The reason you’re not redirected is because the service you pass to logout does not match your registry definitions.
Try with this instead: https://cas-test.cosmos.esa.int/logout?service=http://test.cosmos.esa.int/ Note the trailing slash. A good regex tester could help you troubleshoot things like this. Or, if you were to login, you’d see CAS telling you that you’re not allowed: https://cas-test.cosmos.esa.int/login?service=http://test.cosmos.esa.int You should adjust the evaluation order for each service in your registry, and the pattern. From: Stephan Arts [mailto:[email protected]] Sent: Tuesday, August 26, 2014 1:35 AM To: [email protected] Subject: Re: [cas-user] [CAS 4] Logout Service Redirect not working Here it is: 151 <bean id="serviceRegistryDao" class="org.jasig.cas.services.InMemoryServiceRegistryDaoImpl" 152 p:registeredServices-ref="registeredServicesList" /> 153 154 <util:list id="registeredServicesList"> 155 <!-- 156 <bean class="org.jasig.cas.services.RegexRegisteredService" 157 p:id="0" p:name="HTTP and IMAP" p:description="Allows HTTP(S) and IMAP(S) protocols" 158 p:serviceId="^(https?|imaps?)://.*" p:evaluationOrder="10000001" /> 159 --> 160 <!-- 161 Use the following definition instead of the above to further restrict access 162 to services within your domain (including sub domains). 163 Note that example.com must be replaced with the domain you wish to permit. 164 This example also demonstrates the configuration of an attribute filter 165 that only allows for attributes whose length is 3. 166 --> 167 <!-- 168 <bean class="org.jasig.cas.services.RegexRegisteredService"> 169 <property name="id" value="1" /> 170 <property name="name" value="HTTP and IMAP on example.com" /> 171 <property name="description" value="Allows HTTP(S) and IMAP(S) protocols on example.com" /> 172 <property name="serviceId" value="^(https?|imaps?)://([A-Za-z0-9_-]+\.)*example\.com/.*" /> 173 <property name="evaluationOrder" value="0" /> 174 <property name="attributeFilter"> 175 <bean class="org.jasig.cas.services.support.RegisteredServiceRegexAttributeFilter" c:regex="^\w{3}$" /> 176 </property> 177 </bean> 178 --> 179 <bean class="org.jasig.cas.services.RegexRegisteredService"> 180 <property name="id" value="0" /> 181 <property name="name" value="HTTP on cosmos.esa.int" /> 182 <property name="description" value="Allows HTTP(S) protocols on cosmos.esa.int" /> 183 <property name="serviceId" value="^https?://([A-Za-z0-9_-]+\.)*cosmos\.esa\.int/.*" /> 184 <property name="evaluationOrder" value="0" /> 185 <property name="allowedAttributes"> 186 <list> 187 <value>Name</value> 188 <value>Email</value> 189 </list> 190 </property> 191 </bean> 192 <bean class="org.jasig.cas.services.RegexRegisteredService"> 193 <property name="id" value="1" /> 194 <property name="name" value="HTTP on cosmos.esa.int" /> 195 <property name="description" value="Allows HTTP(S) protocols on cosmos.esa.int" /> 196 <property name="serviceId" value="^https?://([A-Za-z0-9_-]+\.)*estec\.esa\.int/.*" /> 197 <property name="evaluationOrder" value="0" /> 198 <property name="allowedAttributes"> 199 <list> 200 <value>Name</value> 201 <value>Email</value> 202 </list> 203 </property> 204 </bean> 205 </util:list> On 26/08/14 10:07, Misagh Moayyed wrote: My guess is that the service is not found in the registry somehow. Could you post your registry configuration as well? From: Stephan Arts [mailto:[email protected]] Sent: Tuesday, August 26, 2014 12:11 AM To: [email protected] <mailto:[email protected]> Subject: Re: [cas-user] [CAS 4] Logout Service Redirect not working It's going from 'finishLogout' to 'logoutView', which should only happen if the redirectURL is not set. 2014-08-26 06:53:02,829 DEBUG [org.springframework.webflow.engine.DecisionState] - <Entering state 'finishLogout' of flow 'logout'> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.Transition] - <Executing [Transition@68a15056 on = *, to = logoutView]> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.Transition] - <Exiting state 