<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Sans";
panose-1:2 11 6 2 3 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We are in the process of migrating our existing CAS client apps to use our IdP3 and remove our Jasig CAS server by attrition. No need for 2 SSOs, right?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Anyway, we set up our CAS protocol in IdP3 following the wiki instructions for basic setup. In idp.properties, our idp sessioning is enabled and set to shibboleth.StorageService; as is our CAS storage service. Our CAS authentication/SSO
is working nicely for our non-gateway authn requests.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For whatever reason, our CAS clients that are making requests with the gateway=true option for anonymous access, which work well with our CAS server, are not working with the IdP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For a simple test, I have a development environment on my localhost running on Jetty port 80. I also have a ‘cas-sample’ web application (running on a tomcat @ localhost:7080) with the root page dispatching to a spring servlet with an
org.jasig.cas.client.authentication.AuthenticationFilter. The gateway property set to true on the filter. It makes no difference if I browse to CAS sample before, or after getting an IdP session for an elsewhere service, I get the same result from the CAS
filter, ‘no ticket and no assertion found’. I am seeing the activity on the IdP process log as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below is a log snippet from both the IdP and the CAS sample app. The Idp snippet begins with a separate CAS authentication(just Google as a test service) to get a session. Then there is the gateway call from cas-sample:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">IdP<o:p></o:p></p>
<p class="MsoNormal">2016-02-04 10:17:55,099 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'jo180287e' succeeded<o:p></o:p></p>
<p class="MsoNormal">2016-02-04 10:17:57,718 - INFO [net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction:100] - Granted service ticket for http://www.google.com<o:p></o:p></p>
<p class="MsoNormal">2016-02-04 10:17:57,719 - INFO [Shibboleth-Audit.SSO:241] - 20160204T171757Z||f2733dd88cf098da867dae61068ea69a2a2711270afe1386579ffc04d3026532|http://www.google.com|https://www.apereo.org/cas/protocol/login|||||||jo180287e|ST-1454606277718-J6Afm2c8vPBP2Xj1AHQ4pCOwu<o:p></o:p></p>
<p class="MsoNormal">2016-02-04 10:18:24,588 - INFO [Shibboleth-Audit.SSO:241] - 20160204T171824Z||f2733dd88cf098da867dae61068ea69a2a2711270afe1386579ffc04d3026532|http://localhost:7080/cas-sample|https://www.apereo.org/cas/protocol/login||||||||<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CAS sample<o:p></o:p></p>
<p class="MsoNormal">DEBUG 2016-02-04 10:18:24 no ticket and no assertion found<o:p></o:p></p>
<p class="MsoNormal">DEBUG 2016-02-04 10:18:24 setting gateway attribute in session<o:p></o:p></p>
<p class="MsoNormal">DEBUG 2016-02-04 10:18:24 Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade@7b47068c]<o:p></o:p></p>
<p class="MsoNormal">DEBUG 2016-02-04 10:18:24 Constructed service url: http://localhost:7080/cas-sample<o:p></o:p></p>
<p class="MsoNormal">DEBUG 2016-02-04 10:18:24 redirecting to "https://localhost/idp/profile/cas/login?service=http%3A%2F%2Flocalhost%3A7080%2Fcas-sample&gateway=true"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The IdP is redirecting back to the service without painting a login view as expected, but the redirect does not have any parameters included, namely the ticket, if I already have a session on the IdP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Am I missing a config for the IdP somewhere?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Lucida Sans",sans-serif">Josh O’Dowd<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Lucida Sans",sans-serif">Software Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Lucida Sans",sans-serif">Central IT, University of Montana<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Lucida Sans",sans-serif">(406)243-6283<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>