Shibboleth IDP 3 as CAS Server

Thu Jun 11 17:48:04 EDT 2015

Alright, I was going about that part wrong, my new mod_auth_cas config:

LoadModule auth_cas_module modules/mod_auth_cas.so

<IfModule !mod_ssl.c>
    LoadModule ssl_module modules/mod_ssl.so
</IfModule>

<IfModule mod_auth_cas.c>
    CASVersion 2
    CASLoginURL https://shib.sou.edu/idp/profile/cas/login
    CASValidateURL https://shib.sou.edu/idp/profile/cas/samlValidate
    CASProxyValidateURL https://shib.sou.edu/idp/profile/cas/proxyValidate
    CASCertificatePath /etc/pki/tls/certs/ca-bundle.crt
    CASValidateServer On
    CASValidateSAML On
    CASCookiePath /var/cache/httpd/mod_auth_cas_cookies/
    CASDebug On
</IfModule>

Now I get the following invalid ticket error in apache logs:

[Thu Jun 11 14:43:04 2015] [info] Initial (No.1) HTTPS request received for
child 3 (server cas.sou.edu:443)
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1745): [client
140.211.91.96] Entering cas_authenticate(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(607): [client
140.211.91.96] Modified r->args (old
'ticket=ST-1434058984764-CWnL48dV62jogJ8VXk6F7cVUB', new ''), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1600): [client
140.211.91.96] entering getResponseFromServer(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(519): [client
140.211.91.96] entering getCASService(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(539): [client
140.211.91.96] CAS Service 'https%3a%2f%2fcas.sou.edu%2fsecure%2f',
referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1674): [client
140.211.91.96] Validation response: <?xml version="1.0"
encoding="UTF-8"?>\n<soap11:Envelope xmlns:soap11="
http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><saml1p:Response
MajorVersion="1" MinorVersion="1"
xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode
Value="INVALID_TICKET"
xmlns="http://www.ja-sig.org/products/cas/"/><saml1p:StatusMessage>E_SESSION_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></soap11:Body></soap11:Envelope>,
referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1293): [client
140.211.91.96] entering isValidCASTicket(), referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1299): [client
140.211.91.96] MOD_AUTH_CAS: response = <?xml version="1.0"
encoding="UTF-8"?>\n<soap11:Envelope xmlns:soap11="
http://schemas.xmlsoap.org/soap/envelope/"><soap11:Body><saml1p:Response
MajorVersion="1" MinorVersion="1"
xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode
Value="INVALID_TICKET"
xmlns="http://www.ja-sig.org/products/cas/"/><saml1p:StatusMessage>E_SESSION_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></soap11:Body></soap11:Envelope>,
referer:
https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1
[Thu Jun 11 14:43:04 2015] [debug] ssl_engine_kernel.c(1863): OpenSSL:
Write: SSL negotiation finished successfully
[Thu Jun 11 14:43:04 2015] [info] [client 140.211.91.96] Connection closed
to child 3 with standard shutdown (server cas.sou.edu:443)

But in idp-process.log I get this:

2015-06-11 14:43:04,759 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:182] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'martinicj'
succeeded
2015-06-11 14:43:04,764 - INFO
[net.shibboleth.idp.cas.flow.GrantServiceTicketAction:101] - Granted
service ticket for https://cas.sou.edu/secure/
2015-06-11 14:43:04,922 - INFO
[net.shibboleth.idp.cas.flow.ValidateTicketAction:117] - Successfully
validated ST-1434058984764-CWnL48dV62jogJ8VXk6F7cVUB for
https://cas.sou.edu/secure/

*Jesse Martinich*
Systems Administrator
Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
541-552-8424

On Thu, Jun 11, 2015 at 2:29 PM, Jesse Martinich <martinicj at sou.edu> wrote:

> Thanks, I am using 443 for everything.
>
> Jesse
>
>
> *Jesse Martinich*
> Systems Administrator
> Southern Oregon University | 1250 Siskiyou Blvd | Ashland OR  97520
> 541-552-8424
>
>
> On Thu, Jun 11, 2015 at 2:24 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 6/11/15, 9:21 PM, "Jesse Martinich" <martinicj at sou.edu> wrote:
>>
>>
>>
>> >Thank you. I'm not sure which cert I should make sure I am trusting.
>> >Using s_client just checks the ssl cert being used for Tomcat SSL. Don't
>> >I need to make sure idp-signing.crt is being trusted?
>>
>> Not for the callback, no. If you're hitting 443, it's the user facing
>> cert. If you're hitting 8443, which I don't think you did, it would be the
>> back channel cert. Both are configured in Jetty/Tomcat not the IdP.
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/346d414b/attachment.html>