Hi dhawes,
This is how I left cas.conf content:
LoadModule auth_cas_module modules/mod_auth_cas.so
<Directory "/var/www/html/secured-by-cas">
<IfModule mod_auth_cas.c>
AuthType CAS
CASAuthNHeader On
</IfModule>
#Require all granted
Require valid-user
</Directory>
<IfModule mod_auth_cas.c>
CASLoginUrl https://casdev.gas.local:8443/cas/login
CASValidateUrl https://casdev.gas.local:8443/cas/serviceValidate
CASCookiePath /var/cache/httpd/mod_auth_cas/
CASValidateSAML Off
CASSSOEnabled On
CASDebug On
CASCertificatePath /etc/httpd/conf/casdev.gas.local.crt
</IfModule>
This is the output of "curl -v https://casdev.gas.local:8443"; :
<https://casdev.gas.local:8443>
* About to connect() to casdev.gas.local port 8443 (#0)
* Trying 192.168.0.150...
* Connected to casdev.gas.local (192.168.0.150) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: CN=casdev.gas.local,OU=DSI-GAS,O=BCI,L=MPT,ST=Maputo,C=MZ
* start date: Sep 13 05:24:14 2017 GMT
* expire date: Sep 03 05:24:14 2019 GMT
* common name: casdev.gas.local
* issuer: CN=casdev.gas.local,OU=DSI-GAS,O=BCI,L=MPT,ST=Maputo,C=MZ
* NSS error -8156 (SEC_ERROR_CA_CERT_INVALID)
* Issuer certificate is invalid.
* Closing connection 0
curl: (60) Issuer certificate is invalid.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
Here is info about casdev.gas.local (I generated a new one trying to solve
the problem):
keytool -printcert -v -file conf/casdev.gas.local.crt
Owner: CN=casdev.gas.local, OU=DSI-GAS, O=BCI, L=MPT, ST=Maputo, C=MZ
Issuer: CN=casdev.gas.local, OU=DSI-GAS, O=BCI, L=MPT, ST=Maputo, C=MZ
Serial number: 660b315e
Valid from: Wed Sep 13 01:24:14 EDT 2017 until: Tue Sep 03 01:24:14 EDT 2019
Certificate fingerprints:
MD5: 23:C1:A1:AE:85:F3:75:F4:88:BA:DE:3C:3F:2F:B2:AA
SHA1: 0E:CE:B8:F4:70:C8:87:82:B8:53:A0:F7:D2:DF:E2:91:8D:CD:D2:02
SHA256: 14:7B:65:2C:0B:61:E5:3E:17:14:E1:E1:FD:4D:8A:D9:15:D3:D2:09:E2:
48:C0:61:27:CF:9A:03:DD:91:D4:EF
Signature algorithm name: SHA256withRSA
Version: 3
Extensions:
#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: DB 59 D4 74 C4 D3 F2 16 31 70 53 AA C9 38 65 47 .Y.t....1pS..8eG
0010: 65 53 AF 72 eS.r
]
]
On Wednesday, September 13, 2017 at 11:59:11 PM UTC+2, dhawes wrote:
>
> I think this is the right path to go down, but I would have expected a
> better error message from curl.
>
> I do see that you have "CASValidateSaml On", so you should most likely
> use the /samlValidate endpoint.
>
> So, you should now have:
>
> CASValidateUrl https://casdev.gas.local:8443/cas/samlValidate
> CASCertificatePath /etc/httpd/conf/casdev.crt
>
> What is the CN and subjectAltName of /etc/httpd/conf/casdev.crt?
>
> What do you get when you:
>
> curl -v https://casdev.gas.local:8443
>
> from your machine running Apache?
>
> On 13 September 2017 at 11:50, Doug C <[email protected] <javascript:>>
> wrote:
> > Micas,
> >
> > I am not really sure. I assuming you did change the CASLoginUrl and
> > CASValidateUrl to use the casdev.gas.local domain and that the
> > casdev.gas.local domain SSL certificate is what is stored at
> > /etc/httpd/conf/casdev.crt.
> >
> > If that is the case I am currently out of ideas though I really do think
> it
> > has something to do with your the server hosting the casclient not being
> > able to communicate with the casdev server.
