Hello Ray,
Thank you very much with your replies.
I discovered what I was attempting to do would not work using javascript
and REST api, as you mention "SSO session identifier is not available".
webserverA and webserverB are two separate services. CAS is a separate as
well.
I have a temporary workaround for now, using iframe(CAS) for javascript
popup login window on webserverA, which will display URL link to webserverB
upon successful login.
I will look into proxying as this is probably the correct config that I
need.
Thanks again with your help.
Warren
On Friday, March 22, 2019 at 6:38:57 PM UTC-7, rbon wrote:
>
> Warren,
>
> I have not used rest interface but it looks like the SSO session
> identifier is not available (this is TGC for 'normal' browsing).
>
> Is your objective to have webserverA use services of webserverB or will
> this be two separate services?
>
> If the former, look into proxying.
>
> Are you saying that the second service, webserverB, is CAS itself?
>
> I think AUTHENTICATION_EVENT_TRIGGERED happens whenever cas/login is
> accessed. If you do not have a default destination configured (used when no
> service=... parameter is sent), I would think the log in page would be
> displayed. Check developer tools to be sure.
>
> Ray
>
> On Fri, 2019-03-22 at 14:23 -0700, Warren White wrote:
>
> Hi Ray,
> That was me debugging in browser, that is why the ~30s difference.
> Only one CAS server, v6.0.0. My client and server times are same.
>
> I have modified cas.ticket.st.timeToKillInSeconds to accommodate debugging
> in client browser.
>
> Here is the log output:
>
> 2019-03-22 14:07:04,159 DEBUG [org.apereo.cas.rest.factory.
> DefaultTicketGrantingTicketResourceEntityResponseFactory] - <Created
> response entity [<201 CREATED Created,TGT-5-*****8b3UT7Cxc6Mdev,{Location
> =[https://dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]}>]>
>
> 2019-03-22 14:07:04,159 INFO [org.apereo.inspektr.audit.support.
> Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
>
> =============================================================
>
> WHO: wwhite
>
> WHAT: [status=201-CREATED,location=https:
> //dev.CASserver/cas/v1/tickets/TGT-5-*****8b3UT7Cxc6Mdev]
>
> ACTION: REST_API_TICKET_GRANTING_TICKET_CREATED
>
> APPLICATION: CAS
>
> WHEN: Fri Mar 22 14:07:04 PDT 2019
>
> CLIENT IP ADDRESS: 10.6.61.64
>
> SERVER IP ADDRESS: 10.6.2.7
>
> =============================================================
>
>
>
> >
>
> 2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
> DefaultAuthenticationResultBuilder] - <Evaluating authentication
> principal [SimplePrincipal(id=wwhite, attributes={last_name=[White],
> personRole=[login, admin, student, clerical, secondary], first_name=[
> Warren], email=[[email protected]]})] for inclusion in result>
>
> 2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
> CoreAuthenticationUtils] - <Merged attributes with the final result as [{
> last_name=[White], personRole=[login, admin, student, clerical, secondary
> ], first_name=[Warren], email=[[email protected]]}]>
>
> 2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
> DefaultAuthenticationResultBuilder] - <Collected principal attributes [{
> last_name=[White], personRole=[login, admin, student, clerical, secondary
> ], first_name=[Warren], email=[[email protected]]}] for inclusion in
> this result for principal [wwhite]>
>
> 2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
> CoreAuthenticationUtils] - <Merged attributes with the final result as [{
> credentialType=[UsernamePasswordCredential], authenticationMethod=[
> QueryDatabaseAuthenticationHandler], successfulAuthenticationHandlers=[
> QueryDatabaseAuthenticationHandler]}]>
>
> 2019-03-22 14:07:04,174 DEBUG [org.apereo.cas.authentication.
> DefaultAuthenticationResultBuilder] - <Finalized authentication
> attributes [{credentialType=[UsernamePasswordCredential],
> authenticationMethod=[QueryDatabaseAuthenticationHandler],
> successfulAuthenticationHandlers=[QueryDatabaseAuthenticationHandler]}]
> for inclusion in this authentication result>
>
> 2019-03-22 14:07:04,175 DEBUG [org.apereo.cas.authentication.
> DefaultPrincipalElectionStrategy] - <Nominated [SimplePrincipal(id=wwhite,
> attributes={last_name=[White], personRole=[login, admin, student, clerical
> , secondary], first_name=[Warren], email=[[email protected]]})] as
> the primary principal>
>
> 2019-03-22 14:07:04,175 DEBUG [org.apereo.cas.authentication.
> DefaultAuthenticationResultBuilder] - <Determined primary authentication
> principal to be [SimplePrincipal(id=wwhite, attributes={last_name=[White],
> personRole=[login, admin, student, clerical, secondary], first_name=[
> Warren], email=[[email protected]]})]>
>
> 2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.services.
> DefaultRegisteredServiceAccessStrategy] - <Skipping access strategy policy
> , since no attributes rules are defined>
>
> 2019-03-22 14:07:04,176 INFO [org.apereo.inspektr.audit.support.
> Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
>
> =============================================================
>
> WHO: wwhite
>
> WHAT: [result=Service Access Granted,service=https:
> //dev.CASserver/cas/,requiredAttributes={}]
>
> ACTION: SERVICE_ACCESS_ENFORCEMENT_TRIGGERED
>
> APPLICATION: CAS
>
> WHEN: Fri Mar 22 14:07:04 PDT 2019
>
> CLIENT IP ADDRESS: 10.6.61.64
>
> SERVER IP ADDRESS: 10.6.2.7
>
> =============================================================
>
>
>
> >
>
> 2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.services.
