , CAS also offers the authentication throttling functionality [based on MongoDb](https://apereo.github.io/cas/development/installation/Configuring-Authentication-Throttling.html) that is tightly integrated with the same auditing facility. Library Upgrades ---------------- * Kotlin * Checkstyle * Spring Webflow * Commons Pool * Spring Boot * Apache Tomcat * Pac4j * Gradle * Person Directory * Apache HttpClient * HikariCP * Inspektr * Spring * Java CAS Client (version `3.5.0` is now available) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.3.0+RC2+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&title=CAS+5.3.0+RC2+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&title=CAS+5.3.0+RC2+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&name=CAS+5.3.0+RC2+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&title=CAS+5.3.0+RC2+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&title=CAS+5.3.0+RC2+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F02%2F09%2F530rc2-release%2F&t=CAS+5.3.0+RC2+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 5.2.0 RC4 Feature Release – Apereo Community Blog CAS 5.2.0 RC4 Feature Release ============================= Monday, Oct 16, 2017 8 minute read **Collaborate** The blog is managed and hosted on Github. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.1.0` GA was released on [May 27th 2017](https://github.com/apereo/cas/releases/tag/v5.1.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `5.2.0`. This post intends to highlight some of the improvements and enhancements packed into the **fourth** release candidate in the `5.2.0` series. The in-development documentation of CAS `5.2.0` is [available here](https://apereo.github.io/cas/development/) . The release schedule is also [available here](https://github.com/apereo/cas/milestones) . The release policy is [available here](https://apereo.github.io/cas/developer/Release-Policy.html) . You can read more about the previous release candidate [here](https://apereo.github.io/2017/09/15/520rc3-release/) . * [Shake Well Before Use](https://apereo.github.io/2017/10/16/520rc4-release/#shake-well-before-use) * [Apache Maven](https://apereo.github.io/2017/10/16/520rc4-release/#apache-maven) * [Gradle](https://apereo.github.io/2017/10/16/520rc4-release/#gradle) * [Minors](https://apereo.github.io/2017/10/16/520rc4-release/#minors) * [Test Coverage](https://apereo.github.io/2017/10/16/520rc4-release/#test-coverage) * [Attribute Resolution Dashboard](https://apereo.github.io/2017/10/16/520rc4-release/#attribute-resolution-dashboard) * [Management Web Application](https://apereo.github.io/2017/10/16/520rc4-release/#management-web-application) * [Authentication](https://apereo.github.io/2017/10/16/520rc4-release/#authentication) * [Contacts](https://apereo.github.io/2017/10/16/520rc4-release/#contacts) * [Attribute Value Filters](https://apereo.github.io/2017/10/16/520rc4-release/#attribute-value-filters) * [User Interface](https://apereo.github.io/2017/10/16/520rc4-release/#user-interface) * [Redis Sentinel Support](https://apereo.github.io/2017/10/16/520rc4-release/#redis-sentinel-support) * [JMS Ticket Registry](https://apereo.github.io/2017/10/16/520rc4-release/#jms-ticket-registry) * [OAuth User Profile Rendering](https://apereo.github.io/2017/10/16/520rc4-release/#oauth-user-profile-rendering) * [Attribute Consent](https://apereo.github.io/2017/10/16/520rc4-release/#attribute-consent) * [Attribute Hashing](https://apereo.github.io/2017/10/16/520rc4-release/#attribute-hashing) * [Groovy Support](https://apereo.github.io/2017/10/16/520rc4-release/#groovy-support) * [Service Expiration Policies](https://apereo.github.io/2017/10/16/520rc4-release/#service-expiration-policies) * [Acceptable Usage Policy](https://apereo.github.io/2017/10/16/520rc4-release/#acceptable-usage-policy) * [MongoDb Storage](https://apereo.github.io/2017/10/16/520rc4-release/#mongodb-storage) * [Groovy Password Encoders](https://apereo.github.io/2017/10/16/520rc4-release/#groovy-password-encoders) * [Configuration Metadata UI](https://apereo.github.io/2017/10/16/520rc4-release/#configuration-metadata-ui) * [Metrics](https://apereo.github.io/2017/10/16/520rc4-release/#metrics) * [Storage](https://apereo.github.io/2017/10/16/520rc4-release/#storage) * [REST Service Registry](https://apereo.github.io/2017/10/16/520rc4-release/#rest-service-registry) * [Library Upgrades](https://apereo.github.io/2017/10/16/520rc4-release/#library-upgrades) * [Get Involved](https://apereo.github.io/2017/10/16/520rc4-release/#get-involved) * [Das Ende](https://apereo.github.io/2017/10/16/520rc4-release/#das-ende) Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . In order to start experimenting with release candidates, use the following strategies. At any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Apache Maven In the `pom.xml` of the overlay, adjust the following tag to match below: 5.2.0-RC4 ### Gradle In the `gradle.properties` of the overlay, adjust the following setting to match below: cas.version=5.2.0-RC4 Minors ------ 1. Thanks to [@CobraFlow](https://github.com/CobraFlow) , delegated authentication using CAS is now able to correctly parse the CAS protocol setting. 2. Cassandra authentication support is now able to correctly pick up the connection factory from the application context, and uses the correct setting for usernames when constructing authentication queries. 3. Thanks to [@marwatk](https://github.com/marwatk) , the password management webflow is now correctly registering an event to respond to _Password Must Change_ scenarios. 4. Documentation guidelines to explain how to [deploy CAS as an OS service](https://apereo.github.io/cas/development/installation/Configuring-Deployment-System-Service.html) . 5. Thanks to [@acvcu](https://github.com/acdcu) , multifactor authentication bypass options now correctly take into account the principal attribute name. 6. Small improvements in the way access strategy policies are enforced, specially when dealing attribute release policies that have semi complex mapping rules. 7. Mapping attributes to be considered as CAS usernames now correctly takes into account multi-valued attributes. 8. Thanks to [@marwatk](https://github.com/marwatk) , validating security question answers are now made extensible to account for custom validation rules. 9. Anchor fragments are now automatically preserved while redirecting back to the application with a ticket. 10. MDUI elements for services found in the registry now correctly honor information and privacy URLs. 11. Thanks to [@bhohler](https://github.com/bhohler) , verification of credential’s password against Cloud Directory is now done properly. 12. Signing certificates configured for [WSFED delegated authentication](https://apereo.github.io/cas/development/integration/ADFS-Integration.html) are now made watchable. 13. Thanks to [@bsandiford](https://github.com/bsandiford) , memcached serialization via Kryo now takes into account a few more ticket expiration policies and other components. It is also set to issue a warning if and when unregistered classes in the kryo registry are found. 14. CAS as a Spring Boot Application can now be deployed as [a fully-executable file](https://apereo.github.io/cas/development/installation/Configuring-Servlet-Container.html) . 15. Thanks to [@marwatk](https://github.com/marwatk) , extensible error handling logic is now built into the password management to ensure password update operations can correctly report back failure events. 16. Slight cleanup to ensure MongoDb and Redis ticket registries are able to take advantage of crypto operations. 17. Thanks to [@sbearcsiro](https://github.com/sbearcsiro) , servide registry auto-initialization from JSON services now is prevented from adding duplicate records. 18. Minor improvements to the audit log message where super long messages are now abbreviated down to `125` characters. 19. Thanks to [@marwatk](https://github.com/marwatk) , ordering of security questions for password management is now preserved. 20. Plenty of minor documentation improvements, such a few notes on how the [service registry initialization](https://apereo.github.io/cas/development/installation/AutoInitialization-Service-Management.html) works and what one might be able to do in order to disable CAS’ embedded logging configuration when [using an external servlet container](https://apereo.github.io/cas/development/installation/Configuring-Servlet-Container.html#external) . 21. Thanks to [@NgSekLong](https://github.com/NgSekLong) , the signature block type produced in a SAML2 response is now controllable via settings to encode signatures in `PEM` or `DER` mode. 22. Thanks to [@frett](https://github.com/frett) , the payload produced by proxy validation event is now able to remain CAS Protocol v3 compatibble by releasing attributes. 