Configuring LifeRay and CAS to work with LDAP

I saw many tutorials on CAS, Liferay and LDAP – but unfortunetly, none of them worked for me. So I decided to document what does work (at least for me).
Note that my environment is based on LifeRay 6.0.5 and CAS 3.5.1.

1. Configure Tomcat for SSL. I have used port 443. You can read all about it here
1. After creating the certificates, I just ended up with adding the following tag in TOMCAT_HOME/conf/server.xml

 
<Connector
           port="443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/root/.keystore" keystorePass="password"
           clientAuth="false" sslProtocol="TLS"/>  

2. IMPORTANT I did not manage to make CAS work with a self signed certificate, so I’ve used a temporary free one.
2. Configure LifeRay for LDAP
   1. Login to LifeRay
   2. Go to the Control Panel–>Settings–>Authentication–>LDAP
   3. Ensure the “Enabled” check box is selected
   4. I strongly suggest enabling the “Import” checkbox and ensure Import is enabled for server startup.
   5. Add a server
   6. Fill in the LDAP server details (it’s easy to check them with an LDAP browser like jxplorer)
   7. Save your configuration
   8. I usually restart Tomcat after that change, and view the log to see all users were successfully imported
3. Build CAS
   1. Download CAS (I downloaded it from here)
   2. Unzip the file
   3. Edit the CAS_HOME/cas-server-webapp/pom.xml file and add the following:

   <dependency>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-support-ldap</artifactId>
        <version>3.5.1</version>
   </dependency>
   

   4. Build CAS using maven. The command to run is mvn clean install
4. Deploy CAS
   1. Copy the newly created WAR file from CAS_HOME/cas-server-webapp/target/cas.war to TOMCAT_HOME/webapps
5. Configure CAS for LDAP
   1. Edit the TOMCAT_HOME/webapps/cas/WEB-INF/deployerConfigContext.xml
   2. Add the following at the end of the file (just before the /beans tag)

   <bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource">
     <!-- DO NOT enable JNDI pooling for context sources that perform LDAP bind operations. -->
     <property name="pooled" value="false"/>
    
     <!--
       Although multiple URLs may defined, it's strongly recommended to avoid this configuration
       since the implementation attempts hosts in sequence and requires a connection timeout
       prior to attempting the next host, which incurs unacceptable latency on node failure.
       A proper HA setup for LDAP directories should use a single virtual host that maps to multiple
       real hosts using a hardware load balancer.
     -->
     <property name="url" value="ldap://LDAP_SERVER:389" />
    
     <!--
       Manager credentials are only required if your directory does not support anonymous searches.
       Never provide these credentials for FastBindLdapAuthenticationHandler since the user's
       credentials are used for the bind operation.
     -->
     <property name="userDn" value="cn=Manager"/>
     <property name="password" value="test"/>
    
     <!-- Place JNDI environment properties here. -->
     <property name="baseEnvironmentProperties">
       <map>
         <!-- Three seconds is an eternity to users. -->
         <entry key="com.sun.jndi.ldap.connect.timeout" value="3000" />
         <entry key="com.sun.jndi.ldap.read.timeout" value="3000" />
    
         <!-- Explained at http://download.oracle.com/javase/1.3/docs/api/javax/naming/Context.html#SECURITY_AUTHENTICATION -->
         <entry key="java.naming.security.authentication" value="simple" />
       </map>
     </property>
   </bean>
   

   3. Add the following under the list tag of the authenticationHandlers tag

         <bean class="org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler"
   p:filter="mail=%u"
   p:searchBase="ou=people,dc=test,dc=com"
   p:contextSource-ref="contextSource" />
                         </list>
                 </property>
         </bean>
   

6. Configure LifeRay for CAS
1. Login to LifeRay
2. Go to the Control Panel–>Settings–>Authentication–>CAS
3. Ensure the “Enabled” check box is selected
4. Ensure the “LDAP Import” check box is selected
5. Enter the URLs of the CAS server
6. Save
7. Add the following line to TOMCAT_HOME/webapps/ROOT/WEB-INF/classes/system-ext.properties

com.liferay.filters.sso.cas.CASFilter=true

8. Add the following line to TOMCAT_HOME/webapps/ROOT/WEB-INF/classes/portal-ext.properties

auto.login.hooks=com.liferay.portal.security.auth.CASAutoLogin

9. Restart Tomcat

You can now access your LifeRay instance, and get the CAS login instead…