{"id":15018,"date":"2018-04-10T17:10:06","date_gmt":"2018-04-10T17:10:06","guid":{"rendered":"https:\/\/ephesoft.com\/docs\/?page_id=15018"},"modified":"2020-12-03T14:48:11","modified_gmt":"2020-12-03T21:48:11","slug":"sso-cas-based-sso-framework","status":"publish","type":"docs","link":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/","title":{"rendered":"SSO | CAS-Based SSO Framework"},"content":{"rendered":"<p>SSO (Single Sign-On) is a mechanism of\u00a0access control\u00a0that can be applied on multiple related but independent\u00a0software\u00a0systems. This way, a user\u00a0logs in\u00a0once and gains access to multiple systems without being prompted to log in again for each individual application.<\/p>\n<p>Previously, the SSO mechanism in Ephesoft Transact only supported integration of the SAML-enabled Spring Security framework. For more information on this feature, refer <a href=\"https:\/\/ephesoft.com\/docs\/home\/documentation\/security-compliance-support-saml-v2\">here<\/a>.<\/p>\n<p>In Transact 4.5.0.0, SSO functionality can also be implemented on the basis of CAS (Central Authentication Service). Now, you can configure Transact with Spring Security and CAS, both with and without CAS proxy support.<\/p>\n<h2><strong>CAS (Central Authentication Service)<\/strong><\/h2>\n<p>CAS is an Enterprise Java solution for web application authentication that also provides the benefit of Single Sign-On (SSO). Technically, SSO can be achieved because the authentication can be removed from the web application and handled centrally. And, when this authentication is handled by a single service, access to many services can be granted once and &#8220;remembered&#8221; for the life of the web session or even longer. Keep in mind that the SSO feature does not have to be employed and yet CAS authentication still provides a reliable authentication mechanism.<\/p>\n<h3><strong>CAS Server<\/strong><\/h3>\n<p>The CAS server is a Java servlet built on the Spring Framework. Its primary responsibility is to authenticate users and grant access to CAS-enabled services, commonly called CAS clients or services, by issuing and validating tickets. An SSO session is created when the CAS server issues a ticket-granting ticket (TGT) to the user upon successful login. A service-ticket (ST) is issued to a service at the user\u2019s request via browser redirect using the TGT as a token. The ST is subsequently validated at the CAS server via back-channel communication. Ephesoft Transact also supports proxy-granting-ticket (PGT), in which the server issues a PGT to Transact. Transact uses this PGT to create proxy tickets for accessing other web applications under the same authentication umbrella.<\/p>\n<h3><strong>CAS Clients<\/strong><\/h3>\n<p>The term \u201cCAS client\u201d has two distinct meanings in its common use. A CAS client is any CAS-enabled application that can communicate with the server via a supported protocol. A CAS client is also a software package that can be integrated with various software platforms and applications to communicate with the CAS server via some authentication protocol (e.g. CAS, SAML, OAuth). In our case, Ephesoft is a CAS client that communicates with the CAS server for the purpose of authentication and SSO.<\/p>\n<h3><strong>CAS with Proxy Support<\/strong><\/h3>\n<p>If proxy support is required, the CAS client requests a proxy-granting-ticket (PGT) rather than a normal service-ticket (ST). Using this proxy ticket, the CAS client can securely communicate with other CAS clients under the same CAS SSO umbrella. This rapidly increases the performance of the CAS client when communicating with other CAS clients under this umbrella because the CAS client with PGT no longer needs to request an ST for each request to other CAS clients. Configuring the CAS client with proxy support should be handled carefully as improper configuration may lead to a security breach. Proper configuration steps and suggestions are provided below.<\/p>\n<h3><strong>CAS without Proxy Support<\/strong><\/h3>\n<p>CAS without proxy support should be used when there is only a single application under the SSO umbrella or when the system does not require communication between CAS clients under the same umbrella. When CAS is used without proxy support, the CAS client works on a service-ticket (ST) granted by the CAS server. This configuration is preferable if the situation does not require proxy support as it is less vulnerable to a security breach.