Shibboleth IDP 3 as CAS Server

[Marvin Addison]

Your CAS service registry entry looks good.


> I have entered the following text in my relying-party.xml:
>
>     <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
>

RP config looks good.

<IfModule mod_auth_cas.c>
>     CASVersion 2
>     CASLoginURL https://shib.sou.edu/idp/profile/cas/login
>     CASValidateURL https://shib.sou.edu/idp/profile/cas/samlValidate
>
    CASProxyValidateURL https://shib.sou.edu/idp/profile/cas/proxyValidate
>     CASCertificatePath /etc/pki/tls/certs/shib.pem
>     CASValidateServer On
>     CASValidateSAML On
>     CASCookiePath /var/cache/httpd/mod_auth_cas_cookies/
>     CASDebug On
> </IfModule>
>

Apache config looks good. Note that in general you have the choice of SAML
or CAS endpoints for attribute release, but the choice is limited in
practice by client support. mod_auth_cas only supports attribute release
via the SAML protocol, so your config is correct in that view.


> -----
> I am using this block to protect a directory:
>
> <Directory /var/www/html/secure>
>      Options -Indexes FollowSymLinks
>      AllowOverride
>      Order allow,deny
>      Allow from all
>      Authtype CAS
>      require cas-attribute "eduPersonAffiliation:staff"
> </Directory>
>
> I have also tried "require valid-user" with the same end result.
>
> -----
> I receive the following message in my browser(s):
>
> Authorization Required
>
> This server could not verify that you are authorized to access the
> document requested. Either you supplied the wrong credentials (e.g., bad
> password), or your browser doesn't understand how to supply the credentials
> required.
>

That typically indicates a ticket validation failure. I'm surprised you
didn't get more diagnostic information with CASDebug On. In the case of a
networking or TLS negotiation failure, for example, you would see libcurl
errors in the Apache error log with debugging enabled.


>
> Apache/2.2.15 (CentOS) Server at cas.sou.edu Port 443
>
> -----
> In idp-protocol.log I see the following message:
>
> 2015-06-11 11:56:38,222 - INFO
> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:182] -
> Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'martinicj'
> succeeded
> 2015-06-11 11:56:38,244 - INFO
> [net.shibboleth.idp.cas.flow.GrantServiceTicketAction:101] - Granted
> service ticket for https://cas.sou.edu/secure/
>
> -----
> In the Apache logs I don't see any errors. ssl_access and ssl_request show
> the ticket URL:
>
> 140.211.91.96 - - [11/Jun/2015:12:00:08 -0700] "GET /secure/ HTTP/1.1" 302
> 350
> 140.211.91.96 - - [11/Jun/2015:12:00:15 -0700] "GET
> /secure/?ticket=ST-1434049215356-bQFlSQIjEWXCgf1Pb94AQAtGt HTTP/1.1" 401 479
>
> [11/Jun/2015:12:00:08 -0700] 140.211.91.96 TLSv1.2
> ECDHE-RSA-AES128-GCM-SHA256 "GET /secure/ HTTP/1.1" 350
> [11/Jun/2015:12:00:15 -0700] 140.211.91.96 TLSv1.2
> ECDHE-RSA-AES128-GCM-SHA256 "GET
> /secure/?ticket=ST-1434049215356-bQFlSQIjEWXCgf1Pb94AQAtGt HTTP/1.1" 479
>
> The Apache cert is still SHA1, the Shib cert is SHA2. I can upgrade the
> fore, if that is potential factor.
>
> Let me know what other information might be helpful or if I have clearly
> missed anything
>
> Thanks for your help!
> Jesse
>
> *Jesse Martinich*
> Systems Administrator
> Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> 541-552-8424
>
>
> Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/8f21d100/attachment.html>