Using the cas-overlay-template, I am trying to access the CAS login screen from HTTP(s)://localhost/admin:
https://localhost:8443/cas/login?service=https%3A%2F%2F0.0.0.0%2Fadmin
To do this, I am trying to define services inside /etc/cas/services/services.json:
{
"#class" : "org.apereo.cas.services.RegexRegisteredService",
"serviceId" : "^http://.*",
"name" : "http_services",
"allowed": true,
"ssoEnabled": true,
"anonymousAccess": false,
"id" : 1,
"evaluationOrder" : 1
},
{
"#class" : "org.apereo.cas.services.RegexRegisteredService",
"serviceId" : "^https://.*",
"name" : "https_services",
"allowed": true,
"ssoEnabled": true,
"anonymousAccess": false,
"id" : 2,
"evaluationOrder" : 2
}
FWIW, I've also tried to define a service file according to the pattern described here.
In /etc/config/cas.properties, I have defined the following:
cas.server.name=https://cas.example.org:8443
cas.server.prefix=${cas.server.name}/cas
cas.service-registry.json.location=classpath:/services
logging.config=file:/etc/cas/config/log4j2.xml
Finally in build.gradle, I have added the support for JSON service registry:
dependencies {
...
implementation "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}"
}
No matter what I do, after building and running the Docker image, I always get the same thing:
INFO [org.apereo.cas.services.AbstractServicesManager] - <Loaded [0] service(s) from [JsonServiceRegistry].>
When I go to the URL, I am told
"Application Not Authorized to Use CAS".
What am I doing wrong?
Bonus question: https://cas.example.org:8443 does not work in the URL. Do I need to edit something in the docker container to get this to map onto my local machine?
-- UPDATE --
As was said in the answer, I needed to create a single, named service:
// File: /etc/cas/services/today-12345.json
{
"#class":"org.apereo.cas.services.RegexRegisteredService",
"serviceId":"^(https|http|imaps)://.*",
"name":"today",
"id" :12345
}
To part 2 of Misagh's answer, based on what I'm seeing in the Dockerfile, the /etc/cas/services directory simply doesn't exist by the time ./gradlew runs, and so the services aren't registered.
If I put in my cas.properties file
cas.service-registry.json.location=/etc/cas/services
I get a stacktrace that includes:
Caused by: java.io.FileNotFoundException: class path resource [etc/cas/services] cannot be resolved to URL because it does not exist
If I /bin/sh into the container, I can see the service inside of the /etc/cas/services directory.
I've been getting around this by simply copying the .json file after the Docker containers have been built
docker cp ~/emu/cas-overlay-template/etc/cas/services/today-12345.json [CONTID]:/tmp/services
(/tmp/services because that's where the console output says it's watching for services)
-- SOLUTION --
The path had to be:
cas.service-registry.json.location=file:/etc/cas/services
What am I doing wrong?
Multiple things.
You have your services in /etc/cas/services/services.json as a single JSON file. That is not correct. You need to have 1 file per 1 app. Consult the documentation for JSON service registry.
cas.service-registry.json.location should point to the directory location where such JSON files are found. You need to make sure this location in your Docker setup points or contains your service definitions.
I know I'm a bit late but I think the location /etc/cas/services it is defined in the apereo cas standalone profile. If you define another spring profile it will look for /tmp/services. It happened to me while configuring cas in docker environment and wanting to use a test profile.
Related
I have been having a long and frustrating experience trying to get AASA to work for webcredentials. My goal here is to allow usernames and passwords to be stored in the iOS keychain.
I did have this working on a root domain the other week but it is not sufficient for my scenario as I will explain. It didn't work for me straight away I have to say but it eventually started working after a clean build so I thought this was the issue then but now I am not so sure.
I am using Expo with EAS build. We have a multi-tenant application. From a single codebase we deploy to multiple apps in the store. All are on the same team ID but they are separate applications and use separate credentials, nothing is shared.