<\/p>\n<h2><strong>Configuring CAS-based SSO mechanism<\/strong><\/h2>\n<p>The following files must be configured:<\/p>\n<ul>\n<li>EPHESOFT_HOME\/JavaAppServer\/conf\/server.xml<\/li>\n<li>EPHESOFT_HOME\/Application\/applicationContext.xml<\/li>\n<li>EPHESOFT_HOME\/Application\/WEB-INF\/classes\/META_INF\/CAS-config\/cas-config.properties<\/li>\n<li>EPHESOFT_HOME\/Application\/WEB-INF\/web.xml<\/li>\n<\/ul>\n<h3><strong>Configuring server.xml<\/strong><\/h3>\n<p>To integrate CAS, Ephesoft Transact must be run over SSL with the following suggested configurations:<\/p>\n<ol>\n<li>Uncomment the connector protocol. A sample Tomcat connector with suggested configurations is shown below:<br \/>\n<img decoding=\"async\" width=\"784\" height=\"165\" class=\"wp-image-15019\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\connector protocol2.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28.png 784w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28-300x63.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28-768x162.png 768w\" sizes=\"(max-width: 784px) 100vw, 784px\" \/><\/li>\n<li>Provide the keystore file path and its password (if using proxy setup).<\/li>\n<li>Provide the truststore file path and password. Make sure the truststore file is the same as that of %JAVA_HOME% because CAS internally looks for the truststore in the %JAVA_HOME%\/jre\/lib\/security folder.<\/li>\n<li>Specify the port number (the suggested port is 8443).<\/li>\n<li>Comment out any other connector, if required.<\/li>\n<\/ol>\n<h3><strong>Configuring applicationContext.xml<\/strong><\/h3>\n<ul>\n<li>Uncomment the <strong>applicationContext-securityCASwithProxy.xml<\/strong> bean in applicationContext.xml to enable CAS SSO with proxy support, or<\/li>\n<li>Uncomment the <strong>applicationContext-securityCASwithoutProxy.xml<\/strong> bean in applicationContext.xml to enable CAS SSO without proxy support.<\/li>\n<\/ul>\n<p><img decoding=\"async\" width=\"1097\" height=\"144\" class=\"wp-image-15020\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-29.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\context.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-29.png 1097w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-29-300x39.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-29-768x101.png 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-29-1024x134.png 1024w\" sizes=\"(max-width: 1097px) 100vw, 1097px\" \/><\/p>\n<h3><strong>Configuring cas-config.properties<\/strong><\/h3>\n<ul>\n<li>Provide values for <strong>cas.server.host <\/strong>and <strong>cas.service.host<\/strong><a id=\"post-15018-_applicationContext.xml\"><\/a> in the properties file. Ephesoft recommends using port number 8443.<\/li>\n<\/ul>\n<p><img decoding=\"async\" width=\"974\" height=\"122\" class=\"wp-image-15021\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-30.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\casconfig.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-30.png 974w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-30-300x38.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-30-768x96.png 768w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<ul>\n<li>cas.server.host represents the complete host address of the CAS server. Ex: casServer:8443<\/li>\n<li>cas.service.host represents the complete host address of the system where Ephesoft is running. Ex: casService:8443<\/li>\n<\/ul>\n<p>These host addresses are further used to calculate the required URLs and to ensure proper communication between the CAS server and Ephesoft Transact.<\/p>\n<h3><strong>Configuring web.xml<\/strong><\/h3>\n<p>1. Uncomment the \u201ccharacterEncodingFilter\u201d filter and its filter mapping.<\/p>\n<p><img decoding=\"async\" width=\"934\" height=\"383\" class=\"wp-image-15022\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-31.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\1.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-31.png 934w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-31-300x123.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-31-768x315.png 768w\" sizes=\"(max-width: 934px) 100vw, 934px\" \/><\/p>\n<p>2. Uncomment the \u201cspringSecurityFilterChain\u201d filter and its filter mapping.<\/p>\n<p><img decoding=\"async\" width=\"877\" height=\"378\" class=\"wp-image-15023\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-32.