[GH] (grails-core/fix/cas-single-signout-and-proxy-receptor): Workflow run "CI" is working again!

[GitBox <gi...@apache.org>]

The GitHub Actions job "CI" on grails-core.git/fix/cas-single-signout-and-proxy-receptor has succeeded.
Run started by GitHub user sbglasius (triggered by sbglasius).

Head commit for run:
06d8801b2c225103c27cff25c9ea3b65b9eacec2 / Søren Berg Glasius <so...@glasius.dk>
fix(cas): repair proxy receptor and single sign-out, add integration tests

The CAS plugin had no tests at all, and its only exerciser was a bootRun-only
demo pointed at a hand-run CAS server. Two defects were living in that gap.

Fixes:

* casAuthenticationFilter set proxyReceptorUrl unconditionally. Spring Security
  7.1 rejects a null pattern, so an application that did not configure a proxy
  receptor - the default - failed to start. It is now only set when configured,
  which is how CasAuthenticationFilter expresses that proxy support is off.
  Previously the unguarded assignment produced a matcher for the literal path
  '/**null', quietly giving unconfigured applications a live proxy receptor.

* Single sign-out never worked. The plugin set useSessionFixationPrevention to
  false from doWithSpring, but it declares loadAfter = ['springSecurityCore'],
  so the core plugin had already defined sessionAuthenticationStrategy from the
  original value. The session was still replaced on login, so CAS logout
  requests matched no session. The bean is now redefined from the CAS plugin as
  well, through the same BeanTypeResolver the core plugin uses so an
  application's sessionAuthenticationStrategyBeanClass override still wins.

Behaviour change:

* cas.useSingleSignout now defaults to false. Enabling it disables session
  fixation prevention, which an application should choose deliberately rather
  than inherit. The plugin warns at startup when it is enabled. Documented in
  the CAS configuration reference and in the Grails 8 upgrade guide.

Tests:

grails-test-examples-spring-security-cas-test1 now runs against a real Apereo
CAS server started with Testcontainers, gated on Docker availability, and no
longer needs an externally managed CAS server for bootRun either. An
EnvironmentPostProcessor starts the container and supplies the CAS URLs before
the context is built; the service and proxy callback URLs, which depend on the
port the embedded server binds, are set once the server is up.

Three configurations run via the existing TESTCONFIG idiom: 'cas' (proxy
settings unset), 'casProxy' (full proxy-granting-ticket round trip) and
'casNoSingleSignout' (asserts the new default). Coverage spans the login
handshake, ticket validation, role enforcement, proxy tickets obtained through
AttributePrincipal, and single sign-out. Logout requests are posted from a
cookie-less client, as CAS does, so the filter's behaviour cannot be confused
with the session clearing that a failed authentication would cause anyway.

Also fixes an unrelated pre-existing gap: 'Grails BOM Hibernate7 Micronaut.adoc'
is generated and gitignored but was missing from the rat exclusions, so rat
failed after any docs build.

Report URL: https://github.com/apache/grails-core/actions/runs/32271608967

With regards,
GitHub Actions via GitBox