I am confident my apps textContentType of username and password on my TextFields is correct as this has not changed from when I managed to get it working originally and I have checked it countless times.
Expectation
For the "Save Password" prompt to be displayed after login. What I have noticed however is when going to store a password manually using "add password" via iCloudKeychain from the keyboard accessory this does accurately show the correct "TENANT_SUBDOMAIN.example.com". I find this confusing.
Goal Scenario
I am hosting a site on Netlify. I have it setup to support wildcard subdomains with a LetsEncrypt provisioned wildcard SSL certificate. I then have edge functions which change the content of my index.html and apple-app-site-association file dynamically based on the requested subdomain.
I have added the Associated Domains capability to my provisioning profile.
I am using the latest Expo 47 and EAS build. I have added in the appropriate associated domains configuration and I can see this when introspecting my entitlements under com.apple.developer.associated-domains and it is correct.
I am using TestFlight for testing. I am doing a --clean-build on EAS every time and I also increase the runtime version. I have also tried manually refreshing credentials outside of the build process which does this automatically. This must be using the correct provisioning profile otherwise I would get a build failure as the requested entitlements wouldn't match.
The AASA file is currently hosted just in the .well-known directory. I have tried using the root and also tried using both. There are no redirects taking place.
I am aware the AASA file is pulled on application installation and update. I repeatedly remove the apps and then reboot my phone in an attempt to reset any device caches.
The content-type of the file is application/json and I have confirmed this using developer tools in the browser.
There is no robots.txt or anything blocking the request from an infrastructure perspective. There are no additional firewalls or geo restricted access as I am just using plain Netlify to host this, nothing fancy.
I am confident the Team ID and bundle IDs are correct in the AASA file.
I remove the content-length header in the Edge function so it is correctly calculated by the network instead and I have confirmed this using curl.
When I check the file using https://app-site-association.cdn-apple.com/a/v1/site.example.com Apple has the correct file cached on it's CDN so I would expect it to work.
I added in an applinks section so I could use the Apple App Search API validation tool and the Branch.io AASA verification tool to verify correctness. Branch.io says the file is fine and Apple says it's fine also but because the App has not been deployed to the store yet I see Error no apps with domain entitlements. From what I can tell this is normal in development and makes sense as it uses the current released version of the app to verify the deep link configuration. So to me this means Apple can parse the file correctly.
When I stream my device console logs; on install I can see the AASA requesting the correct domains. I see no errors on swcd I just see the Beginning data task AASA-XXXX with the correct domains.
When I run Charles proxy on my phone with a verified SSL installation (also reinstalled a few times now) I do not see quite what I would expect - but the device logs seem to imply it is doing the correct thing. When I view the app-site-association... URL requests in Charles there is one per application install which is correct. The request is marked as Unknown and when I look at the request the host is shown but as you would expect from SSL I see no path. The info says METHOD: CONNECT with Error - Input Error: EOF. This is the only error I see, I am not sure if it is a red herring and something to do with Charles. Given the error as you expect there is no body in the request or response. It is worth noting in general testing I have no VPN enabled and I have do not have Private Relay enabled in my iOS settings.
