<div dir="ltr">Alright, I was going about that part wrong, my new mod_auth_cas config:<div><br></div><div><div>LoadModule auth_cas_module modules/mod_auth_cas.so</div><div><br></div><div><IfModule !mod_ssl.c></div><div> LoadModule ssl_module modules/mod_ssl.so</div><div></IfModule></div><div><br></div><div><IfModule mod_auth_cas.c></div><div> CASVersion 2</div><div> CASLoginURL <a href="https://shib.sou.edu/idp/profile/cas/login">https://shib.sou.edu/idp/profile/cas/login</a></div><div> CASValidateURL <a href="https://shib.sou.edu/idp/profile/cas/samlValidate">https://shib.sou.edu/idp/profile/cas/samlValidate</a></div><div> CASProxyValidateURL <a href="https://shib.sou.edu/idp/profile/cas/proxyValidate">https://shib.sou.edu/idp/profile/cas/proxyValidate</a></div><div> CASCertificatePath /etc/pki/tls/certs/ca-bundle.crt</div><div> CASValidateServer On</div><div> CASValidateSAML On</div><div> CASCookiePath /var/cache/httpd/mod_auth_cas_cookies/</div><div> CASDebug On</div><div></IfModule></div><div><br></div><div><br></div><div><br></div><div>Now I get the following invalid ticket error in apache logs:</div><div><br></div><div><div>[Thu Jun 11 14:43:04 2015] [info] Initial (No.1) HTTPS request received for child 3 (server <a href="http://cas.sou.edu:443">cas.sou.edu:443</a>)</div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1745): [client 140.211.91.96] Entering cas_authenticate(), referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(607): [client 140.211.91.96] Modified r->args (old 'ticket=ST-1434058984764-CWnL48dV62jogJ8VXk6F7cVUB', new ''), referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1600): [client 140.211.91.96] entering getResponseFromServer(), referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(519): [client 140.211.91.96] entering getCASService(), referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(539): [client 140.211.91.96] CAS Service 'https%3a%2f%<a href="http://2fcas.sou.edu">2fcas.sou.edu</a>%2fsecure%2f', referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1674): [client 140.211.91.96] Validation response: <?xml version="1.0" encoding="UTF-8"?>\n<soap11:Envelope xmlns:soap11="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><soap11:Body><saml1p:Response MajorVersion="1" MinorVersion="1" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode Value="INVALID_TICKET" xmlns="<a href="http://www.ja-sig.org/products/cas/">http://www.ja-sig.org/products/cas/</a>"/><saml1p:StatusMessage>E_SESSION_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></soap11:Body></soap11:Envelope>, referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1293): [client 140.211.91.96] entering isValidCASTicket(), referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] mod_auth_cas.c(1299): [client 140.211.91.96] MOD_AUTH_CAS: response = <?xml version="1.0" encoding="UTF-8"?>\n<soap11:Envelope xmlns:soap11="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><soap11:Body><saml1p:Response MajorVersion="1" MinorVersion="1" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode Value="INVALID_TICKET" xmlns="<a href="http://www.ja-sig.org/products/cas/">http://www.ja-sig.org/products/cas/</a>"/><saml1p:StatusMessage>E_SESSION_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></soap11:Body></soap11:Envelope>, referer: <a href="https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1">https://shib.sou.edu/idp/profile/cas/login;jsessionid=ABB8C586467A003B849E5D5CF0BB6C72?execution=e1s1</a></div><div>[Thu Jun 11 14:43:04 2015] [debug] ssl_engine_kernel.c(1863): OpenSSL: Write: SSL negotiation finished successfully</div><div>[Thu Jun 11 14:43:04 2015] [info] [client 140.211.91.96] Connection closed to child 3 with standard shutdown (server <a href="http://cas.sou.edu:443">cas.sou.edu:443</a>)</div></div><div><br></div><div><br></div><div>But in idp-process.log I get this:</div><div><br></div><div><div>2015-06-11 14:43:04,759 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:182] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'martinicj' succeeded</div><div>2015-06-11 14:43:04,764 - INFO [net.shibboleth.idp.cas.flow.GrantServiceTicketAction:101] - Granted service ticket for <a href="https://cas.sou.edu/secure/">https://cas.sou.edu/secure/</a></div><div>2015-06-11 14:43:04,922 - INFO [net.shibboleth.idp.cas.flow.ValidateTicketAction:117] - Successfully validated ST-1434058984764-CWnL48dV62jogJ8VXk6F7cVUB for <a href="https://cas.sou.edu/secure/">https://cas.sou.edu/secure/</a></div></div><div><br></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><span style="font-size:12.8000001907349px"><b><br></b></span></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><span style="font-size:12.8000001907349px"><b>Jesse Martinich</b></span></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)">Systems Administrator</div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1">Southern Oregon University</font><span style="font-size:12.8000001907349px"> </span><font size="1">| 1250 Siskiyou Blvd </font><font size="1">| Ashland OR 97520</font><br></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1">541-552-8424</font></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1"><br></font></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1"><img src="https://docs.google.com/uc?export=download&id=0BwKjt2yacqt7UkNnWGxXaS1VUzQ&revid=0BwKjt2yacqt7bm9QbWZ5ejBHUWdZeGhGZ0VGWFVLTHFHb21BPQ"></font></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Jun 11, 2015 at 2:29 PM, Jesse Martinich <span dir="ltr"><<a href="mailto:martinicj@sou.edu" target="_blank">martinicj@sou.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks, I am using 443 for everything.<span class="HOEnZb"><font color="#888888"><div><br></div><div>Jesse</div></font></span></div><div class="gmail_extra"><span class=""><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><span style="font-size:12.8000001907349px"><b><br></b></span></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><span style="font-size:12.8000001907349px"><b>Jesse Martinich</b></span></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)">Systems Administrator</div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1">Southern Oregon University</font><span style="font-size:12.8000001907349px"> </span><font size="1">| 1250 Siskiyou Blvd </font><font size="1">| Ashland OR 97520</font><br></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1"><a href="tel:541-552-8424" value="+15415528424" target="_blank">541-552-8424</a></font></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1"><br></font></div><div style="font-size:12.8000001907349px;color:rgb(136,136,136)"><font size="1"><img src="https://docs.google.com/uc?export=download&id=0BwKjt2yacqt7UkNnWGxXaS1VUzQ&revid=0BwKjt2yacqt7bm9QbWZ5ejBHUWdZeGhGZ0VGWFVLTHFHb21BPQ"></font></div></div></div></div></div></div></div></div></div></div></div>
<br></span><div><div class="h5"><div class="gmail_quote">On Thu, Jun 11, 2015 at 2:24 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 6/11/15, 9:21 PM, "Jesse Martinich" <<a href="mailto:martinicj@sou.edu" target="_blank">martinicj@sou.edu</a>> wrote:<br>
<br>
<br>
<br>
>Thank you. I'm not sure which cert I should make sure I am trusting.<br>
>Using s_client just checks the ssl cert being used for Tomcat SSL. Don't<br>
>I need to make sure idp-signing.crt is being trusted?<br>
<br>
</span>Not for the callback, no. If you're hitting 443, it's the user facing<br>
cert. If you're hitting 8443, which I don't think you did, it would be the<br>
back channel cert. Both are configured in Jetty/Tomcat not the IdP.<br>
<span><font color="#888888"><br>
-- Scott<br>
</font></span><div><div><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div>