Thanks again Yauheni -Gary
From: [email protected] [mailto:[email protected]] On Behalf Of Yauheni Sidarenka Sent: Thursday, January 19, 2017 2:55 AM To: CAS Community <[email protected]> Subject: Re: [cas-user] Cas 5 and implementing ehcache replication Hello, I may guess this happens because you use different cookie encryption on both CAS servers (nearly the same that sesharaju sv said). You know, when you start CAS 5.0.0 without any configuration it produces WARN messages like these: WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - <Secret key for signing is not defined. CAS will attempt to auto-generate the signing key> WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - <Generated signing key rShUuOJuPwpIAvzo-eJLQttzyP_61e5Q1rwlnzExJBdfmubp_7Z2ABqhDk0nnwn7Lo4U4p3Uni2FncBSR6sk8Q of size 512. The generated key MUST be added to CAS settings.> WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - <No encryption key is defined. CAS will attempt to auto-generate keys> WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - <Generated encryption key HuCQqOznZTCchApj of size 16. The generated key MUST be added to CAS settings.> WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - <Secret key for encryption is not defined. CAS will attempt to auto-generate the encryption key> WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - <Generated encryption key bmMKn_wh5PQYHaIN6c-8XnNt40Cpbz1PI0-1GTbvzMs of size 256. The generated key MUST be added to CAS settings.> WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - <Secret key for signing is not defined. CAS will attempt to auto-generate the signing key> WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - <Generated signing key Tfz8OkZze_xYsO_9pNeeDj3htHa7uz2lJApUQ7VkwgorC3VYHP0C6z1LrXugRKqtBxfM2ixVLOMnj_BAWUfF2Q of size 512. The generated key MUST be added to CAS settings.> So I just added these settings to my cas.properties (as stated in messages) and I hope it is easy to guess what to place for each line: cas.tgc.encryptionKey= cas.tgc.signingKey= cas.webflow.encryption.key= cas.webflow.signing.key= Then I just copied these exact values to properties for second server and since that HA has started working fine. CAS 5.0.0 encrypts ticket granting cookie (TGC) and therefore, in my opinion, each CAS server in HA cluster should have equal cas.tgc.* keys to read and understand cookies produced by other members of cluster. I am not convinced about the necessity of cas.webflow.* settings but if CAS says they must be added - I must add them :) Regards, Yauheni On Thursday, January 19, 2017 at 8:42:35 AM UTC+3, maxwell_g wrote: Thank you! Yauheni That fixed TGT from being destroyed and I am able to bring up multiple SSO applications after logging in one time. This however leads me to another issue. I am running two cas servers with ehcache replication. After logging into one application, I can see the ticket is replicated to both servers however when I stop the server that I initially logged into, the load balancer sends me to the replicated server however it doesn’t recognize the replicated ticket and asks for me to login again. Any clues how I can troubleshoot this issue? -Gary From: [email protected]<javascript:> [mailto:[email protected]<javascript:>] On Behalf Of Yauheni Sidarenka Sent: Tuesday, January 17, 2017 6:22 AM To: CAS Community <[email protected]<javascript:>> Subject: Re: [cas-user] Cas 5 and implementing ehcache replication Hello, We had similar issue and we solved it using cas.ticket.registry.ehcache.persistence=LOCALTEMPSWAP property instead of cas.ticket.registry.ehcache.persistence=NONE which is default one for CAS 5.0.0 (and to be clear, for Ehcache as well). Hope this will help you. Regards, Yauheni. On Tuesday, January 17, 2017 at 8:49:55 AM UTC+3, maxwell_g wrote: In summary, the behavior I see is the following: 1. I login to the first SSO application 2. CAS creates the TGT ticket on the first server and then replicates it to the second. 3. I bring up the login for the second SSO application. 4. CAS performs a TICKET_GRANTING_TICKET_DESTROYED on the TGT ticket 5. Because the TGT is gone, CAS proceeds to login into the second SSO application. Why causes CAS to delete the TGT ticket? -Gary -----Original Message----- From: Maxwell, Gary Sent: Monday, January 16, 2017 3:28 PM To: [email protected]<mailto:[email protected]> Subject: RE: [cas-user] Cas 5 and implementing ehcache replication Hi Seshu, I turned on Debug and It shows me where it creates the TGT: DEBUG [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Adding ticket TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXX.edu<http://5B0wydvh6k-login-test1.XXXXXXXX.edu> to the cache org.apereo.cas.ticket.TicketCache to live 7200 seconds and stay idle for 7200 seconds> However latter on (in abbreviated log) it says it can't find it: DEBUG [org.apereo.cas.web.support.DefaultCasCookieValueManager] - <Decoded cookie value is [TGT-**********************************************[email protected]@Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0]> TRACE [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket encryption is not enabled. Falling back to default behavior> DEBUG [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id [TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXX.fortlewis.edu<http://5B0wydvh6k-login-test1.XXXXXXXX.fortlewis.edu>] is found in the registry> TRACE [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket encryption is not enabled. Falling back to default behavior> DEBUG [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id [TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXX.edu<http://5B0wydvh6k-login-test1.XXXXXXXX.edu>] is found in the registry> TRACE [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket encryption is not enabled. Falling back to default behavior> DEBUG [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id [TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXXX.edu<http://5B0wydvh6k-login-test1.XXXXXXXXX.edu>] is found in the registry> DEBUG [org.apereo.cas.CentralAuthenticationServiceImpl] - <Ticket [TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXX.edu<http://5B0wydvh6k-login-test1.XXXXXXXX.edu>] by type [Ticket] cannot be found in the ticket registry.> DEBUG [org.apereo.cas.CentralAuthenticationServiceImpl] - <Removing ticket [TGT-**********************************************5B0wydvh6k-login-test1.XXXXXXXX.edu<http://5B0wydvh6k-login-test1.XXXXXXXX.edu>] from registry...> Any Ideas why???? -Gary -----Original Message----- From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of sesharaju sv Sent: Monday, January 16, 2017 11:34 AM To: [email protected]<mailto:[email protected]> Subject: Re: [cas-user] Cas 5 and implementing ehcache replication This would be few reasons behind this issue. Please enable your ehcache logging to debug and you should be able to see what exactly the issues is. Thanks Seshu On 16 January 2017 at 23:42, Maxwell, Gary <[email protected]<mailto:[email protected]>> wrote: > .We have installed cas 5 along with ehcache replication. When we login > to a SSO application the replication works great however when we log > into the next SSO application, CAS deletes the existing TGT. CAS then > requires the user to re-authenticate. Does anyone know why this would be > happening? > > > > Thanks for any insight on this! > > > > -Gary > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google > Groups "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]<mailto:[email protected]>. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/016e99eee450407ca0bb6a035d5032fb%40mbx2.fortlewis.edu. -- Venkata S Sadhu India (Mobile) : +91 7032638062 INDIA -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAABZGc2v3cFumnBDu%2B7%3DVu0XzJC%2B7cvOGMpzY6OYa7zgtagPvQ%40mail.gmail.com. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<javascript:>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c69c367c-0bee-44c4-8224-936af7d2f0fc%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/c69c367c-0bee-44c4-8224-936af7d2f0fc%40apereo.org?utm_medium=email&utm_source=footer>. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/b5b0ab8d-28cb-451e-b2f5-bce66fbb77e6%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/b5b0ab8d-28cb-451e-b2f5-bce66fbb77e6%40apereo.org?utm_medium=email&utm_source=footer>. -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/3d4cfaec5b9447999edc49e188e19e07%40mbx2.fortlewis.edu.
