Re: [cas-user] CAS 5.0.0RC1 - MFA webflow not found

2016-09-26 Thread Philippe MARASSE 
Hello,

Thanks for your answer, I've opened this issue :
https://github.com/apereo/cas/issues/2018

Regards

Le 23/09/2016 à 19:35, Misagh Moayyed a écrit :
>> Second test :
>>   - SPNEGO
>>   - yubikey
>>
>> => works oddly : my client service page uses phpCAS, on first pass I
>> get an "Authentication Error, try again", If I click on "try again",
>> then yubikey token is asked, and after validation, I'm logged to the
>> application.
>>
>> I suspect that transition on success after SPNEGO to be incorrect.
>> It's hardcoded to
>> CasWebflowConstants.TRANSITION_ID_SEND_TICKET_GRANTING_TICKET, but
>> MFA shoud be inspected before sending TGC, shouldn't it ?
>
> It should, yes. Do submit a bug plz. I suspect MFA only takes into
> account interactive authn, which is something that needs to be fixed. 
>
> -- 
> You received this message because you are subscribed to the Google
> Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to cas-user+unsubscr...@apereo.org
> .
> To post to this group, send email to cas-user@apereo.org
> .
> Visit this group at
> https://groups.google.com/a/apereo.org/group/cas-user/.
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/etPan.57e567f8.1ae214b4.2e6e%40unicon.net
> .
> For more options, visit https://groups.google.com/a/apereo.org/d/optout.

-- 
Philippe MARASSE

Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit
CS 10587 - 370 avenue Jacques Cœur 
86021 Poitiers Cedex
Tel : 05.49.44.57.19

-- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To post to this group, send email to cas-user@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/78fb387b-e387-e88f-9418-237b7df61cae%40ch-poitiers.fr.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.


smime.p7s
Description: Signature cryptographique S/MIME

Re: [cas-user] CAS 5.0.0RC1 - MFA webflow not found

2016-09-23 Thread Misagh Moayyed 
Second test :
  - SPNEGO
  - yubikey

=> works oddly : my client service page uses phpCAS, on first pass I get an 
"Authentication Error, try again", If I click on "try again", then yubikey 
token is asked, and after validation, I'm logged to the application.

I suspect that transition on success after SPNEGO to be incorrect. It's 
hardcoded to CasWebflowConstants.TRANSITION_ID_SEND_TICKET_GRANTING_TICKET, but 
MFA shoud be inspected before sending TGC, shouldn't it ?
It should, yes. Do submit a bug plz. I suspect MFA only takes into account 
interactive authn, which is something that needs to be fixed. 

-- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To post to this group, send email to cas-user@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/etPan.57e567f8.1ae214b4.2e6e%40unicon.net.
For more options, visit https://groups.google.com/a/apereo.org/d/optout.

Re: [cas-user] CAS 5.0.0RC1 - MFA webflow not found

2016-09-20 Thread Philippe MARASSE 
Hello,

I've rolled back to simple LDAP Authentication + Yubikey, my service
definition (generated via cas-management webapp) is :

{
  @class: org.apereo.cas.services.RegexRegisteredService
  serviceId: https?://myserver.example.com/testcas/cas5v3.php
  name: test mfa
  id: 3139139547012322
  description: Test MFA Yubikey
  evaluationOrder: 1
  logoutType: NONE
  attributeReleasePolicy:
  {
@class: org.apereo.cas.services.ReturnAllAttributeReleasePolicy
principalAttributesRepository:
{
  @class:
org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository
  expiration: 2
  timeUnit: HOURS
}
authorizedToReleaseCredentialPassword: false
authorizedToReleaseProxyGrantingTicket: false
  }
  multifactorPolicy:
  {
@class:
org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
multifactorAuthenticationProviders:
[
  java.util.HashSet
  [
mfa-yubikey
  ]
]
failureMode: CLOSED
  }
  accessStrategy:
  {
@class: org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy
enabled: true
ssoEnabled: true
requireAllAttributes: true
caseInsensitive: false
  }
}

Yubikey web-flow seems to be registered :

2016-09-20 09:20:09,895 DEBUG
[org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl]
- 
...
2016-09-20 09:20:36,003 WARN
[org.apereo.cas.web.flow.resolver.impl.RegisteredServiceAuthenticationPolicyWebflowEventResolver]
- 

In MFA wiki page (
https://apereo.github.io/cas/development/installation/Configuring-Multifactor-Authentication.html#yubikey
), there's a mention of "id" field, but I didn't find any reference in
my configuration files.

Regards.


Le 16/09/2016 à 16:57, Philippe MARASSE a écrit :
> Hello,
>
> I'm trying to trigger MFA (with yubikey), on a service access.
> Triggering seems to work but mfa-yubikey webflow is not found ??
>
> Extract from logs :
> 2016-09-16 16:28:03,438 DEBUG
> [org.springframework.webflow.engine.builder.DefaultFlowHolder] -
> 
> 2016-09-16 16:28:04,503 DEBUG
> [org.springframework.webflow.definition.registry.FlowDefinitionRegistryImpl]
> - <*Registering flow definition* 'URL
> [jar:file:/var/tomcat/inst2/webapps/cas/WEB-INF/lib/cas-server-support-yubikey-5.0.0.RC1.jar!/webflow/mfa-yubikey/mfa-yubikey-webflow.xml]'
> under id '*mfa-yubikey*'>
> 2016-09-16 16:28:08,806 INFO
> [org.apereo.cas.configuration.CasConfigurationRebinder] -  CAS configuration
> cas-org.apereo.cas.configuration.CasConfigurationProperties>
> ...
> 2016-09-16 16:28:41,259 INFO [org.ldaptive.auth.Authenticator] -
> 
> 2016-09-16 16:28:41,267 INFO
> [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] -
> 
> 2016-09-16 16:28:41,299 INFO
> [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] -
> 
> 2016-09-16 16:28:41,533 WARN
> [org.apereo.cas.web.flow.resolver.impl.RegisteredServiceAuthenticationPolicyWebflowEventResolver]
> - <*Transition definition cannot be found for event [mfa-yubikey]*>
> 2016-09-16 16:28:41,538 DEBUG
> [org.springframework.webflow.execution.ActionExecutor] -  executing org.apereo.cas.web.flow.AuthenticationViaFormAction@b553;
> result = authenticationFailure>
>
> Is login-webflow.xml needing modifications (documentation does not
> mention this) ?
>
> Regards.
> -- 
> Philippe MARASSE
>
> Responsable pôle Infrastructures - DSIO
> Centre Hospitalier Henri Laborit
> CS 10587 - 370 avenue Jacques Cœur 
> 86021 Poitiers Cedex
> Tel : 05.49.44.57.19
> -- 
> You received this message because you are subscribed to the Google
> Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to cas-user+unsubscr...@apereo.org
> .
> To post to this group, send email to cas-user@apereo.org
> .
> Visit this group at
> https://groups.google.com/a/apereo.org/group/cas-user/.
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/dd99844e-7ea7-12e4-9872-323d46c2f8a9%40ch-poitiers.fr
> .
> For more options, visit https://groups.google.com/a/apereo.org/d/optout.

-- 
Philippe MARASSE

Responsable pôle Infrastructures - DSIO
Centre Hospitalier Henri Laborit
CS 10587 - 370 avenue Jacques Cœur 
86021 Poitiers Cedex
Tel : 05.49.44.57.19

-- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to cas-user+unsubscr...@apereo.org.
To post to this group, send email to cas-user@apereo.org.
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/6e14fc0f-fe47-5d79-7d4b-213425026bba%40ch-poitiers.fr.
For more