Not a client issue. More likely, you’re missing this in your CAS configuration:
https://jasig.github.io/cas/4.0.x/protocol/SAML-Protocol.html#saml-id-generator From: [email protected] [mailto:[email protected]] On Behalf Of Robert Sent: Tuesday, January 12, 2016 12:24 PM To: CAS Community <[email protected]> Subject: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client behavior Looking for some help with an odd situation that we are seeing with our local CAS install. Install background: * CAS 4.0.6 * Tomcat 7 * RHEL 6 * added dependencies * memcached * ldap support * jdbc support * saml support Implementation works fine for SAML 1.1 attribute release to almost all clients, but an external vendor is having issues with using JBoss and java-cas-client. JBoss is configured to use CAS client with the following web.xml configuration: <!-- CAS FILTERS --> <filter> <filter-name>CAS Authentication Filter</filter-name> <filter-class>org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>https://casauth/cas/login <https://casauth/cas/login%3c/param-value> </param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>https://service:8443 <https://service:8443%3c/param-value> </param-value> </init-param> </filter> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class>org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>https://casauth/cas <https://casauth/cas%3c/param-value> </param-value> </init-param> <init-param> <param-name>serverName</param-name> <param-value>https://service:8443 <https://service:8443%3c/param-value> </param-value> </init-param> <init-param> <param-name>tolerance</param-name> <param-value>10000</param-value> </init-param> <init-param> <param-name>redirectAfterValidation</param-name> <param-value>true</param-value> </init-param> </filter> ...snip... <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>*.jsp</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>*.do</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Authentication Filter</filter-name> <url-pattern>*.jsp</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Authentication Filter</filter-name> <url-pattern>*.do</url-pattern> </filter-mapping> The odd behaviour is that the client seems to be making the following requests: GET https://casauth/cas/login?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F POST https://casauth/cas/login;jsessionid=82EA6DE4A504E1C9C973B7C9D42F8FA5?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F In the corresponding CAS log I see the expected user authentication vs ldap, but when the system attempts to generate a corresponding service ticket request I see the following warning: WARN [org.jasig.cas.CentralAuthenticationServiceImpl] - <Cannot create service ticket because the key [org.jasig.cas.support.saml.authentication.principal.SamlService] for service [https://service:8443/HelpDesk/] is not linked to a ticket id generator> INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN ============================================================= WHO: user WHAT: https://service:8443/HelpDesk/ ACTION: SERVICE_TICKET_NOT_CREATED APPLICATION: CAS WHEN: ---- CLIENT IP ADDRESS: ---- SERVER IP ADDRESS: casauth ============================================================= This is odd as all other clients using SAML have no issues (php, Google Apps, etc..), but they all use cas/login?service=xxx and then cas/samlValidate?target=xxx&SAMLart=st. The fact that the java client sends TARGET to cas/login seems to be the obvious cause, but that seems to be the default behavior of that client. I would expect to see TARGET used at cas/samlValidate. Is there something the vendor has configured incorrectly in the web.xml? Or should I be looking in the configuration of our CAS instance? -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] <mailto:[email protected]> . Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
