Fwd: [Ext] Re: CAS / peoplesoft - same trick should work with Shib

[Jorge Fernandez Cancio]

Hi Bryan,

Thanks for your answers!!!!

I have been trying to configure everything in CAS server but I have some
problems writing proxying applications using CAS (
https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough)


I saw that you used proxy authentication

Cas20ProxyReceivingTicketValidationFilter

Any particular reason for this? why the need for CAS Proxy Tickets? The
peoplesoft need to comunicate with a third party tools? I mean it has to
work as a proxy app?

Thanks for your answers


On Fri, Jun 17, 2016 at 9:08 AM, Bryan Wooten <bryan.wooten at utah.edu> wrote:

> Comments Below
>
>
>
> *Bryan Wooten*
>
> Tel: (801)585-9323
>
> Email: bryan.wooten at utah.edu
>
>
>
> [image: Identity & Access Management_combined centered]
>
>
>
>
>
> *From:* Jorge Fernandez Cancio [mailto:jorgefdez205 at gmail.com]
> *Sent:* Friday, June 17, 2016 6:47 AM
> *To:* Bryan Wooten <bryan.wooten at utah.edu>
> *Cc:* Nate Klingenstein <nate.klingenstein at utah.edu>
> *Subject:* [Ext] Re: CAS / peoplesoft - same trick should work with Shib
>
>
>
> Hi Bryan
>
>
>
> Thanks so much for the pptx..., Unfortunately the link is dead but I could
> take a look to the presentation and I have some questions:
>
>
>
> I have attached the ppt.
>
>
>
> I saw that you used Cas20ProxyReceivingTicketValidationFilter
> and org.jasig.cas.client.util.HttpServletRequestWrapperFilter as filters in
> the People Soft side, any particular reason for that? does Peoplesoft
> support only CAS 2.0?
>
>
>
> I could not see in the PeopleSoft Code how do you validdate the tickect
> against CAS? That's part is needed?
>
>
>
> Did you used Shib in the middle?
>
>
>
> The is no Shib involved. The real trick is getting peoplesoft signon code
> to recognize remote_user whether set by CAS , Shib or something else.
>
>
>
> In funclibldap:
>
>
>
> Function CAS_AUTHENTICATION()
>
>    &logger = initLogger();
>
>
>
>    &logger.info("CAS_AUTHENTICATION ============ Start of
> CAS_AUTHENTICATION =============   (" | %SignonUserId | ")");
>
>    printRequestHeaders();
>
>
>
>    If &bConfigRead = False Then
>
>       getLDAPConfig();
>
>    End-If;
>
>
>
>    *&cas_result = %Request.RemoteUser;*
>
>    If &cas_result <> "" Then
>
>       /* User is authenticated, log them into PeopleSoft */
>
>       &logger.info(" CAS_AUTHENTICATION - " | "Remote user = " |
> &cas_result | " logged in by CAS_AUTHENTICATION");
>
>       *SetAuthenticationResult( True, Upper(&cas_result), "", False);*
>
>       &authMethod = "CAS";
>
>       &CAS_userid = &cas_result;
>
>       &sql_PSOPRDEFN = CreateSQL("Select FAILEDLOGINS from PSOPRDEFN where
> OPRID=:1", Upper(&cas_result));
>
>       &ret = &sql_PSOPRDEFN.Fetch(&failedLogin);
>
>
>
>       If (&failedLogin <> 0) Then
>
>          SQLExec("update PSOPRDEFN set FAILEDLOGINS=0 whe
>
>
>
> What communication protocol did you use for CAS integration, CAS 2.0?
>
>
>
> Yes I have always used CAS 2.0, but it does not really matter.
>
>
>
> In your use case the 3rd party tool (back-end authentication) was LDAP or
> ActiveDirectory? In this case PeopleSoft need to bee synchronized with this
> tool?
>
>
>
> Our CAS binds to OpenDJ, Peoplesoft can reference a different LDAP or AD.
> Hope this helps. It has been a few years since I did all this so some
> details may be escaping me.
>
>
>
> So here is my thoughts if you want to forget CAS. You need to front your
> Peoplesoft Weblogic servers with Apache. On this Apache you install the
> Shib SP and protect the Weblogic URLs with the SP. As users hit Peoplesoft
> they will be authenticated to your Shib IDP. This will set remote_user (and
> potentially other attributes passed as either environment variable or http
> headers) At this point it is all up to peoplesoft signon code to trust
> remote_user in funclibldap. Hope this makes sense.
>
>
>
> Thanks in advance and sorry for so many questions....
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> On Thu, Jun 16, 2016 at 6:14 PM, Bryan Wooten <bryan.wooten at utah.edu>
> wrote:
>
> Attached is my presentation on this topic. It has most the info.
>
>
>
> This may also help:
>
>
>
> http://lanyrd.com/2014/apereo/sdbbdp/
>
>
>
> *Bryan Wooten*
>
> Tel: (801)585-9323
>
> Email: bryan.wooten at utah.edu
>
>
>
> [image: Identity & Access Management_combined centered]
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/c3ede701/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 6374 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/c3ede701/attachment-0001.jpg>