23. [X509 principal resolution](https://apereo.github.io/cas/development/installation/X509-Authentication.html) is now able to support EDIPI defined as part of the certificate’s CN. 24. [Remote Trusted authentication](https://apereo.github.io/cas/development/installation/Trusted-Authentication.html) is now able to use a custom request header to extract the authenticated username. 25. [Delegated authentication](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) is now able to support [Keycloak](https://apereo.github.io/2017/10/16/520rc4-release/www.keycloak.org/) . Test Coverage ------------- CAS is now integrated with [coveralls.io](https://coveralls.io/github/apereo/cas) to report back test coverage statistics. The propduced report will help to identify areas that need more attention in terms of QA and verification. As of this writing, CAS stands at 43% test coverage and that number will continue to grow in the coming months with the addition of test cases and fine-tuning of the reporting tool to skip and ignore relevant areas. Attribute Resolution Dashboard ------------------------------ The attribute resolution interface presented as part of CAS dashboard now allows for one to test authentication and observe the CAS payload that might be released to a registered application in the CAS service registry, indicating various protocols. ![image](https://user-images.githubusercontent.com/1205228/31140834-8b63f688-a882-11e7-9010-abe7ec37798a.png) Management Web Application -------------------------- ### Authentication Authentication strategies for the CAS management web application have been improved to support a [few more options](https://apereo.github.io/cas/development/installation/Installing-ServicesMgmt-Webapp.html) . Similarly, authorization rules are now allowed to support JSON/YAML backends. ### Contacts Thanks to [@tsschmidt](https://github.com/tsschmidt) , the registered service definition model is now able to [support contacts](https://apereo.github.io/cas/development/installation/Configuring-Service-Contacts.html) . Support for contacts is also made available in the management web application. ![image](https://user-images.githubusercontent.com/1205228/31142213-73581fc0-a886-11e7-9fed-61e7e89b1021.png) ### Attribute Value Filters Thanks to [@tsschmidt](https://github.com/tsschmidt) , attribute value filters are now also supported in the CAS management web application: ![image](https://user-images.githubusercontent.com/1205228/31539488-8b8241d4-b015-11e7-8138-945917cb106b.png) ### User Interface Thanks to [@tsschmidt](https://github.com/tsschmidt) , UX continues to see improvements and minor bug fixes. Time and availability permitting, we are working to include workflow and wizard functionality into the interface. Redis Sentinel Support ---------------------- Redis Sentinel provides high availability for Redis. In practical terms this means that using Sentinel you can create a Redis deployment that resists without human intervention to certain kind of failures. Redis Sentinel also provides other collateral tasks such as monitoring, notifications and acts as a configuration provider for clients. Thanks to [@ozayduman](https://github.com/ozayduman) , components in CAS that integrate with Redis such the [Redis Ticket Registry](https://apereo.github.io/cas/development/installation/Redis-Ticket-Registry.html) or the [Redis Service Registry](https://apereo.github.io/cas/development/installation/Redis-Service-Management.html) are now extended to support Sentinel for better HA configuration. JMS Ticket Registry ------------------- A new ticket registry implementation is now available which [based on JMS](https://apereo.github.io/cas/development/installation/Messaging-JMS-Ticket-Registry.html) with support for a variety of messaging systems such as ActiveMQ, Artemis, etc. OAuth User Profile Rendering ---------------------------- [Additional options](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) are now exposed that control the rendering of the OAuth user profile. Attribute Consent ----------------- ### Attribute Hashing **Beware** This may be a breaking change. Consult [the docs](https://apereo.github.io/cas/development/) to learn more. [Attribute consent](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) functionality no longer applies a SHA-512 hashing function to attribute names and values. The consent decisions are now limited to signing and encryption only. With the one-way hash removed, CAS now presents the functionality underneath to decrypt records and present them back to the user in form of administrative dashboards and user interfaces, allowing users to revoke or modify a decision. ### Groovy Support [Attribute consent](https://apereo.github.io/cas/development/integration/Attribute-Release-Consent.html) can now be managed via an externally-defined Groovy script for easier extensibility and customizations. Service Expiration Policies --------------------------- Service definitions are now given [the ability to expire](https://apereo.github.io/cas/development/installation/Configuring-Service-Expiration-Policy.html) on a designated date. Thanks to [@tsschmidt](https://github.com/tsschmidt) , the management web application also supports this capability too: ![image](https://user-images.githubusercontent.com/1205228/31487273-020eeca0-af47-11e7-9a74-759d38659c0a.png) Acceptable Usage Policy ----------------------- ### MongoDb Storage [Acceptable Usage Policy](https://apereo.github.io/cas/development/installation/Webflow-Customization-AUP.html) is now slightly improved to support MongoDb for a storage option. Groovy Password Encoders ------------------------ CAS password encoders are now allowed to be defined [as a Groovy script](https://apereo.github.io/cas/development/installation/Configuration-Properties-Common.html#password-encoding) to assist with designing custom encoding schemes. Configuration Metadata UI ------------------------- Accessing [CAS configuration metadata](https://apereo.github.io/cas/development/installation/Configuration-Metadata-Repository.html) is now possible via the CAS dashboards: ![image](https://user-images.githubusercontent.com/1205228/30881885-1dc62358-a314-11e7-8ebc-f79c41891d88.png) Most if not all CAS properties are annotated with `@RequiredProperty` and `@RequiredModule` which are then picked up by the metadata generation process and translated for REST APIs, etc. Metrics ------- ### Storage [CAS metrics](https://apereo.github.io/cas/development/installation/Configuring-Metrics.html) may be routed to varying types of databases for storage and analytics. REST Service Registry --------------------- Managing service definitions may also be carried out via a [REST implementation](https://apereo.github.io/cas/development/installation/REST-Service-Management.html) of your choice. Library Upgrades ---------------- * Spring Boot * Spring Webflow * Spring * jQuery * jQuery UI * Gradle * Hibernate * Apache Tomcat * Apache Http Client * Spring Data * Log4j * Spring MongoDb * Dropwizard Metrics * Swagger * Bootstrap Datepicker * AspectJ * MariaDb Driver * Google Maps * AWS Java SDK Additionally, Javascript linting process is internally updated to support ECMAScript 6. Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Das Ende -------- Big thanks to all who participate in the development of this release to submit patches, report issues and suggest improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+5.2.0+RC4+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&title=CAS+5.2.0+RC4+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&title=CAS+5.2.0+RC4+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&name=CAS+5.2.0+RC4+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&title=CAS+5.2.0+RC4+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&title=CAS+5.2.0+RC4+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2017%2F10%2F16%2F520rc4-release%2F&t=CAS+5.2.0+RC4+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # CAS 6.0.0 RC1 Feature Release – Apereo Community Blog CAS 6.0.0 RC1 Feature Release ============================= Friday, Aug 3, 2018 14 minute read **Collaborate** The blog is managed and hosted on GitHub. If you wish to update the contents of this post or if you have found an inaccuracy and wish to make corrections, we recommend that you please submit a pull request to [this repository](https://github.com/apereo/apereo.github.io) . The official CAS `5.3.0` GA was released on [June 29th, 2018](https://github.com/apereo/cas/releases/tag/v5.3.0) . Since then, the project has been moving forward with development of the next feature release that is tagged as `6.0.0`. Note that this is a **major release** of the CAS software which _may_ present significant changes in