JarCastingWhat is this project? 
This is a project to develop free and open source compatibly licensed extensions for the CAS server v4.1.x product implementing
- support for authenticating using multiple authentication factors
- support for relying parties (CAS-using applications) understanding how strongly the user authenticated from the ticket validation response, and
- support for relying parties exerting authentication strength requirements.
NOTICE
Minimum supported version of CAS in versions is 4.1.x. MFA integration with CAS 3.x as part of this project is NO LONGER maintained, as CAS v3.x itself is EOLed. CAS v4.2.x is NOT supported.
Requirements
- JDK 7+
- Apache Maven 3.3.x
- CAS 4.1.x
MultiFactor Support
duo-two-factor(via DuoSecurity)
Configuration
Maven Overlay
Use the following maven overlay as an example.
AuthN Methods
An authn-methods.conf file is expected to be found at /etc/cas with the following content:
[ {
"rank" : 1,
"name" : "duo-two-factor"
} ]
Messages
The following UI messages should be put into messages.properties file:
# Multifactor Authentication Messages
UNACCEPTABLE_AUTHENTICATION_METHOD=Ticket ''{0}'' did not fulfill the required authentication method ''{1}''.
UNRECOGNIZED_AUTHENTICATION_METHOD=This CAS server does not recognize the authentication method [''{0}''] specified on the validation request.
service.mfa.unrecognized.authn.method.header=Unrecognized Authentication Method
service.mfa.unrecognized.authn.method.message=You are trying to log in to <strong>''{0}''</strong> with a required authentication method of <strong>''{1}''</strong>. \
Unfortunately, CAS doesn't recognize that authentication method and so does not know how to require you to authenticate in that way.
service.mfa.service.requires.mfa.header=This service requires a specific authentication method in addition to username and password.
service.mfa.service.requires.mfa.message=The additional required authentication method is [''{0}'']. After successfully providing username and password, you will be prompted for this additional authentication factor.
service.mfa.service.mfa.inprogress.header=Multifactor Authentication is in progress...
service.mfa.service.mfa.inprogress.message=The additional required authentication method is [''{0}'']. The authentication is requested by [''{1}''].
screen.mfa.welcome.instructions=Enter your one-time password
screen.mfa.button.cancel=Not you?
screen.mfa.welcome.back=Welcome back, {0}!
service.mfa.unknown.principal.header=User not recognized
service.mfa.unknown.principal.message=CAS cannot establish an authentication context because it doesn't recognize one or more of the \
provided credentials. It is likely that the newly provided credentials are resolved in such a way that do not match at least one of the \
authenticated user ids (otherwise known as the 'Principal').
service.mfa.generic.error.heading=An authentication error has occurred!
service.mfa.generic.error.message=Additional information: {0}
Properties
The following settings are required for MFA in cas.properties:
# mfa.method.userAttribute=
# mfa.destroy.prev.sso=
# mfa.default.authn.method=
# mfa.authn.methods.config.location=
# mfa.method.response.attribute=
duo.api.host=
duo.integration.key=
duo.secret.key=
duo.application.key=
Per Application
Services that wish to declare their authentication method, must do so inside the service registry configuration.
{
"@class" : "org.jasig.cas.services.RegexRegisteredService",
"serviceId" : "^https://.*",
"properties" : {
"@class" : "java.util.HashMap",
"authn_method" : {
"@class" : "org.jasig.cas.services.DefaultRegisteredServiceProperty",
"values" : [ "java.util.HashSet", [ "duo-two-factor" ] ]
}
}
}
Per Attribute
CAS may aso initiate the sequence for a desired authentication method based on a configured principal attribute. Upon successful authentication, the principal attributes that are constructed by CAS will be queried for the given attribute. Its value will route the login flow to execute the appropriate authentication level.
mfa.method.userAttribute=memberOf
The attribute value should be duo-two-factor.
Per Application & Attribute
Activates MFA for a given application, only if the authenticated user carries an attribute that matches the given pattern.
{
"@class" : "org.jasig.cas.services.RegexRegisteredService",
"serviceId" : "^https://.*",
"properties" : {
"@class" : "java.util.HashMap",
"authn_method" : {
"@class" : "org.jasig.cas.services.DefaultRegisteredServiceProperty",
"values" : [ "java.util.HashSet", [ "duo-two-factor" ] ]
},
"mfa_attribute_name" : {
"@class" : "org.jasig.cas.services.DefaultRegisteredServiceProperty",
"values" : [ "java.util.HashSet", [ "isMemberOf" ] ]
},
"mfa_attribute_pattern" : {
"@class" : "org.jasig.cas.services.DefaultRegisteredServiceProperty",
"values" : [ "java.util.HashSet", [ "faculty|staff" ] ]
}
}
}
Opt-In
Opt-in mode requested by applications on demand when MFA is required:
https://<cas-server-url>/cas/login?service=xyz&authn_method=duo-two-factor
