├── .gitignore
├── Dockerfile
├── LICENSE
├── README.md
├── deployerConfigContext.xml
└── mysql-connector-java-5.1.28-bin.jar


/.gitignore:
--------------------------------------------------------------------------------
1 | .DS_Store
2 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM wnameless/mysql-phpmyadmin
 2 | 
 3 | MAINTAINER Wei-Ming Wu <wnameless@gmail.com>
 4 | 
 5 | # Install libfuse2
 6 | RUN apt-get install -y libfuse2; \
 7 | 	cd /tmp; \
 8 | 	apt-get download fuse; \
 9 | 	dpkg-deb -x fuse_* .; \
10 | 	dpkg-deb -e fuse_*; \
11 | 	rm fuse_*.deb; \
12 | 	echo -en '#!/bin/bash\nexit 0\n' > DEBIAN/postinst; \
13 | 	dpkg-deb -b . /fuse.deb; \
14 | 	dpkg -i /fuse.deb
15 | 
16 | # Install Java 7
17 | RUN apt-get install -y openjdk-7-jdk
18 | 
19 | # Install Tomcat 7
20 | RUN apt-get install -y tomcat7 tomcat7-admin
21 | RUN sed -i "s#</tomcat-users>##g" /etc/tomcat7/tomcat-users.xml; \
22 | 	echo '  <role rolename="manager-gui"/>' >>  /etc/tomcat7/tomcat-users.xml; \
23 | 	echo '  <role rolename="manager-script"/>' >>  /etc/tomcat7/tomcat-users.xml; \
24 | 	echo '  <role rolename="manager-jmx"/>' >>  /etc/tomcat7/tomcat-users.xml; \
25 | 	echo '  <role rolename="manager-status"/>' >>  /etc/tomcat7/tomcat-users.xml; \
26 | 	echo '  <role rolename="admin-gui"/>' >>  /etc/tomcat7/tomcat-users.xml; \
27 | 	echo '  <role rolename="admin-script"/>' >>  /etc/tomcat7/tomcat-users.xml; \
28 | 	echo '  <user username="admin" password="admin" roles="manager-gui, manager-script, manager-jmx, manager-status, admin-gui, admin-script"/>' >>  /etc/tomcat7/tomcat-users.xml; \
29 | 	echo '</tomcat-users>' >> /etc/tomcat7/tomcat-users.xml
30 | 
31 | # Configure https
32 | RUN sed -i "s#</Server>##g" /etc/tomcat7/server.xml; \
33 | 	sed -i "s#  </Service>##g" /etc/tomcat7/server.xml; \
34 | 	echo '    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="/usr/share/tomcat7/.keystore" keystorePass="tomcat_admin" />' >> /etc/tomcat7/server.xml; \
35 | 	echo '  </Service>' >> /etc/tomcat7/server.xml; \
36 | 	echo '</Server>' >> /etc/tomcat7/server.xml
37 | 
38 | # Install CAS server
39 | RUN cd /tmp; \
40 | 	wget http://downloads.jasig.org/cas/cas-server-3.5.2-release.tar.gz; \
41 | 	tar xzvf cas-server-3.5.2-release.tar.gz; \
42 |     cp cas-server-3.5.2/modules/cas-server-webapp-3.5.2.war /var/lib/tomcat7/webapps/cas.war; \
43 |     service tomcat7 start; \
44 |     sleep 10; \
45 |     service tomcat7 stop; \
46 |     cp cas-server-3.5.2/modules/cas-server-support-jdbc-3.5.2.jar /var/lib/tomcat7/webapps/cas/WEB-INF/lib
47 | 
48 | # Create CAS authentication DB
49 | RUN chmod 1777 /tmp; \
50 | 	mysqld & \
51 | 	sleep 5; \
52 | 	echo "CREATE DATABASE cas" | mysql -u root; \
53 | 	echo "CREATE TABLE cas_users (id INT AUTO_INCREMENT NOT NULL, username VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_bin NOT NULL, password VARCHAR(255) CHARACTER SET utf8 COLLATE utf8_bin NOT NULL, PRIMARY KEY (id), UNIQUE KEY (username))"| mysql -u root -D cas; \
54 | 	echo "INSERT INTO cas_users (username, password) VALUES ('guest', '084e0343a0486ff05530df6c705c8bb4')" | mysql -u root -D cas; \
55 | 	sleep 10
56 | 
57 | # Replace CAS deployerConfigContext.xml & install MySQL driver
58 | ADD deployerConfigContext.xml /
59 | ADD mysql-connector-java-5.1.28-bin.jar /
60 | RUN mv deployerConfigContext.xml /var/lib/tomcat7/webapps/cas/WEB-INF/deployerConfigContext.xml; \