> >
> > Doug
> >
> >
> > On Wednesday, September 13, 2017 at 11:29:22 PM UTC+8, Micas Camela
> wrote:
> >>
> >> Thank Doug for the reply.
> >>
> >> After changing the IP to the hostname I am still getting the error
> page.
> >>
> >> Here is the output from apache:
> >>
> >> [Wed Sep 13 00:51:14.091627 2017] [ssl:info] [pid 11557] [client
> >> 192.168.0.1:49515] AH01964: Connection to child 1 established (server
> >> casclient.gas.local:443)
> >> [Wed Sep 13 00:51:14.091794 2017] [ssl:debug] [pid 11557]
> >> ssl_engine_kernel.c(1879): [client 192.168.0.1:49515] AH02043: SSL
> virtual
> >> host for servername casclient.gas.local found
> >> [Wed Sep 13 00:51:14.092245 2017] [ssl:debug] [pid 11557]
> >> ssl_engine_kernel.c(1812): [client 192.168.0.1:49515] AH02041:
> Protocol:
> >> TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
> >> [Wed Sep 13 00:51:14.092526 2017] [ssl:info] [pid 11557] (70014)End of
> >> file found: [client 192.168.0.1:49515] AH01991: SSL input filter read
> >> failed.
> >> [Wed Sep 13 00:51:14.092553 2017] [ssl:debug] [pid 11557]
> >> ssl_engine_io.c(992): [client 192.168.0.1:49515] AH02001: Connection
> closed
> >> to child 1 with standard shutdown (server casclient.gas.local:443)
> >> [Wed Sep 13 00:51:14.093534 2017] [ssl:info] [pid 11558] [client
> >> 192.168.0.1:49516] AH01964: Connection to child 2 established (server
> >> casclient.gas.local:443)
> >> [Wed Sep 13 00:51:14.093858 2017] [ssl:debug] [pid 11558]
> >> ssl_engine_kernel.c(1879): [client 192.168.0.1:49516] AH02043: SSL
> virtual
> >> host for servername casclient.gas.local found
> >> [Wed Sep 13 00:51:14.094427 2017] [ssl:debug] [pid 11558]
> >> ssl_engine_kernel.c(1812): [client 192.168.0.1:49516] AH02041:
> Protocol:
> >> TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
> >> [Wed Sep 13 00:51:14.094807 2017] [ssl:debug] [pid 11558]
> >> ssl_engine_kernel.c(224): [client 192.168.0.1:49516] AH02034: Initial
> (No.1)
> >> HTTPS request received for child 2 (server casclient.gas.local:443),
> >> referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094910 2017] [authz_core:debug] [pid 11558]
> >> mod_authz_core.c(809): [client 192.168.0.1:49516] AH01626:
> authorization
> >> result of Require valid-user : denied (no authenticated user yet),
> referer:
> >> https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094919 2017] [authz_core:debug] [pid 11558]
> >> mod_authz_core.c(809): [client 192.168.0.1:49516] AH01626:
> authorization
> >> result of <RequireAny>: denied (no authenticated user yet), referer:
> >> https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094926 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(2076): [client 192.168.0.1:49516] Entering
> >> cas_authenticate(), referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094934 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(584): [client 192.168.0.1:49516] CAS Service
> >> 'https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php',
> referer:
> >> https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094936 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(532): [client 192.168.0.1:49516] entering
> getCASLoginURL(),
> >> referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094940 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(509): [client 192.168.0.1:49516] entering
> getCASGateway(),
> >> referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094942 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(599): [client 192.168.0.1:49516] entering
> redirectRequest(),
> >> referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:14.094944 2017] [auth_cas:debug] [pid 11558]
> >> mod_auth_cas.c(611): [client 192.168.0.1:49516] Adding outgoing
> header:
> >> Location:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php,
>
>
> >> referer: https://casclient.gas.local/
> >> [Wed Sep 13 00:51:19.101068 2017] [ssl:info] [pid 11558] (70007)The
> >> timeout specified has expired: [client 192.168.0.1:49516] AH01991: SSL
> input
> >> filter read failed.