When I perform a sysdiagnose I see the following at the timestamp in my console log in the swcutil_show.txt device log. This looks correct in comparison to other apps webcredentials and applinks services I see there and I see no errors:
Service: webcredentials
App ID: MYTEAMID.com.cf.example.b2c.ios
App Version: 1.0
App PI: <LSPersistentIdentifier 0x141816200> { v = 0, t = 0x8, u = 0x1e7c, db = 0094F7C4-3078-41A2-A33E-79D5A62C80A6, {length = 8, bytes = 0x7c1e000000000000} }
Domain: CORRECT_SUBDOMAIN.example.app
User Approval: unspecified
Site/Fmwk Approval: approved
Flags:
Last Checked: 2022-12-09 14:14:32 +0000
Next Check: 2022-12-14 14:03:00 +0000
Service: applinks
App ID: MYTEAMID.com.cf.example.b2c.ios
App Version: 1.0
App PI: <LSPersistentIdentifier 0x13fd38d00> { v = 0, t = 0x8, u = 0x219c, db = 0094F7C4-3078-41A2-A33E-79D5A62C80A6, {length = 8, bytes = 0x9c21000000000000} }
Domain: CORRECT_SUBDOMAIN.example.app
Patterns: {"/":"*"}
User Approval: unspecified
Site/Fmwk Approval: approved
Flags:
Last Checked: 2022-12-13 13:13:23 +0000
Next Check: 2022-12-18 13:01:51 + 0000
At end of file:
MYTEAMID.com.cf.example.b2c.ios: 8 bytes
(This seems correct for all apps)
Other Scenario
I have tried setting this up using an apex on another domain which hasn't been seen before by Apple. I have tried using a subdomain with a root domain serving the same content and I have tried the subdomain and root domain on their own. I have also tried not using the Edge functions and having static files but to no avail.
When I do this I ensure I wait for the Apple CDN to catch up and remove/add entries prior to deleting the apps, rebooting my device, and reinstalling to test.
AASA File
AASA content comes back with the correct payload and Content-Type: application/json and Content-Length headers, both from Apples CDN and the origin. When I had this somehow working in my initial test it was on a root domain and I did not have an applinks section, this was only added so I could use the verification tools for universal links.
I am not sending back different content or duplicated content and I block the www subdomain - I have also tried it with a www subdomain for the record.
{
"applinks": {
"details": [
{
"appIDs": [
"MYTEAMID.com.cf.example.b2c.ios"
],
"components": [
{
"#": "no_universal_links",
"exclude": true,
"comment": "Matches any URL with a fragment that equals no_universal_links and instructs the system not to open it as a universal link."
}
]
}
]
},
"webcredentials": {
"apps": [
"MYTEAMID.com.cf.example.b2c.ios"
]
}
}
I have also tried this with the older format:
{
"applinks": {
"apps": [],
"details": [
{
"appID": "MYTEAMID.com.cf.example.b2c.ios",
"paths": [
"*"
]
}
]
},
"webcredentials": {
"apps": [
"MYTEAMID.com.cf.example.b2c.ios"
]
}
}
associatedDomains iOS. expo config
associatedDomains: [
`webcredentials:${SUBDOMAIN}.example.app`,
`applinks:${SUBDOMAIN}.example.app`,
],
Help :)
I have been trying to get this to work for a long time now and I am completely out of ideas. If anybody has any suggestions I would really appreciate it. I am very confused how the devices request seems correct and the CDN content is correct but it is still not working. It's worth also reiterating that I need to have different subdomains for each tenant as the credentials must not be shared across apps so the keychain->domain association store must be different.
I am wondering if it's the LetsEncrypt wildcard SSL certificate but I wouldn't expect it to verify and for Apple to cache the file if this was the case. It seems very unlikely to me but it is the only thing I haven't tried at this point.
Many Thanks,
Mark
I am creating CloudFormation stack with Elasticsearch service, however it fails for AdvancedSecurityOptions, which works perfectly fine with aws es create-elasticsearch-domain
my JSON template snippet is below:
...
"AdvancedOptions": {
"rest.action.multi.allow_explicit_index": true
},
"AdvancedSecurityOptions": {
"Enabled": true,
"InternalUserDatabaseEnabled": false,
"MasterUserOptions": {
"MasterUserARN": "arn:aws:iam::1234567890:role/role_name"
}
},
"DomainName": {
"Ref": "ESDomainName"
}
...
I am unable to get this code working, any help related to fine grain access control would be really appreciated.
The AdvancedSecurityOptions is the latest addition to Amazon Elasticsearch service added recently as part of Fine Grained Access Control. This is available only via Console, CLI and API for now.
