From: Abhijit Gaikwad Sent: Tuesday, November 24, 2015 4:39 PM To: [email protected] Subject: RE: [cas-user] CAS 4.1.1 Google Apps SAML issue
Hello, I saw the release of CAS 4.1.2 and tried using the skew allowance but it still doesn't work for me. I still get the your credentials have expired. I noticed two things: 1. Only one of the two NotOnOrAfter values get skewed. The other one is still set to the current time. On our production setup CAS 3.5.1 both values get increased by a year. I suspect that is the issue and may be you guys could skew both? <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> </samlp:Status> <Assertion ID="<<skdjfskjsdfslkjlksjdlfjskd>>" IssueInstant="2003-04-17T00:46:02.000Z" Version="2.0"> <Issuer>https://www.opensaml.org/IDP</Issuer<https://www.opensaml.org/IDP%3c/Issuer>> <Subject> <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"><<personDetails>></NameID> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <SubjectConfirmationData InResponseTo="<<somerandomstringlksjdlfkjsflksdjflks>>" NotOnOrAfter="2015-11-24T15:39:00.000Z" Recipient="https://www.google.com/a/<<mydomain>>/acs<https://www.google.com/a/%3c%3cmydomain%3e%3e/acs>"/> </SubjectConfirmation> </Subject> <Conditions NotBefore="2003-04-17T00:46:02.000Z" NotOnOrAfter="2015-11-24T15:41:00.000Z"> <AudienceRestriction> <Audience>https://www.google.com/a/<<mydomain>>/acs</Audience<https://www.google.com/a/%3c%3cmydomain%3e%3e/acs%3c/Audience>> </AudienceRestriction> </Conditions> <AuthnStatement AuthnInstant="2015-11-24T15:39:00.000Z"> <AuthnContext> <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef> </AuthnContext> </AuthnStatement> </Assertion> </samlp:Response> 2. The skew value is being subtracted from the current time. So instead of adding say 2 seconds, 2 seconds get subtracted from current time. I am not sure if that was the intended purpose, I got around that by adding a negative skep in test (-120) Help will be greatly appreciated. Thanks, --- Abhijit Gaikwad Applications Programmer | [email protected]<mailto:[email protected]> From: Abhijit Gaikwad [mailto:[email protected]] Sent: Monday, November 09, 2015 1:16 PM To: [email protected]<mailto:[email protected]> Subject: RE: [cas-user] CAS 4.1.1 Google Apps SAML issue Thanks Misagh, Created an issue for it on github: https://github.com/Jasig/cas/issues/1266 --- Abhijit Gaikwad Applications Programmer | [email protected]<mailto:[email protected]> From: Misagh Moayyed [mailto:[email protected]] Sent: Monday, November 09, 2015 12:33 PM To: [email protected]<mailto:[email protected]> Subject: RE: [cas-user] CAS 4.1.1 Google Apps SAML issue Looks like there is a skewAllowance setting for SAML1 but not for SAML2. Do file an issue please. From: Abhijit Gaikwad [mailto:[email protected]] Sent: Monday, November 9, 2015 9:31 AM To: [email protected]<mailto:[email protected]> Subject: [cas-user] CAS 4.1.1 Google Apps SAML issue Hello, We are working on deploying CAS 4.1.1 to production and were trying to get google apps for education SSO to work. Unfortunately I get a "Google Apps - This service cannot be accessed because your login credentials have expired. Please log in and try again." Error from google. Looking around it seemed to be an issue with clocks set on servers, but I have confirmed the clock and ntp is configured correctly on the server. Looking at the saml response I noticed "NotOnOrAfter="2015-11-09T09:59:14.000Z"" is set to the current time. Which if I understand correctly means by the time it makes it to google a second has passed and the credentials have expired. We have CAS 3.5.x in production and working and looking at the saml response from it "NotOnOrAfter="2016-11-09T10:03:00Z"" the date is set to 1 year ahead so the credentials don't expire by the time it makes it to google's servers. (The date I was able to confirm both of these behavious in code: 4.1.x: https://github.com/Jasig/cas/blob/master/cas-server-support-saml-googleapps/src/main/java/org/jasig/cas/support/saml/authentication/principal/GoogleAccountsServiceResponseBuilder.java#L97 3.5.x: https://github.com/Jasig/cas/blob/3.5.x/cas-server-core/src/main/java/org/jasig/cas/authentication/principal/GoogleAccountsService.java#L178 Looking at the forums it seems appears the above configuration is working for people, although I don't see how it would if NotOnOrAfter is set to a time 1 second is the past. Am I missing something here? Any guidance will be highly appreciated. Thanks, --- Abhijit Gaikwad Applications Programmer | [email protected]<mailto:[email protected]> -- You are currently subscribed to [email protected]<mailto:[email protected]> as: [email protected]<mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected]<mailto:[email protected]> as: [email protected]<mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected]<mailto:[email protected]> as: [email protected]<mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
