So, I'm trying to get ClearPass working in a load-balanced CAS environment with a memcache ticket registry. I discovered this Wiki entry:
https://wiki.jasig.org/display/CASUM/ClearPass+and+Multiple+Server+Configurations But I can't seem to get it working. My clearpass-configuration.xml is as follows: <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to Jasig under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. Jasig licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at the following location: http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <beans xmlns="http://www.springframework.org/schema/beans"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xmlns:p="http://www.springframework.org/schema/p"; xmlns:sec="http://www.springframework.org/schema/security"; xmlns:util="http://www.springframework.org/schema/util"; xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd";> <bean id="CPserialTranscoder" class="net.spy.memcached.transcoders.SerializingTranscoder" p:compressionThreshold="2048" /> <bean id="memcachedMap" class="net.spy.memcached.CacheMap"> <constructor-arg index="0"> <bean class="net.spy.memcached.spring.MemcachedClientFactoryBean" p:servers="${memcached.servers}" p:protocol="${memcached.protocol}" p:locatorType="${memcached.locatorType}" p:failureMode="${memcached.failureMode}" p:transcoder-ref="CPserialTranscoder"> <property name="hashAlg"> <util:constant static-field="net.spy.memcached.DefaultHashAlgorithm.${memcached.hashAlgorithm}" /> </property> </bean> </constructor-arg> <constructor-arg index="1" value="7200" /> <!-- this is the timeout for the cache in seconds --> <constructor-arg index="2" value="clearPass_" /> <!-- this is the prefix for the keys stored in the map --> </bean> <bean id="credentialsCache" class="org.jasig.cas.extension.clearpass.EncryptedMapDecorator"> <constructor-arg index="0" ref="memcachedMap" /> <constructor-arg index="1" value="********" /> <!-- Replace the salt and secret key with one of your choosing --> <constructor-arg index="2" value="********" /> </bean> <!-- NOTE: Name of delegated ticket registry bean in ticketRegistry.xml must be "ticketRegistryValue." --> <bean id="ticketRegistry" class="org.jasig.cas.extension.clearpass.TicketRegistryDecorator"> <constructor-arg index="0" ref="ticketRegistryValue"/> <constructor-arg index="1" ref="credentialsCache"/> </bean> <!-- implementation of the clear pass vending service --> <bean id="clearPassController" class="org.jasig.cas.extension.clearpass.ClearPassController"> <constructor-arg index="0" ref="credentialsCache"/> </bean> <bean id="handlerMappingClearPass" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping" p:alwaysUseFullPath="true"> <property name="mappings"> <props> <prop key="/clearPass"> clearPassController </prop> </props> </property> </bean> <!-- Security configuration --> <bean id="clearPassFilterChainProxy" class="org.springframework.security.web.FilterChainProxy"> <sec:filter-chain-map request-matcher="ant"> <sec:filter-chain pattern="/clearPass" filters="casValidationFilter,httpServletRequestWrappingFilter"/> </sec:filter-chain-map> </bean> <!-- NOTE: It is dangerous to include a non-proxied CAS Filter for protecting /clearPass. Non-proxied CAS Filters like AuthenticationFilter don't honor the Filter chain proxy protection mechanism and, worse yet, allow access to the logged on user's cleartext password. It could be useful to enable this bean for easy testing of clearPass functionality however.--> <!-- <bean id="casAuthenticationFilter" class="org.jasig.cas.client.authentication.AuthenticationFilter"> <property name="casServerLoginUrl" value="${cas.securityContext.casProcessingFilterEntryPoint.loginUrl}"/> <property name="serverName" value="${server.name}"/> </bean> --> <!-- NOTE: A bean named clearPassProxyList must define the list of proxying services authorized to obtain clearpass credentials. --> <bean id="casValidationFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter"> <property name="serverName" value="${server.name}"/> <property name="exceptionOnValidationFailure" value="false"/> <property name="useSession" value="true"/> <property name="ticketValidator"> <bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"> <constructor-arg index="0" value="${server.prefix}" /> <property name="allowedProxyChains" ref="clearPassProxyList" /> </bean> </property> </bean> <bean id="httpServletRequestWrappingFilter" class="org.jasig.cas.client.util.HttpServletRequestWrapperFilter"/> </beans> Here are the properties from the cas.properties file: # MemCached properties memcached.servers=hera.yc.edu:11212,liam.yc.edu:11212,nicholas.yc.edu:11212,saul.yc.edu:11212 memcached.protocol=BINARY memcached.locatorType=CONSISTENT memcached.failureMode=Redistribute memcached.hashAlgorithm=FNV1_64_HASH expiration.policy.tgt.validity_period=${tgt.maxTimeToLiveInSeconds} expiration.policy.st.validity_period=${st.timeToKillInSeconds} The logs don't show any errors on startup, but when you try to authenticate with the CAS server it comes back and says the CAS server is unavailable. Thanks in advance, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user
