{"id":645,"date":"2023-09-05T19:02:20","date_gmt":"2023-09-05T18:02:20","guid":{"rendered":"https:\/\/www.francelabs.com\/blog\/?p=645"},"modified":"2024-01-11T15:09:06","modified_gmt":"2024-01-11T14:09:06","slug":"configure-a-cas-server-and-cas-management-webapp-with-docker","status":"publish","type":"post","link":"https:\/\/www.francelabs.com\/blog\/configure-a-cas-server-and-cas-management-webapp-with-docker\/","title":{"rendered":"Configure a CAS server and CAS management webapp with Docker"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>The task of setting up a CAS server on Docker is not very smooth. The official documentation is not very explicit about it.<\/p>\n\n\n\n<p>We decided to write a post on this subject in order to help others to quickly configure a CAS server with a complete tutorial.<\/p>\n\n\n\n<p>Warning : here we speak about deploying a TESTING CAS server, this configuration is not for production, especially to authorize any application !<\/p>\n\n\n\n<p>First I would like to mention the very good articles on this site that were a very good basis :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:\/\/fawnoos.com\/2022\/05\/31\/cas65x-docker-deployment\/<br>https:\/\/fawnoos.com\/2021\/02\/04\/cas63-management-webapp\/<\/code><\/pre>\n\n\n\n<p>We were previously using the demo CAS server avaible here : <a href=\"https:\/\/casserver.herokuapp.com\/cas\">https:\/\/casserver.herokuapp.com\/cas<\/a> but for some time now, it is not possible anymore to use it with any application. It refuses unauthorized applications. That is why we needed to have our own CAS server.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p>For our tutorial, we took a vanilla instance into Digital Ocean on Debian 12 with 16 GB RAM.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Requirements : <ul><li>Java 11 <\/li><li>Docker<\/li><li>A real certificate name on the server. Indeed without it, we could not have a functional environment (we used LetsEncrypt in this example)<\/li><li>jq installed<br>See annexes below to have indications to install these dependencies<\/li><\/ul><\/li><\/ul>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Installation of the CAS server<\/strong><\/li><\/ol>\n\n\n\n<ul class=\"wp-block-list\"><li>Create a keystore on the server with the SSL certificate generated<\/li><\/ul>\n\n\n\n<p>We assume that the certificate and the key were issued by LetsEncrypt and are located into \/etc\/letsencrypt\/live\/$DOMAIN_NAME<\/p>\n\n\n\n<p>Replace $DOMAIN_NAME by the name of your domain, in our example it is castest.datafari.com<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export DOMAIN_NAME=castest.datafari.com\nopenssl pkcs12 -export -in \/etc\/letsencrypt\/live\/$DOMAIN_NAME\/fullchain.pem -inkey \/etc\/letsencrypt\/live\/$DOMAIN_NAME\/privkey.pem -out letsencrypt.p12<\/code><\/pre>\n\n\n\n<p>When the script asks you for a password enter &#8216;changeit&#8217;.<\/p>\n\n\n\n<p>With the last command, we created a keystore into p12 format. We need to convert it into JKS format.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>keytool -importkeystore -srckeystore letsencrypt.p12 -srcstoretype PKCS12 -destkeystore letsencrypt.jks -deststoretype JKS\n<\/code><\/pre>\n\n\n\n<p>When the script asks you for a password : destination and source, always enter &#8216;changeit&#8217;.<\/p>\n\n\n\n<p>We can now run the CAS server with Docker.<\/p>\n\n\n\n<p>Create a directory for CAS : here \/var\/work\/cas<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p \/var\/work\/cas<\/code><\/pre>\n\n\n\n<p>Copy the JKS keystore to this folder :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp \/root\/letsencrypt.jks \/var\/work\/cas<\/code><\/pre>\n\n\n\n<p>Rename it to &#8216;thekeystore&#8217; and change the permission on it (just in case)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mv \/var\/work\/letsencrypt.jks \/var\/work\/thekeystore\nchmod 777 \/var\/work\/thekeystore<\/code><\/pre>\n\n\n\n<p>Before launching the CAS server, we can set some settings. Look at https:\/\/fawnoos.com\/2022\/05\/31\/cas65x-docker-deployment\/#container-configuration to have more information.