Installation

Legacy Installation Guide‑ For CAS Versions Prior to 5.0

1. The CAS server is built with Java and requires two core runtime environments:

• JDK (Java Development Kit): Includes the Java Virtual Machine (JVM) to execute Java programs and forms the fundamental runtime base.
• Tomcat (Web Container): Used to host and run the CAS WAR web application.

1. Recommended installation sequence: Install JDK first → then install Tomcat (Tomcat automatically detects the local JDK during setup)

Dependencies

1. JDK

Version: (JDK) Java 17
Direct Link: Java Downloads | Oracle

⚠️ Note: JDK7 is outdated and only compatible with older CAS releases; avoid using it for new‑project deployments.

2. Apache Tomcat

Version: Tomcat (Windows Installer)
Apache Tomcat® – Welcome!

Installation Steps

1. Install JDK
   • Launch the EXE installer; you may set a custom install directory
   • 【Critical】After installation, configure system environment variables: JAVA_HOME and Path, so Tomcat can properly locate your Java runtime
2. Install Tomcat 7
   • Run the setup wizard; it will auto‑detect your pre‑installed JDK
   • Customise Tomcat port (defaults to 8080) and define admin account credentials
   • Options on the final setup screen:
   • Run Apache Tomcat: Check this box to start the Tomcat service automatically once you click Finish
   • Show Readme: You can uncheck this; the documentation is not required for setup
   • Click Finish to complete installation

Configuring SSL/HTTPS for Tomcat

Core requirement: The CAS protocol enforces HTTPS on the server side. Plain HTTP will not work, so you must configure an SSL certificate within Tomcat.

1. Use the built‑in JDK keytool utility to create a JKS keystore (self‑signed certificate)
2. Edit Tomcat’s conf/server.xml file and enable the SSL connector
3. Restart Tomcat and test HTTPS by visiting https://localhost:8443

Generate Self‑Signed Certificate (JKS)

Pre‑requisites

1. Create a folder for certificate storage, example: C:\Keys
2. Launch Command Prompt as Administrator
   > On Windows 7/10/11, writing directly to the root of drive C under a normal CMD session triggers permission‑denied errors.
3. Navigate into the bin folder of your JDK/JRE installation

cd "c:\Program Files\Java\jre\bin"Code language: JavaScript (javascript)

Generic command template (works with modern JDK releases)

keytool -genkey -alias tomcat -keyalg RSA -storepass changeit -keystore c:\Keys\.keystore -validity 36000Code language: CSS (css)

Parameter Reference

Parameter	Description
-genkey	Generate a public‑private key pair
-alias tomcat	Custom alias name for this certificate
-keyalg RSA	Cryptographic algorithm; standard RSA
-storepass changeit	Keystore password (remember this value, you will need it later for Tomcat setup)
-keystore c:\Keys\.keystore	Output path for the generated keystore file
-validity 36000	Certificate validity period in days

Interactive Prompt Input

After running the command, supply the following values step‑by‑step:

1. First and last name: Enter your domain name (any value is fine for lab environments)
2. Organisational unit, organisation, city, state or province, country code (cn)
3. Type y to confirm your entered details
4. Key password: Press Enter directly; reuse the same password as your keystore

Command To Inspect Certificate

keytool -list -keystore "C:\Keys\.keystore"Code language: PHP (php)

Enter your password. Proper output confirms successful certificate creation.

Configure SSL Connector Inside Tomcat server.xml

1. Open Tomcat/conf/server.xml
2. Locate the commented‑out SSL Connector block, uncomment it and fill in your certificate path and keystore password

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
    keystoreFile="C:\Keys\.keystore"
    keystorePass="changeit" />Code language: HTML, XML (xml)

Parameter Breakdown

• port="8443": Tomcat default HTTPS port (standard HTTPS runs on 443; switching to port 443 requires handling port‑binding permissions)
• keystoreFile: Full absolute filesystem path pointing to your generated certificate file
• keystorePass: The keystore password you set earlier with keytool
• clientAuth="false": Client‑side certificate validation disabled (keep false for testing environments)

Validation Procedure

Start Tomcat and open this address in your web browser:
https://127.0.0.1:8443

Browsers flag self‑signed certificates as “Not Secure”; this is expected behaviour. For production deployments you must obtain a valid CA‑signed certificate.

CAS Installation 5.0+

1. Obtain Artifacts

Starting from CAS 5.0+, the traditional war + Tomcat pattern has been dropped. Built on SpringBoot, CAS ships as a self‑contained executable Jar; an external Tomcat instance is no longer required

1. CAS Server

Generate deployment artefact online via CAS Initializr
https://casinitializr.apereo.org

2. CAS Server Deployment Workflow

1. Open CAS Initializr

• Select CAS Version: 7.0.x (latest stable release)
• Check core modules: Core / Web / SSL
• Generate and download cas.war or directly get the standalone cas.jar

Pick one of the two packaging formats:

• Option A (Recommended): Standalone Jar, embeds Tomcat, ready‑to‑run out‑of‑the‑box
• Option B: Legacy WAR package, deployable onto external Tomcat (not recommended)

2. Deploy as Standalone Jar (mainstream approach)
   1) Save the downloaded cas.jar
   2) Create config directory ./etc/cas/config and add file cas.properties
   3) Startup command (Java 17 or newer is mandatory)

java -jar cas.jarCode language: CSS (css)

3. Port and HTTPS notes
   Default embedded Tomcat port: 8443 (HTTPS)
   Newer releases enforce HTTPS by default, matching the specification for older CAS versions.

3. Access URL

https://127.0.0.1:8443/casCode language: JavaScript (javascript)

Installation