'finishLogout'> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.ViewState] - <Entering state 'logoutView' of flow 'logout'> For some reason it appears as if the flow execution URL is being broken somewhere: 2014-08-26 06:53:04,335 DEBUG [org.springframework.webflow.mvc.view.AbstractMvcView] - <Rendering MVC [org.springframework.web.servlet.view.JstlView: name 'casLogoutView'; URL [/WEB-INF/view/jsp/cosmos/ui/casLogoutView.jsp]] with model map [{flowRequestContext=[RequestControlContextImpl@d1ff12e externalContext = org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620 <mailto:org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620> , currentEvent = finish, requestScope = map[[empty]], attributes = map[[empty]], messageContext = [DefaultMessageContext@554790b0 sourceMessages = map[[null] -> list[[empty]]]], flowExecution = [FlowExecutionImpl@2c1309bd flow = 'logout', flowSessions = list[[FlowSessionImpl@15e46de6 flow = 'logout', state = 'logoutView', scope = map['logoutRequests' -> list[[empty]], 'logoutIndex' -> 0, 'viewScope' -> map['renderSignIn' -> true]]]]]], flashScope=map[[empty]], logoutRequests=[], logoutIndex=0, currentUser=null, flowExecutionKey=e1s1, flowExecutionUrl=/cas/logout?service=%5BLjava.lang.String%3B%407d7ec2b0&RelayState=e1s1, renderSignIn=true, viewScope=map['renderSignIn' -> true]}]> Complete output: 2014-08-26 06:53:02,643 DEBUG [org.springframework.webflow.mvc.servlet.FlowHandlerMapping] - <No flow mapping found for request with URI '/cas/logout'> 2014-08-26 06:53:02,643 DEBUG [org.springframework.webflow.mvc.servlet.FlowHandlerMapping] - <Mapping request with URI '/cas/logout' to flow with id 'logout'> 2014-08-26 06:53:02,661 DEBUG [org.springframework.webflow.executor.FlowExecutorImpl] - <Launching new execution of flow 'logout' with input map['service' -> 'http://test.cosmos.esa.int']> 2014-08-26 06:53:02,661 DEBUG [org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl] - <Getting FlowDefinition with id 'logout'> 2014-08-26 06:53:02,662 DEBUG [org.springframework.webflow.engine.builder.DefaultFlowHolder] - <Assembling the flow for the first time> 2014-08-26 06:53:02,759 DEBUG [org.springframework.webflow.engine.impl.FlowExecutionImplFactory] - <Creating new execution of 'logout'> 2014-08-26 06:53:02,764 DEBUG [org.springframework.webflow.execution.factory.ConditionalFlowExecutionListenerLoader] - <Loaded [1] of possible 1 listeners for this execution request for flow 'logout', the listeners to attach are list[org.jasig.cas.web.flow.TerminateWebSessionListener@17eb7542]> 2014-08-26 06:53:02,764 DEBUG [org.springframework.webflow.engine.impl.FlowExecutionImpl] - <Starting in org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620 <mailto:org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620> with input map['service' -> 'http://test.cosmos.esa.int']> 2014-08-26 06:53:02,770 DEBUG [org.springframework.webflow.engine.ActionState] - <Entering state 'terminateSession' of flow 'logout'> 2014-08-26 06:53:02,772 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Executing [EvaluateAction@1d23ee10 expression = terminateSessionAction.terminate(flowRequestContext), resultExpression = [null]]> 2014-08-26 06:53:02,773 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Putting action execution attributes map[[empty]]> 2014-08-26 06:53:02,806 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Removing ticket [TGT-3-GjDuVfmF1AWZT6t2jtwUDfX30FYwAYi1Rex4QkCxaDYcheAFd1-01] from registry.> 2014-08-26 06:53:02,811 ERROR [com.github.stephanarts.cas.ticket.registry.ZMQTicketRegistry] - <Missing Ticket> 2014-08-26 06:53:02,814 ERROR [com.github.stephanarts.cas.ticket.registry.ZMQTicketRegistry] - <Missing Ticket> 2014-08-26 06:53:02,814 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <TicketGrantingTicket [TGT-3-GjDuVfmF1AWZT6t2jtwUDfX30FYwAYi1Rex4QkCxaDYcheAFd1-01] cannot be found in the ticket registry.