Hi all,
I have implemented the SAML pac4j with the CAS-5.1.0.
My scenario is:
1. Logout from Okta IdP should logout CAS
2. Logout from any CAS protected application should logout Okta.
Following are my cas configuration:
*CAS SAML Properties:*
cas.authn.pac4j.saml[0].keystorePassword=changeit
cas.authn.pac4j.saml[0].privateKeyPassword=changeit
cas.authn.pac4j.saml[0].serviceProviderEntityId=urn:mace:saml:pac4j.org
cas.authn.pac4j.saml[0].serviceProviderMetadataPath=/home/user1/cas-test/
tomcat_cas/cas-config/sp-metadata.xml
cas.authn.pac4j.saml[0].keystorePath=/home/user1/cas-test/tomcat_cas/cas-
config/samlKeystore.jks
cas.authn.pac4j.saml[0].identityProviderMetadataPath=https:
//dev-777290.oktapreview.com/app/exkb41ouu7HJn5aHh0h7/sso/saml/metadata
cas.authn.pac4j.autoRedirect=false
*CAS Service Registry Config:*
{
"@class": "org.apereo.cas.services.RegexRegisteredService",
"serviceId": "^(http|https|imaps)://.*",
"name": "HTTPS and IMAPS",
"id": 10000001,
"description": "This service definition authorizes all application urls
that support HTTPS and IMAPS protocols.",
"proxyPolicy":
{
"@class": "org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy"
},
"evaluationOrder": 10000,
"usernameAttributeProvider":
{
"@class":
"org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider",
"canonicalizationMode": "NONE",
"encryptUsername": false
},
"logoutType" : "BACK_CHANNEL",
"attributeReleasePolicy":
{
"@class": "org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy",
"principalAttributesRepository":
{
"@class":
"org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository"
,
"expiration": 2,
"timeUnit": "HOURS"
},
"authorizedToReleaseCredentialPassword": false,
"authorizedToReleaseProxyGrantingTicket": false,
"excludeDefaultAttributes": false
},
"multifactorPolicy":
{
"@class":
"org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy",
"failureMode": "CLOSED",
"bypassEnabled": false
},
"accessStrategy":
{
"@class":
"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy",
"enabled": true,
"ssoEnabled": true,
"requireAllAttributes": true,
"caseInsensitive": false
}
}
Below is my Okta configuration:
<https://lh3.googleusercontent.com/-X56v1z-AZ34/WXnmHVDUSiI/AAAAAAAALAA/28AakEJ68BQrEKrQmbKOPwhy22rA_oB_QCLcBGAs/s1600/Okta-Cas.png>
Problem is when I logout from Okta CAS is not receiving any BACK CHANEL
logout message from Okta. Also when I'm logging out from CAS Okta is not
getting logged out.
Any help will be appreciated.
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/e15ebf8c-9e69-4487-97a1-083701b4e003%40apereo.org.