I am not sure if the thread is with outdated info, but according to the official AWS documentation on this link it should be possible to use the AdvancedSecurityOptions for Fine Grained Access Control. It even states that it is meant to be used for FGAC at the top of the page.
Continuing from DNakevski# answer above, for FGAC we need to ensure the following three settings in the CFN template are set to true since they serve as pre-requisites:
EncryptionAtRestOptions
NodeToNodeEncryptionOptions and
HTTPS.
Further, the important parameter for FGAC in the CFN template is AdvancedSecurityOptions and needs to be set to Enabled: true
AmazonES/Opendistro-for-ES provides two ways for security with FGAC. One is through using a IAM user as a master-user and other is through having basic auth.
If you need to take the IAM way then set the InternalUserDatabaseEnabled to false and only have the parameter *MasterUserARN: "IAM User ARN" under the MasterUserOptions field.
If you need to take the basic auth (username and password) approach set the InternalUserDatabaseEnabled to true and have the MasterUserName: "any-name" and the MasterUserPassword: "xxx"* Please have at least one lower case, one upper case, one digit and one special character for the password else the CFN template will rollback. However, the failure message is easily seen on the CFN console under events.
I have a simple working CFN yaml here doing the same just in case.
I am working with cas-overlay-template project in version 6.1.4. I have implemented two mfa providers on my CAS, Google Authenticator and CAS Simple. Both are working, I have tested them separately and I have got the results I've expected.
Until now, I have been activating the mfa modifying the cas.properties file adding this properties: cas.authn.mfa.globalProviderId=mfa-gauth when I wanted to use Google, or cas.authn.mfa.globalProviderId=mfa-simple when I used the CAS itself.
Well, in CAS documentation is mentioned that is possible to enable a provider selection menu, if resolved more than one just by adding this propertie: cas.authn.mfa.provider-selection-enabled=true. So, my configuration is the following:
cas.authn.mfa.provider-selection-enabled=true
cas.authn.mfa.globalProviderId=mfa-gauth
cas.authn.mfa.globalProviderId=mfa-simple
But when I try to login with any user (I'm using the default one casuser:Mellon), CAS don't show me a menu in which I can select the following mfa provider, It directly goes to mfa-simple provider.
What am I doing wrong?
Well, in CAS documentation is mentioned that is possible to enable a provider selection menu, if resolved more than one just by adding this properties:
So far so good.
So, my configuration is the following:
That's the problem. You are not resolving/triggering more than just one provider. You start with mfa-gauth and then override it with mfa-simple. In CAS 6.1.x, the globalProviderId only accepts a single identifier. It's not a list or a container of any kind to accept more than one value. This has been addressed in the next coming release.
At the moment, to resolve more than one provider you will need to assign the MFA providers to a registered service definition. Like so:
{
"#class": "org.apereo.cas.services.RegexRegisteredService",
"serviceId": "^(https|imaps)://.*",
"name": "Example",
"id": 1,
"description": "This service definition defines a service.",
"evaluationOrder": 1,
"multifactorPolicy" : {
"#class" : "org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy",
"multifactorAuthenticationProviders" : [ "java.util.LinkedHashSet", [ "mfa-duo", "mfa-gauth" ] ]
}
}
This means, provider selection can be enabled on a per-application basis. Alternatively, you can write a small groovy script to return more than one provider back to CAS, allowing the selection menu to display the menu items.
Read this post for full details.
I'm working in VS Code and started getting this error yesterday. All of my json files have this error, not just a few. If I remember right there was an update to the program yesterday or the day before. Did the update break something or reset a setting that I forgot I had set?
When looking this up, people are talking about downloading the schema and using it locally, but I would prefer not to have to do that and would instead like to find out why this broke?
I am using a proxy, but as far as I know that hasn't changed. Here's the exact error I'm getting.