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\2.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-32.png 877w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-32-300x129.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-32-768x331.png 768w\" sizes=\"(max-width: 877px) 100vw, 877px\" \/><\/p>\n<p>3. Comment out the \u201csessionTimeoutFilter\u201d and its filter mapping.<\/p>\n<p><img decoding=\"async\" width=\"903\" height=\"196\" class=\"wp-image-15024\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-33.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\3.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-33.png 903w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-33-300x65.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-33-768x167.png 768w\" sizes=\"(max-width: 903px) 100vw, 903px\" \/><\/p>\n<p>4. Comment out the \u201cSessionTimeoutServlet\u201d and its servlet mapping.<\/p>\n<p><img decoding=\"async\" width=\"917\" height=\"236\" class=\"wp-image-15025\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-34.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\4.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-34.png 917w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-34-300x77.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-34-768x198.png 768w\" sizes=\"(max-width: 917px) 100vw, 917px\" \/><\/p>\n<p>5. Comment out all \u201csecurity-constraint\u201d and \u201clogin-config\u201d nodes.<\/p>\n<p><img decoding=\"async\" width=\"854\" height=\"282\" class=\"wp-image-15026\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-35.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\5.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-35.png 854w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-35-300x99.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-35-768x254.png 768w\" sizes=\"(max-width: 854px) 100vw, 854px\" \/><\/p>\n<p><img decoding=\"async\" width=\"859\" height=\"181\" class=\"wp-image-15027\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-36.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\6.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-36.png 859w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-36-300x63.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-36-768x162.png 768w\" sizes=\"(max-width: 859px) 100vw, 859px\" \/><\/p>\n<p>6. Change the port to 8443.<\/p>\n<p>7. Change the protocol to https.<\/p>\n<p><img decoding=\"async\" width=\"814\" height=\"222\" class=\"wp-image-15028\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-37.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\7.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-37.png 814w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-37-300x82.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-37-768x209.png 768w\" sizes=\"(max-width: 814px) 100vw, 814px\" \/><\/p>\n<p>8. Choose \u20181\u2019 as the value for \u201cauthenticationType\u201d.<\/p>\n<p><img decoding=\"async\" width=\"957\" height=\"197\" class=\"wp-image-15029\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-38.png\" alt=\"C:\\Users\\Ephesoft\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\9.png\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-38.png 957w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-38-300x62.png 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-38-768x158.png 768w\" sizes=\"(max-width: 957px) 100vw, 957px\" \/><\/p>\n<h3><strong>Truststore and Keystore<\/strong><\/h3>\n<p>A Java Key Store (JKS) is a repository of security certificates. CAS exchanges involve usage of cryptography for signing and encryption of data. This Key Store will contain a <strong><em>certificate and private key<\/em><\/strong> that will be used to digitally sign CAS messages and encrypt their content.<\/p>\n<p>The CAS server and CAS client (Ephesoft Transact) interact with each other in an encrypted environment. For that purpose, the CAS server and Ephesoft Transact both maintain their own keystore and truststore. The certificate in the CAS server\u2019s keystore must be imported into the Ephesoft Transact truststore.<\/p>\n<p>To use CAS with proxy support, the certificate in the Ephesoft Transact keystore must be imported into the CAS server\u2019s truststore.<\/p>\n<p><strong>Creating Private Key<\/strong><\/p>\n<ol>\n<li>Open a command line or terminal window and make sure you&#8217;re in your home directory.