61 | 	mv mysql-connector-java-5.1.28-bin.jar /var/lib/tomcat7/webapps/cas/WEB-INF/lib
62 | 
63 | EXPOSE 22
64 | EXPOSE 80
65 | EXPOSE 3306
66 | EXPOSE 8080
67 | EXPOSE 8443
68 | 
69 | CMD chmod 1777 /tmp; \
70 | 	mysqld_safe & \
71 | 	service apache2 start; \
72 | 	[ ! -f /usr/share/tomcat7/.keystore ] && printf tomcat_admin\\ntomcat_admin\\n\\n\\n\\n\\n\\n\\ny\\ntomcat_admin\\ntomcat_admin\\n | keytool -genkey -alias tomcat -keyalg RSA -keystore /usr/share/tomcat7/.keystore; \
73 | 	service tomcat7 start; \
74 | 	/usr/sbin/sshd -D
75 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright [2014] [Wei-Ming Wu]
 2 | 
 3 | Licensed under the Apache License, Version 2.0 (the "License");
 4 | you may not use this file except in compliance with the License.
 5 | You may obtain a copy of the License at
 6 | 
 7 |     http://www.apache.org/licenses/LICENSE-2.0
 8 | 
 9 | Unless required by applicable law or agreed to in writing, software
10 | distributed under the License is distributed on an "AS IS" BASIS,
11 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | See the License for the specific language governing permissions and
13 | limitations under the License.
14 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | docker-cas_mysql
 2 | ============================
 3 | 
 4 | ```
 5 | docker pull wnameless/cas-mysql
 6 | ```
 7 | 
 8 | Run with 22, 80, 8080, 8443 and 3306 ports opened:
 9 | ```
10 | docker run -d -p 49160:22 -p 49161:80 -p 49162:8080 -p 49163:8443 -p 49164:3306 wnameless/cas-mysql
11 | ```
12 | 
13 | Login the CAS server https://localhost:49163/cas/login with following credential:
14 | ```
15 | username: guest
16 | password: guest
17 | ```
18 | It's just a demo account. You can create more account by phpMyAdmin.
19 | Be aware that all passwords suppose to be hashed by MD5.
20 | 
21 | Open http://localhost:49161/phpmyadmin in your browser with following credential:
22 | ```
23 | username: root
24 | password:
25 | ```
26 | 
27 | Open Tomcat web admin http://localhost:49162/manager/html with following credential:
28 | ```
29 | username: admin
30 | password: admin
31 | ```
32 | 
33 | Login by SSH
34 | ```
35 | ssh root@localhost -p 49160
36 | password: admin
37 | ```
38 | 


--------------------------------------------------------------------------------
/deployerConfigContext.xml:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="UTF-8"?>
  2 | <!--
  3 | 
  4 |     Licensed to Jasig under one or more contributor license
  5 |     agreements. See the NOTICE file distributed with this work
  6 |     for additional information regarding copyright ownership.
  7 |     Jasig licenses this file to you under the Apache License,
  8 |     Version 2.0 (the "License"); you may not use this file
  9 |     except in compliance with the License.  You may obtain a
 10 |     copy of the License at the following location:
 11 | 
 12 |       http://www.apache.org/licenses/LICENSE-2.0
 13 | 
 14 |     Unless required by applicable law or agreed to in writing,
 15 |     software distributed under the License is distributed on an
 16 |     "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 17 |     KIND, either express or implied.  See the License for the
 18 |     specific language governing permissions and limitations
 19 |     under the License.
