IdP V3 logout and RemoteUser Auth Flow using external CAS server

[Waldbieser, Carl]

If you are going to use an external CAS server for authentication, I'd recommend using the Unicon shib-cas-authn3 [1] project.  It was pretty simple to follow the directions and get it working.

Thanks,
Carl Waldbieser
ITS Systems Programmer
Lafayette College

[1] https://github.com/Unicon/shib-cas-authn3

----- Original Message -----
From: "Nomit Babraa" <h.babraa at sheffield.ac.uk>
To: users at shibboleth.net
Sent: Friday, July 8, 2016 3:51:50 PM
Subject: IdP V3 logout and RemoteUser Auth Flow using external CAS server

Hi

We are working on our IdP v3 deployment and have configured RemoteUser
Auth Flow using an external CAS server by doing the following.

1) idp.authn.flows= RemoteUser in conf/idp.properties
2) Configuring a CAS client in the IdP's web.xml as shown here
https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration based
on how we configured our IdP v2.

It may well be that this is the incorrect method of RemoteUser Auth
Flow using an external CAS server so I hope to stand corrected if so.

Given the above set up I then tested simple logout as described at
https://wiki.shibboleth.net/confluence/display/IDP30/LogoutConfiguration

I could see the shib_idp_session_ss and shib_idp_session cookies being
destroyed when I hit /profile/Logout. (although a JSESSIONID cookie
remained)  I also destroyed my CAS server session by logging out of
the CAS server.

However I was able to log back in to another SP without logging in to
the IdP/CAS server and could see new  shib_idp_session_ss and
shib_idp_session cookies appearing.

I would not have expected this to happen.

Looking a the logs I can see the following

2016-07-07 17:18:07,171 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:334] - Profile
Action SelectAuthenticationFlow: Selecting inactive authentication
flow authn/RemoteUser
2016-07-07 17:18:07,201 - DEBUG
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:231] - User
identity extracted from REMOTE_USER: [me]
016-07-07 17:18:07,222 - INFO
[net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:115] -
Profile Action ValidateExternalAuthentication: External authentication
succeeded for user: [me]

I then went though logout of the IdP and CAS server again, but this
time also destroyed the JSESSIONID cookie mentioned above.

This time I was prompted to login to the IdP/CAS server again as I would expect.

I presume that the remote_user header is being stored in the
HttpSession Object stored in the /idp context even though it should
only have request scope?


How would I achieve the logout I desire with a RemoteUser Auth Flow
using an external CAS server?

Thanks for any help

Cheers

n99
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net