Hi Ray,
That was me debugging in browser, that is why the ~30s difference.
Only one CAS server, v6.0.0. My client and server times are same.
I have modified cas.ticket.st.timeToKillInSeconds to accommodate debugging
in client browser.
Here is the log output:
2019-03-22 14:07:04,159 DEBUG [org.apereo.cas.rest.factory.
DefaultTicketGrantingTicketResourceEntityResponseFactory] - <Created
response entity [<201 CREATED Created,TGT-5-*****8b3UT7Cxc6Mdev,{Location=[
https://dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]}>]>
2019-03-22 14:07:04,159 INFO [org.apereo.inspektr.audit.support.
Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: wwhite
WHAT: [status=201-CREATED,location=https:
//dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]
ACTION: REST_API_TICKET_GRANTING_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
DefaultAuthenticationResultBuilder] - <Evaluating authentication principal [
SimplePrincipal(id=wwhite, attributes={last_name=[White], personRole=[login,
admin, student, clerical, secondary], first_name=[Warren], email=[white.
[email protected]]})] for inclusion in result>
2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
CoreAuthenticationUtils] - <Merged attributes with the final result as [{
last_name=[White], personRole=[login, admin, student, clerical, secondary],
first_name=[Warren], email=[[email protected]]}]>
2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
DefaultAuthenticationResultBuilder] - <Collected principal attributes [{
last_name=[White], personRole=[login, admin, student, clerical, secondary],
first_name=[Warren], email=[[email protected]]}] for inclusion in this
result for principal [wwhite]>
2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
CoreAuthenticationUtils] - <Merged attributes with the final result as [{
credentialType=[UsernamePasswordCredential], authenticationMethod=[
QueryDatabaseAuthenticationHandler], successfulAuthenticationHandlers=[
QueryDatabaseAuthenticationHandler]}]>
2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
DefaultAuthenticationResultBuilder] - <Finalized authentication attributes
[{credentialType=[UsernamePasswordCredential], authenticationMethod=[
QueryDatabaseAuthenticationHandler], successfulAuthenticationHandlers=[
QueryDatabaseAuthenticationHandler]}] for inclusion in this authentication
result>
2019-03-22 14:07:04,175 DEBUG [org.apereo.cas.authentication.
DefaultPrincipalElectionStrategy] - <Nominated [SimplePrincipal(id=wwhite,
attributes={last_name=[White], personRole=[login, admin, student, clerical,
secondary], first_name=[Warren], email=[[email protected]]})] as the
primary principal>
2019-03-22 14:07:04,175 DEBUG [org.apereo.cas.authentication.
DefaultAuthenticationResultBuilder] - <Determined primary authentication
principal to be [SimplePrincipal(id=wwhite, attributes={last_name=[White],
personRole=[login, admin, student, clerical, secondary], first_name=[Warren
], email=[[email protected]]})]>
2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.services.
DefaultRegisteredServiceAccessStrategy] - <Skipping access strategy policy,
since no attributes rules are defined>
2019-03-22 14:07:04,176 INFO [org.apereo.inspektr.audit.support.
Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: wwhite
WHAT: [result=Service Access Granted,service=https:
//dev.CASserver/cas/,requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.services.
RegisteredServiceAccessStrategyUtils] - <Current authentication via ticket [
TGT-5-*****8b3UT7Cxc6Mdev] allows service [https://dev.CASserver/cas/] to
participate in the existing SSO session>
2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.ticket.factory.
DefaultServiceTicketFactory] - <Looking up service ticket id generator for [
org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl]>
2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.factory.
DefaultServiceTicketFactory] - <Attempting to encode service ticket [ST-5-
BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.factory.
DefaultServiceTicketFactory] - <Encoded service ticket id [ST-5-
BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.registry.
AbstractMapBasedTicketRegistry] - <Added ticket [TGT-5-*****8b3UT7Cxc6Mdev]
to registry.>
2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.registry.
AbstractMapBasedTicketRegistry] - <Added ticket [ST-5-
BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] to registry.>
2019-03-22 14:07:04,177 INFO [org.apereo.cas.
DefaultCentralAuthenticationService] - <Granted ticket [ST-5-
BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] for service [https://dev.CASserver/cas/]
and principal [wwhite]>
2019-03-22 14:07:04,177 INFO [org.apereo.inspektr.audit.support.
Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: wwhite
WHAT: ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev for https://dev.CASserver/cas/
ACTION: SERVICE_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.rest.factory.
CasProtocolServiceTicketResourceEntityResponseFactory] - <Generated service
ticket [ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,178 INFO [org.apereo.inspektr.audit.support.
Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: wwhite
WHAT: [status=200-OK,body=ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]
ACTION: REST_API_SERVICE_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,226 INFO [org.apereo.inspektr.audit.support.
Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
=============================================================
WHO: audit:unknown
WHAT: [event=success,timestamp=Fri Mar 22 14:07:04 PDT 2019,source=
RankedMultifactorAuthenticationProviderWebflowEventResolver]
ACTION: AUTHENTICATION_EVENT_TRIGGERED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
Just to be clear, the last log audit trail, is after logging in from
webserverA successfully, then forwards to webserverB, which asks for
user/pass again.
For my test setup, I am using webserverA(Joomla) with pop up login form, to
access webserverB which is default CAS server.
Warren E. White
Programmer Analyst
South Island Distance Education School (SIDES)
On Friday, March 22, 2019 at 1:02:36 PM UTC-7, rbon wrote:
>
> Warren,
>
> Is the same ST being used by both applications? Or is app B really taking
> 30s to submit ST for validation?
>
> If you have more than one CAS server, verify that their clocks are in sync.
>
> Ray
>
> On Fri, 2019-03-22 at 12:25 -0700, Warren White wrote:
>
> Found this in error log:
>
> <Ticket has expired because the difference between current time
> [2019-03-22T19:06:43.241651Z] and ticket time [2019-03-22T19:06:10.086215Z]
> is greater than or equal to [10].>
>
> On Friday, March 22, 2019 at 10:24:31 AM UTC-7, Warren White wrote:
>
> I am having issues with a javascript pop up login window, that when URL
> redirect to another service, the CAS login screen is displayed.
>
> I have application A(websiteA), where user logs in using a javascript pop
> up window, which succeeds.
> After successful login, URL redirect to application B(websiteB).
> But when websiteB is displayed, it behaves as if user has not logged in,
> and CAS login page is displayed.
> CAS login server is serverCAS.
>
> I do have fully functional CAS server, where normal process uses CAS login
> screen.
> ExampleA: webserverX -> login -> serverCAS -> login page -> success ->
> forward back to webserverX
>
> What I need is:
> ExampleB: websiteA-> login popup -> authentication success -> forward to
> websiteB
> But websiteB forwards to serverCAS login page.
>
> It is as if ssoEnabled=false, which it is not.
>
>
> I see in logs that for ExampleA SERVICE_TICKET_VALIDATE_SUCCESS happens.
> And in ExampleB, I do not see that.
>
> Does ticket validation need to be done?
> Any advice?
>
>
> --
> Ray Bon
> Programmer analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected] <javascript:>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/6367b6c1-8168-4621-8c3a-192a8f9fa9f5%40apereo.org.
