Skip to content

Commit 229a670

Browse files
cslzchencslzchen
committed
Merge branch 'release/26.1.0'
2 parents 39ce8de + ef58ad2 commit 229a670

20 files changed

Lines changed: 292 additions & 73 deletions

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
We follow the CalVer (https://calver.org/) versioning scheme: YY.MINOR.MICRO.
44

5+
26.1.0 (2026-05-07)
6+
===================
7+
8+
* OSF4I In-progress SSO Project - CAS Piece
59

610
25.1.1 (10-11-2025)
711
===================

‎README.md‎

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ OSF CAS is the centralized authentication and authorization service for the [OSF
2727

2828
# Implementations
2929

30-
The implementation of OSF CAS is based on [Apereo CAS 6.2.8](https://github.com/apereo/cas/tree/v6.2.8) via [CAS Overlay Template 6.2.x](https://github.com/apereo/cas-overlay-template/tree/6.2). Refer to [CAS Documentation 6.2.x](https://apereo.github.io/cas/6.2.x/) for more details.
30+
The implementation of OSF CAS is based on [Apereo CAS 6.2.8](https://github.com/apereo/cas/tree/v6.2.8) via [CAS Overlay Template 6.2.x](https://github.com/apereo/cas-overlay-template/tree/6.2). Refer to [CAS Documentation 6.2.x](https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/) for more details.
3131

3232
## Legacy Implementations
3333

@@ -40,6 +40,33 @@ A legacy version can be found at [CAS Overlay](https://github.com/CenterForOpenS
4040
- PostgreSQL `9.6`
4141
- JDK `11`
4242

43+
44+
# Local Development
45+
46+
For local development, replace the default Dockerfile with Dockerfile-local.
47+
This is required to ensure proper loading and usage of cas-local.properties.
48+
```bash
49+
cp Dockerfile-local Dockerfile
50+
```
51+
52+
# Special Instructions for Apple Silicon (M1, M2, M3) and Other ARM64 Architectures
53+
54+
If you are running Docker on ARM64 architecture (Apple Silicon or similar), you must explicitly set the platform to linux/amd64 when using OpenJDK 11 images.
55+
Without this, the CAS container may fail to build or run correctly.
56+
57+
Update the Dockerfile as follows:
58+
```dockerfile
59+
# Dockerfile
60+
61+
FROM --platform=linux/amd64 adoptopenjdk/openjdk11:alpine-slim AS overlay
62+
...
63+
...
64+
65+
FROM --platform=linux/amd64 adoptopenjdk/openjdk11:alpine-jre AS cas
66+
...
67+
```
68+
This forces Docker to use an amd64 image via emulation and ensures compatibility with CAS and OpenJDK 11 on ARM-based machines.
69+
4370
# Configure, Build and Run OSF CAS
4471

4572
It is recommended to use the provided scripts to [build](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-build.sh) and [run](https://github.com/CenterForOpenScience/osf-cas/blob/develop/docker-run.sh) CAS. Refer to Apereo [README.md](https://github.com/apereo/cas-overlay-template/tree/6.2#cas-overlay-template-) for more options.
@@ -68,27 +95,20 @@ cas.authn.osf-postgres.jpa.dialect=io.cos.cas.osf.hibernate.dialect.OsfPostgresD
6895

6996
## CAS DB
7097

71-
The implementation of OSF CAS uses the [JPA Ticket Registry](https://apereo.github.io/cas/6.2.x/ticketing/Configuring-Ticketing-Components.html#ticket-registry) for durable ticket storage and thus requires a relational database. Set up a `PostgreSQL@9.6` server and review [JPA Ticket Registry settings](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L127-L173). In most cases, only [Database connections](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L139-L143) need to be updated. Other JDBC and JPA settings can be adjusted if necessary.
98+
The implementation of OSF CAS uses the [JPA Ticket Registry](https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/ticketing/Configuring-Ticketing-Components.md#ticket-registry) for durable ticket storage and thus requires a relational database. Set up a `PostgreSQL@9.6` server and review [JPA Ticket Registry settings](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L127-L173). In most cases, only [Database connections](https://github.com/CenterForOpenScience/osf-cas/blob/d0a03b51c9b1ce7795a210223c1ce38d5b2742de/etc/cas/config/cas.properties#L139-L143) need to be updated. Other JDBC and JPA settings can be adjusted if necessary.
7299

73-
Here is an example for local development. Use `192.168.168.167` to access host outside the docker container. Use the port `54321` since the default `5432` one has been used by OSF DB. Update `pg_hba.conf` to grant proper access permission depending on the setup.
100+
Here is an example for local development. Use `192.168.168.167` to access host outside the docker container.
74101

