Hi Joshua, Note this is based solely on my experience as a CAS admin at my institution. I hope others will add to the conversation.
Your risk example is correct because it’s basically making any app that wants to use your CAS service a seemingly institutionally-supported resource, which can lead to the type of scenario you describe, but it also risks releasing sensitive user attributes (think FERPA) depending on how you set up your attribute release policy; users would only need to access the link and have an existing CAS session—no input required. The more university specific approach is better, but relies on proper controls and vetting where your DNS is managed. Can you see a scenario where a subdomain might get provisioned that you would not want using CAS services? A non-security factor on a catch all registration is that each service may have different attribute requirements, therefore you’d want to have a separate registration and attribute release policy. I’ve found CAS to be very good at renaming and transforming attributes to meet the needs of different services. Again, this is just my perspective as long-time user of CAS. On Wed, Feb 15, 2023 at 8:55 PM Joshua Leger <[email protected]> wrote: > Hello, > > I have recently taken over the CAS instance at my university and have a > question about security for the regex in CasRegisteredService. > > My understanding is that you wouldn't want to set up a service with a > serviceId of "^https://.+"; because an attacker could make a fake website > that seems legitimate because it uses our actual CAS server to authenticate > and then convinces the user to input sensitive information. If my > university owns the university.edu domain though, could I set up a regex > like "^https?://[^/]*university\.edu/.*" that allows all subdomains safely > because an attacker couldn't make their own subdomain that they control? > Are there any other risks of the "^https://.+"; serviceId that I haven't > thought of? > > Thanks! > > -- > - Website: https://apereo.github.io/cas > - Gitter Chatroom: https://gitter.im/apereo/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/9d329790-70fd-4e84-b22d-29a3192cd304n%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/9d329790-70fd-4e84-b22d-29a3192cd304n%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAEdMQHU6NNAQXuVzkBXy%3D%3DANcfbZr6NX-3ykcd41oyP2s-wofg%40mail.gmail.com.
