Unicon CAS Update March 2013

Unicon CAS Update27 March 2013

Bill Thompson • Andrew Petro

Wednesday, March 27, 13

http://creativecommons.org/licenses/by-nc/3.0/us/deed.en_US

http://creativecommons.org/licenses/by-nc/3.0/us/deed.en_US

Agenda

1. What is this briefing?

2. Highlights and observations

3. Unicon activities since previous update

4. Intentions

5. Next steps


Welcome to this briefing

• Unicon’s CAS strategy

• Sourcing support for open source software

• Unicon’s “Cooperative” Support

• Thank you to our support subscribers


Introduction: Andrew Petro

• Jasig CAS committer, involved in CAS since before CAS 3

• 7 years with Unicon, most of which in Cooperative Support

• Unicon’s Cooperative Support for CAS technical lead


This session is being recorded.

• Will post after:

• Slides

• Notes blog post with useful hyperlinks

• Slidecast with audio


Observations and Highlights


CAS Server 3.5

• Still the current stable release.

• What you adopt or upgrade to today.


CAS Server 3.5.2 released February 22nd• Security fixes

• require proxy chain for accessing /cas/clearPass

• handle exception on bad execution ID (looked like a JavaScript injection vulnerability, but isn’t really)

• Improvements:

• OAuth, monitoring, logging


CAS addons

• Free and open source add-ons for CAS server

• Trends towards newer, exploratory features

• https://github.com/Unicon/cas-addons


https://github.com/Unicon/cas-addons




cas-addons

• JSON, MongoDb Service Registry

• MongoDb Service Registry

• JSON Person Attribute DAO

• JSON CAS ticket validation response

• Stormpath Authentication Handler

• ...


cas-java-clients-addons• Free and open source

add-ons for Java CAS clients (Jasig Java CAS Client, Spring Security, Apache Shiro)

• Trends towards newer, exploratory features

• https://github.com/Unicon/cas-java-clients-addons








Add to your Maven overlay, e.g.


CAS 4

• Roadmap:

• level of assurance capabilities and attendant protocol evolution

• Improved authentication APIs supporting multiple credentials, in part supporting this

• Catch up documented protocol to evident practices


CAS AppSec Working Group

• Public cas-appsec email list

• https://wiki.jasig.org/x/goRmAw


https://wiki.jasig.org/display/CAS/CAS+AppSec+Working+Group

https://wiki.jasig.org/display/CAS/CAS+AppSec+Working+Group

Jasig + Sakai = Apereo

• Jasig (the non-profit context for CAS, uPortal, Bedework, SSP, etc.) consolidated with the Sakai Foundation (the non-profit context for Sakai CLE, etc.)

• New organization named “Apereo”

• http://www.apereo.org/


http://www.apereo.org/

http://www.apereo.org/

Jasig-Sakai UnConference

• Held January 14-16th at ASU Polytechnic campus

• discussions including

• review of code towards CAS 4

• local customizations and usages of CAS

• automating 2fa token onboarding


Open Apereo 2013 Conference

• Registration open!

• Early bird until May 3rd

• ~ Sunday June 2nd through Thursday June 6th 2013

• San Diego


Apereo 2013

http://conf2013.apereo.org/schedule




CAS and Shib pre-conference seminar!


Unicon development, contribution, participation in CAS since last Update


What is “Cooperative Development”?

• Sustaining engineering budget under the Cooperative Support for CAS program

• Unicon maintains the supported open source software making it more supportable and valuable to subscribers

• What I tell the team: “Act in the best interests of the subscribers, of the community, and of Unicon”


Maintain CAS Generally and Unicon-led features

• Example: ClearPass enhanced in CAS 3.5.2 to reject bare service tickets (only proxy tickets with a blessed proxy chain allowed)


Work towards the next CAS features release (CAS 4)

• support custom filters for releasing attributes to a service

• improved message bundle handling (prefer an English message over failure)

