CAS Rest 协议在没有通用服务定义的情况下不起作用

Question

I want to use REST Protocol in my services. For this, I enabled Rest Protocol and trying to get TGT. Also, all examples were based on generic service registration which I don't want in prod environment.

Here is the generic service registry example that should not be used in prod environment. And I did not use this in my environment:

{
  /*
    Generic service definition that applies to https/imaps urls
    that wish to register with CAS for authentication.
  */
  "@class" : "org.apereo.cas.services.RegexRegisteredService",
  "serviceId" : "^(https|imaps)://.*",
  "name" : "HTTPS and IMAPS",
  "id" : 10000001,
}

Instead, I have the following one:

{
  "@class": "org.apereo.cas.services.RegexRegisteredService",
  // this service will match all the requests contains test in the request url
  "serviceId": "^https?:\\/\\/.*test($|\\/).*$",
  "name": "Test",
  "id": 1,
  "description": "Test service",
  "evaluationOrder": 2,
  "requiredHandlers": [
    "java.util.HashSet",
    [
      "TestHandler"
    ]
  ],
  "attributeReleasePolicy": {
    "@class": "org.apereo.cas.services.ReturnAllAttributeReleasePolicy"
  },
  "properties": {
    "@class": "java.util.HashMap",
    "jwtAsServiceTicket": {
      "@class": "org.apereo.cas.services.DefaultRegisteredServiceProperty",
      "values": [
        "java.util.HashSet",
        [
          "true"
        ]
      ]
    }
  }
}

I can not request a ticket granting ticket as explained here :

POST /cas/v1/tickets HTTP/1.0
'Content-type': 'Application/x-www-form-urlencoded'
username=battags&password=password&additionalParam1=paramvalue

I got the following exception:

Unauthorized Service Access. Service [] is not found in service registry

When I debug the code, I can see that TGT is created and my registered service works fine. An exception is thrown because of the registered service check for againts CAS Server in JWTBuilder :

    val registeredService = payload.getRegisteredService() == null
        ? locateRegisteredService(serviceAudience)
        : payload.getRegisteredService();
    RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);

Here CAS tries to check if service access is allowed. payload.getRegisteredService returns null and locateRegisteredService is called with serviceAudience, than ensureServiceAccessIsAllowed throws the exception.

Problem is: serviceAudience is always filled with CAS server prefix which means this there must a service definition that matches with CAS server prefix . All examples work when I enable generic service definition but when I remove it, TGT does not return because of the above check.

Any idea, solution? I don't want to allow everyone able to create TGT, I can add service definition that only matches with CAS prefix also but first it is better to understand if I miss something or if this is a bug.

My Cas version: 6.1.0

My configurations:

server.port=8095
server.servlet.context-path=/bouncer
cas.authn.policy.any.tryAll=false
cas.authn.policy.any.enabled=true
cas.serviceRegistry.initFromJson=true
cas.serviceRegistry.json.location=file:/services

My build:

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-war-plugin</artifactId>
            <version>${maven-war-plugin.version}</version>
            <configuration>
                <warName>${project.artifactId}</warName>
                <failOnMissingWebXml>false</failOnMissingWebXml>
                <recompressZippedFiles>false</recompressZippedFiles>
                <archive>
                    <compress>false</compress>
                    <manifestFile>${manifestFileToUse}</manifestFile>
                </archive>
                <overlays>
                    <overlay>
                        <groupId>org.apereo.cas</groupId>
                        <artifactId>cas-server-webapp${app.server}</artifactId>
                        <excludes>
                            <exclude>WEB-INF/lib/log4j-api-2.12.1.jar</exclude>
                            <exclude>WEB-INF/lib/log4j-jcl-2.12.1.jar</exclude>
                            <exclude>WEB-INF/lib/log4j-jul-2.12.1.jar</exclude>
                            <exclude>WEB-INF/lib/log4j-slf4j18-impl-2.12.1.jar</exclude>
                            <exclude>WEB-INF/lib/log4j-web-2.12.1.jar</exclude>
                            <exclude>WEB-INF/lib/slf4j-api-1.8.0-beta4.jar</exclude>
                        </excludes>
                    </overlay>
                </overlays>
            </configuration>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>${maven-compiler-plugin.version}</version>
        </plugin>
    </plugins>
    <finalName>${project.artifactId}.jar</finalName>
</build>