architecture, configuration or behavior. Please review the [release policy](https://apereo.github.io/cas/developer/Release-Policy.html) to learn more about the scope of the release. This post intends to highlight some of the improvements and enhancements packed into the **first** release candidate in the `6.0.0` series. Shake Well Before Use --------------------- We strongly recommend that you take advantage of the release candidates as they come out. Waiting for a `GA` release is only going to set you up for unpleasant surprises. A `GA` is simply [a tag and nothing more](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) . Note that CAS releases are _strictly_ time-based releases; they are not scheduled or based on specific benchmarks, statistics or completion of features. To gain confidence in a particular release, it is strongly recommended that you start early by experimenting with release candidates and/or follow-up snapshots. In order to start experimenting with release candidates, at any given time, you should be able to append `-SNAPSHOT` to the CAS version specified in order to take advantage of snapshot builds as changes are made and published. ### Overlay In the `build.properties` of [the overlay](https://github.com/apereo/cas-overlay-template/tree/6.0) , adjust the following setting: casVersion=6.0.0-RC1 The template overlays are getting reorganized to some degree before they can be fully functional with CAS 6. Be sure to double check the branch and the overlay structure as you navigate though CAS versions and release candidates. Changes ------- * [New & Noteworthy](https://apereo.github.io/2018/08/03/600rc1-release/#new--noteworthy) * [Java 10](https://apereo.github.io/2018/08/03/600rc1-release/#java-10) * [Servlet Specification v4](https://apereo.github.io/2018/08/03/600rc1-release/#servlet-specification-v4) * [Spring v5](https://apereo.github.io/2018/08/03/600rc1-release/#spring-v5) * [Spring Boot v2](https://apereo.github.io/2018/08/03/600rc1-release/#spring-boot-v2) * [Metrics](https://apereo.github.io/2018/08/03/600rc1-release/#metrics) * [Endpoints](https://apereo.github.io/2018/08/03/600rc1-release/#endpoints) * [Endpoint Security](https://apereo.github.io/2018/08/03/600rc1-release/#endpoint-security) * [CAS Command-line Shell](https://apereo.github.io/2018/08/03/600rc1-release/#cas-command-line-shell) * [Dynamic SAML2 Metadata](https://apereo.github.io/2018/08/03/600rc1-release/#dynamic-saml2-metadata) * [Webflow Decorations](https://apereo.github.io/2018/08/03/600rc1-release/#webflow-decorations) * [Adaptive Authentication IP Intelligence](https://apereo.github.io/2018/08/03/600rc1-release/#adaptive-authentication-ip-intelligence) * [Azure MFA Integration](https://apereo.github.io/2018/08/03/600rc1-release/#azure-mfa-integration) * [Google Authenticator Account Management](https://apereo.github.io/2018/08/03/600rc1-release/#google-authenticator-account-management) * [OAuth & OpenID Connect JSON Output](https://apereo.github.io/2018/08/03/600rc1-release/#oauth--openid-connect-json-output) * [OAuth Device Flow](https://apereo.github.io/2018/08/03/600rc1-release/#oauth-device-flow) * [OAuth Proof Key Code Exchange (PKCE)](https://apereo.github.io/2018/08/03/600rc1-release/#oauth-proof-key-code-exchange-pkce) * [CAS as Multifactor Authentication Provider](https://apereo.github.io/2018/08/03/600rc1-release/#cas-as-multifactor-authentication-provider) * [Couchbase Audits](https://apereo.github.io/2018/08/03/600rc1-release/#couchbase-audits) * [SAML2 Metadata Health Status](https://apereo.github.io/2018/08/03/600rc1-release/#saml2-metadata-health-status) * [OAuth Token Introspection](https://apereo.github.io/2018/08/03/600rc1-release/#oauth-token-introspection) * [YubiKey Account Management](https://apereo.github.io/2018/08/03/600rc1-release/#yubikey-account-management) * [Nexmo SMS Integration](https://apereo.github.io/2018/08/03/600rc1-release/#nexmo-sms-integration) * [Small Stuff](https://apereo.github.io/2018/08/03/600rc1-release/#small-stuff) * [Library Upgrades](https://apereo.github.io/2018/08/03/600rc1-release/#library-upgrades) * [Resources](https://apereo.github.io/2018/08/03/600rc1-release/#resources) * [Get Involved](https://apereo.github.io/2018/08/03/600rc1-release/#get-involved) * [Credits](https://apereo.github.io/2018/08/03/600rc1-release/#credits) ### New & Noteworthy #### Java 10 **WATCH OUT!** This is a breaking change. You will need to make sure the deployment platform is prepped with the correct Java version before moving forward. Oracle recently announced that they intend to move Java to a release every six months. Under the new release schedule, Oracle proposes strict time-based releases, known as feature releases. These will appear every year in March and September. The new release schedule is intended to begin immediately after the release of Java 9 (which is long-gone at this point), with the next release of Java to come in early 2018. The release schedule of the CAS software quite happily lends itself to the Java release schedule as well. There has been a feature release once every 6 months or so for the past couple of years and such releases have exclusively been time-based releases with a number of candidates in between them for adopters to experiment. That being said, in order to keep up with the Java release schedule, stay on a supported platform and keep the progress ball moving forward, the minimum required Java version is set to be `11` starting with CAS 6. This has not been an easy effort; the CAS 6 development has been in progress since February 2018 with early testing of snapshots and release candidates of Java as well as all other software packages and libraries to ensure a successful build and deployment model. For the most part, all functionality continues to remain the same as it was and the change in platform requirements should remain completely invisible to the deployment. Note that this particular release candidate will be based on top of Java 10, having passed 9 already. As other libraries begin to catch up with Java 11 and provider better support, CAS will ultimately switch to Java 11 before the final GA release. While there are no specific plans as of this writing, there will likely be follow-up feature releases after CAS `6` in form of `6.1`, `6.2`, etc each of which may require and depend on future Java releases such as `12`, `13`, etc. #### Servlet Specification v4 **Attention** This might be a breaking change. While there isn't anything in CAS (yet) that would take advantage of the new specification features, we obviously reserve the right to do. You are better off switching to the required version as time and energy allows. The [embedded server containers](https://apereo.github.io/cas/development/installation/Configuring-Servlet-Container.html) provided by CAS (Apache Tomcat, Jetty, etc) have been and will be upgraded to include support for the new specification version. This will most notably include required support for Apache Tomcat 9+ and Undertow 2+. #### Spring v5 Given changes in the platform requirements, the Spring framework that is very heavily used internally by CAS has been updated to its most recent version that is version `5.0.x`. You can read all about Spring 5 [here](https://springframework.guru/what-is-new-with-spring-framework-5/) . While for the most part, the upgrade is rather invisible to the CAS developer and adopter, one area that is negatively impacted by the change is the [SAML2 functionality in CAS](https://apereo.github.io/cas/development/protocol/SAML-Protocol.html) that uses the Velocity templating engine needed by the [OpenSAML library](https://wiki.shibboleth.net/confluence/display/OS30/Home) to submit SAML responses, etc. Velocity support is [no longer available in Spring 5](https://jira.spring.io/browse/spr-13795) and additional measures are taken in CAS to ensure OpenSAML and friends and continue to do the job without relying on Velocity support assumed to be available with the Spring framework. It is quite likely that CAS would ultimately switch to Spring `5.1.x` to take full advantage of Java 11 support. #### Spring Boot v2 CAS is entirely based on the [Spring Boot framework](https://spring.io/projects/spring-boot) at heart, which controls the orchestration and management of CAS settings, configuration modules, and many other things. Moving to the newer version of the Java platform as well as the Spring framework requires CAS to switch to the latest iteration of the Spring Boot framework, namely the `2.x` series. You can read all about Spring Boot 2 [here](https://spring.io/blog/2018/03/01/spring-boot-2-0-goes-ga) . **JDK Compatibility** Full support for Java 11 will be provided by Spring Boot `2.1.x`, expected to be released in September 2018. Given the impact and utility of