> 2014-08-26 06:53:02,817 ERROR [com.github.stephanarts.cas.ticket.registry.ZMQTicketRegistry] - <Missing Ticket> 2014-08-26 06:53:02,820 ERROR [com.github.stephanarts.cas.ticket.registry.ZMQTicketRegistry] - <Missing Ticket> 2014-08-26 06:53:02,823 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - <Audit trail record BEGIN ============================================================= WHO: audit:unknown WHAT: TGT-3-GjDuVfmF1AWZT6t2jtwUDfX30FYwAYi1Rex4QkCxaDYcheAFd1-01 ACTION: TICKET_GRANTING_TICKET_DESTROYED APPLICATION: CAS WHEN: Tue Aug 26 06:53:02 GMT 2014 CLIENT IP ADDRESS: (redacted) SERVER IP ADDRESS: 127.0.0.1 ============================================================= > 2014-08-26 06:53:02,825 DEBUG [org.jasig.cas.web.support.CookieRetrievingCookieGenerator] - <Removed cookie with name [CASTGC]> 2014-08-26 06:53:02,825 DEBUG [org.jasig.cas.web.support.CookieRetrievingCookieGenerator] - <Removed cookie with name [CASPRIVACY]> 2014-08-26 06:53:02,827 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Clearing action execution attributes map[[empty]]> 2014-08-26 06:53:02,827 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Finished executing [EvaluateAction@1d23ee10 expression = terminateSessionAction.terminate(flowRequestContext), resultExpression = [null]]; result = success> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.engine.Transition] - <Executing [Transition@4a41d5e8 on = *, to = doLogout]> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.engine.Transition] - <Exiting state 'terminateSession'> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.engine.ActionState] - <Entering state 'doLogout' of flow 'logout'> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Executing [EvaluateAction@2842986e expression = logoutAction, resultExpression = [null]]> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Putting action execution attributes map[[empty]]> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Executing org.jasig.cas.web.flow.LogoutAction@2c257268 <mailto:org.jasig.cas.web.flow.LogoutAction@2c257268> > 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Finished executing org.jasig.cas.web.flow.LogoutAction@2c257268 <mailto:org.jasig.cas.web.flow.LogoutAction@2c257268> ; result = finish> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Clearing action execution attributes map[[empty]]> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Finished executing [EvaluateAction@2842986e expression = logoutAction, resultExpression = [null]]; result = finish> 2014-08-26 06:53:02,828 DEBUG [org.springframework.webflow.engine.Transition] - <Executing [Transition@4e7a207c on = finish, to = finishLogout]> 2014-08-26 06:53:02,829 DEBUG [org.springframework.webflow.engine.Transition] - <Exiting state 'doLogout'> 2014-08-26 06:53:02,829 DEBUG [org.springframework.webflow.engine.DecisionState] - <Entering state 'finishLogout' of flow 'logout'> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.Transition] - <Executing [Transition@68a15056 on = *, to = logoutView]> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.Transition] - <Exiting state 'finishLogout'> 2014-08-26 06:53:02,831 DEBUG [org.springframework.webflow.engine.ViewState] - <Entering state 'logoutView' of flow 'logout'> 2014-08-26 06:53:02,841 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Putting conversation attribute 'name' with value logout> 2014-08-26 06:53:02,841 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Putting conversation attribute 'caption' with value null> 2014-08-26 06:53:02,841 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Putting conversation attribute 'description' with value null> 2014-08-26 06:53:02,843 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Putting conversation attribute 'flowExecutionSnapshotGroup' with value org.springframework.webflow.execution.repository.impl.SimpleFlowExecutionSnapshotGroup@398e9aa3 <mailto:org.springframework.webflow.execution.repository.impl.SimpleFlowExecutionSnapshotGroup@398e9aa3> > 2014-08-26 06:53:02,843 DEBUG [org.springframework.webflow.engine.impl.FlowExecutionImpl] - <Assigned key e1s1> 2014-08-26 