Our uniqueIdGenerators.xml does have the samlServiceTicketUniqueidGenerator
bean. The config for reference:
<!-- ID Generators -->
<bean id="ticketGrantingTicketUniqueIdGenerator"
class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
c:maxLength="50"
c:suffix="${host.name}" />
<bean id="serviceTicketUniqueIdGenerator"
class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
c:maxLength="20"
c:suffix="${host.name}" />
<bean id="loginTicketUniqueIdGenerator"
class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
c:maxLength="30"
c:suffix="${host.name}" />
<bean id="proxy20TicketUniqueIdGenerator"
class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator"
c:maxLength="20"
c:suffix="${host.name}" />
<bean id="samlServiceTicketUniqueIdGenerator"
class="org.jasig.cas.support.saml.util.SamlCompliantUniqueTicketIdGenerator">
<constructor-arg index="0" value="https://localhost:8443"; />
<property name="saml2compliant" value="true" />
</bean>
<util:map id="uniqueIdGeneratorsMap">
<entry
key="org.jasig.cas.authentication.principal.SimpleWebApplicationServiceImpl"
value-ref="serviceTicketUniqueIdGenerator" />
<entry key="org.jasig.cas.authentication.principal.SamlService"
value-ref="serviceTicketUniqueIdGenerator" />
<entry
key="org.jasig.cas.support.saml.authentication.principal.GoogleAccountsService"
value-ref="serviceTicketUniqueIdGenerator" />
</util:map>
From: [email protected] [mailto:[email protected]] On Behalf Of Misagh
Moayyed
Sent: January-12-16 4:48 PM
To: CAS Community <[email protected]>
Subject: RE: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client
behavior
Not a client issue. More likely, you’re missing this in your CAS configuration:
https://jasig.github.io/cas/4.0.x/protocol/SAML-Protocol.html#saml-id-generator
From: [email protected]<mailto:[email protected]>
[mailto:[email protected]] On Behalf Of Robert
Sent: Tuesday, January 12, 2016 12:24 PM
To: CAS Community <[email protected]<mailto:[email protected]>>
Subject: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client
behavior
Looking for some help with an odd situation that we are seeing with our local
CAS install.
Install background:
* CAS 4.0.6
* Tomcat 7
* RHEL 6
* added dependencies
* memcached
* ldap support
* jdbc support
* saml support
Implementation works fine for SAML 1.1 attribute release to almost all clients,
but an external vendor is having issues with using JBoss and java-cas-client.
JBoss is configured to use CAS client with the following web.xml configuration:
<!-- CAS FILTERS -->
<filter>
<filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class>
<init-param>
<param-name>casServerLoginUrl</param-name>
<param-value>https://casauth/cas/login</param-value<https://casauth/cas/login%3c/param-value>>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://service:8443</param-value<https://service:8443%3c/param-value>>
</init-param>
</filter>
<filter>
<filter-name>CAS Validation Filter</filter-name>
<filter-class>org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://casauth/cas</param-value<https://casauth/cas%3c/param-value>>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://service:8443</param-value<https://service:8443%3c/param-value>>
</init-param>
<init-param>
<param-name>tolerance</param-name>
<param-value>10000</param-value>
</init-param>
<init-param>
<param-name>redirectAfterValidation</param-name>
<param-value>true</param-value>
</init-param>
</filter>
...snip...
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
The odd behaviour is that the client seems to be making the following requests:
GET https://casauth/cas/login?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F
POST
https://casauth/cas/login;jsessionid=82EA6DE4A504E1C9C973B7C9D42F8FA5?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F
In the corresponding CAS log I see the expected user authentication vs ldap,
but when the system attempts to generate a corresponding service ticket request
I see the following warning:
WARN [org.jasig.cas.CentralAuthenticationServiceImpl] - <Cannot create service
ticket because the key
[org.jasig.cas.support.saml.authentication.principal.SamlService] for service
[https://service:8443/HelpDesk/] is not linked to a ticket id generator>
INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: user
WHAT: https://service:8443/HelpDesk/
ACTION: SERVICE_TICKET_NOT_CREATED
APPLICATION: CAS
WHEN: ----
CLIENT IP ADDRESS: ----
SERVER IP ADDRESS: casauth
=============================================================
This is odd as all other clients using SAML have no issues (php, Google Apps,
etc..), but they all use cas/login?service=xxx and then
cas/samlValidate?target=xxx&SAMLart=st.
The fact that the java client sends TARGET to cas/login seems to be the obvious
cause, but that seems to be the default behavior of that client. I would
expect to see TARGET used at cas/samlValidate.
Is there something the vendor has configured incorrectly in the web.xml? Or
should I be looking in the configuration of our CAS instance?
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected]<mailto:[email protected]>.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected]<mailto:[email protected]>.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
