Table of Contents
Installing Apereo CAS server on Debian Jessie (together with Guacamole)
CAS WAR overlay
$ git clone https://github.com/apereo/cas-overlay-template
$ git checkout 5.1
We want JSON service registry, google auth and ldap support
Diff for adding our extra dependencies to pom.xml
$ git diff pom.xml diff --git a/pom.xml b/pom.xml index 126dc7c..51e35f0 100755 --- a/pom.xml +++ b/pom.xml @@ -66,13 +66,43 @@ <type>war</type> <scope>runtime</scope> </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-webapp-config-security</artifactId> + <version>${cas.version}</version> + </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-support-jdbc-drivers</artifactId> + <version>${cas.version}</version> + </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-support-json-service-registry</artifactId> + <version>${cas.version}</version> + </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-support-gauth</artifactId> + <version>${cas.version}</version> + </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-support-gauth-jpa</artifactId> + <version>${cas.version}</version> + </dependency> + <dependency> + <groupId>org.apereo.cas</groupId> + <artifactId>cas-server-support-ldap</artifactId> + <version>${cas.version}</version> + </dependency> </dependencies> <properties> <cas.version>5.1.9</cas.version> <springboot.version>1.5.3.RELEASE</springboot.version> <!-- app.server could be -jetty, -undertow, -tomcat, or blank if you plan to provide appserver --> - <app.server>-tomcat</app.server> + <app.server></app.server> <maven.compiler.source>1.8</maven.compiler.source> <maven.compiler.target>1.8</maven.compiler.target> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
asuadmin@wrkm-guacamole:~/cas-overlay-template$ bash build.sh package
root@wrkm-guacamole:/home/asuadmin/cas-overlay-template# cp target/cas.war /var/lib/tomcat8/webapps/
Fix so logging works
root@wrkm-guacamole:~# mkdir -p /etc/cas/logs root@wrkm-guacamole:~# chown tomcat8 /etc/cas/logs/
Make connections to port :8080 trusted as secure
We can do this since we use HTTPS on the reverse proxy to localhost:8080
root@wrkm-guacamole:/etc/tomcat8# diff -u /etc/tomcat8/server.xml-org /etc/tomcat8/server.xml --- /etc/tomcat8/server.xml-org 2017-06-21 13:36:46.000000000 +0200 +++ /etc/tomcat8/server.xml 2017-11-05 21:08:49.050114344 +0100 @@ -68,7 +68,7 @@ --> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" - redirectPort="8443" /> + secure="true" /> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatThreadPool"
Changes to tomcat8 startup parameters
In /etc/default/tomcat8
JAVA_OPTS=“-Djava.awt.headless=true -XX:+UseConcMarkSweepGC -Djava.security.egd=file:/dev/./urandom -Djava.security.auth.login.config=file:/etc/cas/config/jaas.config -Djava.security.krb5.conf=/etc/krb5.conf”
Apache reverse proxy
root@wrkm-guacamole:/etc/apache2/conf-available# cat cas-rproxy.conf <Location /cas/> SSLRequireSSL Order allow,deny Allow from all ProxyPass http://localhost:8080/cas/ ProxyPassReverse http://localhost:8080/cas/ </Location>
Updated instructions for Apereo CAS 6.3 on Debian Buster
To just build the standard default build
$ git clone https://github.com/apereo/cas-overlay-template cas-overlay-template-6.3.x $ git checkout origin/6.3 -b wrkm-6.3 $ ./gradlew build [...] $ ls -l build/libs/cas.war -rw-r--r-- 1 xxx xxx 101063231 Mar 16 09:18 build/libs/cas.war
Add our dependencies, and choose to run in the Debian tomcat container
diff --git a/build.gradle b/build.gradle index 89791ab..3d646b4 100644 --- a/build.gradle +++ b/build.gradle @@ -82,6 +82,14 @@ dependencies { } // CAS dependencies/modules may be listed here statically... implementation "org.apereo.cas:cas-server-webapp-init:${casServerVersion}" + implementation "org.apereo.cas:cas-server-support-json-service-registry:${casServerVersion}" + implementation "org.apereo.cas:cas-server-support-jpa-ticket-registry:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-jdbc-drivers:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-gauth:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-gauth-jpa:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-ldap:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-reports:${project.'cas.version'}" + implementation "org.apereo.cas:cas-server-support-oauth-webflow:${project.'cas.version'}" } tasks.findByName("jibDockerBuild") diff --git a/gradle.properties b/gradle.properties index cd77ab2..4c0e900 100644 --- a/gradle.properties +++ b/gradle.properties @@ -4,7 +4,7 @@ springBootVersion=2.3.7.RELEASE # Use -jetty, -undertow to other containers # Or blank if you want to deploy to an external container -appServer=-tomcat +appServer= executable=false tomcatVersion=9.0.43
Extract the War to get hold of the files that may need to be modified
$ ./gradlew explodeWar
Then copy and modify files like so:
cp build/cas-resources/templates/fragments/footer.html src/main/resources/templates/fragments/
Added to the server.xml - in addition to previous noted changes
<!-- Remote IP Valve - to parse the X-Forwarded-For type headers --> <Valve className="org.apache.catalina.valves.RemoteIpValve" />