> RegisteredServiceAccessStrategyUtils] - <Current authentication via
> ticket [TGT-5-*****8b3UT7Cxc6Mdev] allows service
> [https://dev.CASserver/cas/]
> to participate in the existing SSO session>
>
> 2019-03-22 14:07:04,176 DEBUG [org.apereo.cas.ticket.factory.
> DefaultServiceTicketFactory] - <Looking up service ticket id generator for
> [org.apereo.cas.authentication.principal.SimpleWebApplicationServiceImpl]>
>
> 2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.factory.
> DefaultServiceTicketFactory] - <Attempting to encode service ticket [ST-5-
> BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
>
> 2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.factory.
> DefaultServiceTicketFactory] - <Encoded service ticket id [ST-5-
> BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
>
> 2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.registry.
> AbstractMapBasedTicketRegistry] - <Added ticket [TGT-5-*****8b3UT7Cxc6Mdev
> ] to registry.>
>
> 2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.ticket.registry.
> AbstractMapBasedTicketRegistry] - <Added ticket [ST-5-
> BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] to registry.>
>
> 2019-03-22 14:07:04,177 INFO [org.apereo.cas.
> DefaultCentralAuthenticationService] - <Granted ticket [ST-5-
> BWTZN8e3zEXGkqIV3JZWOIak8Mwdev] for service [https://dev.CASserver/cas/]
> and principal [wwhite]>
>
> 2019-03-22 14:07:04,177 INFO [org.apereo.inspektr.audit.support.
> Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
>
> =============================================================
>
> WHO: wwhite
>
> WHAT: ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev for https://dev.CASserver/cas/
>
> ACTION: SERVICE_TICKET_CREATED
>
> APPLICATION: CAS
>
> WHEN: Fri Mar 22 14:07:04 PDT 2019
>
> CLIENT IP ADDRESS: 10.6.61.64
>
> SERVER IP ADDRESS: 10.6.2.7
>
> =============================================================
>
>
>
> >
>
> 2019-03-22 14:07:04,177 DEBUG [org.apereo.cas.rest.factory.
> CasProtocolServiceTicketResourceEntityResponseFactory] - <Generated
> service ticket [ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]>
>
> 2019-03-22 14:07:04,178 INFO [org.apereo.inspektr.audit.support.
> Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
>
> =============================================================
>
> WHO: wwhite
>
> WHAT: [status=200-OK,body=ST-5-BWTZN8e3zEXGkqIV3JZWOIak8Mwdev]
>
> ACTION: REST_API_SERVICE_TICKET_CREATED
>
> APPLICATION: CAS
>
> WHEN: Fri Mar 22 14:07:04 PDT 2019
>
> CLIENT IP ADDRESS: 10.6.61.64
>
> SERVER IP ADDRESS: 10.6.2.7
>
> =============================================================
>
>
>
> >
>
> 2019-03-22 14:07:04,226 INFO [org.apereo.inspektr.audit.support.
> Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN
>
> =============================================================
>
> WHO: audit:unknown
>
> WHAT: [event=success,timestamp=Fri Mar 22 14:07:04 PDT 2019,source=
> RankedMultifactorAuthenticationProviderWebflowEventResolver]
>
> ACTION: AUTHENTICATION_EVENT_TRIGGERED
>
> APPLICATION: CAS
>
> WHEN: Fri Mar 22 14:07:04 PDT 2019
>
> CLIENT IP ADDRESS: 10.6.61.64
>
> SERVER IP ADDRESS: 10.6.2.7
>
> =============================================================
>
>
> Just to be clear, the last log audit trail, is after logging in from
> webserverA successfully, then forwards to webserverB, which asks for
> user/pass again.
> For my test setup, I am using webserverA(Joomla) with pop up login form,
> to access webserverB which is default CAS server.
>
>
> Warren E. White
> Programmer Analyst
> South Island Distance Education School (SIDES)
>
> On Friday, March 22, 2019 at 1:02:36 PM UTC-7, rbon wrote:
>
> Warren,
>
> Is the same ST being used by both applications? Or is app B really taking
> 30s to submit ST for validation?
>
> If you have more than one CAS server, verify that their clocks are in sync.
>
> Ray
>
> On Fri, 2019-03-22 at 12:25 -0700, Warren White wrote:
>
> Found this in error log:
>
> <Ticket has expired because the difference between current time
> [2019-03-22T19:06:43.241651Z] and ticket time [2019-03-22T19:06:10.086215Z]
> is greater than or equal to [10].>
>
> On Friday, March 22, 2019 at 10:24:31 AM UTC-7, Warren White wrote:
>
> I am having issues with a javascript pop up login window, that when URL
> redirect to another service, the CAS login screen is displayed.
>
> I have application A(websiteA), where user logs in using a javascript pop
> up window, which succeeds.
> After successful login, URL redirect to application B(websiteB).
> But when websiteB is displayed, it behaves as if user has not logged in,
> and CAS login page is displayed.
> CAS login server is serverCAS.
>
> I do have fully functional CAS server, where normal process uses CAS login
> screen.
> ExampleA: webserverX -> login -> serverCAS -> login page -> success ->
> forward back to webserverX
>
> What I need is:
> ExampleB: websiteA-> login popup -> authentication success -> forward to
> websiteB
> But websiteB forwards to serverCAS login page.
>
> It is as if ssoEnabled=false, which it is not.
>
>
> I see in logs that for ExampleA SERVICE_TICKET_VALIDATE_SUCCESS happens.
> And in ExampleB, I do not see that.
>
> Does ticket validation need to be done?
> Any advice?
>
>
> --
> Ray Bon
> Programmer analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected]
>
>
> --
> Ray Bon
> Programmer analyst
> Development Services, University Systems
> 2507218831 | CLE 019 | [email protected] <javascript:>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/bfdf54ea-f329-4981-a98a-0d82417c498f%40apereo.org.
