Thanks everybody for replies.
I have solved my problem.
I looked into tcpdump on CAS server to see what happens when I issue a
logout, and I've seen that it sends logout request to some strange ip
address on 443 port, which was blocked on this address.
Upon furter envestigation i figured out that it was a proxy problem and i
opened /etc/profile.d/proxy.sh and changed 443 port to port which our proxy
uses.
понедельник, 23 апреля 2018 г., 16:05:20 UTC+2 пользователь Viacheslav
Babanin написал:
>
> Hello, I have encountered issue with SSO for SAML 1.1 clients with CAS 5.2
>
> I am rather new cas user and probably i am missing something obvious.
>
> I am using folowing phpCAS client:
>
> <?php
> require_once 'phpcas/source/CAS.php';
> // Enable debugging
> phpCAS::setDebug('phpCAS.log');
> // Enable verbose error messages. Disable in production!
> phpCAS::setVerbose(true);
> // Initialize phpCAS
> $cas_host = 'cas-1.uek.krakow.pl';
> // Context of the CAS Server
> $cas_context = '/cas';
> // Port of your CAS server. Normally for a https server it's 443
> $cas_port = 443;
> phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);
> // For production use set the CA certificate that is the issuer of the cert
> // on the CAS server and uncomment the line below
> // phpCAS::setCasServerCACert($cas_server_ca_cert_path);
> // For quick testing you can disable SSL validation of the CAS server.
> // THIS SETTING IS NOT RECOMMENDED FOR PRODUCTION.
> // VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS
> PROTOCOL!
> phpCAS::setNoCasServerValidation();
> // force CAS authentication
>
> $cas_real_hosts = array('cas-1.uek.krakow.pl');
>
>
> phpCAS::handleLogoutRequests(true, $cas_real_hosts);
>
> phpCAS::forceAuthentication();
> // at this step, the user has been authenticated by the CAS server
> // and the user's login name can be read with phpCAS::getUser().
> // logout if desired
> // logout if desired
> if (isset($_REQUEST['logout'])) {
> phpCAS::logout();
> }
> ?>
> <html>
> <head>
> <title>Advanced SAML 1.1 example</title>
> <meta http-equiv="Content-Type" content="text/html;
> charset=utf-8"/>
> </head>
> <body>
> <h2>Advanced SAML 1.1 example</h2>
> <?php require 'script_info.php' ?>
>
> Authentication succeeded for user
> <strong><?php echo phpCAS::getUser(); ?></strong>.
> User has attributes
> <strong><?php if(phpCAS::hasAttributes()){
> echo 'true';
> }
> else {
> echo 'false';
> }
>
> ?></strong>.
> <h3>User Attributes</h3>
> <ul>
> <?php
> foreach (phpCAS::getAttributes() as $key => $value) {
> if (is_array($value)) {
> echo '<li>', $key, ':<ol>';
> foreach ($value as $item) {
> echo '<li><strong>', $item, '</strong></li>';
> }
> echo '</ol></li>';
> } else {
> echo '<li>', $key, ': <strong>', $value, '</strong></li>' .
> PHP_EOL;
> }
> }
> ?>
> </ul>
> <p><a href="?logout=">Logout</a></p>
> </body>
> </html>
>
>
> Single sign in works like expected. If I have several CAS clients, when I
> log in to one of them, I am authenticated in all, like expected.
>
> But Single Logout completely doesn't work for me. When I log out using CAS
> logout endpoint "{cas-server}/cas/logout" i receive message that I am
> logged out from CAS and I can see in SSO manager that CAS Session is
> terminated.
> But all application sessions are still alive, I am allowed not only to
> navigate client pages but also close\open tabs and I am still logged in.
>
> I have tried to configure service with client application with both
> "BACK_CHANNEL" and "FRONT_CHANNEL" logoutType with no luck.
>
> 1. If I use BACK_CHANNEL.