75102
```yaml
76103
# In `cas.properties` or `cas-local.properties`
77104

78-
cas.ticket.registry.jpa.user=longzechen
105+
cas.ticket.registry.jpa.user=postgres
79106
cas.ticket.registry.jpa.password=
80107
cas.ticket.registry.jpa.driver-class=org.postgresql.Driver
81-
cas.ticket.registry.jpa.url=jdbc:postgresql://192.168.168.167:54321/osf-cas?targetServerType=master
108+
cas.ticket.registry.jpa.url=jdbc:postgresql://192.168.168.167:5432/osf-cas?targetServerType=master
82109
cas.ticket.registry.jpa.dialect=org.hibernate.dialect.PostgreSQL95Dialect
83110
```
84111

85-
```yaml
86-
# In `pg_hba.conf`
87-
88-
# TYPE DATABASE USER ADDRESS METHOD
89-
host osf-cas longzechen 192.168.168.167/24 trust
90-
```
91-
92112
## Signing and Encryption Keys
93113

94114
### CAS Server

‎etc/cas/config/attribute-map-prod.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,9 @@
201201
<!-- Princeton University (PU) -->
202202
<Attribute name="urn:oid:1.2.840.113556.1.2.141" id="department"/>
203203

204+
<!-- Washington State University (wsu) -->
205+
<Attribute name="urn:oid:2.5.4.11" id="department"/>
206+
204207
<!-- Selective SSO Filter Attribute -->
205208
<!-- University of Manchester (UOM) -->
206209
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="selectiveSsoFilter"/>

‎etc/cas/config/cas.properties‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ cas.server.dev-mode.allow-force-http-error=${ALLOW_FORCE_HTTP_ERROR:false}
2525

2626
########################################################################################################################
2727
# Throttling
28-
# Configuration guide: https://apereo.github.io/cas/6.2.x/installation/Configuring-Authentication-Throttling.html
29-
# Properties: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#authentication-throttling
28+
# Configuration guide: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/installation/Configuring-Authentication-Throttling.md
29+
# Properties: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/configuration/Configuration-Properties.md#authentication-throttling
3030
########################################################################################################################
3131
#
3232
# Authentication Failure Throttling
@@ -40,7 +40,7 @@ cas.authn.throttle.failure.range-seconds=1
4040

4141
########################################################################################################################
4242
# CAS Monitoring & Statistics Endpoints
43-
# See: https://apereo.github.io/cas/6.2.x/monitoring/Monitoring-Statistics.html
43+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/monitoring/Monitoring-Statistics.md
4444
########################################################################################################################
4545
management.endpoints.web.exposure.include=health
4646
management.endpoint.health.enabled=true
@@ -72,14 +72,14 @@ cas.authn.accept.users=
7272

7373
########################################################################################################################
7474
# JSON Service Registry
75-
# See: https://apereo.github.io/cas/6.2.x/services/JSON-Service-Management.html
75+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/services/JSON-Service-Management.md
7676
########################################################################################################################
7777
cas.serviceRegistry.json.location=file:/etc/cas/services
7878
########################################################################################################################
7979

8080
########################################################################################################################
8181
# CAS Logout and Single Logout (SLO)
82-
# https://apereo.github.io/cas/6.2.x/installation/Logout-Single-Signout.html
82+
# https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/installation/Logout-Single-Signout.md
8383
########################################################################################################################
8484
# CAS Logout
8585
#
@@ -130,7 +130,7 @@ cas.authn.osf-api.instn-authn-xsl-location=file:/etc/cas/institutions-auth.xsl
130130

131131
########################################################################################################################
132132
# OSF PostgreSQL Authentication
133-
# See: https://apereo.github.io/cas/6.2.x/installation/Configuring-Custom-Authentication.html
133+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/installation/Configuring-Custom-Authentication.md
134134
########################################################################################################################
135135
# Authentication settings
136136
#
@@ -148,7 +148,7 @@ cas.authn.osf-postgres.jpa.dialect=${OSF_DB_HIBERNATE_DIALECT:io.cos.cas.osf.hib
148148

149149
########################################################################################################################
150150
# JPA Ticket Registry
151-
# See: https://apereo.github.io/cas/6.2.x/ticketing/JPA-Ticket-Registry.html
151+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/ticketing/JPA-Ticket-Registry.md
152152
########################################################################################################################
153153
# Global JDBC Settings
154154
#
@@ -196,24 +196,24 @@ cas.ticket.registry.jpa.jpa-locking-timeout=PT1H
196196

197197
########################################################################################################################
198198
# Signing and Encryption
199-
# See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties-Common.html#signing--encryption
199+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/configuration/Configuration-Properties-Common.md#signing--encryption
200200
########################################################################################################################
201201
# Spring Client Session
202-
# See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#spring-webflow-client-side-session
202+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/configuration/Configuration-Properties.md#spring-webflow-client-side-session
203203
#
204204
cas.webflow.crypto.signing.key=${WEB_FLOW_SIGNING_KEY}
205205
cas.webflow.crypto.encryption.key=${WEB_FLOW_ENCRYPTION_KEY}
206206
#
207207
# Ticket Granting Cookie (TGC)
208-
# See: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#signing--encryption-4
208+
# See: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/configuration/Configuration-Properties.md#signing--encryption-4
209209
#
210210
cas.tgc.crypto.signing.key=${TGC_SIGNING_KEY}
211211
cas.tgc.crypto.encryption.key=${TGC_ENCRYPTION_KEY}
212212
########################################################################################################################
213213

