Just caught that after I replied. Modified it to use samlServiceTicketUniqueIdGenerator and I am still seeing the same warning of service not linked with an id generator.
From: [email protected] [mailto:[email protected]] On Behalf Of Carlos M. Fernández Sent: January-12-16 11:48 PM To: CAS Community <[email protected]> Subject: Re: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client behavior The SamlService entry in your <util:map> should point to samlServiceTicketUniqueIdGenerator instead of serviceTicketUniqueIdGenerator as it does now. Can you change that and see how it behaves? Best regards, -- Carlos. ________________________________ From: "King, Robert" <[email protected]<mailto:[email protected]>> To: "Misagh Moayyed" <[email protected]<mailto:[email protected]>>, "CAS Community" <[email protected]<mailto:[email protected]>> Sent: Tuesday, January 12, 2016 10:08:53 PM Subject: RE: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client behavior Our uniqueIdGenerators.xml does have the samlServiceTicketUniqueidGenerator bean. The config for reference: <!-- ID Generators --> <bean id="ticketGrantingTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator" c:maxLength="50" c:suffix="${host.name}" /> <bean id="serviceTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator" c:maxLength="20" c:suffix="${host.name}" /> <bean id="loginTicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator" c:maxLength="30" c:suffix="${host.name}" /> <bean id="proxy20TicketUniqueIdGenerator" class="org.jasig.cas.util.DefaultUniqueTicketIdGenerator" c:maxLength="20" c:suffix="${host.name}" /> <bean id="samlServiceTicketUniqueIdGenerator" class="org.jasig.cas.support.saml.util.SamlCompliantUniqueTicketIdGenerator"> <constructor-arg index="0" value="https://localhost:8443"; /> <property name="saml2compliant" value="true" /> </bean> <util:map id="uniqueIdGeneratorsMap"> <entry key="org.jasig.cas.authentication.principal.SimpleWebApplicationServiceImpl" value-ref="serviceTicketUniqueIdGenerator" /> <entry key="org.jasig.cas.authentication.principal.SamlService" value-ref="serviceTicketUniqueIdGenerator" /> <entry key="org.jasig.cas.support.saml.authentication.principal.GoogleAccountsService" value-ref="serviceTicketUniqueIdGenerator" /> </util:map> From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Misagh Moayyed Sent: January-12-16 4:48 PM To: CAS Community <[email protected]<mailto:[email protected]>> Subject: RE: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client behavior Not a client issue. More likely, you’re missing this in your CAS configuration: https://jasig.github.io/cas/4.0.x/protocol/SAML-Protocol.html#saml-id-generator From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Robert Sent: Tuesday, January 12, 2016 12:24 PM To: CAS Community <[email protected]<mailto:[email protected]>> Subject: [cas-user] Odd CAS 4.0, Saml11AuthenticationFilter/java-cas-client behavior Looking for some help with an odd situation that we are seeing with our local CAS install. Install background: * CAS 4.0.6 * Tomcat 7 * RHEL 6 * added dependencies * memcached * ldap support * jdbc support * saml support Implementation works fine for SAML 1.1 attribute release to almost all clients, but an external vendor is having issues with using JBoss and java-cas-client. JBoss is configured to use CAS client with the following web.xml configuration: <!-- CAS FILTERS --> <filter> <filter-name>CAS Authentication Filter</filter-name> <filter-class>org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class> <init-param> <param-name>casServerLoginUrl</param-name> <param-value>https://casauth/cas/login</param-value<https://casauth/cas/login%3c/param-value>> </init-param> <init-param> <param-name>serverName</param-name> <param-value>https://service:8443</param-value<https://service:8443%3c/param-value>> </init-param> </filter> <filter> <filter-name>CAS Validation Filter</filter-name> <filter-class>org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class> <init-param> <param-name>casServerUrlPrefix</param-name> <param-value>https://casauth/cas</param-value<https://casauth/cas%3c/param-value>> </init-param> <init-param> <param-name>serverName</param-name> <param-value>https://service:8443</param-value<https://service:8443%3c/param-value>> </init-param> <init-param> <param-name>tolerance</param-name> <param-value>10000</param-value> </init-param> <init-param> <param-name>redirectAfterValidation</param-name> <param-value>true</param-value> </init-param> </filter> ...snip... <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>*.jsp</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Validation Filter</filter-name> <url-pattern>*.do</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Authentication Filter</filter-name> <url-pattern>*.jsp</url-pattern> </filter-mapping> <filter-mapping> <filter-name>CAS Authentication Filter</filter-name> <url-pattern>*.do</url-pattern> </filter-mapping> The odd behaviour is that the client seems to be making the following requests: GET https://casauth/cas/login?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F POST https://casauth/cas/login;jsessionid=82EA6DE4A504E1C9C973B7C9D42F8FA5?TARGET=https%3A%2F%2Fservice%3A8443%2FHelpDesk%2F In the corresponding CAS log I see the expected user authentication vs ldap, but when the system attempts to generate a corresponding service ticket request I see the following warning: WARN [org.jasig.cas.CentralAuthenticationServiceImpl] - <Cannot create service ticket because the key [org.jasig.cas.support.saml.authentication.principal.SamlService] for service [https://service:8443/HelpDesk/] is not linked to a ticket id generator> INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN ============================================================= WHO: user WHAT: https://service:8443/HelpDesk/ ACTION: SERVICE_TICKET_NOT_CREATED APPLICATION: CAS WHEN: ---- CLIENT IP ADDRESS: ---- SERVER IP ADDRESS: casauth ============================================================= This is odd as all other clients using SAML have no issues (php, Google Apps, etc..), but they all use cas/login?service=xxx and then cas/samlValidate?target=xxx&SAMLart=st. The fact that the java client sends TARGET to cas/login seems to be the obvious cause, but that seems to be the default behavior of that client. I would expect to see TARGET used at cas/samlValidate. Is there something the vendor has configured incorrectly in the web.xml? Or should I be looking in the configuration of our CAS instance? -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. --> -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