Problems loading reference 'https://schemastore.azurewebsites.net/schemas/json/package.json': Unable to load schema from 'https://schemastore.azurewebsites.net/schemas/json/package.json': Unable to connect to https://schemastore.azurewebsites.net/schemas/json/package.json. Error: connect ECONNREFUSED 168.62.224.13:443
I'm behind my company's proxy which I don't know the details because it's everything automatic, and this problem have bug me for some time.
I'm not sure whether this is an universal solution but according to this issue, the http.proxySupport setting is defaulting to "override".
I turn this setting off and the errors disappeared:
"http.proxySupport": "off"
Open User settings of visual studio code through the command palette:
Press F1
Type user settings.
Select Preferences:Open User Settings from drop down
Put below code and modify accordingly:
"http.proxy": "http://username:password#hostname:port/",
"http.proxyAuthorization": null,
"http.proxyStrictSSL": true
Just close your VsCode Editor and open it again. That should fix the error.
I just turned off checkbox schema download and error gone.
Press F1 and follow open user settings/user/extentions/JSON
I was facing following issue with Angular 6:
Problems loading reference 'https://schemastore.azurewebsites.net/schemas/json/package.json': Unable to load schema from 'https://schemastore.azurewebsites.net/schemas/json/package.json': Unable to connect to https://schemastore.azurewebsites.net/schemas/json/package.json. Error: unable to get local issuer certificate
I added following properties at the end of the User Settings File and worked for me:
"http.proxy": "",
"http.proxyAuthorization": null,
"http.proxyStrictSSL": false
Add this to your setting.json. Your problem will be solved! Plus this works for me.
"json.schemas": [
{
"fileMatch": ["/package.json"],
"url": "https://json.schemastore.org/package",
"schema": true
}
]
Well i didnt like the idea to set "http.proxyStrictSSL": false, so i started searching, and i found this Issue on SchemaStore site from azure. After seeing this i concluded that my proxy was getting some problem with the certificate and authentication. What i did was change all "https" to "http" in the following session of package.json file(Mine was on this path: C:\Program Files\Microsoft VS Code\resources\app\extensions\typescript-basics\package.json).
"jsonValidation": [
{
"fileMatch": "tsconfig.json",
"url": "http://schemastore.azurewebsites.net/schemas/json/tsconfig.json"
},
{
"fileMatch": "tsconfig.json",
"url": "./schemas/tsconfig.schema.json"
},
{
"fileMatch": "tsconfig.*.json",
"url": "http://schemastore.azurewebsites.net/schemas/json/tsconfig.json"
},
{
"fileMatch": "tsconfig.*.json",
"url": "./schemas/tsconfig.schema.json"
},
{
"fileMatch": "typings.json",
"url": "http://schemastore.azurewebsites.net/schemas/json/typings.json"
}
]
I solved this issue by turning off proxy support in VS Code.
Open Settings and search for proxy support at the top. The only option shown should then be the one you want to switch from Override (which is the default) to off:
PS: You can also locate settings by pressing F1 and entering user settings.
please follow the step below to solve this problem:
Open the folder where package.json file present
Type npm install from cmd
restart VS code or any IDE that you use.
I tried every setting - the only one which works is adding this to settings.json:
"json.schemas": [
{
"fileMatch": [
"/package.json"
],
"url": "https://json.schemastore.org/package",
"schema": true
},
]
}
Note, using the HTTP URL doesn't work - it just ignores the URL.
If you still want the proxy support to work, just disable the proxyStrictSSL. Don't need to adjust other settings.
After banging my head against this for longer than I care to admit, I just needed to add the proxyAuthorization value for my Base64 encoded credentials, and did not need the proxy or proxyStrictSSL values.
I already had my proxy correctly configured in my environment variables. It only has the domain and port, not my credentials, ex. "HTTP_PROXY" "http://example.com:port/".
I used this C# code in LINQPad to get the proxyAuthorization value from my credentials:
var pw = "user#example.com:password";
var base64Encoded = Convert.ToBase64String(Encoding.UTF8.GetBytes(pw));
base64Encoded.Dump();
This is what I have in my user settings.json, using the encoded string from the above code dump.