 20 | 
 21 | -->
 22 | <!--
 23 | 	| deployerConfigContext.xml centralizes into one file some of the declarative configuration that
 24 | 	| all CAS deployers will need to modify.
 25 | 	|
 26 | 	| This file declares some of the Spring-managed JavaBeans that make up a CAS deployment.  
 27 | 	| The beans declared in this file are instantiated at context initialization time by the Spring 
 28 | 	| ContextLoaderListener declared in web.xml.  It finds this file because this
 29 | 	| file is among those declared in the context parameter "contextConfigLocation".
 30 | 	|
 31 | 	| By far the most common change you will need to make in this file is to change the last bean
 32 | 	| declaration to replace the default SimpleTestUsernamePasswordAuthenticationHandler with
 33 | 	| one implementing your approach for authenticating usernames and passwords.
 34 | 	+-->
 35 | 
 36 | <beans xmlns="http://www.springframework.org/schema/beans"
 37 |        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 38 |        xmlns:p="http://www.springframework.org/schema/p"
 39 |        xmlns:tx="http://www.springframework.org/schema/tx"
 40 |        xmlns:sec="http://www.springframework.org/schema/security"
 41 |        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
 42 |        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
 43 |        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
 44 | 	<!--
 45 | 		| This bean declares our AuthenticationManager.  The CentralAuthenticationService service bean
 46 | 		| declared in applicationContext.xml picks up this AuthenticationManager by reference to its id, 
 47 | 		| "authenticationManager".  Most deployers will be able to use the default AuthenticationManager
 48 | 		| implementation and so do not need to change the class of this bean.  We include the whole
 49 | 		| AuthenticationManager here in the userConfigContext.xml so that you can see the things you will
 50 | 		| need to change in context.
 51 | 		+-->
 52 | 	<bean id="authenticationManager"
 53 | 		class="org.jasig.cas.authentication.AuthenticationManagerImpl">
 54 | 		
 55 | 		<!-- Uncomment the metadata populator to allow clearpass to capture and cache the password
 56 | 		     This switch effectively will turn on clearpass.
 57 | 		<property name="authenticationMetaDataPopulators">
 58 | 		   <list>
 59 | 		      <bean class="org.jasig.cas.extension.clearpass.CacheCredentialsMetaDataPopulator">
 60 | 		         <constructor-arg index="0" ref="credentialsCache" />
 61 | 		      </bean>
 62 | 		   </list>
 63 | 		</property>
 64 | 		 -->
 65 | 		
 66 | 		<!--
 67 | 			| This is the List of CredentialToPrincipalResolvers that identify what Principal is trying to authenticate.
 68 | 			| The AuthenticationManagerImpl considers them in order, finding a CredentialToPrincipalResolver which 
 69 | 			| supports the presented credentials.
 70 | 			|
 71 | 			| AuthenticationManagerImpl uses these resolvers for two purposes.  First, it uses them to identify the Principal
 72 | 			| attempting to authenticate to CAS /login .  In the default configuration, it is the DefaultCredentialsToPrincipalResolver
 73 | 			| that fills this role.  If you are using some other kind of credentials than UsernamePasswordCredentials, you will need to replace
 74 | 			| DefaultCredentialsToPrincipalResolver with a CredentialsToPrincipalResolver that supports the credentials you are
 75 | 			| using.
 76 | 			|
 77 | 			| Second, AuthenticationManagerImpl uses these resolvers to identify a service requesting a proxy granting ticket. 
 78 | 			| In the default configuration, it is the HttpBasedServiceCredentialsToPrincipalResolver that serves this purpose. 
 79 | 			| You will need to change this list if you are identifying services by something more or other than their callback URL.
 80 | 			+-->
 81 | 		<property name="credentialsToPrincipalResolvers">
 82 | 			<list>
 83 | 				<!--
 84 | 					| UsernamePasswordCredentialsToPrincipalResolver supports the UsernamePasswordCredentials that we use for /login 
 85 | 					| by default and produces SimplePrincipal instances conveying the username from the credentials.