<dependencies>
            <!--START: Extend CAS as WebApp-->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-webapp${app.server}</artifactId>
                <version>${cas.version}</version>
                <type>war</type>
                <scope>runtime</scope>
            </dependency>
            <!--END-->

            <!--START: Logback Gelf(Graylog Extended Log Format) integration-->
            <dependency>
                <groupId>de.siegmar</groupId>
                <artifactId>logback-gelf</artifactId>
                <version>${logback-gelf.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>ch.qos.logback</groupId>
                        <artifactId>logback-classic</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>ch.qos.logback</groupId>
                        <artifactId>logback-core</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!--START: Java 11 integration problems, use older logback and slf4j until it is supported-->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>${logback-classic.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>${slf4j-api.version}</version>
            </dependency>
            <!--END-->

            <!-- TODO: Problem The following two deps are needed for sending traces to zipkin -->
            <!-- Problem: https://github.com/spring-cloud/spring-cloud-sleuth/issues/1193 -->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-sleuth</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!--this one is needed, because else an exception will be thrown caused
               by: java.lang.NoClassDefFoundError: com/netflix/servo/monitor/Monitors-->
            <dependency>
                <groupId>com.netflix.servo</groupId>
                <artifactId>servo-core</artifactId>
                <version>${servo-core.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <!-- START: Support JWT/CAS Protocol: https://apereo.github.io/cas/6.0.x/installation/Configure-ServiceTicket-JWT.html -->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-token-tickets</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!-- START: REST Endpoints enabled for cli authentications -->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-rest-tokens</artifactId>
                <version>${cas.version}</version>

                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!-- START: JSON Service Registry Enabled -->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-json-service-registry</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>javax.el</groupId>
                        <artifactId>el-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!--START: OIDC Protocol enabled-->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-oidc</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!--START: Enable consul client -->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-consul-client</artifactId>
                <version>${cas-server-support-consul-client.version}</version>

                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!--START: Enable Custom Authentication for CAS: https://apereo.github.io/cas/6.0.x/installation/Configuring-Custom-Authentication.html-->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-core-authentication-api</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-core-api-configuration-model</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>

            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-core-web-api</artifactId>
                <version>${cas.version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

            <!--START: Enable Logback Support: https://apereo.github.io/cas/6.0.x/logging/Logging-Logback.html#logback-logging-->
            <dependency>
                <groupId>org.apereo.cas</groupId>
                <artifactId>cas-server-support-logback</artifactId>
                <version>${cas.version}</version>

                <exclusions>
                    <exclusion>
                        <groupId>ch.qos.logback</groupId>
                        <artifactId>logback-classic</artifactId>
                    </exclusion>

                    <exclusion>
                        <groupId>ch.qos.logback</groupId>
                        <artifactId>logback-core</artifactId>
                    </exclusion>
                    <exclusion>
                        <groupId>org.slf4j</groupId>
                        <artifactId>slf4j-api</artifactId>
                    </exclusion>
                    <!-- NotNull annotation comes from this package conflicts with hibarnate for ConsulProperties class-->
                    <exclusion>
                        <groupId>edu.washington.cs.types.checker</groupId>
                        <artifactId>checker-framework</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <!--END-->

        </dependencies>

Answer 1

Any idea, solution? I don't want to allow everyone able to create TGT, I can add service definition that only matches with CAS prefix also but first it is better to understand if I miss something or if this is a bug.

You're not missing anything. This sounds like a bug to me. As a workaround, I would add the service definition that matches the CAS prefix for now.

It sounds like this problem likely only manifests itself because you're using this:

<dependency>
    <groupId>org.apereo.cas</groupId>
    <artifactId>cas-server-support-token-tickets</artifactId>
    <version>${cas.version}</version>
    <exclusions>
        <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
        </exclusion>
    </exclusions>
</dependency>

If you have no need for this, then you can remove it to also remove the problem. Otherwise for now, your workaround for add service definition that only matches with CAS prefix should do.

PS You can try to switch to 6.1.2 but I dont think that would at make a difference in this case; it's a good idea to switch anyway.