<\/li>\n<li>Execute the following command:<\/li>\n<\/ol>\n<table>\n<tbody>\n<tr>\n<td><strong>keytool -genkey -alias tomcat -keyalg RSA -validity\u00a0365<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>NOTE: <\/strong>The \u201cvalidity\u201d parameter allows you to specify (number of days) how long the certificate should be valid for. The longer the time-period, the less likely you are to need to recreate it. To recreate it, you&#8217;d need to delete the old one and then follow these instructions again.<\/p>\n<p>The response will look something like this:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>Enter keystore password:<\/p>\n<p>Re-enter\u00a0new\u00a0password:<\/p>\n<p>What is your first and last name?<\/p>\n<p>[Unknown]:\u00a0 $REPLACE_WITH_FULL_MACHINE_NAME<\/p>\n<p>What is the name of your organizational unit?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your organization?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your City or Locality?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your State or Province?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the two-letter country code\u00a0for\u00a0this\u00a0unit?<\/p>\n<p>[Unknown]:\u00a0 US<\/p>\n<p>Is CN=$FULL_MACHINE_NAME, OU=Test, O=Test, L=Test, ST=Test, C=US correct?<\/p>\n<p>[no]:\u00a0 yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>For the keystore password, you should enter &#8220;changeit&#8221; without the quotation marks. When prompted for the first and last name, you should enter your machine name during development. Enter the rest of the information specific to your organization. After confirming the information you have provided, a keystore will be created and a private key will be added to that keystore.<\/p>\n<p>Any application that wishes to securely connect to this CAS server would need to import the certificate. You can export a certificate that&#8217;s compatible with other JVM keystores by executing the following command:<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>keytool -export -alias tomcat -file server.crt<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You&#8217;ll get output that looks like this:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>Enter keystore password:<\/p>\n<p>Certificate stored in file &lt;server.crt&gt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You can then import the\u00a0<strong>server.crt<\/strong>\u00a0into the Ephesoft Transact JVM keystore by executing the following command:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>keytool -import\u00a0-file server.crt -keystore $JAVA_HOME\/jre\/lib\/security\/cacerts -alias tomcat<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The path of this newly created keystore will be used in configuring the CAS server using Tomcat.<\/p>\n<p><strong>Note: <\/strong>For using CAS with proxy support, perform the following procedure in Ephesoft Transact to create a keystore and import Transact\u2019s certificate into the CAS server truststore.<\/p>\n<p><strong>Creating Private Key<\/strong><\/p>\n<ol>\n<li>Open a command line or terminal window and make sure you&#8217;re in your home directory.<\/li>\n<li>Execute the following command:<\/li>\n<\/ol>\n<table>\n<tbody>\n<tr>\n<td><strong>keytool -genkey -alias tomcat -keyalg RSA -validity\u00a0365<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The response will look something like this:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>Enter keystore password:<\/p>\n<p>Re-enter\u00a0new\u00a0password:<\/p>\n<p>What is your first and last name?<\/p>\n<p>[Unknown]:\u00a0 $REPLACE_WITH_FULL_MACHINE_NAME<\/p>\n<p>What is the name of your organizational unit?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your organization?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your City or Locality?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the name of your State or Province?<\/p>\n<p>[Unknown]:\u00a0 Test<\/p>\n<p>What is the two-letter country code\u00a0for\u00a0this\u00a0unit?<\/p>\n<p>[Unknown]:\u00a0 US<\/p>\n<p>Is CN=$FULL_MACHINE_NAME, OU=Test, O=Test, L=Test, ST=Test, C=US correct?<\/p>\n<p>[no]:\u00a0 yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>For the keystore password, you should enter &#8220;changeit&#8221; without the quotation marks. When prompted for the first and last name, you should enter your machine name during development. Enter the rest of the information as it applies to your organization. After confirming all the entries, a keystore will be created and a private key will be added to that keystore.