the framework in the CAS codebase, a rather large number of changes have had to be introduced in order to achieve a successful upgrade and keep as much of the current functionality as possible. However, a number of areas in CAS are negatively impacted by this upgrade some of which are more visible than others and sometimes for the better. These areas include are but not limited to [CAS metrics](https://apereo.github.io/cas/development/installation/Configuring-Metrics.html) , [actuator/admin endpoints](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) as well as their security and protection strategy. It is quite likely that CAS would ultimately switch to Spring Boot `2.1.x` to take full advantage of Java 11 support. #### Metrics **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust accordingly. As part of the Spring Boot v2 upgrade, [CAS metrics](https://apereo.github.io/cas/development/installation/Configuring-Metrics.html) are cleaned up as much as possible to delegate the entire task of capturing and recording metrics to Spring Boot, which internally delegates that functionality by auto-configuring components from the [micrometer project](https://github.com/micrometer-metrics/micrometer) . This is an application metrics facade for the most popular monitoring tools whose connection information is entirely controlled by specific properties and settings provided by Spring Boot. In this area, CAS only begins to prepare the deployment environment with the right set of dependencies and libraries and then gets out of the way, allowing micrometer and native Spring Boot functionality to take over. While [a large set of options](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-metrics.html) are supported by micrometer and auto-configured by Spring Boot to capture and store metrics, as a result of this change support for services such as MongoDb, Redis and such are removed from CAS given support for the equivalent components in Spring Boot is removed. However, note that micrometer continues to add support for newer services and target systems and by simply keeping the dependencies up-to-date and relevant, those options would automatically become available to CAS. #### Endpoints Actuator endpoints, known in CAS as [admin endpoints](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) , let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the `health` endpoint provides basic application health information. Spring Boot 2 brings a brand new endpoint infrastructure that allows you to define one or several operations in a technology independent fashion with support for Spring MVC, Spring WebFlux and more. **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust accordingly. This means while the endpoints provided by Spring Boot will transition quite nicely over to CAS 6, those that are provided by CAS needed to be redesigned again to lend themselves to the new technology-agnostic strategy. In this new model, endpoints exhibit the following traits: * Each endpoint can be individually enabled or disabled and a global default is available to control this behavior en mass. * The security of each endpoint is entirely controlled by Spring Security, once and if found in the application bundle on the _classpath_. More on this later in the following section. * Each endpoint may be individually chosen for exposure over the web. * By default, endpoints are exposed over HTTP under the `/actuator` path by using the ID of the endpoint. However, endpoints can be remapped. For example, the following settings remap `/actuator/health` to `/healthcheck`: management.endpoints.web.base-path=/ management.endpoints.web.path-mapping.health=healthcheck **Dashboards** Note that all UI functionality and dashboards are removed from the CAS where the server is only tasked to fetch and produce data using the available endpoints in RESTful and secure ways. The ultimate end goal is to introduce relevant UI components and screens into the CAS management web application that would consume data from such endpoints, making the management web application truly a _management_ web application. To learn more about endpoints, monitors and health indicators from the Spring Boot perspective, please [review this document](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html) . ##### Endpoint Security Endpoint security in Spring Boot v2 and by extension CAS receives a complete overhaul. All endpoints are considered disabled and sensitive by default, protected by a pair of pre-defined master credentials in CAS properties. Spring Boot 2.0 does not provide separate auto-configuration for user-defined endpoints and actuator endpoints with a rather overloaded `sensitive` property. All that functionality is handed off to Spring Security. **WATCH OUT!** This is a breaking change. Consult the CAS documentation and adjust accordingly. When Spring Security is on the classpath, the auto-configuration secures all endpoints by default. CAS relies on Spring Security’s content-negotiation strategy to determine whether to use `httpBasic` or `formLogin`, and security of endpoints is extended by CAS configuration to determine the access level and permissions of each endpoint. There will be follow-up guides and posts about how to get endpoints secured and available for proper access but for now, [this document](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html#security) should be a decent starting point. #### CAS Command-line Shell The [CAS command-line shell](https://apereo.github.io/cas/development/installation/Configuring-Commandline-Shell.html) , as a result of upgrading to the latest Spring Shell version, is impacted such that basic command-line options available in the non-interactive version of the shell are now removed. This means that you may still log into the shell and work with available CAS commands as you did interactively, taking advantage of features such as command history, tab completion, etc. #### Dynamic SAML2 Metadata [Dynamic SAML2 metadata management](https://apereo.github.io/cas/development/installation/Configuring-SAML2-DynamicMetadata.html) via JPA and MongoDb is now able to support and store SAML2 identity provider metadata artifacts. Support for additional storage options may be added in future on demand. #### Webflow Decorations Learn how to fetch and display data dynamically from external data sources and endpoints and pass those along to the webflow by [reviewing this guide](https://apereo.github.io/cas/development/installation/Webflow-Customization-Decorators.html) . #### Adaptive Authentication IP Intelligence [Adaptive Authentication](https://apereo.github.io/cas/development/installation/Configuring-Adaptive-Authentication.html) gains support to examine client IP addresses using a variety of strategies to determine whether requests should be allowed or rejected. #### Azure MFA Integration The integration with [Microsoft’s Azure multifactor authentication](https://apereo.github.io/cas/5.3.x/installation/MicrosoftAzure-Authentication.html) , previously marked as deprecated functionality, is now removed from CAS. #### Google Authenticator Account Management Accounts registered with [Google Authenticator](https://apereo.github.io/cas/development/installation/GoogleAuthenticator-Authentication.html) can now be monitored and managed administratively via [CAS monitoring capabilities](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) . #### OAuth & OpenID Connect JSON Output **WATCH OUT!** This is a breaking change. Service definitions and/or schemas need to be updated accordingly. The `jsonFormat` property assigned to each OAuth or OpenID Connect services is now removed and JSON is now made the default output syntax. #### OAuth Device Flow OAuth device flow is [now supported](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) . #### OAuth Proof Key Code Exchange (PKCE) OAuth PKCE flow is [now supported](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html) . #### CAS as Multifactor Authentication Provider CAS gains the ability to act as a [simple multifactor authentication provider](https://apereo.github.io/cas/development/installation/Simple-Multifactor-Authentication.html) , issuing tokens on its own and sharing them with the end-user via email and/or text messages. #### Couchbase Audits Couchbase is now supported for [CAS audit logs](https://apereo.github.io/cas/development/installation/Audits.html) . #### SAML2 Metadata Health Status Status of SAML metadata assigned to a SAML service can now be reported back as part of the [CAS health monitoring](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) . #### OAuth Token Introspection CAS OAuth support can now lend itself to [token introspection](https://apereo.github.io/cas/development/installation/OAuth-OpenId-Authentication.html#endpoints) . The