• JavaScript file selection power in themes

• richer markup for Login form messages


Innovate on Unicon-led features

• EhCache ticket registry support for bulk ticket retrieval


cas-addons

• cas-addons 1.1

• Events framework

• Assertions convenience class

• cas-addons 1.2

• Register per-service whether login initiates a single sign-on session


cas-java-clients-addons

• Spring Security extension to integrate with ClearPass

• ClearPass proxy ticket validator


unicon-shibboleth-idp-template

• Template Shibboleth IdP

• Demonstrates deferring to CAS for login experience, credentials validation


What this means for you: tactically

• Tighten ClearPass configuration

• Upgrade to CAS 3.5.2

• continue to look to cas-addons etc. for extra features you might value, such as nuancing logging in to which services initiates SSO


What this means for you: strategically

• Each CAS release gets a little better

• Glitches and defects are addressed

• Extra features available for adoption out of cas-addons


Intentions for near-term development and

participation


What we do

• Maintain CAS 3.5 (current stable recommended release)

• Work towards CAS 4 (next release)

• Explore extensions and opportunities

• Responsive to inputs from subscriber experiences

• Explicit requests / votes

• Learn from providing support

• Empathize with your needs and projects


Maintain CAS 3.5

• especially ClearPass and EhCacheTicketRegisty

• Example: default ClearPass to encrypt credentials in cache

• Example: revisit JSP session creation

• Participate in CAS AppSec WG


Maintain client libraries

• Example: more and better ClearPass support in the client libraries


Work towards CAS 4

• CAS protocol update, now with a Working Group

• LPPE evolution beyond LDAP

• Multi-factor authentication support


Facilitate integrations among FLOSS projects

• CAS and Shibboleth IdP integration

• CAS and Grouper integration?


Next Steps


This session is being recorded.

• Will post after:

• Slides

• Notes blog post with useful hyperlinks

• Slidecast with audio


Let’s do this again.

• Next Unicon CAS Update:

• Friday June 28th

• 8:30 am Pacific == 11:30 am Eastern

• This is a date change.


Feedback welcome.

• By all means, please do get in touch.


Reminder to support subscribers:

• You’re welcome encouraged to get in touch directly if you’d like any of this information contextualized to your specific situation. E.g., Does my particular ClearPass configuration need updated to require a proxy chain?

• Feedback especially welcome.


Call to action

• Consider attending Open Apereo 2013

• Likely great CAS content, certainly great colleagues to meet with and conversations to be had.

• Kick it off with a pre-conference seminar or two.


Contact Information

• Bill Thompson, Director of Identity and Access Management [email protected]

• Andrew Petro, Cooperative Support for CAS Technical Lead [email protected]


mailto:[email protected]




(License)

This work is licensed under the Creative Commons Attribution-NonCommercial 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/3.0/us/.


Photo credits• Personal photos of Jim and Andrew: all rights reserved.

• Microphone:http://www.flickr.com/photos/deanhp/3711222265/http://creativecommons.org/licenses/by/2.0/deed.en

• Cactus:http://www.flickr.com/photos/robertrd/2788387337/http://creativecommons.org/licenses/by-nc-nd/2.0/

• San Diego:http://www.flickr.com/photos/nchill4x4/3430830083/http://creativecommons.org/licenses/by-nc-nd/2.0/

• Sun Flower:http://www.flickr.com/photos/59773274@N00http://creativecommons.org/licenses/by/2.0/


http://www.flickr.com/photos/deanhp/3711222265/

http://www.flickr.com/photos/deanhp/3711222265/

http://creativecommons.org/licenses/by-nc-nd/2.0/


http://www.flickr.com/photos/robertrd/2788387337/

http://www.flickr.com/photos/robertrd/2788387337/



http://www.flickr.com/photos/nchill4x4/3430830083/

http://www.flickr.com/photos/nchill4x4/3430830083/



http://www.flickr.com/photos/59773274@N00

http://www.flickr.com/photos/59773274@N00

http://creativecommons.org/licenses/by/2.0/

http://creativecommons.org/licenses/by/2.0/

Technology

Unicon CAS Update March 2013