Shibboleth IDP 3 as CAS Server

[Jesse Martinich]

Hello, I am hoping to get some help with the CAS server part of IDP 3 setup.

I've got the v3 IDP up and working with all of the SPs that our v2 IDP is
currently working with. I have also gotten to a point where I can issue
service tickets to an Apache server running mod_auth_cas, but I receive an
"Authorization Required" message.

I would like to release attributes like ePPN, ePPA, first, last, etc and be
able to support CAS clients in general.

I've attached my cas-protocol.xml file.

-----
I have entered the following text in my relying-party.xml:

    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <util:list>
                <ref bean="Shibboleth.SSO" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <ref bean="SAML2.SSO" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="CAS.LoginConfiguration" />
                <ref bean="CAS.ProxyConfiguration" />
                <ref bean="CAS.ValidateConfiguration" />
            </util:list>
        </property>
    </bean>

-----
Here is the mod_auth_cas configuration I am using in Apache:

LoadModule auth_cas_module modules/mod_auth_cas.so

<IfModule !mod_ssl.c>
    LoadModule ssl_module modules/mod_ssl.so
</IfModule>

<IfModule mod_auth_cas.c>
    CASVersion 2
    CASLoginURL https://shib.sou.edu/idp/profile/cas/login
    CASValidateURL https://shib.sou.edu/idp/profile/cas/samlValidate
    CASProxyValidateURL https://shib.sou.edu/idp/profile/cas/proxyValidate
    CASCertificatePath /etc/pki/tls/certs/shib.pem
    CASValidateServer On
    CASValidateSAML On
    CASCookiePath /var/cache/httpd/mod_auth_cas_cookies/
    CASDebug On
</IfModule>

-----
I am using this block to protect a directory:

<Directory /var/www/html/secure>
     Options -Indexes FollowSymLinks
     AllowOverride
     Order allow,deny
     Allow from all
     Authtype CAS
     require cas-attribute "eduPersonAffiliation:staff"
</Directory>

I have also tried "require valid-user" with the same end result.

-----
I receive the following message in my browser(s):

Authorization Required

This server could not verify that you are authorized to access the document
requested. Either you supplied the wrong credentials (e.g., bad password),
or your browser doesn't understand how to supply the credentials required.

Apache/2.2.15 (CentOS) Server at cas.sou.edu Port 443

-----
In idp-protocol.log I see the following message:

2015-06-11 11:56:38,222 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:182] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'martinicj'
succeeded
2015-06-11 11:56:38,244 - INFO
[net.shibboleth.idp.cas.flow.GrantServiceTicketAction:101] - Granted
service ticket for https://cas.sou.edu/secure/

-----
In the Apache logs I don't see any errors. ssl_access and ssl_request show
the ticket URL:

140.211.91.96 - - [11/Jun/2015:12:00:08 -0700] "GET /secure/ HTTP/1.1" 302
350
140.211.91.96 - - [11/Jun/2015:12:00:15 -0700] "GET
/secure/?ticket=ST-1434049215356-bQFlSQIjEWXCgf1Pb94AQAtGt HTTP/1.1" 401 479

[11/Jun/2015:12:00:08 -0700] 140.211.91.96 TLSv1.2
ECDHE-RSA-AES128-GCM-SHA256 "GET /secure/ HTTP/1.1" 350
[11/Jun/2015:12:00:15 -0700] 140.211.91.96 TLSv1.2
ECDHE-RSA-AES128-GCM-SHA256 "GET
/secure/?ticket=ST-1434049215356-bQFlSQIjEWXCgf1Pb94AQAtGt HTTP/1.1" 479

The Apache cert is still SHA1, the Shib cert is SHA2. I can upgrade the
fore, if that is potential factor.

Let me know what other information might be helpful or if I have clearly
missed anything

Thanks for your help!
Jesse

*Jesse Martinich*
Systems Administrator
Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
541-552-8424


Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/84dd3a24/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cas-protocol.xml
Type: text/xml
Size: 2020 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/84dd3a24/attachment-0001.xml>