semantics of this functionality are identical to that of OpenID Connect. #### YubiKey Account Management Accounts registered with [YubiKey Authentication](https://apereo.github.io/cas/development/installation/YubiKey-Authentication.html) can now be monitored and managed administratively via [CAS monitoring capabilities](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) . #### Nexmo SMS Integration CAS can now integrate with the [Nexmo platform](https://apereo.github.io/cas/development/installation/SMS-Messaging-Configuration.html) for sending text messages. ### Small Stuff * Delegated to the OpenID Connect provider for authentication now supports a new `tenant` option. * Aspects of OpenID Connect discovery profile, such as supported claim types, signing algorithms, etc can now be customized via CAS settings. * While generating JWTs, a `typ` header parameter is now specified. * The signing algorithm of [OpenID Connect services](https://apereo.github.io/cas/development/installation/OIDC-Authentication.html#register-clients) can now be defined for each RP. * Delegated authentication should correctly take advantage of the `unauthorizedUrl` field assigned to a service definition. * Delegated authentication should hide aspects of the CAS user interface while auto-redirecting to a provider. * Additional audit points are now provided for OAuth functionality to capture access token requests and responses as well as device codes. * The [multifactor trusted devices endpoint](https://apereo.github.io/cas/development/installation/Monitoring-Statistics.html) can now fetch registered devices linked to a user name. * Internal APIs used to manage Google Authenticator tokens and accounts are improved to support additional removal and counting ops. * Consistent package import order rules are now applied across the codebase and enforced by Checkstyle. * CAS is now using [SonarQube](https://sonarcloud.io/dashboard?id=org.apereo.cas%3Acas-server) for static analysis and extra code quality measures. * A ton of improvements to the Travis CI test harness to ensure CAS builds can execute as efficiently as possible while running integration tests. * Binary attribute values should now be properly encoded in CAS validation payload. * [Acceptable Usage Policy](https://apereo.github.io/cas/development/installation/Webflow-Customization-AUP.html) and [Interrupt Notification](https://apereo.github.io/cas/development/installation/Webflow-Customization-Interrupt.html) features of CAS are now wired up to play nice with [delegated authentication flow](https://apereo.github.io/cas/development/integration/Delegate-Authentication.html) . * SPNEGO authentication properties are now split into two sections were one deals with system-level settings and the other controls a collection of SPNEGO authntication attempts with support for multiple service principals, etc. * Small number of adjustments to ensure CAS cookie management can optionally control cookie session-pinning. ### Library Upgrades * Java * Spring * Spring Boot * Apache Tomcat * Spring Boot Admin * JUnit * Kryo * JAXB * Swagger * Eureka * InfluxDb * Apache Ignite * MongoDb Driver * MariaDb Driver * PostgreSQL Driver * Couchbase * Hazelcast * MySQL * Guava * Amazon SDK * Twilio * Pac4j * Nimbus JWT * Cassandra Driver * Font Awesome * Bootstrap Resources --------- * [Documentation](https://apereo.github.io/cas/development/) * [Release Schedule](https://github.com/apereo/cas/milestones) * [Release Policy](https://apereo.github.io/cas/developer/Release-Policy.html) Get Involved ------------ * Start your CAS deployment today. Try out features and [share feedback](https://apereo.github.io/cas/Mailing-Lists.html) . * Better yet, [contribute patches](https://apereo.github.io/cas/developer/Contributor-Guidelines.html) . * Suggest and apply documentation improvements. Credits ------- Big thanks to all who participate in the development of this release to submit patches and contribute improvements. Keep’em coming! [Misagh Moayyed](https://fawnoos.com/) Share this post! [](https://facebook.com/sharer.php?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F "Share on Facebook") [](https://twitter.com/intent/tweet?text=CAS+6.0.0+RC1+Feature+Release&url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F "Share on Twitter") [](https://plus.google.com/share?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F "Share on Google+") [](http://www.linkedin.com/shareArticle?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&title=CAS+6.0.0+RC1+Feature+Release "Share on LinkedIn") [](http://digg.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&title=CAS+6.0.0+RC1+Feature+Release "Share on Digg") [](http://www.tumblr.com/share/link?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&name=CAS+6.0.0+RC1+Feature+Release "Share on Tumblr") [](http://reddit.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&title=CAS+6.0.0+RC1+Feature+Release "Share on Reddit") [](http://www.stumbleupon.com/submit?url=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&title=CAS+6.0.0+RC1+Feature+Release "Share on StumbleUpon") [](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fapereo.github.io%2F2018%2F08%2F03%2F600rc1-release%2F&t=CAS+6.0.0+RC1+Feature+Release "Share on Hacker News") Follow Apereo on [Twitter](https://twitter.com/Apereo) . ### Related Posts [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/09/08/vuln/) [#### OpenID Federation with pac4j and CAS\ \ Learn how to use CAS as a trust anchor and a federated OP with a pac4j client](https://apereo.github.io/2026/09/01/openidfederation/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/25/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/08/18/vuln/) [#### Changes to CAS Security Vulnerability Response\ \ Apereo CAS is shortening the security disclosure grace window.](https://apereo.github.io/2026/06/23/sec-grace-window/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/18/vuln/) [#### CAS Vulnerability Disclosure\ \ Disclosure of a series of security issues with the Apereo CAS software.](https://apereo.github.io/2026/06/06/vuln/) [#### CAS OpenID Connect Vulnerability Disclosure\ \ Disclosure of a security issue with the Apereo CAS software acting itself as an OpenID Connect provider.](https://apereo.github.io/2026/05/27/oidc-vuln/) [#### Java CAS Client JWT Vulnerability Disclosure\ \ Disclosure of a security issue with the Java CAS Client validating JWTs.](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) [#### Apereo CAS - External Identity Providers\ \ An overview of Apereo CAS' ability to register identity providers for external and delegated authentication attempts.](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) --- # All Posts – Apereo Community Blog #### Apereo * [uPortal annual report, June 2018 edition](https://apereo.github.io/2018/06/25/up-annual-report/) * [Nominate awesome fits for the Apereo board](https://apereo.github.io/2018/04/20/nominate-to-board/) * [Feedback on draft Apereo strategy](https://apereo.github.io/2018/04/04/apereo-strategy/) * [Easier CLA submission](https://apereo.github.io/2017/05/05/jotform-clas/) * [September 2016 Apereo Newsletter](https://apereo.github.io/2016/09/19/newsletter/) #### Blog * [Checking Out Pull Requests Locally](https://apereo.github.io/2019/12/31/github-pr-as-branch/) * [Saving Time is Time Consuming](https://apereo.github.io/2019/03/29/startup-times/) * [Why you should choose CAS as your SSO system](https://apereo.github.io/2018/10/25/why-you-should-choose-cas-as-your-sso-system/) * [Effective Software Troubleshooting Tactics](https://apereo.github.io/2018/09/05/effective-diagnostics/) * [Notes from Better by Design 2018](https://apereo.github.io/2018/08/24/better-by-design-2018/) * [Get Productive with Shell Aliases](https://apereo.github.io/2018/07/14/shell-aliases-collection/) * [feat(conventional\_commits): signal breaking changes in commit titles](https://apereo.github.io/2018/07/07/indicate-breaks-in-conventional-commit-titles/) * [One Can Only Hope in Buchistan](https://apereo.github.io/2018/06/22/united-nations-buchistan/) * [Do State The Obvious](https://apereo.github.io/2017/09/13/efficient-marketing-intech/) * [Stop Writing Code](https://apereo.github.io/2017/09/10/stop-writing-code/) * [Let Your Docker Containers Speak](https://apereo.github.io/2017/08/24/tip-docker-container-to-host/) * [Busting the Myth - GA Release](https://apereo.github.io/2017/03/08/the-myth-of-ga-rel/) * [On The Theory of Possibility](https://apereo.github.io/2017/02/18/onthe-theoryof-possibility/) * [Guy walks into an Auto Shop](https://apereo.github.io/2017/01/20/theart-of-mechanics/) * [Singing "I Love Bug Reports"](https://apereo.github.io/2016/09/26/love-thy-bugs/) * [Veresk Software