"http.proxyAuthorization": "BASE64_ENCODED_VALUE"
Note: I believe that if I didn't need the full username with email address in the credentials for our proxy to let me out, I could have used an above solution. But since I did, this was the only way I could get it to work.
I`ve just delete this setting 😃
"http.proxy": "http://.......",
For me this works the Azure Storage Emulator stopped working ;-(
To start the Azure Storage Emulator:
Select the Start button or press the Windows key.
Begin typing Azure Storage Emulator.
Select the emulator from the list of displayed applications.
https://learn.microsoft.com/en-us/azure/storage/common/storage-use-emulator
just do the 3
in CMD
AzureStorageEmulator.exe init
AzureStorageEmulator.exe start
AzureStorageEmulator.exe status
BAM all worked
It's issue of opening the vs code using command line or any type of terminal
for avoid this issue.
Just restart the vs code or close the vs code and open again
Add following code in setting.json file
"http.proxy": "",
"http.proxyStrictSSL": false
To Open setting.json file use the below step
Press F1
Type User Setting and then select Preferences:Open User Settings
Then click on Edit Setting.json link
for me turns out that the problem was due to terminal.integrated.shell.windows being deprecated in VSCode.
these are the steps i followed to fix it :
Open command palette (CTRL + Shift + P)
Search "Preferences: Open "User Settings" (the JSON file)"
find this field => terminal.integrated.shell.windows delete it and type this instead inside of "terminal.integrated.profiles.windows":
"PowerShell": {
"source": "PowerShell",
"icon": "terminal-powershell"
},
"Command Prompt": {
"path": [
"${env:windir}\\Sysnative\\cmd.exe",
"${env:windir}\\System32\\cmd.exe"
],
"args": [],
"icon": "terminal-cmd"
},
"Git Bash": {
"source": "Git Bash"
}
},```
if you want to disable PowerShell, just set its value to null
I have installed node-push-server. The configuration is loaded from a json like this:
{
"webPort": 8000,
"mongodbUrl": "mongodb://username:password#localhost/database",
"gcm": {
"apiKey": "YOUR_API_KEY_HERE"
},
"apn": {
"connection": {
"gateway": "gateway.sandbox.push.apple.com",
"cert": "/path/to/cert.pem",
"key": "/path/to/key.pem"
},
"feedback": {
"address": "feedback.sandbox.push.apple.com",
"cert": "/path/to/cert.pem",
"key": "/path/to/key.pem",
"interval": 43200,
"batchFeedback": true
}
}
}
How can I set the enviroment variables for my application in this json file?
I don't think it's possible. You should be able to change all these settings in the code though. For example in node you can do: process.env.OPENSHIFT_VARIABLENAME to read an environment variable.
Example for MongoDB connection string from docs:
//provide a sensible default for local development
mongodb_connection_string = 'mongodb://127.0.0.1:27017/' + db_name;
//take advantage of openshift env vars when available:
if(process.env.OPENSHIFT_MONGODB_DB_URL){
mongodb_connection_string = process.env.OPENSHIFT_MONGODB_DB_URL + db_name;
}
As an alternative, there is a quick and easy deployable gear called AeroGear Push that might serve your needs.
Config files can be awkward because including them in your source repo isn't always a good move.
OpenShift deployments are mostly git push-driven, so there are several options for helping you correctly resolve your configs on the server.
Configuring your service using ENV vars is the most common approach, but since this one requires a flat file, you'll need to find a way to update the file with the correct values.
If you know what keys and values are needed, you should be able to write a script that updates the example json, or merges two json objects to produce a flat config file including the strings node-pushserver will expect.
It looks like mongodbUrl, webPort, (and domain?) would need to be populated with OpenShift-provided values (when available). config-multipaas might be able to help with that.
I would probably implement the config bootstrapping / merging work as a build step, allowing you to prep the config file and start node-pushserver in it's usual way