Pablo, This looks like java (rather than cas/tomcat) complaining. If you use self signed certs to identify your websites (shib and cas), you will need to add them to the java keystore (in the java directory). thekeystore in /etc/cas is for cas operation.
Ray On Sat, 2021-08-21 at 08:34 -0700, Pablo Vidaurri wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. I have CAS 6.3, ran the createKeystore and get a "thekeystore" file created in /etc/cas. I also imported the /etc/cas/cas.cer to my JDK cacert file. Great! I can login via auth/login and logging in with a CAS Client also works. I see user attributes also returned. Next, I enabled shibboleth with the following cas.properties: cas.authn.saml-idp.entity-id=https://localhost/idp/shibboleth cas.authn.saml-idp.metadata.location=file:/etc/cas/saml I do not see an explanation on what the other config options are for so left them out for now. On startup, I see the idp metadata file and key/cer files created in /etc/cas/saml. Now using a SAML Client that works with standalone Shibboleth 4.x, I have imported the idp metadata file into the client app and setup the sp metadata file in CAS. In my service file: { "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId" : "http://mysamlclient.com/sample/samlclient";, "name" : "SAML Localhost", "id" : 20210729178235, "evaluationOrder" : 30, "metadataLocation" : "file:/etc/cas/metadata/local_saml_client.xml" } and I have the sp metadata file in /etc/cas/metadata/local_saml_client.xml. Now when trying to access my saml client, I do get redirected to CAS sign in page but then on redirect back to the client I get an error: - <SSL error getting response from host: localhost : Error Message: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed> javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed CAS client and logging in via cas/login page still works, just not with SAML client. Not sure which keystore Shib is using at this point. Is it different than the /etc/cas/keystore and the JDK cacert file? Any pointers would be appreciated. Thanks. -psv -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d27ace02d36f9396b6f908680494457486dea21f.camel%40uvic.ca.