 86 | 					| 
 87 | 					| If you've changed your LoginFormAction to use credentials other than UsernamePasswordCredentials then you will also
 88 | 					| need to change this bean declaration (or add additional declarations) to declare a CredentialsToPrincipalResolver that supports the
 89 | 					| Credentials you are using.
 90 | 					+-->
 91 | 				<bean class="org.jasig.cas.authentication.principal.UsernamePasswordCredentialsToPrincipalResolver" >
 92 | 					<property name="attributeRepository" ref="attributeRepository" />
 93 | 				</bean>
 94 | 				<!--
 95 | 					| HttpBasedServiceCredentialsToPrincipalResolver supports HttpBasedCredentials.  It supports the CAS 2.0 approach of
 96 | 					| authenticating services by SSL callback, extracting the callback URL from the Credentials and representing it as a
 97 | 					| SimpleService identified by that callback URL.
 98 | 					|
 99 | 					| If you are representing services by something more or other than an HTTPS URL whereat they are able to
100 | 					| receive a proxy callback, you will need to change this bean declaration (or add additional declarations).
101 | 					+-->
102 | 				<bean
103 | 					class="org.jasig.cas.authentication.principal.HttpBasedServiceCredentialsToPrincipalResolver" />
104 | 			</list>
105 | 		</property>
106 | 
107 | 		<!--
108 | 			| Whereas CredentialsToPrincipalResolvers identify who it is some Credentials might authenticate, 
109 | 			| AuthenticationHandlers actually authenticate credentials.  Here we declare the AuthenticationHandlers that
110 | 			| authenticate the Principals that the CredentialsToPrincipalResolvers identified.  CAS will try these handlers in turn
111 | 			| until it finds one that both supports the Credentials presented and succeeds in authenticating.
112 | 			+-->
113 | 		<property name="authenticationHandlers">
114 | 			<list>
115 | 				<!--
116 | 					| This is the authentication handler that authenticates services by means of callback via SSL, thereby validating
117 | 					| a server side SSL certificate.
118 | 					+-->
119 | 				<bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
120 | 					p:httpClient-ref="httpClient" />
121 | 				<!--
122 | 					| This is the authentication handler declaration that every CAS deployer will need to change before deploying CAS 
123 | 					| into production.  The default SimpleTestUsernamePasswordAuthenticationHandler authenticates UsernamePasswordCredentials
124 | 					| where the username equals the password.  You will need to replace this with an AuthenticationHandler that implements your
125 | 					| local authentication strategy.  You might accomplish this by coding a new such handler and declaring
126 | 					| edu.someschool.its.cas.MySpecialHandler here, or you might use one of the handlers provided in the adaptors modules.
127 | 					+-->
128 | 				<!-- <bean 
129 | 					class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" /> -->
130 | 				<bean class="org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler">
131 |                     <property name="dataSource">
132 |                         <bean id="dataSource"
133 |                             class="org.springframework.jdbc.datasource.DriverManagerDataSource">
134 |                             <property name="driverClassName" value="com.mysql.jdbc.Driver" />
135 |                             <property name="url" value="jdbc:mysql://localhost:3306/cas?useUnicode=true&amp;characterEncoding=utf-8" />
136 |                             <property name="username" value="root" />
137 |                             <property name="password" value="" />
138 |                         </bean>
139 |                     </property>
140 |                     <property name="sql" value="select password from cas_users where username=?" />
141 |                     <property name="passwordEncoder">
142 |                         <bean class="org.jasig.cas.authentication.handler.DefaultPasswordEncoder">
143 |                             <constructor-arg value="MD5" />
144 |                         </bean>
145 |                     </property>
146 |                 </bean>
147 | 			</list>
148 | 		</property>
149 | 	</bean>
150 | 
151 | 
152 | 	<!--
153 | 	This bean defines the security roles for the Services Management application.  Simple deployments can use the in-memory version.
154 | 	More robust deployments will want to use another option, such as the Jdbc version.
155 | 	
156 | 	The name of this should remain "userDetailsService" in order for Spring Security to find it.
