So after some analysis of the issue, we were able to come to a resolution with this issue. The documentation shows that when your configuration lacks the required keys for CAS to encrypt the cookie / ticket, it will then generate them for you as shown here: https://apereo.github.io/cas/5.1.x/installation/Configuring-SSO-Session-Cookie.html#configuration
What wasn't apparent right away was that two sets of keys are generated: one set specified for the Ticket-granting cookie and another set not specified for anything specific. Example output (note: key values were removed but would normally appear in your log output): 2017-06-22 10:11:32,402 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Secret key for encryption is not defined for [Ticket-granting Cookie]; CAS will attempt to auto-generate the encryption key> 2017-06-22 10:11:32,410 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Generated encryption key [<key-value-here>] of size [256] for [Ticket-granting Cookie]. The generated key MUST be added to CAS settings.> 2017-06-22 10:11:32,410 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Secret key for signing is not defined for [Ticket-granting Cookie]. CAS will attempt to auto-generate the signing key> 2017-06-22 10:11:32,410 WARN [org.apereo.cas.util.cipher.BaseStringCipherExecutor] - <Generated signing key [<key-value-here>] of size [512] for [Ticket-granting Cookie]. The generated key MUST be added to CAS settings.> 2017-06-22 10:11:32,715 WARN [org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Secret key for signing is not defined. CAS will attempt to auto-generate the signing key> 2017-06-22 10:11:32,715 WARN [org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Generated signing key [<key-value-here>] of size [512]. The generated key MUST be added to CAS settings.> 2017-06-22 10:11:32,715 WARN [org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <No encryption key is defined. CAS will attempt to auto-generate keys> 2017-06-22 10:11:32,715 WARN [org.apereo.cas.util.cipher.BaseBinaryCipherExecutor] - <Generated encryption key [<key-value-here>] of size [16]. The generated key MUST be added to CAS settings.> The same keys generated for the ticket-granting cookie need to be used in both your ticket security settings and your tgc settings: cas.ticket.security.cipherEnabled=true cas.ticket.security.encryptionKey=<generated-256-ticket-cookie-key-value-here> cas.ticket.security.signingKey=<generated-512-ticket-cookie-key-value-here> cas.tgc.signingKey=<generated-512-ticket-cookie-key-value-here> cas.tgc.encryptionKey=<generated-256-ticket-cookie-key-value-here> cas.tgc.cipherEnabled=true The keys were used in the tgc settings but not applied in the ticket security settings. Once the keys were set in both sets of settings, SSO started working. On Tuesday, June 20, 2017 at 8:55:20 AM UTC-4, atilling wrote: > > Is there any documentation of the function of these two properties? > > I see that they exist from > https://apereo.github.io/cas/5.1.x/installation/Configuration-Properties.html#global-sso-behavior > > but there is no mention of function. > > I am attempting to deploy 5.1.0 and while I can get logins to work I can > not get SSO to work. > > I have verified that the TGC cookie is working and being sent with correct > domain, path and 2 hr lifespan same as we had in 3.5.3 and I have verified > via service manager that all of our services have a check in enable SSO. > However, for each cas enabled application the user is required to login > again. > > Thank you for any help, > > -Andrew > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d121f6d3-bc9f-4d5c-af87-10dca8557695%40apereo.org.