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>&#8220;Adjust the CAS root logging level to debug so we can get more details from the running CAS web application.<br>Rename the CAS SSO cookie to <em>SSO_COOKIE<\/em>.<br>Allow the service registry instance to initialize and bootstrap itself from the embedded JSON files that ship with CAS.<br>Enable the schedule for the service registry loader&#8221;<\/p><cite>https:\/\/fawnoos.com\/2022\/05\/31\/cas65x-docker-deployment\/#container-configuration<\/cite><\/blockquote>\n\n\n\n<p>Basically with this configuration, we will have more verbosity on logs and we will authorize all applications with our CAS server.<\/p>\n\n\n\n<p>Enter this command :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>properties='{\n  \"logging\": {\n    \"level\": {\n      \"org.apereo.cas\": \"debug\"\n    }\n  },\n  \"cas\": {\n    \"tgc\": {\n      \"name\": \"SSO_COOKIE\"\n    },\n    \"service-registry\": {\n      \"core\": {\n        \"init-from-json\": true\n      },\n      \"schedule\": {\n        \"enabled\": false\n      }\n    }\n  }\n}'\nproperties=$(echo \"$properties\" | tr -d '&#91;:space:]')\necho -e \"***************************\\nCAS properties\\n***************************\"\necho \"${properties}\" | jq<\/code><\/pre>\n\n\n\n<p>We can now use these properties into the SPRING_APPLICATION_JSON property.<\/p>\n\n\n\n<p>We can now launch the CAS server. We add a bind mount with the keystore we just created: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export CAS_KEYSTORE=\/var\/work\/cas\/thekeystore\ndocker run --rm -d   --mount type=bind,source=\"${CAS_KEYSTORE}\",target=\/etc\/cas\/thekeystore   -e SPRING_APPLICATION_JSON=\"${properties}\"   -p 8444:8443 --name casserver apereo\/cas:6.5.<\/code><\/pre>\n\n\n\n<p>After some time, the CAS server can be found at this url : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;$DOMAIN_NAME:8444\/cas\/login <\/code><\/pre>\n\n\n\n<p>so in our example it would be:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;castest.datafari.com:8444\/cas\/login<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"410\" src=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-1024x410.jpg\" alt=\"\" class=\"wp-image-646\" srcset=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-1024x410.jpg 1024w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-300x120.jpg 300w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-768x308.jpg 768w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-1536x616.jpg 1536w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46-500x200.jpg 500w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.05.46.jpg 1914w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption>CAS login UI<\/figcaption><\/figure>\n\n\n\n<p>The default credentials are : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>user : casuser<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>password: Mellon<\/code><\/pre>\n\n\n\n<p>We can now install the CAS management webapp.<\/p>\n\n\n\n<p><strong>2. Installation of the CAS management webapp<\/strong><\/p>\n\n\n\n<p>Clone the code from the Github project CAS Management Overlay<\/p>\n\n\n\n<p>Here we clone it into \/var\/work\/cas : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/var\/work\/cas\ngit clone https:\/\/github.com\/apereo\/cas-management-overlay.git\n\n<\/code><\/pre>\n\n\n\n<p>We want to checkout the code with the 6.5 version : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd cas-management-overylay\ngit checkout 6.5<\/code><\/pre>\n\n\n\n<p>Copy the keystore into the project : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp \/var\/work\/cas\/thekeystore \/var\/work\/cas\/cas-management-overlay\/etc\/cas\/thekeystore\n<\/code><\/pre>\n\n\n\n<p>Edit the management.properties located into cas\/config : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nano \/var\/work\/cas\/cas-management-overlay\/etc\/cas\/config\/management.properties<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>cas.server.name=https:\/\/$DOMAIN_NAME:8444\ncas.server.prefix=${cas.server.name}\/cas\n\nmgmt.server-name=https:\/\/$DOMAIN_NAME:8443\nmgmt.admin-roles&#91;0]=ROLE_ADMIN\nmgmt.user-properties-file=file:\/etc\/cas\/config\/users.json\n\nlogging.config=file:\/etc\/cas\/config\/log4j2-management.xml\n\n<\/code><\/pre>\n\n\n\n<p>Edit