[Ext] Re: CAS / peoplesoft - same trick should work with Shib

[Bryan Wooten]

I worked on that a long time ago. I am not sure why I chose that validation filter.

I suspect you can use any validation filter you want.

Bryan Wooten
Tel: (801)585-9323
Email: bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>

[Identity & Access Management_combined centered]


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jorge Fernandez Cancio
Sent: Wednesday, June 29, 2016 8:16 AM
To: users at shibboleth.net
Subject: Fwd: [Ext] Re: CAS / peoplesoft - same trick should work with Shib

Hi Bryan,

Thanks for your answers!!!!

I have been trying to configure everything in CAS server but I have some problems writing proxying applications using CAS (https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough)


I saw that you used proxy authentication

Cas20ProxyReceivingTicketValidationFilter

Any particular reason for this? why the need for CAS Proxy Tickets? The peoplesoft need to comunicate with a third party tools? I mean it has to work as a proxy app?

Thanks for your answers


On Fri, Jun 17, 2016 at 9:08 AM, Bryan Wooten <bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>> wrote:
Comments Below

Bryan Wooten
Tel: (801)585-9323<tel:%28801%29585-9323>
Email: bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>

[Identity & Access Management_combined centered]


From: Jorge Fernandez Cancio [mailto:jorgefdez205 at gmail.com<mailto:jorgefdez205 at gmail.com>]
Sent: Friday, June 17, 2016 6:47 AM
To: Bryan Wooten <bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>>
Cc: Nate Klingenstein <nate.klingenstein at utah.edu<mailto:nate.klingenstein at utah.edu>>
Subject: [Ext] Re: CAS / peoplesoft - same trick should work with Shib

Hi Bryan

Thanks so much for the pptx..., Unfortunately the link is dead but I could take a look to the presentation and I have some questions:

I have attached the ppt.

I saw that you used Cas20ProxyReceivingTicketValidationFilter and org.jasig.cas.client.util.HttpServletRequestWrapperFilter as filters in the People Soft side, any particular reason for that? does Peoplesoft support only CAS 2.0?

I could not see in the PeopleSoft Code how do you validdate the tickect against CAS? That's part is needed?

Did you used Shib in the middle?

The is no Shib involved. The real trick is getting peoplesoft signon code to recognize remote_user whether set by CAS , Shib or something else.

In funclibldap:

Function CAS_AUTHENTICATION()
   &logger = initLogger();

   &logger.info<http://logger.info>("CAS_AUTHENTICATION ============ Start of CAS_AUTHENTICATION =============   (" | %SignonUserId | ")");
   printRequestHeaders();

   If &bConfigRead = False Then
      getLDAPConfig();
   End-If;

   &cas_result = %Request.RemoteUser;
   If &cas_result <> "" Then
      /* User is authenticated, log them into PeopleSoft */
      &logger.info<http://logger.info>(" CAS_AUTHENTICATION - " | "Remote user = " | &cas_result | " logged in by CAS_AUTHENTICATION");
      SetAuthenticationResult( True, Upper(&cas_result), "", False);
      &authMethod = "CAS";
      &CAS_userid = &cas_result;
      &sql_PSOPRDEFN = CreateSQL("Select FAILEDLOGINS from PSOPRDEFN where OPRID=:1", Upper(&cas_result));
      &ret = &sql_PSOPRDEFN.Fetch(&failedLogin);

      If (&failedLogin <> 0) Then
         SQLExec("update PSOPRDEFN set FAILEDLOGINS=0 whe

What communication protocol did you use for CAS integration, CAS 2.0?

Yes I have always used CAS 2.0, but it does not really matter.

In your use case the 3rd party tool (back-end authentication) was LDAP or ActiveDirectory? In this case PeopleSoft need to bee synchronized with this tool?

Our CAS binds to OpenDJ, Peoplesoft can reference a different LDAP or AD. Hope this helps. It has been a few years since I did all this so some details may be escaping me.

So here is my thoughts if you want to forget CAS. You need to front your Peoplesoft Weblogic servers with Apache. On this Apache you install the Shib SP and protect the Weblogic URLs with the SP. As users hit Peoplesoft they will be authenticated to your Shib IDP. This will set remote_user (and potentially other attributes passed as either environment variable or http headers) At this point it is all up to peoplesoft signon code to trust remote_user in funclibldap. Hope this makes sense.

Thanks in advance and sorry for so many questions....








On Thu, Jun 16, 2016 at 6:14 PM, Bryan Wooten <bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>> wrote:
Attached is my presentation on this topic. It has most the info.

This may also help:

http://lanyrd.com/2014/apereo/sdbbdp/

Bryan Wooten
Tel: (801)585-9323<tel:%28801%29585-9323>
Email: bryan.wooten at utah.edu<mailto:bryan.wooten at utah.edu>

[Identity & Access Management_combined centered]





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/e0d06f91/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 6374 bytes
Desc: image001.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/e0d06f91/attachment-0001.jpg>