214214
########################################################################################################################
215215
# Long-term Authentication: Ticket Granting Cookie (TGC) and Ticket Granting Ticket (TGT)
216-
# See https://apereo.github.io/cas/6.2.x/installation/Configuring-LongTerm-Authentication.html
216+
# See https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/installation/Configuring-LongTerm-Authentication.md
217217
########################################################################################################################
218218
# General Cookie Setting for Ticket Granting Cookie
219219
#
@@ -242,7 +242,7 @@ cas.ticket.tgt.remember-me.time-to-kill-in-seconds=7776000
242242

243243
########################################################################################################################
244244
# Pac4j Delegated Authentication
245-
# https://apereo.github.io/cas/6.2.x/integration/Delegate-Authentication.html
245+
# https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/integration/Delegate-Authentication.md
246246
########################################################################################################################
247247
# General settings
248248
#
@@ -275,8 +275,8 @@ cas.authn.pac4j.cas[0].callback-url-type=QUERY_PARAMETER
275275

276276
########################################################################################################################
277277
# OAuth 2.0 Server
278-
# Configuration guide: https://apereo.github.io/cas/6.2.x/installation/OAuth-OpenId-Authentication.html
279-
# Properties: https://apereo.github.io/cas/6.2.x/configuration/Configuration-Properties.html#oauth2
278+
# Configuration guide: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/installation/OAuth-OpenId-Authentication.md
279+
# Properties: https://github.com/apereo/cas/blob/6.2.x/docs/cas-server-documentation/configuration/Configuration-Properties.md#oauth2
280280
########################################################################################################################
281281
# Authorization Code
282282
#

‎etc/cas/config/instn-authn-prod.xsl‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@
250250
</user>
251251
</xsl:when>
252252
<!-- Harvard University (HARVARD) -->
253-
<xsl:when test="$idp='http://www.okta.com/exk1xrjz6q65XDb2J1d8 '">
253+
<xsl:when test="$idp='http://www.okta.com/exk1xrjz6q65XDb2J1d8'">
254254
<id>harvard</id>
255255
<user>
256256
<username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
@@ -457,6 +457,18 @@
457457
<suffix/>
458458
</user>
459459
</xsl:when>
460+
<!-- Texas A&M University (TAMU) -->
461+
<xsl:when test="$idp='urn:mace:incommon:tamu.edu'">
462+
<id>tamu</id>
463+
<user>
464+
<username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
465+
<fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
466+
<givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
467+
<familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
468+
<middleNames/>
469+
<suffix/>
470+
</user>
471+
</xsl:when>
460472
<!-- Towson University (TU) -->
461473
<xsl:when test="$idp='https://shib.towson.edu/idp/shibboleth'">
462474
<id>tu</id>
@@ -895,6 +907,20 @@
895907
<eduPerson>false</eduPerson>
896908
</user>
897909
</xsl:when>
910+
<!-- Washington State University (WSU) -->
911+
<xsl:when test="$idp='http://www.okta.com/exk196cuygihbtIwD2p8'">
912+
<id>wsu</id>
913+
<user>
914+
<username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
915+
<fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
916+
<familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
917+
<givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
918+
<middleNames/>
919+
<suffix/>
920+
<departmentRaw><xsl:value-of select="//attribute[@name='department']/@value"/></departmentRaw>
921+
<eduPerson>false</eduPerson>
922+
</user>
923+
</xsl:when>
898924
<!-- Washington University in St. Louis (WUSTL) -->
899925
<xsl:when test="$idp='https://login.wustl.edu/idp/shibboleth'">
900926
<id>wustl</id>

‎etc/cas/config/instn-authn-test.xsl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,18 @@
309309
<suffix/>
310310
</user>
311311
</xsl:when>
312+
<!-- Texas A&M University (TAMU) -->
313+
<xsl:when test="$idp='urn:mace:incommon:tamu.edu'">
314+
<id>tamu</id>
315+
<user>
316+
<username><xsl:value-of select="//attribute[@name='mail']/@value"/></username>
317+
<fullname><xsl:value-of select="//attribute[@name='displayname']/@value"/></fullname>
318+
<givenName><xsl:value-of select="//attribute[@name='givenname']/@value"/></givenName>
319+
<familyName><xsl:value-of select="//attribute[@name='sn']/@value"/></familyName>
320+
<middleNames/>
321+
<suffix/>
322+
</user>
323+
</xsl:when>
312324
<!-- University of Arizona (UA) -->
313325
<xsl:when test="$idp='urn:mace:incommon:arizona.edu'">
314326
<id>ua</id>

0 commit comments

Comments
 (0)