Architecture](https://apereo.github.io/2016/09/17/practical-soft-arch/) * [Hope for GitHub Pages](https://apereo.github.io/2016/09/16/hope-for-gh-pages/) * [Defining a Product Vision](https://apereo.github.io/2016/08/24/soft-evolution/) * [Hello World](https://apereo.github.io/2016/06/25/first-post/) #### CAS * [CAS Vulnerability Disclosure](https://apereo.github.io/2026/09/08/vuln/) * [OpenID Federation with pac4j and CAS](https://apereo.github.io/2026/09/01/openidfederation/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2026/08/25/vuln/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2026/08/18/vuln/) * [Changes to CAS Security Vulnerability Response](https://apereo.github.io/2026/06/23/sec-grace-window/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2026/06/18/vuln/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2026/06/06/vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2026/05/27/oidc-vuln/) * [Java CAS Client JWT Vulnerability Disclosure](https://apereo.github.io/2026/05/20/casc-jwt-vuln/) * [Apereo CAS - External Identity Providers](https://apereo.github.io/2026/04/25/cas-external-identity-providers/) * [CAS JWT Authentication Vulnerability Disclosure](https://apereo.github.io/2026/03/06/jwt-vuln/) * [Performance improvements on the service registry](https://apereo.github.io/2026/02/09/performance-improvements-service-registry/) * [Apereo CAS Dynamic Configuration Management](https://apereo.github.io/2026/02/07/cas-dynamic-configuration-management/) * [Apereo CAS Receives NLnet Grant to Advance CAS Development](https://apereo.github.io/2026/02/01/cas-nlnet/) * [CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2025/09/25/oauth-oidc-vuln/) * [CAS Simple Multifactor Authentication Vulnerability Disclosure](https://apereo.github.io/2025/08/19/simplemfa-vuln/) * [CAS OAuth/OpenID Connect & WebAuthN Vulnerability Disclosure](https://apereo.github.io/2025/04/11/oidc-webauthn-vuln/) * [CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2024/06/26/oidc-vuln/) * [CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2024/05/18/oauth-vuln/) * [Apereo CAS is now on Develocity](https://apereo.github.io/2024/03/09/develocity/) * [CAS OAuth/OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2023/09/14/oauth-vuln/) * [CAS Groovy Vulnerability Disclosure](https://apereo.github.io/2023/08/30/groovy-vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2023/07/21/oidc-vuln/) * [CAS X.509 Vulnerability Disclosure](https://apereo.github.io/2023/02/20/x509-vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/08/03/oidc-vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/07/01/oidc-vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/06/23/oidc-vuln/) * [CAS Spring Framework RCE Vulnerability Disclosure](https://apereo.github.io/2022/03/31/spring-vuln/) * [CAS OpenID Connect Vulnerability Disclosure](https://apereo.github.io/2022/03/06/oidc-vuln/) * [CAS Log4J Vulnerability Disclosure](https://apereo.github.io/2021/12/11/log4j-vuln/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2021/10/18/restvuln/) * [Publish Private CAS Releases](https://apereo.github.io/2021/07/17/publish-private-release/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2021/02/13/gauthvuln/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2020/10/14/gauthvuln/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2020/07/24/credvuln/) * [CAS Release Notes Moved](https://apereo.github.io/2020/07/02/cas-release-notes/) * [CAS 6.2.0 RC5 Feature Release](https://apereo.github.io/2020/05/29/620rc5-release/) * [CAS 6.2.0 RC4 Feature Release](https://apereo.github.io/2020/04/17/620rc4-release/) * [CAS 6.2.0 RC3 Feature Release](https://apereo.github.io/2020/03/03/620rc3-release/) * [Apereo CAS - Bootiful CAS Client](https://apereo.github.io/2020/02/26/cas-bootiful-client/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2020/02/08/webflowcrypto/) * [CAS 6.2.0 RC2 Feature Release](https://apereo.github.io/2019/12/27/620rc2-release/) * [Apereo CAS - Authentication Handler Resolution](https://apereo.github.io/2019/12/23/cas62x-authn-handler-resolution/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2019/12/20/surrogatevuln/) * [Apereo CAS - SAML2 Metadata Overrides](https://apereo.github.io/2019/12/16/cas62x-saml2-metadata-service/) * [Apereo CAS - Managing Configuration Metadata](https://apereo.github.io/2019/12/15/cas62x-config-metadata/) * [CAS 6.2.0 RC1 Feature Release](https://apereo.github.io/2019/11/29/620rc1-release/) * [Apereo CAS - Deployment Using systemd](https://apereo.github.io/2019/11/28/cas61x-systemd-deployment/) * [Apereo CAS - Python Locust Load Testing](https://apereo.github.io/2019/11/27/cas62x-locust-load-testing/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2019/11/24/smfavuln/) * [Apereo CAS - Google reCAPTCHA Integration](https://apereo.github.io/2019/11/08/cas62x-google-recaptcha/) * [Apereo CAS - JMeter Performance Testing](https://apereo.github.io/2019/11/08/cas61x-jmeter-load-testing/) * [Apereo CAS - OAuth JWT Access Tokens](https://apereo.github.io/2019/11/04/cas62x-oauth-jwt-access-token/) * [CAS 6.2.x Deployment - WAR Overlays](https://apereo.github.io/2019/11/03/cas62-gettingstarted-overlay/) * [Apereo CAS 6.2.x - Building CAS Feature Modules](https://apereo.github.io/2019/11/01/cas62x-codebase-feature-build/) * [Apereo CAS - Service Redirection Strategies](https://apereo.github.io/2019/10/31/cas62x-service-redirect-strategy/) * [Apereo CAS - Service Matching Strategies](https://apereo.github.io/2019/10/28/cas61x-service-matching-strategy/) * [Apereo CAS - Password Management with JDBC](https://apereo.github.io/2019/10/25/cas61x-password-management-jdbc/) * [Apereo CAS - Simple Multifactor Authentication](https://apereo.github.io/2019/10/14/cas61x-simple-mfa-provider/) * [Apereo CAS 2019 Survey Results](https://apereo.github.io/2019/10/09/cas-survey-results2019/) * [CAS 6.1.0 RC6 Feature Release](https://apereo.github.io/2019/10/04/610rc6-release/) * [Apereo CAS - Managing Services via Git](https://apereo.github.io/2019/10/03/cas61x-git-service-registry/) * [Apereo CAS - Ticket Distribution with JMS](https://apereo.github.io/2019/09/30/cas61x-jms-activemq-ticketing/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2019/09/27/numvulndisc/) * [Apereo CAS - SMS Notifications via Twilio](https://apereo.github.io/2019/09/20/cas61x-smsconfig-twilio/) * [CAS 6.1.0 RC5 Feature Release](https://apereo.github.io/2019/09/02/610rc5-release/) * [Apereo CAS - Passwordless Authentication](https://apereo.github.io/2019/07/18/cas61x-passwordless-authn/) * [Apereo CAS - Handling Authentication Webflow Errors with Grace](https://apereo.github.io/2019/07/02/cas61x-error-handling/) * [Apereo CAS - Are We Logged In Yet?](https://apereo.github.io/2019/06/14/cas53x-userlogin-ssostatus/) * [Apereo CAS - REST API Integrations](https://apereo.github.io/2019/06/12/cas61x-rest-api/) * [CAS 6.1.0 RC4 Feature Release](https://apereo.github.io/2019/06/07/610rc4-release/) * [Apereo CAS - Multifactor Provider Selection](https://apereo.github.io/2019/05/13/cas61x-mfa-selection-strategies/) * [Apereo CAS - Dockerized Hazelcast Deployments](https://apereo.github.io/2019/05/13/cas61x-docker-hazelcast-mgmtcenter/) * [Apereo CAS - Configuration Security w/ Jasypt](https://apereo.github.io/2019/05/08/cas61x-jasypt-encryption/) * [CAS 6.1.0 RC3 Feature Release](https://apereo.github.io/2019/04/29/610rc3-release/) * [Apereo CAS - Webflow Decorations](https://apereo.github.io/2019/04/25/cas61x-webflow-decorations/) * [Apereo CAS - SAML2 Metadata Query Protocol](https://apereo.github.io/2019/04/12/cas61x-saml-idp-mdq/) * [Apereo CAS 6.1.x - Credential Caching & Proxy AuthN](https://apereo.github.io/2019/03/25/cas61x-clearpass-pgt-attributes/) * [Apereo CAS 6.1.x - Attribute Repositories w/ Person Directory](https://apereo.github.io/2019/03/15/cas61x-attribute-repositories/) * [Apereo CAS 6.1.x - Building CAS Feature Modules](https://apereo.github.io/2019/03/12/cas61x-codebase-feature-build/) * [CAS 6.1.0 RC2 Feature Release](https://apereo.github.io/2019/03/01/610rc2-release/) * [Apereo CAS - Riffing on Attribute Release Policies](https://apereo.github.io/2019/02/27/cas61-attribute-release-policies/) * [Apereo CAS - Delegated Authentication to SAML2 Identity Providers](https://apereo.github.io/2019/02/25/cas61-delegate-authn-saml2-idp/) * [Apereo CAS - Custom Login Fields w/ Dynamic Bindings](https://apereo.github.io/2019/02/25/cas61-custom-login-fields/) * [Apereo CAS as an OAuth2 Authorization Server](https://apereo.github.io/2019/02/19/cas61-as-oauth-authz-server/) * [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) * [Apereo CAS - Keeping Healthy with Spring Boot](https://apereo.github.io/2019/02/07/cas61-healthstatus-springboot/) * [CAS 6.1.0 RC1 Feature Release](https://apereo.github.io/2019/02/01/610rc1-release/) * [Apereo