Warren,
I have not used rest interface but it looks like the SSO session identifier is
not available (this is TGC for 'normal' browsing).
Is your objective to have webserverA use services of webserverB or will this be
two separate services?
If the former, look into proxying.
Are you saying that the second service, webserverB, is CAS itself?
I think AUTHENTICATION_EVENT_TRIGGERED happens whenever cas/login is accessed.
If you do not have a default destination configured (used when no service=...
parameter is sent), I would think the log in page would be displayed. Check
developer tools to be sure.
Ray
On Fri, 2019-03-22 at 14:23 -0700, Warren White wrote:
Hi Ray,
That was me debugging in browser, that is why the ~30s difference.
Only one CAS server, v6.0.0. My client and server times are same.
I have modified cas.ticket.st.timeToKillInSeconds to accommodate debugging in
client browser.
Here is the log output:
2019-03-22 14:07:04,159 DEBUG
[org.apereo.cas.rest.factory.DefaultTicketGrantingTicketResourceEntityResponseFactory]
- <Created response entity [<201 CREATED
Created,TGT-5-*****8b3UT7Cxc6Mdev,{Location=[https://dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]}>]>
2019-03-22 14:07:04,159 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: wwhite
WHAT:
[status=201-CREATED,location=https://dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]
ACTION: REST_API_TICKET_GRANTING_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,174 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] -
<Evaluating authentication principal [SimplePrincipal(id=wwhite,
attributes={last_name=[White], personRole=[login, admin, student, clerical,
secondary], first_name=[Warren], email=[[email protected]]})] for
inclusion in result>
2019-03-22 14:07:04,174 DEBUG
[org.apereo.cas.authentication.CoreAuthenticationUtils] - <Merged attributes
with the final result as [{last_name=[White], personRole=[login, admin,
student, clerical, secondary], first_name=[Warren],
email=[[email protected]]}]>
2019-03-22 14:07:04,174 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] - <Collected
principal attributes [{last_name=[White], personRole=[login, admin, student,
clerical, secondary], first_name=[Warren], email=[[email protected]]}] for
inclusion in this result for principal [wwhite]>
2019-03-22 14:07:04,174 DEBUG
[org.apereo.cas.authentication.CoreAuthenticationUtils] - <Merged attributes
with the final result as [{credentialType=[UsernamePasswordCredential],
authenticationMethod=[QueryDatabaseAuthenticationHandler],
successfulAuthenticationHandlers=[QueryDatabaseAuthenticationHandler]}]>
2019-03-22 14:07:04,174 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] - <Finalized
authentication attributes [{credentialType=[UsernamePasswordCredential],
authenticationMethod=[QueryDatabaseAuthenticationHandler],
successfulAuthenticationHandlers=[QueryDatabaseAuthenticationHandler]}] for
inclusion in this authentication result>
2019-03-22 14:07:04,175 DEBUG
[org.apereo.cas.authentication.DefaultPrincipalElectionStrategy] - <Nominated
[SimplePrincipal(id=wwhite, attributes={last_name=[White], personRole=[login,
admin, student, clerical, secondary], first_name=[Warren],
email=[[email protected]]})] as the primary principal>
2019-03-22 14:07:04,175 DEBUG
[org.apereo.cas.authentication.DefaultAuthenticationResultBuilder] -
<Determined primary authentication principal to be [SimplePrincipal(id=wwhite,
attributes={last_name=[White], personRole=[login, admin, student, clerical,
secondary], first_name=[Warren], email=[[email protected]]})]>
2019-03-22 14:07:04,176 DEBUG
[org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy] - <Skipping
access strategy policy, since no attributes rules are defined>
2019-03-22 14:07:04,176 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: wwhite
WHAT: [result=Service Access
Granted,service=https://dev.CASserver/cas/,requiredAttributes={}]
ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,176 DEBUG
[org.apereo.cas.services.RegisteredServiceAccessStrategyUtils] - <Current
authentication via ticket [TGT-5-*****8b3UT7Cxc6Mdev] allows service
[https://dev.CASserver/cas/] to participate in the existing SSO session>
2019-03-22 14:07:04,176 DEBUG
[org.apereo.cas.ticket.factory.DefaultServiceTicketFactory] - <Looking up
service ticket id generator for
