Admin Console

The sections below document the admin console that is available to Gluu Casa administrators after installation. Many of the settings are configured during initial setup. Once Casa and Gluu are properly configured, follow the enable methods section below to "turn on" Casa.

All configuration changes applied via the admin console take effect immediately with no restart or other actions required.

LDAP

This header contains the settings Casa uses to establish a connection to the underlying LDAP. These settings are made by the application installer and there is no need to apply any change afterwards. Update these settings only if the application needs to be tested against a different LDAP Server.

oxd

Casa leverages oxd to faciliate user authentication against its corresponding Gluu Server. oxd installation and configuration is prompted during Casa installation. To change or update details about the oxd server, or to configure and use an existing oxd deployment, navigate to the oxd page in the admin console.

In case of lockout, visit the FAQ document.

oxd Settings

The following settings can be adjusted or viewed via the Casa admin console:

• Connection Type: By default, oxd will connect to its corresponding Gluu Server via localhost ("oxd-server"). If oxd is installed on a standalone server, and has the https-extension enabled, the connection can be made over the web. If oxd-server is being used, a normal value would be localhost/ 8099. If the oxd-https-extension is being used, the value will be something like https://oxd.myorg.com:8443. Learn more in the oxd docs.

• URI of the OpenID Provider (OP): This is the URL of the corresponding Gluu Server where users are sent for authentication, e.g. https://idp.myorg.com.

• Client Name: The name of the OpenID client that Casa uses to facilitate SSO with the Gluu Server.

• Authorization Redirect URI: This is the URL of the Casa dashboard landing page that users are directed to after authentication.

• Post logout URI: The URL of the page that users should be directed to after they log out of Casa, e.g. https://myorg.com.

• oxd ID: Upon setting up the Casa client, the oxd ID will be automatically generated. It will look something like 2d88f886-0a8e-4249-af46-d47da0481349

Enabled Methods

Updates need to be made in both the Gluu Server and Casa to get Casa operational.

Enable Authentication Scripts (Gluu)

The Gluu Server uses interception scripts to implement user authentication. For each type of 2FA credential that should be manageable in Casa, the corresponding authentication script must be enabled in Gluu.

To enable authentication methods in Gluu, open oxTrust and navigate to Configuration > Manage custom scripts. Enable the interception script for each type of 2FA credential that should be manageable in Casa - i.e. u2f, super_gluu, otp, and/or twilio_sms.

To confirm script functionality, or if issues arise, check the troubleshooting doc in the FAQ.

Configure Casa

Once the applicable interception scripts are enabled in Gluu, a Casa admin can enable 2FA mechanisms in the Enable methods interface. Check the box for each type of authentication method users should be able to self-service in Casa. You can assign the handler plugin for each method. Choose "System" to use the default implementation provided by the application.

Warning

It may take up to 2 minutes for a method to appear in the enabled methods list of Casa after its corresponding custom script has been activated in oxTrust.

The System handler plugin supports four authentication methods: - OTP SMS - OTP (handling mobile apps and hard tokens) - security keys - Super Gluu.

Developers can provide their own custom handler plugins that add or override the authentication methods in the System plugin.

In their home page, users will see widgets for every available method. These widgets are listed in decreasing order of ACR level. That is, the first method shown will be that with the highest level assigned in its corresponding interception script, and therefore the most secure.

Important

Once users have enrolled credentials for a specific authentication method (e.g. SMS OTP) in Casa, the administrator cannot deactivate that method.

Testing

A recommended practice is to enable one script in the Gluu Server (like U2F), then enable the associated method in Casa. Test and confirm that enrollment and authentication is working as expected, then continue adding other desired 2FA methods. In an incognito browser, employ a user other than admin to test enrollments each time a new method is added. This will prevent the admin user from being accidentally locked out.

Set Default Authentication Method (Gluu)

With the Casa authentication script enabled in the Gluu Server, OpenID Connect clients can now request Casa authentication (i.e. each user's 2FA preference) using the standard OpenID Connect acr_value.

To make each person's 2FA preference in Casa, the default authentication mechanism for all Gluu logins, navigate to Configuration > Manage Authentication > Default Authentication method and set Default acr and oxTrust acr to casa. Click update to save your changes.

2FA settings

Warning

This feature is only available through the "2FA settings" plugin (requires a valid license to operate).

In the 2FA settings, an admin can specify the minimum number of credentials a user must enroll before they are able to turn on 2FA, and choose from a few predefined policies for when 2FA should be prompted.

To reduce the chance of lockout, we recommend setting a minimum of two (2) strong credentials.

Predefined 2FA policy options include:

• Enforce strong authentication for every login attempt
• Prompt for 2FA when users' location is unrecognized
• Prompt for 2FA when users' device is unrecognized
• Allow the user to set their own strong authentication policy

The default policy is to enforce 2FA for every login attempt. If the admin opts to allow users to manager their own policy, a new widget will appear in the user-facing dashboard as described in the user guide.

Pass reset config

If passwords are being stored in the Gluu Server (and not at an external backend directory server like AD), an admin can give users the ability to reset their password from inside Casa. To enable the password reset functionality, navigate to Pass reset config and click the toggle to ON.

Branding

Most organizations will want to custom brand Casa. Follow our guide to learn more about custom branding Casa.

Logging

Application logs are useful sources of information to diagnose anomalies and understand possible causes of errors if presented. Casa uses the Log4J2 logging framework for this. The severity level for logs can be modified at runtime and requires no restart. For more information about logging, check the FAQ entry.

Reset Users Preference

If a user is locked out for any reason (e.g. lost device, etc.), an admin can navigate to Reset users preference in the admin console to reset the user's preferred method to password. Type the username (or part of) in the text field and then press search. Once the user has been located, click the checkbox and click the Change to password button. The row will become disabled, and a success message will be displayed.

Plugins

Plugins are vehicles to augment the functionalities available by default in Gluu Casa. To learn more about plugins, visit the developer guide.

In this section of the console, the current list of active and dormant plugins is shown. Once an element in the list is selected, a summary of the relevant plugin's metadata is visualized. You can manage the state of plugins as well as remove them.

Click on the "Add a plugin..." button to select a file in your local hard drive that you wish to onboard as a new plugin into your Gluu Casa installation. Account that plugin files must have a specific format and structure as explained here.