CAS - SAML2 Identity Provider Integration w/ InCommon](https://apereo.github.io/2019/01/18/cas61-saml2-idp-incommon/) * [CAS 6.1.x Deployment - WAR Overlays](https://apereo.github.io/2019/01/07/cas61-gettingstarted-overlay/) * [Apereo CAS - Have you been pawned?](https://apereo.github.io/2019/01/06/cas61-groovy-haveibeenpawned/) * [Apereo CAS - OohLala Mobile SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oohlalamobile-saml2-integration/) * [Apereo CAS - Cranium Cafe SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oclc-saml2-integration/) * [Apereo CAS - eLumen SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-elumen-saml2-integration/) * [Apereo CAS - Rave SAML2 Integration](https://apereo.github.io/2018/12/23/cas53-getrave-saml2-integration/) * [Apereo CAS - HireTouch SAML2 Integration](https://apereo.github.io/2018/12/22/cas53-hiretouch-saml2-integration/) * [Apereo CAS - Microsoft Office 365 SAML2 Integration](https://apereo.github.io/2018/12/06/cas53-office365-saml2-integration/) * [Apereo CAS - HappyFox SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-happyfox-saml2-integration/) * [Apereo CAS - Cisco Webex SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-cisco-webex-saml2-integration/) * [Apereo CAS - VMware Identity Manager SAML2 Integration](https://apereo.github.io/2018/12/03/cas53-vmwareidentitymgr-saml2-integration/) * [CAS 6.0.0 RC4 Feature Release](https://apereo.github.io/2018/11/30/600rc4-release/) * [Apereo CAS - Scripting Multifactor Authentication Triggers](https://apereo.github.io/2018/11/22/cas5-groovy-mfa/) * [Apereo CAS 6.0.x - Building CAS Feature Modules](https://apereo.github.io/2018/11/20/cas60x-codebase-feature-build/) * [CAS 6.0.x Deployment - WAR Overlays](https://apereo.github.io/2018/11/16/cas60-gettingstarted-overlay/) * [Apereo CAS - Jib at CAS Docker Images](https://apereo.github.io/2018/11/09/cas6-docker-jib/) * [Apereo CAS 6 - Administrative Endpoints & Monitoring](https://apereo.github.io/2018/11/06/cas6-admin-endpoints-security/) * [Apereo CAS - SAML2 Metadata with MongoDb](https://apereo.github.io/2018/11/03/cas6-saml2-metadata-mongodb/) * [Apereo CAS - Slurp Configuration with Groovy](https://apereo.github.io/2018/11/02/cas6-groovy-config-slurper/) * [Apereo CAS - Configuration Management with MongoDb](https://apereo.github.io/2018/10/31/cas6-configuration-mongodb/) * [Apereo CAS - Integration with HashiCorp Vault](https://apereo.github.io/2018/10/30/cas6-configuration-vault/) * [CAS 6.0.0 RC3 Feature Release](https://apereo.github.io/2018/10/26/600rc3-release/) * [Why you should choose CAS as your SSO system](https://apereo.github.io/2018/10/25/why-you-should-choose-cas-as-your-sso-system/) * [Apereo CAS - Integration with Spring Cloud Config Server](https://apereo.github.io/2018/10/25/cas6-cloud-config-server/) * [Apereo CAS - Spring Boot Admin Integration](https://apereo.github.io/2018/10/22/cas6-springboot-admin-server/) * [Apereo CAS - Fun with HashiCorp Consul](https://apereo.github.io/2018/10/22/cas6-consul-discovery/) * [Apereo CAS - Multifactor Authentication with RADIUS](https://apereo.github.io/2018/10/18/cas5-radius-mfa-authn/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2018/09/26/mfavulndisc/) * [CAS 6.0.0 RC2 Feature Release](https://apereo.github.io/2018/09/14/600rc2-release/) * [Apereo CAS - dotCMS SAML2 Integration](https://apereo.github.io/2018/09/06/cas53-dotcms-saml2-integration/) * [Apereo CAS - MaxMind Geo2IP ISP Integration](https://apereo.github.io/2018/08/27/cas5-maxmind-isp-interrupt-integration/) * [Apereo CAS - Authentication Lifecycle Phases](https://apereo.github.io/2018/08/23/cas5-authn-lifecycle-extensions/) * [CAS 6.0.0 RC1 Feature Release](https://apereo.github.io/2018/08/03/600rc1-release/) * [Apereo CAS Delegated Authentication with ADFS](https://apereo.github.io/2018/07/31/cas6-delegated-authn-adfs/) * [Apereo CAS Swag with Swagger](https://apereo.github.io/2018/07/24/cas-apis-swagger/) * [Apereo CAS - Extending Webflows](https://apereo.github.io/2018/06/19/cas53webflow-extensions/) * [Apereo CAS - Administrative Endpoints & Monitoring](https://apereo.github.io/2018/06/15/cas53-admin-endpoints-security/) * [Apereo CAS - Custom Authentication & Attribute Sources](https://apereo.github.io/2018/06/12/cas53-authn-handlers/) * [Apereo CAS - User Interface Customizations](https://apereo.github.io/2018/06/10/cas-userinterface-customizations/) * [CAS Multifactor Authentication with Google Authenticator](https://apereo.github.io/2018/06/10/cas-mfa-google-authenticator/) * [CAS 5.3.x Deployment - WAR Overlays](https://apereo.github.io/2018/06/09/cas53-gettingstarted-overlay/) * [CAS 5.3.0 RC4 Feature Release](https://apereo.github.io/2018/05/25/530rc4-release/) * [Apereo CAS - Identity Impersonation](https://apereo.github.io/2018/05/07/cas-impersonation-authn/) * [Apereo CAS - Customized Settings](https://apereo.github.io/2018/05/04/cas-custom-properties/) * [Apereo CAS - Handling Multiple Logout URLs](https://apereo.github.io/2018/04/24/cas-multiple-logout-urls/) * [Apereo CAS - Access Strategy External URL Redirects](https://apereo.github.io/2018/04/23/cas-access-strategy-url-redirects/) * [Apereo CAS - Linking Accounts with Delegated Authentication](https://apereo.github.io/2018/04/20/cas-delegated-authn-account-linking/) * [Apereo CAS - Test-Driving Feature Modules](https://apereo.github.io/2018/04/05/cas-codebase-feature-build/) * [Apereo CAS Best \[Mal\]Practice - Supercharged Overlays](https://apereo.github.io/2018/04/01/cas-overlays-supercharged/) * [CAS 5.3.0 RC3 Feature Release](https://apereo.github.io/2018/03/30/530rc3-release/) * [Apereo CAS - REFEDS MFA Profile with shib-cas-authn3](https://apereo.github.io/2018/02/26/shibcasauthn-duomfa-refeds/) * [Forced Authentication with Apereo CAS](https://apereo.github.io/2018/02/26/forcedauth-modauth-cas/) * [Apereo CAS - Dances with Protocols](https://apereo.github.io/2018/02/26/cas-delegation-protocols/) * [Apereo CAS - Attribute-based Application Authorization](https://apereo.github.io/2018/02/20/cas-service-rbac-attributeresolution/) * [CAS 5.3.0 RC2 Feature Release](https://apereo.github.io/2018/02/09/530rc2-release/) * [CAS 5.2.x Deployment - WAR Overlays](https://apereo.github.io/2018/02/06/cas52-gettingstarted-overlay/) * [Link CAS OIDC user to existing Database user](https://apereo.github.io/2018/02/02/OIDC-link-account/) * [CAS Multifactor Authentication with Duo Security](https://apereo.github.io/2018/01/08/cas-mfa-duosecurity/) * [Deploying Apereo CAS Behind a Proxy](https://apereo.github.io/2018/01/05/cas-deployment-with-proxy/) * [CAS 5.3.0 RC1 Feature Release](https://apereo.github.io/2017/12/29/530rc1-release/) * [Apereo CAS SAML Integration With ADFS](https://apereo.github.io/2017/11/22/cas-saml-integration-adfs/) * [Introduction to CAS Commandline Shell](https://apereo.github.io/2017/10/30/intro-cas-cli-shell/) * [Multitenancy With CAS](https://apereo.github.io/2017/10/23/cas-multitenancy/) * [JWT Of All Things With CAS](https://apereo.github.io/2017/10/17/cas-jwt-authn-with-duo/) * [CAS 5.2.0 RC4 Feature Release](https://apereo.github.io/2017/10/16/520rc4-release/) * [Extending CAS 5 Webflows](https://apereo.github.io/2017/10/07/webflow-extcfg/) * [CAS 5.1.x Load Tests by Lafayette College](https://apereo.github.io/2017/09/25/cas51-perfresults-LafayetteCollege/) * [CAS 5.2.0 RC3 Feature Release](https://apereo.github.io/2017/09/15/520rc3-release/) * [CAS 5.1.x User Swap - Cause and Analysis](https://apereo.github.io/2017/08/31/cas5-userswap-buganalysis/) * [Interrupt CAS With Class](https://apereo.github.io/2017/08/30/cas-loginflow-interrupt/) * [CAS 5.2.0 RC2 Feature Release](https://apereo.github.io/2017/08/04/520rc2-release/) * [Apereo CAS - Contribution Guidelines](https://apereo.github.io/2017/07/05/cas-contribution-guide/) * [CAS 5.2.0 RC1 Feature Release](https://apereo.github.io/2017/06/30/520rc1-release/) * [CAS 5 - Maintaining Protocol Compatibility](https://apereo.github.io/2017/06/23/cas-protocol-compatibility/) * [CAS Codebase Overview](https://apereo.github.io/2017/06/12/cas-codebase-overview/) * [CAS 5 Load Tests by Lafayette College](https://apereo.github.io/2017/06/09/cas5-perfresults-LafayetteCollege/) * [Shibbolizing Apereo CAS](https://apereo.github.io/2017/05/26/cas-shibsp-samlidp/) * [CAS 5.0.x Integration w/ Apache ZooKeeper](https://apereo.github.io/2017/04/30/cas50-zookeepercfg/) * [CAS 5.1.0 RC4 Feature Release](https://apereo.github.io/2017/04/28/rc4-release/) * [CAS 5.1.0 RC3 Feature Release](https://apereo.github.io/2017/03/31/rc3-release/) * [CAS 5.0.x Deployment - WAR Overlays](https://apereo.github.io/2017/03/28/cas5-gettingstarted-overlay/) * [CAS 5 LDAP AuthN and Jasypt Configuration](https://apereo.github.io/2017/03/24/cas51-ldapauthnjasypt-tutorial/) * [CAS 