157 | 	 -->
158 |     <!-- <sec:user name="@@THIS SHOULD BE REPLACED@@" password="notused" authorities="ROLE_ADMIN" />-->
159 | 
160 |     <sec:user-service id="userDetailsService">
161 |         <sec:user name="@@THIS SHOULD BE REPLACED@@" password="notused" authorities="ROLE_ADMIN" />
162 |     </sec:user-service>
163 | 	
164 | 	<!-- 
165 | 	Bean that defines the attributes that a service may return.  This example uses the Stub/Mock version.  A real implementation
166 | 	may go against a database or LDAP server.  The id should remain "attributeRepository" though.
167 | 	 -->
168 | 	<bean id="attributeRepository"
169 | 		class="org.jasig.services.persondir.support.StubPersonAttributeDao">
170 | 		<property name="backingMap">
171 | 			<map>
172 | 				<entry key="uid" value="uid" />
173 | 				<entry key="eduPersonAffiliation" value="eduPersonAffiliation" /> 
174 | 				<entry key="groupMembership" value="groupMembership" />
175 | 			</map>
176 | 		</property>
177 | 	</bean>
178 | 	
179 | 	<!-- 
180 | 	Sample, in-memory data store for the ServiceRegistry. A real implementation
181 | 	would probably want to replace this with the JPA-backed ServiceRegistry DAO
182 | 	The name of this bean should remain "serviceRegistryDao".
183 | 	 -->
184 | 	<bean
185 | 		id="serviceRegistryDao"
186 |         class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl">
187 |             <property name="registeredServices">
188 |                 <list>
189 |                     <bean class="org.jasig.cas.services.RegexRegisteredService">
190 |                         <property name="id" value="0" />
191 |                         <property name="name" value="HTTP and IMAP" />
192 |                         <property name="description" value="Allows HTTP(S) and IMAP(S) protocols" />
193 |                         <property name="serviceId" value="^(https?|imaps?)://.*" />
194 |                         <property name="evaluationOrder" value="10000001" />
195 |                     </bean>
196 |                     <!--
197 |                     Use the following definition instead of the above to further restrict access
198 |                     to services within your domain (including subdomains).
199 |                     Note that example.com must be replaced with the domain you wish to permit.
200 |                     -->
201 |                     <!--
202 |                     <bean class="org.jasig.cas.services.RegexRegisteredService">
203 |                         <property name="id" value="1" />
204 |                         <property name="name" value="HTTP and IMAP on example.com" />
205 |                         <property name="description" value="Allows HTTP(S) and IMAP(S) protocols on example.com" />
206 |                         <property name="serviceId" value="^(https?|imaps?)://([A-Za-z0-9_-]+\.)*example\.com/.*" />
207 |                         <property name="evaluationOrder" value="0" />
208 |                     </bean>
209 |                     -->
210 |                 </list>
211 |             </property>
212 |         </bean>
213 | 
214 |   <bean id="auditTrailManager" class="com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager" />
215 |   
216 |   <bean id="healthCheckMonitor" class="org.jasig.cas.monitor.HealthCheckMonitor">
217 |     <property name="monitors">
218 |       <list>
219 |         <bean class="org.jasig.cas.monitor.MemoryMonitor"
220 |             p:freeMemoryWarnThreshold="10" />
221 |         <!--
222 |           NOTE
223 |           The following ticket registries support SessionMonitor:
224 |             * DefaultTicketRegistry
225 |             * JpaTicketRegistry
226 |           Remove this monitor if you use an unsupported registry.
227 |         -->
228 |         <bean class="org.jasig.cas.monitor.SessionMonitor"
229 |             p:ticketRegistry-ref="ticketRegistry"
230 |             p:serviceTicketCountWarnThreshold="5000"
231 |             p:sessionCountWarnThreshold="100000" />
232 |       </list>
233 |     </property>
234 |   </bean>
235 | </beans>


--------------------------------------------------------------------------------
/mysql-connector-java-5.1.28-bin.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/wnameless/docker-cas_mysql/48fd5de6e4547dd050737d6979afdf20d8d1ae48/mysql-connector-java-5.1.28-bin.jar


--------------------------------------------------------------------------------