Shibboleth IDP 3 as CAS Server

[Jesse Martinich]

Thank you. I'm not sure which cert I should make sure I am trusting. Using
s_client just checks the ssl cert being used for Tomcat SSL. Don't I need
to make sure idp-signing.crt is being trusted?

Thanks,
Jesse


*Jesse Martinich*
Systems Administrator
Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
541-552-8424


On Thu, Jun 11, 2015 at 2:12 PM, Walter Forbes Hoehn (wassa) <
wassa at memphis.edu> wrote:

> Verify that your CASCertificatePath parameter is in fact pointing to an
> appropriate trust root.  You can test with openssl s_client pointed at the
> same file.
>
> -WFH
>
>
> > On Jun 11, 2015, at 3:54 PM, Jesse Martinich <martinicj at sou.edu> wrote:
> >
> > I'm getting the following in debug:
> >
> > [Thu Jun 11 13:50:52 2015] [info] Initial (No.1) HTTPS request received
> for child 0 (server cas.sou.edu:443)
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1745): [client
> 140.211.91.96] Entering cas_authenticate(), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(607): [client
> 140.211.91.96] Modified r->args (old
> 'ticket=ST-1434055852427-bjIkFqajBP0IVHqJfUbxUY0GA', new ''), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1600): [client
> 140.211.91.96] entering getResponseFromServer(), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(519): [client
> 140.211.91.96] entering getCASService(), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(539): [client
> 140.211.91.96] CAS Service 'https%3a%2f%2fcas.sou.edu%2fsecure%2f',
> referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1666): [client
> 140.211.91.96] MOD_AUTH_CAS: curl_easy_perform() failed (Peer certificate
> cannot be authenticated with known CA certificates), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] mod_auth_cas.c(1293): [client
> 140.211.91.96] entering isValidCASTicket(), referer:
> https://shib.sou.edu/idp/profile/cas/login;jsessionid=F12024FBC898014BF3632F8A8FAFDCAE?execution=e1s1
> > [Thu Jun 11 13:50:52 2015] [debug] ssl_engine_kernel.c(1863): OpenSSL:
> Write: SSL negotiation finished successfully
> > [Thu Jun 11 13:50:52 2015] [info] [client 140.211.91.96] Connection
> closed to child 0 with standard shutdown (server cas.sou.edu:443)
> >
> >
> >
> > Jesse Martinich
> > Systems Administrator
> > Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> > 541-552-8424
> >
> >
> >
> > On Thu, Jun 11, 2015 at 1:46 PM, Jesse Martinich <martinicj at sou.edu>
> wrote:
> > I previously overlooked the lack of debug messages. I had not changed
> the LogLevel in my vhost to debug, so it was still at warn. I am now seeing
> a cert issue, looks like I am trusting the Web SSL cert but not the IDP
> cert.
> >
> > Will update after attempting fix.
> >
> > Thanks!
> > Jesse
> >
> >
> > Jesse Martinich
> > Systems Administrator
> > Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> > 541-552-8424
> >
> >
> >
> > On Thu, Jun 11, 2015 at 1:35 PM, Walter Forbes Hoehn (wassa) <
> wassa at memphis.edu> wrote:
> > Ditto what Marvin said below.  You are going to have to check the client
> end.  The only additional information I’ll add is that every time I’ve seen
> this in the past it has been one of two things:
> >
> > 1)  The CAS client was rejecting the CAS server SSL certificate
> >
> > 2) The CAS client was very old and was not parsing the SOAP envelope
> correctly.  This was with the CAS client for Java, so it probably doesn’t
> apply.
> >
> > Firewall issues probably don’t come into play all that often, because
> most folks are running CAS back-channel requests on port 443 along with the
> /login endpoint.
> >
> > -Walter
> >
> >
> > > On Jun 11, 2015, at 3:23 PM, Marvin Addison <marvin.addison at gmail.com>
> wrote:
> > >
> > > 140.211.91.96 - - [11/Jun/2015:12:58:30 -0700] "POST
> /idp/profile/cas/login;jsessionid=85B70E3AD0AEF47512F7D2D787BEBDCC?execution=e1s1
> HTTP/1.1" 302 -
> > >
> > > The request to /idp/profile/cas/samlValidate to validate the ticket
> ought to follow shortly after the credential submission above. I think we
> need to focus on mod_auth_cas debug output in the Apache error log. What
> does it say?
> >
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> >
> >
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/ce1da759/attachment.html>