<div dir="ltr"><div class="gmail_quote"><div dir="ltr">Hi Bryan,<div><br></div><div>Thanks for your answers!!!!</div><div><br></div><div>I have been trying to configure everything in CAS server but I have some problems writing proxying applications using CAS (<a href="https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough" target="_blank">https://wiki.jasig.org/display/CAS/Proxy+CAS+Walkthrough</a>) </div><div><br></div><div><br></div><div>I saw that you used proxy authentication</div><div><br></div><div><span style="font-family:"Courier New";font-size:13.3333px">Cas20ProxyReceivingTicket</span><span style="font-family:"Courier New";font-size:13.3333px">ValidationFilter</span><br></div><div><span style="font-family:"Courier New";font-size:13.3333px"><br></span></div><div>Any particular reason for this? why the need for CAS Proxy Tickets? The peoplesoft need to comunicate with a third party tools? I mean it has to work as a proxy app?<span style="font-family:"Courier New";font-size:13.3333px"><br></span></div><div><br></div><div>Thanks for your answers</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 17, 2016 at 9:08 AM, Bryan Wooten <span dir="ltr"><<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">Comments Below<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:#1f497d">Bryan Wooten<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Tel: <a href="tel:%28801%29585-9323" value="+18015859323" target="_blank">(801)585-9323</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Email:
<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><img border="0" width="211" height="123" src="cid:image001.jpg@01D1C865.E9E5AB10" alt="Identity & Access Management_combined centered"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Jorge Fernandez Cancio [mailto:<a href="mailto:jorgefdez205@gmail.com" target="_blank">jorgefdez205@gmail.com</a>]
<br>
<b>Sent:</b> Friday, June 17, 2016 6:47 AM<br>
<b>To:</b> Bryan Wooten <<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a>><br>
<b>Cc:</b> Nate Klingenstein <<a href="mailto:nate.klingenstein@utah.edu" target="_blank">nate.klingenstein@utah.edu</a>><br>
<b>Subject:</b> [Ext] Re: CAS / peoplesoft - same trick should work with Shib<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Hi Bryan<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">Thanks so much for the pptx..., Unfortunately the link is dead but I could take a look to the presentation and I have some questions:<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">I have attached the ppt.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I saw that you used <code><span style="font-size:10.0pt">Cas20ProxyReceivingTicketValidationFilter and org.jasig.cas.client.util.HttpServletRequestWrapperFilter as filters in the People Soft side, any particular reason for that? does Peoplesoft
support only CAS 2.0?</span></code><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><code><span style="font-size:10.0pt">I could not see in the PeopleSoft Code how do you validdate the tickect against CAS? That's part is needed?</span></code><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><code><span style="font-size:10.0pt">Did you used Shib in the middle? <u></u><u></u></span></code></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">The is no Shib involved. The real trick is getting peoplesoft signon code to recognize remote_user whether set by CAS , Shib or something else.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">In funclibldap:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">Function CAS_AUTHENTICATION()<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &logger = initLogger();<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &<a href="http://logger.info" target="_blank">logger.info</a>("CAS_AUTHENTICATION ============ Start of CAS_AUTHENTICATION ============= (" | %SignonUserId | ")");<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> printRequestHeaders();<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> If &bConfigRead = False Then<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> getLDAPConfig();<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> End-If;<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> <b>&cas_result = %Request.RemoteUser;</b><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> If &cas_result <> "" Then<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> /* User is authenticated, log them into PeopleSoft */<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &<a href="http://logger.info" target="_blank">logger.info</a>(" CAS_AUTHENTICATION - " | "Remote user = " | &cas_result | " logged in by CAS_AUTHENTICATION");<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
<b>SetAuthenticationResult( True, Upper(&cas_result), "", False);</b><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &authMethod = "CAS";<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &CAS_userid = &cas_result;<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &sql_PSOPRDEFN = CreateSQL("Select FAILEDLOGINS from PSOPRDEFN where OPRID=:1", Upper(&cas_result));<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> &ret = &sql_PSOPRDEFN.Fetch(&failedLogin);<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> If (&failedLogin <> 0) Then<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"> SQLExec("update PSOPRDEFN set FAILEDLOGINS=0 whe<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><code><span style="font-size:10.0pt">What </span></code><span style="font-family:"Courier New"">communication </span>protocol did you use for CAS integration, CAS 2.0?<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">Yes I have always used CAS 2.0, but it does not really matter.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In your use case the 3rd party tool (back-end authentication) was LDAP or ActiveDirectory? In this case PeopleSoft need to bee synchronized with this tool?<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">Our CAS binds to OpenDJ, Peoplesoft can reference a different LDAP or AD. Hope this helps. It has been a few years since I did all this so some details may be escaping
me.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:red">So here is my thoughts if you want to forget CAS. You need to front your Peoplesoft Weblogic servers with Apache. On this Apache you install the Shib SP and protect
the Weblogic URLs with the SP. As users hit Peoplesoft they will be authenticated to your Shib IDP. This will set remote_user (and potentially other attributes passed as either environment variable or http headers) At this point it is all up to peoplesoft
signon code to trust remote_user in funclibldap. Hope this makes sense.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:red"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal">Thanks in advance and sorry for so many questions....<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Jun 16, 2016 at 6:14 PM, Bryan Wooten <<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Attached is my presentation on this topic. It has most the info.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">This may also help:<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><a href="http://lanyrd.com/2014/apereo/sdbbdp/" target="_blank">http://lanyrd.com/2014/apereo/sdbbdp/</a><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b><span style="color:#1f497d">Bryan Wooten</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Tel:
<a href="tel:%28801%29585-9323" target="_blank">(801)585-9323</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Email:
<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a></span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"><img border="0" width="211" height="123" src="cid:image001.jpg@01D1C865.E9E5AB10" alt="Identity & Access Management_combined centered"></span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote></div><br></div>
</div><br></div>