CAS And Shibboleth SSO

[David C Fuhs]

Good afternoon all:

I figured out the problem (why CAS and Shibboleth were not sharing a session on IdP V3).

The two clues came from Marvin Addison (add more fields to the logging output) and Scott Cantor (different IdP hostnames for CAS and Shibboleth clients).  The problem was in our testing environment.

For Shibboleth only, I have long been using an /etc/hosts redirect, so I already had this in place on my client Macintosh:

132.241.173.36 shibboleth.csuchico.edu shibboleth
132.241.173.36 cas.csuchico.edu cas

where 132.241.173.36 is the IP address of shib-upgrade.csuchico.edu, the machine where we are testing the IdP V3 CAS implementation.

However, I have been using development copies of two of a colleague's CAS clients for that part of the testing.  He had changed their configuration to point to shib-upgrade, plus there was no /etc/hosts redirect set on that server.

Adding idp.server_hostname to the logging output made the problem obvious: the logs showed the CAS clients pointing to shib-upgrade.csuchico.edu, while the Shibboleth clients were pointing to shibboleth.csuchico.edu.  Obviously, the IdP is validating the hostname the clients call.

We modified the cas_url for his two development CAS clients and our system administrator added the /etc/hosts redirects to the server those applications run on.  Now I have SSO working every which way (CAS first or Shibboleth first, it doesn't matter).

Fortunately, we have a development server that only one other person and I are using, and he is working on other projects, otherwise it could have been difficult to get a working test environment.  Also, the SSL certificates on shib-upgrade have all the necessary subjectAltNames.

Thanks for the help.

David Fuhs
Enterprise Applications
California State University, Chico

------------------------------

Message: 3
Date: Wed, 02 Aug 2017 14:29:58 +0000
From: Marvin Addison <marvin.addison at gmail.com>
To: Shib Users <users at shibboleth.net>
Subject: Re: CAS And Shibboleth SSO
Message-ID:
	<CACOs9MSTsOA3P+QkALG4Z6_NVX6ziVHPL8dZz1UvuUUb2icvWw at mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

On Wed, Aug 2, 2017 at 7:39 AM Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> Is there anything 'interesting' about your network set up (multiple 
> network adaptors or something such that SAML requests come in one 
> another adaptor and the CAS another)?
>

Network effects are the best explanation for the behavior I can imagine. We could confirm or refute that idea by configuring the logger to log the source IP address; if it's different on the SAML request, then we'd have a smoking gun. See https://wiki.shibboleth.net/confluence/display/IDP30/LoggingConfiguration for more information. You probably want to log the source IP anyway; we've found it extremely helpful for correlating log events for both troubleshooting and abuse investigations.

M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170802/bdc7a6ac/attachment-0001.html>

------------------------------

Message: 4
Date: Wed, 2 Aug 2017 14:32:52 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: CAS And Shibboleth SSO
Message-ID: <6F9E5F5D-F51B-409D-9D97-C3129274808A at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 8/2/17, 10:30 AM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

> Network effects are the best explanation for the behavior I can imagine.

Any possibility the IdP hostname used for CAS and SAML are different?

-- Scott




------------------------------