<\/p>\n<p>Any application that wishes to securely connect to Ephesoft Transact would need to import the certificate. You can export a certificate that&#8217;s compatible with other JVM keystores by executing the following command:<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>keytool -export -alias tomcat -file server.crt<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You&#8217;ll get output that looks like this:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>Enter keystore password:<\/p>\n<p>Certificate stored in file &lt;server.crt&gt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You can then import the\u00a0<strong>server.crt<\/strong>\u00a0into the CAS JVM keystores by executing a command like this:<\/p>\n<table border=\"1\">\n<tbody>\n<tr>\n<td>keytool -import\u00a0-file server.crt -keystore $JAVA_HOME\/jre\/lib\/security\/cacerts -alias tomcat<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>After completing all the above-mentioned configurations, restart the Ephesoft Transact server.<\/p>\n<h1><strong>Suggestions for CAS server setup<\/strong><\/h1>\n<p>To use CAS with proxy support, the CAS server must have the \u201callowedToProxy\u201d attribute of the Ephesoft Transact service set to \u201ctrue\u201d. By default, the \u201callowedToProxy\u201d attribute is set to \u201cfalse\u201d.<\/p>\n<h4><strong>Setting the allowedToProxy attribute to true<\/strong><\/h4>\n<p>Perform the following steps for CAS server versions 3.4.x, 3.5.x, 3.6.x, or 4.0.x.<\/p>\n<ol>\n<li>Open the \u201cdeployerConfigContext.xml\u201d file.<\/li>\n<li>Add the \u201callowedToProxy\u201d attribute in the registeredServicesList section and set its value to \u201ctrue\u201d.<\/li>\n<\/ol>\n<p><img decoding=\"async\" width=\"1036\" height=\"234\" class=\"wp-image-15030\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy2-jpg.jpeg\" alt=\"D:\\e bkup\\CAS doc\\proxy2.jpg\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy2-jpg.jpeg 1036w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy2-jpg-300x68.jpeg 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy2-jpg-768x173.jpeg 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy2-jpg-1024x231.jpeg 1024w\" sizes=\"(max-width: 1036px) 100vw, 1036px\" \/><\/p>\n<p>Perform the following steps for CAS server versions 4.1.x and 4.2.x.<\/p>\n<ol>\n<li>Open the \u201cHTTPSandIMAPS\u201d file corresponding to the Ephesoft Transact service.<\/li>\n<li>Add a regex pattern for the \u201cproxyPolicy\u201d attribute as given below:<\/li>\n<\/ol>\n<p><em>&#8220;proxyPolicy&#8221; : {<\/em><\/p>\n<p><em> &#8220;@class&#8221; : &#8220;org.jasig.cas.services.RegexMatchingRegisteredServiceProxyPolicy&#8221;,<\/em><\/p>\n<p><em> &#8220;pattern&#8221; : &#8220;^https?:\/\/.*&#8221;<\/em><\/p>\n<p><em> }<\/em><\/p>\n<p><img decoding=\"async\" width=\"1230\" height=\"588\" class=\"wp-image-15031\" src=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy-jpg.jpeg\" alt=\"D:\\e bkup\\CAS doc\\proxy.jpg\" srcset=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy-jpg.jpeg 1230w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy-jpg-300x143.jpeg 300w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy-jpg-768x367.jpeg 768w, https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/d-e-bkup-cas-doc-proxy-jpg-1024x490.jpeg 1024w\" sizes=\"(max-width: 1230px) 100vw, 1230px\" \/><\/p>\n<p><strong><em>Note<\/em><\/strong><em>: Use a proper regex pattern instead of the default pattern to further restrict access to services within your domain (including subdomains). You can find the available regex patterns using the following path: <\/em><strong><em>CAS installation Directory -&gt; WEB-INF -&gt; classes -&gt; services<\/em><\/strong><em>.<\/em><\/p>\n","protected":false},"featured_media":0,"parent":47681,"menu_order":2,"comment_status":"closed","ping_status":"closed","template":"","doc_tag":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v19.0 (Yoast SEO v22.