5 SAML2 Delegated AuthN Tutorial](https://apereo.github.io/2017/03/22/cas51-delauthn-tutorial/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2017/03/06/moncfgsecvulndisc/) * [CAS 5.1.0 RC2 Feature Release](https://apereo.github.io/2017/02/24/rc2-release/) * [CAS 5 Database Authentication Tutorial](https://apereo.github.io/2017/02/22/cas51-dbauthn-tutorial/) * [Intro To CAS Auto Configuration Strategy](https://apereo.github.io/2017/02/21/cas-autocfg-strategy/) * [Design CAS-Enabled Custom Protocols](https://apereo.github.io/2017/02/17/cas-custom-protocols/) * [Design Authentication Handlers in CAS 5.1.x](https://apereo.github.io/2017/02/02/cas51-authn-handlers/) * [CAS 5.1.0 RC1 Feature Release](https://apereo.github.io/2016/12/23/51rc1/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2016/10/24/servlvulndisc/) * [Activating MFA in CAS 5](https://apereo.github.io/2016/10/19/mfacas5-extcfg/) * [Bootiful CAS 5 Overlay](https://apereo.github.io/2016/10/04/casbootoverlay/) * [CAS 5.0.0-RC3 Released](https://apereo.github.io/2016/10/01/cas5rc3-release/) * [CAS Git Repository Maintenance](https://apereo.github.io/2016/09/21/gitrepo-maint/) * [CAS 5.0.0-RC1 Release](https://apereo.github.io/2016/08/26/rc1-release/) * [CAS EOL Policy Proposal](https://apereo.github.io/2016/08/08/eol-policy-proposal/) * [CAS 5.0.0-M3 Released](https://apereo.github.io/2016/07/23/m3-release/) * [CAS Survey Results](https://apereo.github.io/2016/06/26/survey-results/) * [CAS Vulnerability Disclosure](https://apereo.github.io/2016/04/08/commonsvulndisc/) #### Gitlab * [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) #### HAProxy * [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) #### LDAP * [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) #### Licensing * [Why does uPortal use Apache 2 license?](https://apereo.github.io/2018/02/20/apache2-chose-uportal/) * [Easier CLA submission](https://apereo.github.io/2017/05/05/jotform-clas/) #### MFA * [Apereo CAS - Scripting Multifactor Authentication Triggers](https://apereo.github.io/2018/11/22/cas5-groovy-mfa/) * [Apereo CAS - Multifactor Authentication with RADIUS](https://apereo.github.io/2018/10/18/cas5-radius-mfa-authn/) * [CAS Multifactor Authentication with Google Authenticator](https://apereo.github.io/2018/06/10/cas-mfa-google-authenticator/) * [Apereo CAS - REFEDS MFA Profile with shib-cas-authn3](https://apereo.github.io/2018/02/26/shibcasauthn-duomfa-refeds/) * [CAS Multifactor Authentication with Duo Security](https://apereo.github.io/2018/01/08/cas-mfa-duosecurity/) * [Activating MFA in CAS 5](https://apereo.github.io/2016/10/19/mfacas5-extcfg/) #### OAuth2 * [Apereo CAS as an OAuth2 Authorization Server](https://apereo.github.io/2019/02/19/cas61-as-oauth-authz-server/) #### Releases * [CAS Release Notes Moved](https://apereo.github.io/2020/07/02/cas-release-notes/) * [CAS 6.2.0 RC5 Feature Release](https://apereo.github.io/2020/05/29/620rc5-release/) * [CAS 6.2.0 RC4 Feature Release](https://apereo.github.io/2020/04/17/620rc4-release/) * [CAS 6.2.0 RC3 Feature Release](https://apereo.github.io/2020/03/03/620rc3-release/) * [CAS 6.2.0 RC2 Feature Release](https://apereo.github.io/2019/12/27/620rc2-release/) * [CAS 6.2.0 RC1 Feature Release](https://apereo.github.io/2019/11/29/620rc1-release/) * [CAS 6.1.0 RC6 Feature Release](https://apereo.github.io/2019/10/04/610rc6-release/) * [CAS 6.1.0 RC5 Feature Release](https://apereo.github.io/2019/09/02/610rc5-release/) * [CAS 6.1.0 RC4 Feature Release](https://apereo.github.io/2019/06/07/610rc4-release/) * [CAS 6.1.0 RC3 Feature Release](https://apereo.github.io/2019/04/29/610rc3-release/) * [CAS 6.1.0 RC2 Feature Release](https://apereo.github.io/2019/03/01/610rc2-release/) * [CAS 6.1.0 RC1 Feature Release](https://apereo.github.io/2019/02/01/610rc1-release/) * [CAS 6.0.0 RC4 Feature Release](https://apereo.github.io/2018/11/30/600rc4-release/) * [CAS 6.0.0 RC3 Feature Release](https://apereo.github.io/2018/10/26/600rc3-release/) * [CAS 6.0.0 RC2 Feature Release](https://apereo.github.io/2018/09/14/600rc2-release/) * [CAS 6.0.0 RC1 Feature Release](https://apereo.github.io/2018/08/03/600rc1-release/) * [CAS 5.3.0 RC4 Feature Release](https://apereo.github.io/2018/05/25/530rc4-release/) * [CAS 5.3.0 RC3 Feature Release](https://apereo.github.io/2018/03/30/530rc3-release/) * [CAS 5.3.0 RC2 Feature Release](https://apereo.github.io/2018/02/09/530rc2-release/) * [CAS 5.3.0 RC1 Feature Release](https://apereo.github.io/2017/12/29/530rc1-release/) * [CAS 5.2.0 RC4 Feature Release](https://apereo.github.io/2017/10/16/520rc4-release/) * [CAS 5.2.0 RC3 Feature Release](https://apereo.github.io/2017/09/15/520rc3-release/) * [CAS 5.2.0 RC2 Feature Release](https://apereo.github.io/2017/08/04/520rc2-release/) * [CAS 5.2.0 RC1 Feature Release](https://apereo.github.io/2017/06/30/520rc1-release/) * [CAS 5.1.0 RC4 Feature Release](https://apereo.github.io/2017/04/28/rc4-release/) * [CAS 5.1.0 RC3 Feature Release](https://apereo.github.io/2017/03/31/rc3-release/) * [CAS 5.1.0 RC2 Feature Release](https://apereo.github.io/2017/02/24/rc2-release/) * [CAS 5.1.0 RC1 Feature Release](https://apereo.github.io/2016/12/23/51rc1/) * [MyUW 2016-10-25 release](https://apereo.github.io/2016/10/25/myuw-release/) * [CAS 5.0.0-RC3 Released](https://apereo.github.io/2016/10/01/cas5rc3-release/) * [CAS 5.0.0-RC1 Release](https://apereo.github.io/2016/08/26/rc1-release/) * [CAS 5.0.0-M3 Released](https://apereo.github.io/2016/07/23/m3-release/) #### SAML * [Apereo CAS - Delegated Authentication to SAML2 Identity Providers](https://apereo.github.io/2019/02/25/cas61-delegate-authn-saml2-idp/) * [Apereo CAS - SAML2 Identity Provider Integration w/ Gitlab (also starting HAProxy and LDAP)](https://apereo.github.io/2019/02/18/cas61-saml2-idp-gitlab/) * [Apereo CAS - SAML2 Identity Provider Integration w/ InCommon](https://apereo.github.io/2019/01/18/cas61-saml2-idp-incommon/) * [Apereo CAS - OohLala Mobile SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oohlalamobile-saml2-integration/) * [Apereo CAS - Cranium Cafe SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-oclc-saml2-integration/) * [Apereo CAS - eLumen SAML2 Integration](https://apereo.github.io/2018/12/24/cas53-elumen-saml2-integration/) * [Apereo CAS - Rave SAML2 Integration](https://apereo.github.io/2018/12/23/cas53-getrave-saml2-integration/) * [Apereo CAS - HireTouch SAML2 Integration](https://apereo.github.io/2018/12/22/cas53-hiretouch-saml2-integration/) * [Apereo CAS - Microsoft Office 365 SAML2 Integration](https://apereo.github.io/2018/12/06/cas53-office365-saml2-integration/) * [Apereo CAS - HappyFox SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-happyfox-saml2-integration/) * [Apereo CAS - Cisco Webex SAML2 Integration](https://apereo.github.io/2018/12/04/cas53-cisco-webex-saml2-integration/) * [Apereo CAS - VMware Identity Manager SAML2 Integration](https://apereo.github.io/2018/12/03/cas53-vmwareidentitymgr-saml2-integration/) * [Apereo CAS - SAML2 Metadata with MongoDb](https://apereo.github.io/2018/11/03/cas6-saml2-metadata-mongodb/) * [Apereo CAS - dotCMS SAML2 Integration](https://apereo.github.io/2018/09/06/cas53-dotcms-saml2-integration/) * [Apereo CAS - REFEDS MFA Profile with shib-cas-authn3](https://apereo.github.io/2018/02/26/shibcasauthn-duomfa-refeds/) * [Apereo CAS SAML Integration With ADFS](https://apereo.github.io/2017/11/22/cas-saml-integration-adfs/) * [Shibbolizing Apereo CAS](https://apereo.github.io/2017/05/26/cas-shibsp-samlidp/) #### a11y * [Better by design 2017: Integrating accessibility across design and development lifecycle](https://apereo.github.io/2017/08/22/bbd-integrating-a11y-across-lifecycle/) #### uPortal * [uPortal annual report, June 2018 edition](https://apereo.github.io/2018/06/25/up-annual-report/) * [Why does uPortal use Apache 2 license?](https://apereo.github.io/2018/02/20/apache2-chose-uportal/) * [August 2017 uPortal Slack summary](https://apereo.github.io/2017/09/26/August-2017-uportal-slack-summary/) * [Summer 2017 uPortal Roadmap Update](https://apereo.github.io/2017/08/30/summer-2017-uportal-roadmap-update/) * [July 2017 uPortal Slack summary](https://apereo.github.io/2017/08/02/july-2017-uportal-slack-summary/) * [June 2017 uPortal Slack summary](https://apereo.github.io/2017/07/05/uportal-slack-summary/) * [MyUW in 2016 - by the numbers](https://apereo.github.io/2017/06/20/myuw-2016-numbers/) * [MyUW in 2016](https://apereo.github.io/2017/01/19/myuw-2016/) * [uPortal 2016-11-14 Webproxy Portlet caching vulnerability](https://apereo.github.io/2016/11/14/web-proxy-overcaching/) * [MyUW 2016-10-25 release](https://apereo.github.io/2016/10/25/myuw-release/) * [MyUW (University of Wisconsin) Build Process](https://apereo.github.io/2016/09/15/myuw-build-now-and-future/) ---