the properties cas.server.name and mgmt.server-name by replacing by your domain name. Here it is the file with our domain example : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cas.server.name=https:\/\/castest.datafari.com:8444\ncas.server.prefix=${cas.server.name}\/cas\n\nmgmt.server-name=https:\/\/castest.datafari.com:8443\nmgmt.admin-roles&#91;0]=ROLE_ADMIN\nmgmt.user-properties-file=file:\/etc\/cas\/config\/users.json\n\nlogging.config=file:\/etc\/cas\/config\/log4j2-management.xml\n\n<\/code><\/pre>\n\n\n\n<p>Build the project with Docker : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/var\/work\/cas\/cas-management\nchmod +x *.sh\n.\/docker-build.sh\n<\/code><\/pre>\n\n\n\n<p>When it is over, you can launch the container : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/docker-run.sh<\/code><\/pre>\n\n\n\n<p>The CAS management page can be found at this URL : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;$DOMAIN_NAME:8443\/cas-management<\/code><\/pre>\n\n\n\n<p>In our example the URL is : <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;castest.datafari.com:8443\/cas-management<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"386\" src=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-1024x386.jpg\" alt=\"\" class=\"wp-image-647\" srcset=\"https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-1024x386.jpg 1024w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-300x113.jpg 300w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-768x290.jpg 768w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-1536x580.jpg 1536w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40-500x189.jpg 500w, https:\/\/www.francelabs.com\/blog\/wp-content\/uploads\/2023\/09\/Capture-de\u0301cran-2023-09-05-a\u0300-15.37.40.jpg 1919w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><figcaption>CAS management UI<\/figcaption><\/figure>\n\n\n\n<p>With this test configuration our CAS server will authorize all applications.<\/p>\n\n\n\n<p><strong>ANNEXES<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Java installation<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get install -y wget apt-transport-https gnupg\nwget -O - https:\/\/packages.adoptium.net\/artifactory\/api\/gpg\/key\/public | apt-key add -\necho \"deb https:\/\/packages.adoptium.net\/artifactory\/deb $(awk -F= '\/^VERSION_CODENAME\/{print$2}' \/etc\/os-release) main\" | tee \/etc\/apt\/sources.list.d\/adoptium.list\napt-get update\napt-get install temurin-11-jdk\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Docker<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -fsSL https:\/\/get.docker.com -o get-docker.sh\nsudo sh .\/get-docker.sh --dry-run<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>jq<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get install jq<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>The task of setting up a CAS server on Docker is not very smooth. The official documentation is not very explicit about it. We decided to write a post on this subject in order to help others to quickly configure &hellip; <a href=\"https:\/\/www.francelabs.com\/blog\/configure-a-cas-server-and-cas-management-webapp-with-docker\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[72,33,48],"class_list":["post-645","post","type-post","status-publish","format-standard","hentry","category-search","tag-cas","tag-datafari","tag-docker"],"_links":{"self":[{"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/posts\/645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/comments?post=645"}],"version-history":[{"count":4,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/posts\/645\/revisions"}],"predecessor-version":[{"id":658,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/posts\/645\/revisions\/658"}],"wp:attachment":[{"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/media?parent=645"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/categories?post=645"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.francelabs.com\/blog\/wp-json\/wp\/v2\/tags?post=645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}