Looking for some help with an odd situation that we are seeing with our
local CAS install.
Install background:
- CAS 4.0.6
- Tomcat 7
- RHEL 6
- added dependencies
- memcached
- ldap support
- jdbc support
- saml support
Implementation works fine for SAML 1.1 attribute release to almost all
clients, but an external vendor is having issues with using JBoss and
java-cas-client.
JBoss is configured to use CAS client with the following web.xml
configuration:
<!-- CAS FILTERS -->
<filter>
<filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class>
<init-param>
<param-name>casServerLoginUrl</param-name>
<param-value>https://casauth/cas/login</param-value>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://service:8443</param-value>
</init-param>
</filter>
<filter>
<filter-name>CAS Validation Filter</filter-name>
<filter-class>org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://casauth/cas</param-value>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://service:8443</param-value>
</init-param>
<init-param>
<param-name>tolerance</param-name>
<param-value>10000</param-value>
</init-param>
<init-param>
<param-name>redirectAfterValidation</param-name>
<param-value>true</param-value>
</init-param>
</filter>
...snip...
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
The odd behaviour is that the client seems to be making the following
requests:
GET https://casauth/cas/login?TARGET=
https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F
POST https://casauth/cas/login;jsessionid=82EA6DE4A504E1C9C973B7C9D42F8FA5?
TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F
In the corresponding CAS log I see the expected user authentication vs
ldap, but when the system attempts to generate a corresponding service
ticket request I see the following warning:
WARN [org.jasig.cas.CentralAuthenticationServiceImpl] - <Cannot create
service ticket because the key
[org.jasig.cas.support.saml.authentication.principal.SamlService] for
service [https://service:8443/HelpDesk/] is not linked to a ticket id
generator>
INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] -
<Audit trail record BEGIN
=============================================================
WHO: user
WHAT: https://service:8443/HelpDesk/
ACTION: SERVICE_TICKET_NOT_CREATED
APPLICATION: CAS
WHEN: ----
CLIENT IP ADDRESS: ----
SERVER IP ADDRESS: casauth
=============================================================
This is odd as all other clients using SAML have no issues (php, Google
Apps, etc..), but they all use cas/login?service=xxx and then
cas/samlValidate?target=xxx&SAMLart=st.
The fact that the java client sends TARGET to cas/login seems to be the
obvious cause, but that seems to be the default behavior of that client. I
would expect to see TARGET used at cas/samlValidate.
Is there something the vendor has configured incorrectly in the web.xml?
Or should I be looking in the configuration of our CAS instance?
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
