Google apps logout script breaks under Tomcat 8?
Baron Fujimoto
baron at hawaii.edu
Tue Mar 24 22:48:44 EDT 2015
On Fri, Mar 20, 2015 at 08:23:00PM -0500, Michael A Grady wrote:
>
>On Mar 20, 2015, at 4:37 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
>
>> On 3/20/15, 4:52 PM, "Baron Fujimoto" <baron at hawaii.edu> wrote:
>>>
>>> Sorry, via CAS3, based on documentation here:
>>> <https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration>
>>
>> Ok, but in what way would clearing those cookies have any impact on logout? I'm just not seeing it. The IdP's session won't matter. Even if you cleared the JSESSIONID cookie, and even if that were the basis of the CAS session, all that would do is take you back to CAS and you'd be right back in again.
I don't claim to understand why clearing the cookies has any impact on
logout, but I can reliably reproduce the behaviour that, after logout, if
I delete the JSESSIONID cookie[*] for the idp host in question with path
"/idp", then the logout sticks, else not.
[*] using Firefox's basic delete cookie feature.
>> Maybe the script you were using also was doing a CAS logout, but if that's the case, it shouldn't matter what happens with the IdP. You could just turn off the PreviousSession handler and push all the SSO aspects back to CAS.
>>
After clearing the cookies, the script was subsequently redirecting to the
CAS logout, which logs the destruction of its Ticket Granting Cookie (TGC).
>Yes, whenever I work with someone layering the IdP over CAS, I recommend disabling PreviousSession on the IdP, because then you have no session there you need to logout of -- you just send the user to the CAS logout endpoint.
Can this accomplished by simply commenting out the PreviousSession
definition in handler.xml? I tried that, and also set our Google Apps to
call the CAS logout directly rather than through the script that deleted
the cookies first. CAS destroys the session, but the IdP still seems to
detect a session on the next login attempt (and does not hand off to CAS
for AuthN). These log excerpts trace this I think:
*** Login ***
IdP> 2015-03-24 14:29:04.945 DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager] Custom relying party configuration found for google.com
IdP> 2015-03-24 14:29:04.953 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler
IdP> 2015-03-24 14:29:04.953 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler] Redirecting to https://idp.example.com:443/idp/Authn/RemoteUser
CAS> 2015-03-24 14:29:06,654 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN
CAS> =============================================================
CAS> WHO: [username: baron]
CAS> WHAT: supplied credentials: [username: baron]
CAS> ACTION: AUTHENTICATION_SUCCESS
CAS> APPLICATION: CAS
CAS> =============================================================
CAS> 2015-03-24 14:29:06,654 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN
CAS> =============================================================
CAS> WHO: [username: baron]
CAS> WHAT: TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas
CAS> ACTION: TICKET_GRANTING_TICKET_CREATED
CAS> APPLICATION: CAS
CAS> =============================================================
CAS> 2015-03-24 14:29:06,656 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN
CAS> =============================================================
CAS> WHO: baron
CAS> WHAT: ST-278-YdAHy24K6fAAS3qaEvTr-cas for https://idp.example.com/idp/Authn/RemoteUser
CAS> ACTION: SERVICE_TICKET_CREATED
CAS> APPLICATION: CAS
CAS> =============================================================
CAS> 2015-03-24 14:29:07,195 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN
CAS> =============================================================
CAS> WHO: audit:unknown
CAS> WHAT: ST-278-YdAHy24K6fAAS3qaEvTr-cas
CAS> ACTION: SERVICE_TICKET_VALIDATED
CAS> APPLICATION: CAS
CAS> =============================================================
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet] Remote user identified as baron returning control back to authentication engine
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Returning control to authentication engine
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Processing incoming request
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Completing user authentication process
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Validating authentication was performed successfully
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Updating session information for principal baron
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Creating shibboleth session for principal baron
IdP> 2015-03-24 14:29:07.242 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Adding IdP session cookie to HTTP response
IdP> 2015-03-24 14:29:07.243 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Recording authentication and service information in Shibboleth session for principal: baron
IdP> 2015-03-24 14:29:07.243 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] User baron authenticated with method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
IdP> 2015-03-24 14:29:07.243 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Returning control to profile handler
IdP> 2015-03-24 14:29:07.243 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Redirecting user to profile handler at https://idp.example.com:443/idp/profile/SAML2/Redirect/SSO
IdP> 2015-03-24 14:29:07.349 INFO [Shibboleth-Audit] 20150325T002907Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|kamfbnlaopdfipdlpfanpgigbkncofkahgllmlbo|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.example.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_b16ec7e500b5aefea7e46d42ee865930|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||baron|_9c201da16ab7d7e4f1df49061b797b68,|
*** Logout ***
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - Removing ticket [TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas] from registry.
