Shibboleth + Jasig CAS

[Gianluigi Ruggeri]

Hi kevin,
Thank you very much for your reply!
Ok, probably I solved my issues:
- I uploaded my metadata file on testshib service;
- I editaed my relying-party.xml file in this way:

        <metadata:MetadataProvider id="URLMD"
xsi:type="metadata:FileBackedHTTPMetadataProvider"
                          metadataURL="
http://www.testshib.org/metadata/testshib-providers.xml"

backingFile="/opt/shibboleth-idp/metadata/testshib.xml">
            <!--
            <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
                <metadata:MetadataFilter
xsi:type="metadata:RequiredValidUntil"
                                maxValidityInterval="P7D" />
                <metadata:MetadataFilter
xsi:type="metadata:SignatureValidation"

trustEngineRef="shibboleth.MetadataTrustEngine"
                                requireSignedMetadata="true" />
                    <metadata:MetadataFilter
xsi:type="metadata:EntityRoleWhiteList">

<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
                </metadata:MetadataFilter>
            </metadata:MetadataFilter>
        -->
        </metadata:MetadataProvider>

Now when I try to test my service using testshib I not receive the previous
error (metadata error).

I configurated my shibboleth Idp to use my CAS server.
I followed this documentation:
https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration

So:

1) I included CAS Client Libraries in Idp;
2) I have modified $SHIB_HOME/conf/handler.xml file where I added:

<!-- Remote User handler for CAS support -->
<LoginHandler xsi:type="RemoteUser">
  <AuthenticationMethod>
    urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
  </AuthenticationMethod>
  <AuthenticationMethod>
    urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
  </AuthenticationMethod>
</LoginHandler>

About this point I added the ph: suffix like in the following block:

<!-- Remote User handler for CAS support -->
<ph:LoginHandler xsi:type="ph:RemoteUser">
  <ph:AuthenticationMethod>
    urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
  </ph:AuthenticationMethod>
  <ph:AuthenticationMethod>
    urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
  </ph:AuthenticationMethod>
</ph:LoginHandler>

in the same file I commented the default block

3) In the web.xml file I added this block file '<ph:LoginHandler
xsi:type="ph:RemoteUser">' (is correct??)

<!-- For CAS client support -->
<context-param>
  <param-name>serverName</param-name>
  <param-value>vincenteservices.resiltech.net</param-value>
</context-param>

<!-- CAS client filters -->
<filter>
  <filter-name>CAS Authentication Filter</filter-name>
  <filter-class>
      org.jasig.cas.client.authentication.AuthenticationFilter
  </filter-class>
  <init-param>
    <param-name>casServerLoginUrl</param-name>
    <param-value>https://vincenteservices.resiltech.net/cas/login
</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>CAS Authentication Filter</filter-name>
  <url-pattern>/Authn/RemoteUser</url-pattern>
</filter-mapping>

<filter>
  <filter-name>CAS Validation Filter</filter-name>
  <filter-class>

org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter
  </filter-class>
  <init-param>
    <param-name>casServerUrlPrefix</param-name>
    <param-value>https://vincenteservices.resiltech.net/cas</param-value>
  </init-param>
  <init-param>
    <param-name>redirectAfterValidation</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>CAS Validation Filter</filter-name>
  <url-pattern>/Authn/RemoteUser</url-pattern>
</filter-mapping>

<filter>
  <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
  <filter-class>
    org.jasig.cas.client.util.HttpServletRequestWrapperFilter
  </filter-class>
</filter>

<filter-mapping>
  <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
  <url-pattern>/Authn/RemoteUser</url-pattern>
</filter-mapping>

- Is correct to change these blocks in this way (change only the url to my
CAS server)? Is necessary to change also <context-param>
  <param-name>serverName</param-name> ? Is necessary to change something
else?

With this configuration when I try to test my Shibbolet Idp (using testshib
service) I have a 500 internal error and I see (in my browser) a redirect
url (in the browser url bar) similar to  my host /Authn/RemoteUser

All these steps are correct?
I possible to have same info to configure shibboleth with a CAS server?

Thank to all





2013/11/27 Kevin P. Foote <kpfoote at iup.edu>

>
> On Wed, 27 Nov 2013, Gianluigi Ruggeri wrote:
>
> > Probably I not have understood very well the question about Shibbolteth
> > metadata.
>
> Metadata is how the two ends of the SAML exchange know how to
> communicate with each other.
>
> <https://wiki.shibboleth.net/confluence/display/SHIB2/Metadata>
>
> > Are correct these steps? Why I obtain an error about the metadata?
> > An other question: I use a tomcat with my certificate (SSL)...is correct
> > regenerate an other certificate as requested during the shibbolteh
> > instalaltion? Is possibile that this is a problem?
>
> Yes so far your steps are ok .. you just need to continue on a bit.
>
> I do not see your metadata in the testshib service currently. You need to
> take your metadata file and register with the testshib service. [1]
>
> You then need to load the testshib metadata into your IdP config. [2]
>
> When these two steps are done then you can make a request to the
> testshib sp. [3]
>
>
>
>
>
> [1] https://testshib.org/register.html
>
> [2] https://testshib.org/configure.html
>
> [3] https://sp.testshib.org/
>
>
>
> ------
> thanks
>   kevin.foote
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131127/049a4f40/attachment.html