06:53:04,333 DEBUG [org.springframework.webflow.engine.ViewState] - <Rendering + [ServletMvcView@3145ac9d view = org.springframework.web.servlet.view.JstlView: name 'casLogoutView'; URL [/WEB-INF/view/jsp/cosmos/ui/casLogoutView.jsp]]> 2014-08-26 06:53:04,333 DEBUG [org.springframework.webflow.engine.ViewState] - < Flash scope = map[[empty]]> 2014-08-26 06:53:04,334 DEBUG [org.springframework.webflow.engine.ViewState] - < Messages = [DefaultMessageContext@554790b0 sourceMessages = map[[null] -> list[[empty]]]]> 2014-08-26 06:53:04,334 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Executing [SetAction@4d6c3e8d name = viewScope.renderSignIn, value = true]> 2014-08-26 06:53:04,334 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Putting action execution attributes map[[empty]]> 2014-08-26 06:53:04,334 DEBUG [org.springframework.webflow.execution.AnnotatedAction] - <Clearing action execution attributes map[[empty]]> 2014-08-26 06:53:04,334 DEBUG [org.springframework.webflow.execution.ActionExecutor] - <Finished executing [SetAction@4d6c3e8d name = viewScope.renderSignIn, value = true]; result = success> 2014-08-26 06:53:04,335 DEBUG [org.springframework.webflow.mvc.view.AbstractMvcView] - <Rendering MVC [org.springframework.web.servlet.view.JstlView: name 'casLogoutView'; URL [/WEB-INF/view/jsp/cosmos/ui/casLogoutView.jsp]] with model map [{flowRequestContext=[RequestControlContextImpl@d1ff12e externalContext = org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620 <mailto:org.springframework.webflow.mvc.servlet.MvcExternalContext@69855620> , currentEvent = finish, requestScope = map[[empty]], attributes = map[[empty]], messageContext = [DefaultMessageContext@554790b0 sourceMessages = map[[null] -> list[[empty]]]], flowExecution = [FlowExecutionImpl@2c1309bd flow = 'logout', flowSessions = list[[FlowSessionImpl@15e46de6 flow = 'logout', state = 'logoutView', scope = map['logoutRequests' -> list[[empty]], 'logoutIndex' -> 0, 'viewScope' -> map['renderSignIn' -> true]]]]]], flashScope=map[[empty]], logoutRequests=[], logoutIndex=0, currentUser=null, flowExecutionKey=e1s1, flowExecutionUrl=/cas/logout?service=%5BLjava.lang.String%3B%407d7ec2b0&RelayState=e1s1, renderSignIn=true, viewScope=map['renderSignIn' -> true]}]> 2014-08-26 06:53:04,382 DEBUG [org.jasig.cas.web.support.CasArgumentExtractor] - <Extractor generated service for: http://test.cosmos.esa.int> 2014-08-26 06:53:04,428 DEBUG [org.jasig.cas.web.view.CasReloadableMessageBundle] - <No properties file found for [classpath:custom_messages_en] - neither plain properties nor XML> 2014-08-26 06:53:04,428 DEBUG [org.jasig.cas.web.view.CasReloadableMessageBundle] - <No properties file found for [classpath:custom_messages] - neither plain properties nor XML> 2014-08-26 06:53:04,429 DEBUG [org.jasig.cas.web.view.CasReloadableMessageBundle] - <No properties file found for [classpath:messages_en] - neither plain properties nor XML> 2014-08-26 06:53:04,429 DEBUG [org.jasig.cas.web.view.CasReloadableMessageBundle] - <Loading properties [messages.properties] with encoding 'UTF-8'> 2014-08-26 06:53:04,434 DEBUG [org.springframework.webflow.engine.Transition] - <Completed transition execution. As a result, the new state is 'logoutView' in flow 'logout'> 2014-08-26 06:53:04,434 DEBUG [org.springframework.webflow.engine.Transition] - <Completed transition execution. As a result, the new state is 'logoutView' in flow 'logout'> 2014-08-26 06:53:04,434 DEBUG [org.springframework.webflow.engine.Transition] - <Completed transition execution. As a result, the new state is 'logoutView' in flow 'logout'> 2014-08-26 06:53:04,435 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Locking conversation 1> 2014-08-26 06:53:04,435 DEBUG [org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository] - <Putting flow execution '[FlowExecutionImpl@2c1309bd flow = 'logout', flowSessions = list[[FlowSessionImpl@15e46de6 flow = 'logout', state = 'logoutView', scope = map['logoutRequests' -> list[[empty]], 'logoutIndex' -> 0, 