Shibboleth IDP 3 as CAS Server

[Jesse Martinich]

I'm getting the following in debug:

[Thu Jun 11 13:50:52 2015] [info] Initial (No.1) HTTPS request received for
child 0 (server cas.sou.edu:443)
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1745): [client
140.211.91.96] Entering cas_authenticate(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(607): [client
140.211.91.96] Modified r->args (old
'ticket=ST-1434055852427-bjIkFqajBP0IVHqJfUbxUY0GA', new ''), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1600): [client
140.211.91.96] entering getResponseFromServer(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(519): [client
140.211.91.96] entering getCASService(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(539): [client
140.211.91.96] CAS Service 'https%3a%2f%2fcas.sou.edu%2fsecure%2f',
referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1666): [client
140.211.91.96] MOD_AUTH_CAS: curl_easy_perform() failed (Peer certificate
cannot be authenticated with known CA certificates), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1293): [client
140.211.91.96] entering isValidCASTicket(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
[Thu Jun 11 13:50:52 2015] [debug] ssl_engine_kernel.c(1863): OpenSSL:
Write: SSL negotiation finished successfully
[Thu Jun 11 13:50:52 2015] [info] [client 140.211.91.96] Connection closed
to child 0 with standard shutdown (server cas.sou.edu:443)



*Jesse Martinich*
Systems Administrator
Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
541-552-8424


Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM

On Thu, Jun 11, 2015 at 1:46 PM, Jesse Martinich <martinicj at sou.edu> wrote:

> I previously overlooked the lack of debug messages. I had not changed the
> LogLevel in my vhost to debug, so it was still at warn. I am now seeing a
> cert issue, looks like I am trusting the Web SSL cert but not the IDP cert.
>
> Will update after attempting fix.
>
> Thanks!
> Jesse
>
>
> *Jesse Martinich*
> Systems Administrator
> Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> 541-552-8424
>
>
> Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM
>
> On Thu, Jun 11, 2015 at 1:35 PM, Walter Forbes Hoehn (wassa) <
> wassa at memphis.edu> wrote:
>
>> Ditto what Marvin said below.  You are going to have to check the client
>> end.  The only additional information I’ll add is that every time I’ve seen
>> this in the past it has been one of two things:
>>
>> 1)  The CAS client was rejecting the CAS server SSL certificate
>>
>> 2) The CAS client was very old and was not parsing the SOAP envelope
>> correctly.  This was with the CAS client for Java, so it probably doesn’t
>> apply.
>>
>> Firewall issues probably don’t come into play all that often, because
>> most folks are running CAS back-channel requests on port 443 along with the
>> /login endpoint.
>>
>> -Walter
>>
>>
>> > On Jun 11, 2015, at 3:23 PM, Marvin Addison <marvin.addison at gmail.com>
>> wrote:
>> >
>> > 140.211.91.96 - - [11/Jun/2015:12:58:30 -0700] "POST
>> /idp/profile/cas/login;jsessionid=85B70E3AD0AEF47512F7D2D787BEBDCC?execution=e1s1
>> HTTP/1.1" 302 -
>> >
>> > The request to /idp/profile/cas/samlValidate to validate the ticket
>> ought to follow shortly after the credential submission above. I think we
>> need to focus on mod_auth_cas debug output in the Apache error log. What
>> does it say?
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/2360ff4f/attachment.html>