> >> [Wed Sep 13 00:51:19.101166 2017] [ssl:debug] [pid 11558]
> >> ssl_engine_io.c(992): [client 192.168.0.1:49516] AH02001: Connection
> closed
> >> to child 2 with standard shutdown (server casclient.gas.local:443)
> >> [Wed Sep 13 00:51:26.874122 2017] [ssl:info] [pid 11559] [client
> >> 192.168.0.1:49558] AH01964: Connection to child 3 established (server
> >> casclient.gas.local:443)
> >> [Wed Sep 13 00:51:26.874276 2017] [ssl:debug] [pid 11559]
> >> ssl_engine_kernel.c(1879): [client 192.168.0.1:49558] AH02043: SSL
> virtual
> >> host for servername casclient.gas.local found
> >> [Wed Sep 13 00:51:26.874666 2017] [ssl:debug] [pid 11559]
> >> ssl_engine_kernel.c(1812): [client 192.168.0.1:49558] AH02041:
> Protocol:
> >> TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
> >> [Wed Sep 13 00:51:26.874848 2017] [ssl:info] [pid 11559] (70014)End of
> >> file found: [client 192.168.0.1:49558] AH01991: SSL input filter read
> >> failed.
> >> [Wed Sep 13 00:51:26.874880 2017] [ssl:debug] [pid 11559]
> >> ssl_engine_io.c(992): [client 192.168.0.1:49558] AH02001: Connection
> closed
> >> to child 3 with standard shutdown (server casclient.gas.local:443)
> >> [Wed Sep 13 00:51:26.875464 2017] [ssl:info] [pid 11561] [client
> >> 192.168.0.1:49559] AH01964: Connection to child 5 established (server
> >> casclient.gas.local:443)
> >> [Wed Sep 13 00:51:26.875571 2017] [ssl:debug] [pid 11561]
> >> ssl_engine_kernel.c(1879): [client 192.168.0.1:49559] AH02043: SSL
> virtual
> >> host for servername casclient.gas.local found
> >> [Wed Sep 13 00:51:26.876552 2017] [ssl:debug] [pid 11561]
> >> ssl_engine_kernel.c(1812): [client 192.168.0.1:49559] AH02041:
> Protocol:
> >> TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
> >> [Wed Sep 13 00:51:26.877040 2017] [ssl:debug] [pid 11561]
> >> ssl_engine_kernel.c(224): [client 192.168.0.1:49559] AH02034: Initial
> (No.1)
> >> HTTPS request received for child 5 (server casclient.gas.local:443),
> >> referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877222 2017] [authz_core:debug] [pid 11561]
> >> mod_authz_core.c(809): [client 192.168.0.1:49559] AH01626:
> authorization
> >> result of Require valid-user : denied (no authenticated user yet),
> referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877229 2017] [authz_core:debug] [pid 11561]
> >> mod_authz_core.c(809): [client 192.168.0.1:49559] AH01626:
> authorization
> >> result of <RequireAny>: denied (no authenticated user yet), referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877241 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(2076): [client 192.168.0.1:49559] Entering
> >> cas_authenticate(), referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877249 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(656): [client 192.168.0.1:49559] Modified r->args (now
> ''),
> >> referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877319 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(1779): [client 192.168.0.1:49559] entering
> >> getResponseFromServer(), referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.877577 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(584): [client 192.168.0.1:49559] CAS Service
> >> 'https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php',
> referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.976446 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(1848): [client 192.168.0.1:49559] MOD_AUTH_CAS:
> >> curl_easy_perform() failed (), referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:26.976523 2017] [auth_cas:debug] [pid 11561]
> >> mod_auth_cas.c(1440): [client 192.168.0.1:49559] entering
> >> isValidCASTicket(), referer:
> >>
> https://casdev.gas.local:8443/cas/login?service=https%3a%2f%2fcasclient.gas.local%2fsecured-by-cas%2findex.php
>
> >> [Wed Sep 13 00:51:31.981146 2017] [ssl:info] [pid 11561] (70007)The
> >> timeout specified has expired: [client 192.168.0.1:49559] AH01991: SSL
> input
> >> filter read failed.
> >> [Wed Sep 13 00:51:31.981234 2017] [ssl:debug
> >
> > ...
> >
> > [Message clipped]
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/9452d31e-6a72-4207-a99c-1ec085472bff%40apereo.org.
