IdP3 CAS gateway issues.

[O'Dowd, Josh]

We are in the process of migrating our existing CAS client apps to use our IdP3 and remove our Jasig CAS server by attrition.  No need for 2 SSOs, right?

Anyway,  we set up our CAS protocol in IdP3 following the wiki instructions for basic setup.  In idp.properties, our idp sessioning is enabled and set to shibboleth.StorageService; as is our CAS storage service.  Our CAS authentication/SSO is working nicely for our non-gateway authn requests.

For whatever reason, our CAS clients that are making requests with the gateway=true option for anonymous access, which work well with our CAS server, are not working with the IdP.

For a simple test, I have a development environment on my localhost running on Jetty port 80.  I also have a 'cas-sample' web application (running on a tomcat @ localhost:7080) with the root page dispatching to a spring servlet with an org.jasig.cas.client.authentication.AuthenticationFilter.  The gateway property set to true on the filter.  It makes no difference if I browse to CAS sample before, or after getting an IdP session for an elsewhere service, I get the same result from the CAS filter, 'no ticket and no assertion found'.  I am seeing the activity on the IdP process log as well.

Below is a log snippet from both the IdP and the CAS sample app.  The Idp snippet begins with a separate CAS authentication(just Google as a test service) to get a session.  Then there is the gateway call from cas-sample:

IdP
2016-02-04 10:17:55,099 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'jo180287e' succeeded
2016-02-04 10:17:57,718 - INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100] - Granted service ticket for http://www.google.com
2016-02-04 10:17:57,719 - INFO [Shibboleth-Audit.SSO:241] - 20160204T171757Z||f2733dd88cf098da867dae61068ea69a2a2711270afe1386579ffc04d3026532|http://www.google.com|https://www.apereo.org/cas/protocol/login|||||||jo180287e|ST-1454606277718-J6Afm2c8vPBP2Xj1AHQ4pCOwu
2016-02-04 10:18:24,588 - INFO [Shibboleth-Audit.SSO:241] - 20160204T171824Z||f2733dd88cf098da867dae61068ea69a2a2711270afe1386579ffc04d3026532|http://localhost:7080/cas-sample|https://www.apereo.org/cas/protocol/login||||||||

CAS sample
DEBUG 2016-02-04 10:18:24 no ticket and no assertion found
DEBUG 2016-02-04 10:18:24 setting gateway attribute in session
DEBUG 2016-02-04 10:18:24 Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade at 7b47068c]
DEBUG 2016-02-04 10:18:24 Constructed service url: http://localhost:7080/cas-sample
DEBUG 2016-02-04 10:18:24 redirecting to "https://localhost/idp/profile/cas/login?service=http%3A%2F%2Flocalhost%3A7080%2Fcas-sample&gateway=true"

The IdP is redirecting back to the service without painting a login view as expected, but the redirect does not have any parameters included, namely the ticket, if I already have a session on the IdP.

Am I missing a config for the IdP somewhere?

Thanks.

Josh O'Dowd
Software Systems Engineer
Central IT, University of Montana
(406)243-6283

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/b1d296e0/attachment.html>