Shibboleth IDP 3 as CAS Server

Thu Jun 11 17:12:10 EDT 2015

Verify that your CASCertificatePath parameter is in fact pointing to an appropriate trust root.  You can test with openssl s_client pointed at the same file.

-WFH

> On Jun 11, 2015, at 3:54 PM, Jesse Martinich <martinicj at sou.edu> wrote:
> 
> I'm getting the following in debug:
> 
> [Thu Jun 11 13:50:52 2015] [info] Initial (No.1) HTTPS request received for child 0 (server cas.sou.edu:443)
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1745): [client 140.211.91.96] Entering cas_authenticate(), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(607): [client 140.211.91.96] Modified r->args (old 'ticket=ST-1434055852427-bjIkFqajBP0IVHqJfUbxUY0GA', new ''), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1600): [client 140.211.91.96] entering getResponseFromServer(), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(519): [client 140.211.91.96] entering getCASService(), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(539): [client 140.211.91.96] CAS Service 'https%3a%2f%2fcas.sou.edu%2fsecure%2f', referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1666): [client 140.211.91.96] MOD_AUTH_CAS: curl_easy_perform() failed (Peer certificate cannot be authenticated with known CA certificates), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1293): [client 140.211.91.96] entering isValidCASTicket(), referer: https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> [Thu Jun 11 13:50:52 2015] [debug] ssl_engine_kernel.c(1863): OpenSSL: Write: SSL negotiation finished successfully
> [Thu Jun 11 13:50:52 2015] [info] [client 140.211.91.96] Connection closed to child 0 with standard shutdown (server cas.sou.edu:443)
> 
> 
> 
> Jesse Martinich
> Systems Administrator
> Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> 541-552-8424
> 
> 
> Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM
> 
> On Thu, Jun 11, 2015 at 1:46 PM, Jesse Martinich <martinicj at sou.edu> wrote:
> I previously overlooked the lack of debug messages. I had not changed the LogLevel in my vhost to debug, so it was still at warn. I am now seeing a cert issue, looks like I am trusting the Web SSL cert but not the IDP cert.
> 
> Will update after attempting fix.
> 
> Thanks!
> Jesse
> 
> 
> Jesse Martinich
> Systems Administrator
> Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> 541-552-8424
> 
> 
> Why I'm at SOU: https://www.youtube.com/watch?v=Ski0MzPd5IM
> 
> On Thu, Jun 11, 2015 at 1:35 PM, Walter Forbes Hoehn (wassa) <wassa at memphis.edu> wrote:
> Ditto what Marvin said below.  You are going to have to check the client end.  The only additional information I’ll add is that every time I’ve seen this in the past it has been one of two things:
> 
> 1)  The CAS client was rejecting the CAS server SSL certificate
> 
> 2) The CAS client was very old and was not parsing the SOAP envelope correctly.  This was with the CAS client for Java, so it probably doesn’t apply.
> 
> Firewall issues probably don’t come into play all that often, because most folks are running CAS back-channel requests on port 443 along with the /login endpoint.
> 
> -Walter
> 
> 
> > On Jun 11, 2015, at 3:23 PM, Marvin Addison <marvin.addison at gmail.com> wrote:
> >
> > 140.211.91.96 - - [11/Jun/2015:12:58:30 -0700] "POST /idp/profile/cas/login;jsessionid=85B70E3AD0AEF47512F7D2D787BEBDCC?execution=e1s1 HTTP/1.1" 302 -
> >
> > The request to /idp/profile/cas/samlValidate to validate the ticket ought to follow shortly after the credential submission above. I think we need to focus on mod_auth_cas debug output in the Apache error log. What does it say?
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net