>
> Thats how service definition looks like:
>
> {
> "@class" : "org.jasig.cas.services.RegexRegisteredService",
> "serviceId" : "https://cas-client.ssl.stub/";,
> "name" : "example_simple_citest",
> "id" : 7,
> "logoutType" : "BACK_CHANNEL",
>
> "attributeReleasePolicy" : {
> "@class" :
> "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy",
> "allowedAttributes" : {
> "@class" : "java.util.TreeMap",
> "uid" : "user_id",
> "sn" : "surname"
> }
> }
> }
>
>
> When I log out using "{cas-server}/cas/logout" endpoint CAS server log
> looks like this: back.txt (see attachment)
>
> phpCAS.log doesn't log anything in this case. And application session
> still lives untill I close browser.
>
> 2. If I use FRONT_CHANNEL.
>
> Thats how service definition looks like:
>
> {
> "@class" : "org.jasig.cas.services.RegexRegisteredService",
> "serviceId" : "https://cas-client.ssl.stub/";,
> "name" : "example_simple_citest",
> "id" : 7,
> "logoutType" : "FRONT_CHANNEL",
>
> "attributeReleasePolicy" : {
> "@class" :
> "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy",
> "allowedAttributes" : {
> "@class" : "java.util.TreeMap",
> "uid" : "user_id",
> "sn" : "surname"
> }
> }
> }
>
> When I log out using "{cas-server}/cas/logout" endpoint CAS server log
> looks like this: front.txt (see attachment)
>
> And I see following message upon logout on endpoint page:
>
>
> <https://lh3.googleusercontent.com/-UTWr5C0Ljuw/Wt3mgxz_NeI/AAAAAAAAAKM/PPlxChw1Gwk--HOokjLhoOO5DUzk7zV2gCLcBGAs/s1600/fronLogout.png>
>
>
>
>
> W
> Which tells me that logout notification has been sent.
>
> At the same time, when endpoint logout happens, phpCAS.log logs following
> message.
>
> D0EE .START (2018-04-23 15:37:16) phpCAS-1.3.5 ******************
> [CAS.php:468]
> D0EE .=> phpCAS::client('S1', 'cas-1.server.test.pl', 443, '/cas')
> [index.php:13]
> D0EE .| => CAS_Client::__construct('S1', false, 'cas-1.server.test.pl',
> 443, '/cas', true) [CAS.php:360]
> D0EE .| | Starting a new session
> ST-26-6Ad0C8OCIF5n-1zWgmiE8HZdw-E-v-cas-1 [Client.php:932]
> D0EE .| | Session is authenticated as: babanin [Client.php:936]
> D0EE .| <= ''
> D0EE .<= ''
> D0EE .=> phpCAS::setNoCasServerValidation() [index.php:20]
> D0EE .| You have configured no validation of the legitimacy of the cas
> server. This is not recommended for production use. [CAS.php:1644]
> D0EE .<= ''
> D0EE .=> CAS_Client::handleLogoutRequests(true, array ( 0 => '
> cas-1.server.test.pl',)) [CAS.php:1276]
> D0EE .| Not a logout request [Client.php:1739]
> D0EE .<= ''
> D0EE .=> phpCAS::forceAuthentication() [index.php:27]
> D0EE .| => CAS_Client::forceAuthentication() [CAS.php:1098]
> D0EE .| | => CAS_Client::isAuthenticated() [Client.php:1280]
> D0EE .| | | => CAS_Client::_wasPreviouslyAuthenticated()
> [Client.php:1393]
> D0EE .| | | | user = `babanin' [Client.php:1622]
> D0EE .| | | <= true
> D0EE .| | | user was already authenticated, no need to look for
> tickets [Client.php:1417]
> D0EE .| | <= true
> D0EE .| | no need to authenticate [Client.php:1282]
> D0EE .| <= true
> D0EE .<= ''
>
> This message looks exactly like regular login message, but it appers when
> tab with application is closed and at the exact time when CAS sends logout
> notification.
> It seems like client receives FRONT_CHANNEL connection from server but
> fails to recognise it as logout request.
>
>
> So, summarising:
>
> Logging out from cas using both endpoint and casified applications causes
> CAS to terminate SSO session but fails to terminate application sessions.
> As a client I am using example code from phpCAS documentation.
> Please help me to solve this issue, or, atlease get understanding of it.
>
> Thank you very much for attention,
>
> Viacheslav Babanin
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/6cdc4311-af63-4b20-b461-47147220f4d3%40apereo.org.
