Spring Security and CAS

Central Authentication Service (CAS) is a single sign-on protocol for the web. Integrating CAS with Spring Security allows for centralized authentication across multiple applications. This guide covers key concepts and steps for setting up CAS authentication in your Spring Boot application, including adding dependencies, configuring CAS settings, and securing endpoints.

Key Concepts of Spring Security and CAS

CAS (Central Authentication Service): A single sign-on protocol for the web.
CAS Authentication: A method to authenticate users using CAS tickets.
Identity Provider (IdP): A CAS server that provides authentication services.
Service Provider (SP): An application that relies on a CAS server to authenticate users.
Security Configuration: Configuring Spring Security to use CAS for authentication.

Adding Dependencies

Include the Spring Security CAS dependency in your pom.xml file:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-cas</artifactId>
    <version>5.4.6</version>
</dependency>

Configuring CAS Settings

Configure CAS settings in the application.yml file:

Example: application.yml

cas:
  server:
    login-url: https://cas.example.com/login
    logout-url: https://cas.example.com/logout
    validate-url: https://cas.example.com/serviceValidate
  client:
    service-url: https://localhost:8080/login/cas

Configuring CAS Authentication

Configure CAS authentication by extending WebSecurityConfigurerAdapter and creating necessary CAS beans:

Example: SecurityConfiguration.java

// SecurityConfiguration.java
package com.example.myapp.config;

import org.jasig.cas.client.authentication.AuthenticationFilter;
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.validation.Cas20ServiceTicketValidator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Bean
    public Cas20ServiceTicketValidator cas20ServiceTicketValidator() {
        return new Cas20ServiceTicketValidator("https://cas.example.com");
    }

    @Bean
    public SingleSignOutFilter singleSignOutFilter() {
        return new SingleSignOutFilter();
    }

    @Bean
    public AuthenticationFilter authenticationFilter() {
        AuthenticationFilter authenticationFilter = new AuthenticationFilter();
        authenticationFilter.setCasServerLoginUrl("https://cas.example.com/login");
        authenticationFilter.setServerName("https://localhost:8080");
        return authenticationFilter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers("/cas/**", "/login/**", "/logout/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .addFilterBefore(authenticationFilter(), LogoutFilter.class)
            .addFilterBefore(singleSignOutFilter(), AuthenticationFilter.class)
            .logout()
            .logoutUrl("/logout")
            .logoutSuccessUrl("/login?logout")
            .addLogoutHandler(new SecurityContextLogoutHandler());
    }
}

Creating Login and Logout Pages

Create custom login and logout pages to handle user authentication:

Example: login.html

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
    <link rel="stylesheet" type="text/css" href="/css/styles.css" />
</head>
<body>
    <div class="swf-lsn-container">
        <h2>Login</h2>
        <form method="post" action="/login/cas">
            <div>
                <label>Username:</label>
                <input type="text" name="username" />
            </div>
            <div>
                <label>Password:</label>
                <input type="password" name="password" />
            </div>
            <div>
                <input type="submit" value="Login" />
            </div>
        </form>
        <div class="swf-lsn-error-message">
            <#if error?string?trim != "">
                Invalid username or password.
            </#if>
            <#if logout?string?trim != "">
                You have been logged out.
            </#if>
        </div>
    </div>
</body>
</html>

Securing Endpoints

Protect specific endpoints by specifying access rules:

Example: SecurityConfiguration.java

// SecurityConfiguration.java
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/cas/**", "/login/**", "/logout/**").permitAll()
        .anyRequest().authenticated()
        .and()
        .addFilterBefore(authenticationFilter(), LogoutFilter.class)
        .addFilterBefore(singleSignOutFilter(), AuthenticationFilter.class)
        .logout()
        .logoutUrl("/logout")
        .logoutSuccessUrl("/login?logout")
        .addLogoutHandler(new SecurityContextLogoutHandler());
}

Key Points

CAS (Central Authentication Service): A single sign-on protocol for the web.
CAS Authentication: A method to authenticate users using CAS tickets.
Identity Provider (IdP): A CAS server that provides authentication services.
Service Provider (SP): An application that relies on a CAS server to authenticate users.
Security Configuration: Configuring Spring Security to use CAS for authentication.
Include the Spring Security CAS dependency in your pom.xml file.
Configure CAS settings in the application.yml file.
Configure CAS authentication by extending WebSecurityConfigurerAdapter and creating necessary CAS beans.
Create custom login and logout pages to handle user authentication.
Protect specific endpoints by specifying access rules.

Conclusion

Integrating CAS with Spring Security allows you to leverage the power of single sign-on for secure authentication across multiple applications. By understanding and configuring CAS settings, security configuration, and authentication flows, you can ensure secure access to your application's resources. Happy coding!