[org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl]>
2019-03-22 14:07:04,177 DEBUG
[org.apereo.cas.ticket.factory.DefaultServiceTicketFactory] - <Attempting to
encode service ticket [ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,177 DEBUG
[org.apereo.cas.ticket.factory.DefaultServiceTicketFactory] - <Encoded service
ticket id [ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,177 DEBUG
[org.apereo.cas.ticket.registry.AbstractMapBasedTicketRegistry] - <Added ticket
[TGT-5-*****8b3UT7Cxc6Mdev] to registry.>
2019-03-22 14:07:04,177 DEBUG
[org.apereo.cas.ticket.registry.AbstractMapBasedTicketRegistry] - <Added ticket
[ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] to registry.>
2019-03-22 14:07:04,177 INFO
[org.apereo.cas.DefaultCentralAuthenticationService] - <Granted ticket
[ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] for service [https://dev.CASserver/cas/]
and principal [wwhite]>
2019-03-22 14:07:04,177 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: wwhite
WHAT: ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev for https://dev.CASserver/cas/
ACTION: SERVICE_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,177 DEBUG
[org.apereo.cas.rest.factory.CasProtocolServiceTicketResourceEntityResponseFactory]
- <Generated service ticket [ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
2019-03-22 14:07:04,178 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: wwhite
WHAT: [status=200-OK,body=ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]
ACTION: REST_API_SERVICE_TICKET_CREATED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
>
2019-03-22 14:07:04,226 INFO
[org.apereo.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit
trail record BEGIN
=============================================================
WHO: audit:unknown
WHAT: [event=success,timestamp=Fri Mar 22 14:07:04 PDT
2019,source=RankedMultifactorAuthenticationProviderWebflowEventResolver]
ACTION: AUTHENTICATION_EVENT_TRIGGERED
APPLICATION: CAS
WHEN: Fri Mar 22 14:07:04 PDT 2019
CLIENT IP ADDRESS: 10.6.61.64
SERVER IP ADDRESS: 10.6.2.7
=============================================================
Just to be clear, the last log audit trail, is after logging in from webserverA
successfully, then forwards to webserverB, which asks for user/pass again.
For my test setup, I am using webserverA(Joomla) with pop up login form, to
access webserverB which is default CAS server.
Warren E. White
Programmer Analyst
South Island Distance Education School (SIDES)
On Friday, March 22, 2019 at 1:02:36 PM UTC-7, rbon wrote:
Warren,
Is the same ST being used by both applications? Or is app B really taking 30s
to submit ST for validation?
If you have more than one CAS server, verify that their clocks are in sync.
Ray
On Fri, 2019-03-22 at 12:25 -0700, Warren White wrote:
Found this in error log:
<Ticket has expired because the difference between current time
[2019-03-22T19:06:43.241651Z] and ticket time [2019-03-22T19:06:10.086215Z] is
greater than or equal to [10].>
On Friday, March 22, 2019 at 10:24:31 AM UTC-7, Warren White wrote:
I am having issues with a javascript pop up login window, that when URL
redirect to another service, the CAS login screen is displayed.
I have application A(websiteA), where user logs in using a javascript pop up
window, which succeeds.
After successful login, URL redirect to application B(websiteB).
But when websiteB is displayed, it behaves as if user has not logged in, and
CAS login page is displayed.
CAS login server is serverCAS.
I do have fully functional CAS server, where normal process uses CAS login
screen.
ExampleA: webserverX -> login -> serverCAS -> login page -> success -> forward
back to webserverX
What I need is:
ExampleB: websiteA-> login popup -> authentication success -> forward to
websiteB
But websiteB forwards to serverCAS login page.
It is as if ssoEnabled=false, which it is not.
I see in logs that for ExampleA SERVICE_TICKET_VALIDATE_SUCCESS happens.
And in ExampleB, I do not see that.
Does ticket validation need to be done?
Any advice?
--
Ray Bon
Programmer analyst
Development Services, University Systems
2507218831 | CLE 019 | [email protected]<javascript:>
--
Ray Bon
Programmer analyst
Development Services, University Systems
2507218831 | CLE 019 | [email protected]
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/1553305130.3399.127.camel%40uvic.ca.
