Tools

Configure the CAS module for LDAP and Active Directory

You can deploy CAS server into Apache Tomcat on Web Help Desk or your own Web Help Desk server. Before you deploy single sign-on (SSO) with CAS 2.0 in your Web Help Desk deployment, follow the procedures in this article to configure the CAS module for LDAP and Active Directory communications.

First published date

10/18/2018 10:32 PM

Last published date

10/31/2019 1:44 PM

Overview

The Central Authentication Service (CAS) is a single sign-on protocol that enables a user to access multiple applications using one set of credentials. This protocol works in conjunction with the CAS server, which handles all the user connections to your Microsoft Exchange and LDAP servers.

You can deploy CAS server into Apache Tomcat on Web Help Desk or your own Web Help Desk server. Before you deploy single sign-on (SSO) with CAS 2.0 in your Web Help Desk deployment, follow the procedures in this article to configure the CAS module for LDAP and Active Directory communications.

Product section

Web Help Desk

Resolution

Download 7-Zip

This utility is a free open source file archiving utility you can use to complete this procedure.
  1. Navigate to the 7-Zip website.
  2. Download and install the 7-Zip archive utility on your system. 

Download the CAS Server file

  1. Navigate to the Apereo website
  2. Click v3.5.1.
  3. Scroll down and click cas-serer-3.5.1-release.zip to download the ZIP file. 
  4. Extract the contents of the ZIP file to a local directory.
  5. Open the cas-server-3.5.1 directory and click modules.
  6. Copy the cas-server-webapp-3.5.1.war file to a local directory.

Edit the WAR file

  1. Download the deployerConfigContext.txt file from the SolarWinds Documentation site and save the file to your local directory.
  2. Open the file in Notepad and copy the content to your clipboard.
  3. Right-click the cas-server-webapp-3.5.1.war file and select 7-Zip > Open Archive.
  4. Double-click the WEB-INF directory.
    The directory displays.

  5. In the archive, right-click the deployerConfigContext.xml file and select Edit.
  6. Paste the content from your clipboard into the archive file, overwriting the existing content. 
  7. In the updated archive file, update the file variables for your deployment. 
    1. Locate the following parameter. If you are using an SSL connection, use ladps:// in the path. 

      <property name="url" value="ldap://127.0.0.1:389" /> 
    2. Replace the value variable with the IP address of your LDAP server. 
    3. Locate the following parameter:
      <property name="userDn" value="ldap_admin@yourdomain.com" />
    4. Replace the value variable with the email address of your LDAP administrator.
    5. Locate the following parameter:
      <property name="password" value="ldap_admin_password" />
    6. Replace the value variable with your LDAP admin password.
    7. Locate the following parameter:
      p:filter="sAMAccountName=%u" p:searchBase="DC=yourdomain,DC=com"
    8. Ensure that the LDAP p:filter search filter matches your LDAP configuration settings. 
    9. Replace the p:searchBase variables with your domain information.  
    10. Save and close the file. 
  8. Download the casproperties.txt file from the SolarWinds Documentation website and save the file to your local directory. 
  9. Open the cas.properties.txt file in Notepad and copy the content to your clipboard.
  10. In the 7-Zip archive, right-click the cas.properrties.xml file and select Edit.
  11. Paste the content from your clipboard to the file, overwriting the existing content. 
  12. In the updated cas.properties.xml file, update the file variables for your deployment. 
    1. Locate the following parameter:
      server.name=http://localhost:8080
    2. Replace the server.hame variable with a WHD server address. For example:
      http://whd.example.com
    3. Under # Unique CAS node name, locate the following argument:
      host.name=cas01.yourdomain.com
    4. Replace.yourdomain.com with your domain name. 
      The host.name parameter is used to generate unique service ticket IDs and SAML artifacts. This is usually set to the specific hostname of the machine running the CAS node. However, it could be any label as long as it is unique in the cluster. 

    5. Save and close the file. 
      Leave the 7-Zip archive open.

Download and apply the dependencies

  1. Download the following dependencies in JAR format:
    • CAS Server Support LDAP v3.5.2 (© 2006-2018 MvnRepository, available at https://mvnrepository.com/, obtained on November 19, 2018).
    • Commons Pool v1.6 (© 2006-2018 MvnRepository, available at https://mvnrepository.com/, obtained on November 19, 2018).
    • LDAPTIVE Core v1.0.5 (© 2006-2018 MvnRepository, available at https://mvnrepository.com/, obtained on November 19, 2018).
    • Spring LDAP v1.3.1 (All)  (© Demo Source and Support, available at http://www.java2s.com/, obtained on November 19, 2018). This file must be unzipped.
  2. Verify that you downloaded the following JAR files:
    - cas-server-support-ldap-3.5.2.jar
    - commons-pool-1.6.jar
    - ldaptive-1.0.5.jar
    - spring-ldap-1.3.1.RELEASE-all.jar

  3. Drag all downloaded dependencies to the archive directory. 
    All new and modified files display in the WEB-INF directory in 7-Zip.

  4. Extract all files in the cas-server-webapp-3.5.1.war archive to a separate directory.
  5. Select all extracted files and directories.
  6. Right-click and select 7-Zip > Add to archive.
  7. In the Archive name field, enter cas.war and save the archive. 
    The archive displays in the directory.

  8. Close 7-Zip.

Deploy CAS server on Apache Tomcat

  1. Stop the Web Help Desk service.
  2. Copy the cas.war file to the /bin/webapps directory on your Apache Tomcat deployment.
  3. Sart the Web Help Desk service.
    CAS 2.0 is now accessible from the following URL:
    https://<webhelpdesk>:<port>/cas

  4. Verify that the HTTPS port is enabled on Apache Tomcat.

    If the port is not enabled, see "Enable SSL on Web Help Desk" in Deploy SSO with CAS 2.0.

    If the HTTPS port is enabled, see "Deploy CAS 2.0 on the Web Help Desk server" in Deploy SSO with CAS 2.0 .

Complete your CAS server deployment

Configure a Group Policy Object (GPO) to push the appropriate Windows login credentials to your Internet Explorer settings. This process allows authenticated users to access the Web Help Desk server without having to log in. GPOs define the settings for your Windows server configuration, and Group Policies apply these settings.

See "Configure a GPO to push the Internet Explorer settings" in Deploy SSO with CAS 2.0 for details.