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>SSO | CAS-Based SSO Framework | Ephesoft Docs<\/title>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSO | CAS-Based SSO Framework\" \/>\n<meta property=\"og:description\" content=\"SSO (Single Sign-On) is a mechanism of\u00a0access control\u00a0that can be applied on multiple related but independent\u00a0software\u00a0systems. This way, a user\u00a0logs [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/\" \/>\n<meta property=\"og:site_name\" content=\"Ephesoft Docs\" \/>\n<meta property=\"article:modified_time\" content=\"2020-12-03T21:48:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/\",\"url\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/\",\"name\":\"SSO | CAS-Based SSO Framework | Ephesoft Docs\",\"isPartOf\":{\"@id\":\"https:\/\/ephesoft.com\/docs\/#website\"},\"datePublished\":\"2018-04-10T17:10:06+00:00\",\"dateModified\":\"2020-12-03T21:48:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ephesoft.com\/docs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Transact\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"System Configuration\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"User Connectivity\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Single Sign-On Resources\",\"item\":\"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/\"},{\"@type\":\"ListItem\",\"position\":6,\"name\":\"SSO | CAS-Based SSO Framework\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ephesoft.com\/docs\/#website\",\"url\":\"https:\/\/ephesoft.com\/docs\/\",\"name\":\"Ephesoft Docs\",\"description\":\"Intelligent Document Processing Made Easy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ephesoft.com\/docs\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SSO | CAS-Based SSO Framework | Ephesoft Docs","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"SSO | CAS-Based SSO Framework","og_description":"SSO (Single Sign-On) is a mechanism of\u00a0access control\u00a0that can be applied on multiple related but independent\u00a0software\u00a0systems. This way, a user\u00a0logs [&hellip;]","og_url":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/","og_site_name":"Ephesoft Docs","article_modified_time":"2020-12-03T21:48:11+00:00","og_image":[{"url":"https:\/\/ephesoft.com\/docs\/wp-content\/uploads\/2018\/04\/c-users-ephesoft-appdata-local-microsoft-windows-1-28.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/","url":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/","name":"SSO | CAS-Based SSO Framework | Ephesoft Docs","isPartOf":{"@id":"https:\/\/ephesoft.com\/docs\/#website"},"datePublished":"2018-04-10T17:10:06+00:00","dateModified":"2020-12-03T21:48:11+00:00","breadcrumb":{"@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/sso-cas-based-sso-framework\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ephesoft.com\/docs\/"},{"@type":"ListItem","position":2,"name":"Transact","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/"},{"@type":"ListItem","position":3,"name":"System Configuration","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/"},{"@type":"ListItem","position":4,"name":"User Connectivity","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/"},{"@type":"ListItem","position":5,"name":"Single Sign-On Resources","item":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/"},{"@type":"ListItem","position":6,"name":"SSO | CAS-Based SSO Framework"}]},{"@type":"WebSite","@id":"https:\/\/ephesoft.com\/docs\/#website","url":"https:\/\/ephesoft.com\/docs\/","name":"Ephesoft Docs","description":"Intelligent Document Processing Made Easy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ephesoft.com\/docs\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"comment_count":0,"_links":{"self":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/15018"}],"collection":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/comments?post=15018"}],"version-history":[{"count":0,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/15018\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/47681"}],"next":[{"title":"Single Sign On","link":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/single-sign-on\/","href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/1291"}],"prev":[{"title":"SAML SSO | Multiple Groups Support","link":"https:\/\/ephesoft.com\/docs\/products\/transact\/configurations\/user-connectivity\/single-sign-on-resources\/saml-sso-multiple-groups-support\/","href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/docs\/15055"}],"wp:attachment":[{"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/media?parent=15018"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/ephesoft.com\/docs\/wp-json\/wp\/v2\/doc_tag?post=15018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}