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas]
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Ticket [TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas] found in registry.
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - Ticket found. Expiring and then deleting.
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.authentication.principal.SamlService] - Sending logout request for: https://idp.example.com/idp/Authn/RemoteUser
CAS> 2015-03-24 14:30:43,505 DEBUG [org.jasig.cas.util.HttpClient] - Attempting to access https://idp.example.com/idp/Authn/RemoteUser
CAS> 2015-03-24 14:30:43,506 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Removing ticket [TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas] from registry
CAS> 2015-03-24 14:30:43,506 DEBUG [org.jasig.cas.ticket.registry.DefaultTicketRegistry] - Attempting to retrieve ticket [TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas]
CAS> 2015-03-24 14:30:43,506 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN
CAS> =============================================================
CAS> WHO: audit:unknown
CAS> WHAT: TGT-177-ob6Nwj3utkMTFVjwI6CP6jhz96AEXCBgCpGqhhH7g7Tp1T1N7U-cas
CAS> ACTION: TICKET_GRANTING_TICKET_DESTROYED
CAS> APPLICATION: CAS
CAS> =============================================================
CAS> 2015-03-24 14:30:43,507 DEBUG [org.jasig.cas.web.support.CookieRetrievingCookieGenerator] - Removed cookie with name [CASTGC]
CAS> 2015-03-24 14:30:43,507 DEBUG [org.jasig.cas.web.support.CookieRetrievingCookieGenerator] - Removed cookie with name [CASPRIVACY]
CAS> 2015-03-24 14:30:43,519 DEBUG [org.jasig.cas.web.support.CasArgumentExtractor] - Extractor generated service for: https://idp.example.com/idp/Authn/RemoteUser
CAS> 2015-03-24 14:30:43,533 DEBUG [org.jasig.cas.util.HttpClient] - Finished sending message tohttps://idp.example.com/idp/Authn/RemoteUser
*** Login again ***
CAS> [no CAS activity]
IdP> 2015-03-24 14:32:21.474 DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager] Custom relying party configuration found for google.com
IdP> 2015-03-24 14:32:21.475 DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler] Redirecting user to authentication engine at https://idp.example.com:443/idp/AuthnEngine
IdP> 2015-03-24 14:32:21.490 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Beginning user authentication process.
IdP> 2015-03-24 14:32:21.490 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Existing IdP session available for principal baron
IdP> 2015-03-24 14:32:21.513 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Completing user authentication process
IdP> 2015-03-24 14:32:21.513 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Validating authentication was performed successfully
IdP> 2015-03-24 14:32:21.513 DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine] Updating session information for principal baron
IdP> 2015-03-24 14:32:21.597 INFO [Shibboleth-Audit] 20150325T003221Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|blceojfjoebkbipiejhkiolkghbjhfahakphfnmp|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.example.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_9e4d56e9a8ce3a8d2f81cb052b1c643b|baron|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||baron|_2d0b3371e5a2d09642a65fb86dc1bf8b,|
--
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
More information about the users
mailing list