'viewScope' -> map['renderSignIn' -> true]]]]]' into repository> 2014-08-26 06:53:04,445 DEBUG [org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository] - <Adding snapshot to group with id 1> 2014-08-26 06:53:04,445 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Putting conversation attribute 'scope' with value map['flashScope' -> map['messagesMemento' -> map[[empty]]]]> 2014-08-26 06:53:04,445 DEBUG [org.springframework.webflow.conversation.impl.SessionBindingConversationManager] - <Unlocking conversation 1> On 26/08/14 08:36, Misagh Moayyed wrote: So you have two cas.properties? which ones actually do exist? Is one overriding the other? Removing variables, I would start out with the default configuration (take out etc/cas) and once logout is working, I would start moving cas.properties out of WEB-INF. If that also fails, I would turn on DEBUG for spring-webflow and see why the logout webflow is not taking the redirect url. From: Stephan Arts [mailto:[email protected]] Sent: Monday, August 25, 2014 11:13 PM To: [email protected] <mailto:[email protected]> Subject: Re: [cas-user] [CAS 4] Logout Service Redirect not working Hi Misagh, The service is defined in the registry as followed: https?://(a-zA-Z0-9\.)*cosmos.esa.int/.* Though with the default catch-all, the behaviour is the same. I initiate the logout as followed: https://cas-test.cosmos.esa.int/logout?service=http://test.cosmos.esa.int Regards, Stephan On 25/08/14 18:06, Misagh Moayyed wrote: Is the service defined in your registry? How are you initiating logout? From: Stephan Arts [mailto:[email protected]] Sent: Monday, August 25, 2014 4:24 AM To: [email protected] <mailto:[email protected]> Subject: [cas-user] [CAS 4] Logout Service Redirect not working Hi, We am running CAS 4.0 with an overlay and a custom ticket-registry backend. We have been preparing a migration from cas 3.5.2 to 4.0 for the past 6 months, and everything is working beautifully except for the service-redirect after logout. I've been investigating the issue a while now, but I am having trouble discovering what goes wrong. I've changed WEB-INF/spring-configuration/propertyFileConfigurer.xml to this: 35 <!-- 36 First check cas.properties in /etc 37 If it is not present, or if not all properties are available, check the default. 38 --> 39 <context:property-placeholder location= <file:///\\%5C%5C%5C%5C%5C%5Cetc%5Ccas.properties> "file:/etc/cas.properties" order="1" 40 ignore-unresolvable="true" ignore-resource-not-found="true" /> 41 <context:property-placeholder location="/WEB-INF/cas.properties" order="2"/> I've got this in cas.properties: cas.logout.followServiceRedirects=true The change to the propertyFileConfigurer.xml is new in our 4.0 build. I know the properties are read from there just fine because I can override host.name in /etc/cas.properties to change it from what is inside WEB-INF/cas.properties Both WEB-INF/cas.properties and /etc/cas.properties have the cas.logout.followServiceRedirects=true line in them. With DEBUG logging enabled I see entries like this: 2014-08-25 09:55:42,262 DEBUG [org.jasig.cas.web.support.CasArgumentExtractor] - <Extractor generated service for: http://test.cosmos.esa.int> When I do a login and when I do a logout, so that seems to work well. But no indication as to why it wouldn't redirect me back to the service. The documentation I found here[0] would suggest that having a valid service definition and the cas.logout.followServiceRedirects=true property should suffice. Where would you suggest I continue my quest to find the source of the problem? -- HE Space Operations B.V. for ESA - European Space Agency Stephan Arts_ Senior UNIX Engineer Research & Scientific Support Department Science & Robotic Exploration Directorate (SRE-S) [0] http://jasig.github.io/cas/4.0.0/installation/Logout-Single-Signout.html -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] <mailto:[email protected]> as: [email protected] <mailto:[email protected]> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user
