Out of curiosity, what happens if you take the load balancer out of the picture
- does the required re-authentication happen? Also, do you have any kind of
session replication set up between your CAS nodes, such as hazelcast? Also,
what frequency does this happen? Eg., if someone logs into a CAS application,
then immediately into another application? Or is there some delay in between
the login attempts?
Some things to check:
Session timeout in your web.xml file:
<session-config>
<session-timeout>5</session-timeout>
</session-config>
If there is more of a delay than X minutes in between logins, the users will
have to re-authenticate. We have ours set to 120 (2 hours.)
If your URL has "&renew=true" then this will always be the case; that forces
the user to re-authenticate to CAS regardless of their current session status.
This option can also be forced through your service registry, so you'll want to
check that as well.
Also, you may want to kick up your logging to DEBUG for additional details
about what's going on during the login process.
Cookies working correctly too?
Ultimately to me, since "I was able to consistently reproduce the issue so
after stopping tomcat 8 and rebooting the server it started working again." it
sounds like one of your two boxes may be having an issue, because at that
point, the connections should be failing over to the other one.
Chris
>>> Juan Quintanilla <[email protected]> 01/14/16 7:29 AM >>>
So wanted to send an update, it seems that the intermittent SSO issue
also happened on our Second CAS server today. Once it was rebooted it seemed to
not prompt the user to log in again to a CAS application once they had already
authenticated to another CAS application. Below is a snippet from the logs
showing ldap authentication request for each service even though I was already
authenticated in the first service. When I took a look at the audit logs it
seems that its generating a new TGT for each service, so for some reason CAS
was not recognizing that a TGT already existed for the user. The client
applications point to a load balanced address which directs the traffic to
either of the 2 CAS servers using sticky sessions, I was able to consistently
reproduce the issue so after stopping tomcat 8 and rebooting the server it
started working again.
2016-01-14 07:27:33,286 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] - <Resolved principal
testact>2016-01-14 07:27:33,287 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler@2f4e8fcd
authenticated testact with credential [username: testact].>
2016-01-14 07:27:33,298 INFO [org.jasig.cas.CentralAuthenticationServiceImpl]
- <Granted service ticket [ST-152455-TIaEn95bgajMf4ux46KO-testcas.fiu.edu] for
service [https ://testsite1.fiu.edu/] for user [testact]>
2016-01-14 07:28:22,804 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler successfully
authenticat ed [username: testact]>
2016-01-14 07:28:22,902 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] - <Resolved principal
testact>
2016-01-14 07:28:22,903 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler@2f4e8fcd
authenticated testact with credential [username: testact].>
2016-01-14 07:28:22,912 INFO [org.jasig.cas.CentralAuthenticationServiceImpl]
- <Granted service ticket [ST-152461-1GbGPNwN7KSiPdvZDejk-testcas.fiu.edu] for
service [https ://testsite2.fiu.edu/] for user [testact]>
2016-01-14 07:29:59,697 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler successfully
authenticat ed [username: testact]>
2016-01-14 07:29:59,795 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] - <Resolved principal
testact>
2016-01-14 07:29:59,795 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler@2f4e8fcd
authenticated testact with credential [username: testact].>
2016-01-14 07:29:59,803 INFO [org.jasig.cas.CentralAuthenticationServiceImpl]
- <Granted service ticket [ST-152473-c0Vy6l1X9lTZGxk0uPb4-testcas.fiu.edu] for
service [https ://testsite3.fiu.edu/login] for user [testact]>
___________________
Juan Quintanilla
UTS - Enterprise Group
305-348-6573
[email protected]
From: [email protected] <[email protected]> on behalf of Juan
Quintanilla <[email protected]>
Sent: Wednesday, January 13, 2016 8:33 PM
To: [email protected]
Subject: [cas-user] CAS Intermittent SSO logins issues
Hi,
We are running CAS 3.6.0 and its been working fine but on occasions we are
seeing issues where a user logs into a CAS application and then goes to another
CAS application and is prompted to log in again. The applications are not
configured to renew or force a new login.
The 2 CAS servers point to the same oracle database and running tomcat 8 both
having the same configuration.
We see this more consistent on the first CAS server during tomcat startup
where if we point an application to the 1st CAS server directly we are forced
to login to each application no matter if we have set a CAS Session. Once the
server is restarted again the issue goes away.
This time we see it very intermittently so we are not sure where to look, the
second CAS server does not seem to have the issue, but like I said they have
the same config and after a tomcat restart its fine.
Any help would really be appreciated.
___________________
Juan Quintanilla
UTS - Enterprise Group
305-348-6573
[email protected]
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
--
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
