<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hello all:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our production and development IdP specifics:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Red Hat Enterprise Linux Server release 6.9 (Santiago)<o:p></o:p></p>
<p class="MsoNormal">Oracle Java JDK 1.8.0_131<o:p></o:p></p>
<p class="MsoNormal">Jetty 9.3.9<o:p></o:p></p>
<p class="MsoNormal">Shibboleth IdP 3.3.1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are currently running Shibboleth IdP version 3.3.1 in production. We are also running an old version of CAS (3.5.2.1) in production. Our goals are to use the CAS protocol implementation in IdP V3 to eliminate CAS entirely, and to have
just one single sign-on session across both CAS and Shibboleth clients.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Having followed the instructions under CASProtocolConfiguration on the wiki, we have two CAS clients successfully authenticating using IdP V3. They share a session as expected: if one successfully logs in to CAS Client A, then no login
dialog box is displayed when the user goes to access CAS Client B, he is simply granted access to the application. The same situation exists with Shibboleth clients and applications: successfully log in to one and the user’s credentials are not required again
to access a second Shibboleth-protected application.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What isn’t working: CAS and Shibboleth do not recognize each other’s sessions: after a successful login to a Shibboleth-protected application, the user is required to enter his credentials again to access a CAS-protected application, or
vice versa: the user successfully logs in to a CAS-protected application, but has to enter his credentials again if he wants to use a Shibboleth-protected application.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It appears we have addressed the four main requirements as listed under “CAS Quickstart”:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Configure suitable storage service:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From idp.properties:<o:p></o:p></p>
<p class="MsoNormal">idp.session.StorageService = shibboleth.StorageService<o:p></o:p></p>
<p class="MsoNormal">idp.cas.StorageService = shibboleth.StorageService<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Add CAS protocol profiles to the default relying party:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From relying-party.xml:<o:p></o:p></p>
<p class="MsoNormal"><bean id=”shibboleth.DefaultRelyingParty” parent=”RelyingParty”><o:p></o:p></p>
<p class="MsoNormal"> <property name=”profileConfigurations”><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> ….multiple lines omitted…<o:p></o:p></p>
<p class="MsoNormal"> <ref bean=”CAS.LoginConfiguration” /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean=”CAS.ProxyConfiguration” /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean=”CAS.ValidateConfiguration” /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"></bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Add verified CAS relying parties:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From cas-protocol.xml:<o:p></o:p></p>
<p class="MsoNormal"><bean class=”net.shibboleth.idp.cas.service.ServiceDefinition”<o:p></o:p></p>
<p class="MsoNormal"> c:regex=https://([A-Za-z0-9_-]+\.)*csuchico\.edu(:\d+)?/.*<o:p></o:p></p>
<p class="MsoNormal"> p:group=”csuchico-cas-clients”<o:p></o:p></p>
<p class="MsoNormal"> p:authorizedToProxy=”true”<o:p></o:p></p>
<p class="MsoNormal"> p:singleLogoutParticipant=”true” /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We intend to restrict this further, but for now any on-campus clients are okay.<o:p></o:p></p>
<p class="MsoNormal">We will need to do CAS proxying, but have not got that far yet.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Configure SSL/TLS trust:<o:p></o:p></p>
<p class="MsoNormal">Not implemented yet. Need to get basic SSO functioning before we address CAS proxies.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The IdP logs (idp-warn.log, idp-process.log) don’t indicate anything obvious, other than Shibboleth or CAS not recognizing the existing session that the other protocol created.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Historically, we have made only the minimum changes from the defaults that are required. The only heavily-customized part of our IdP installation is login.vm, which is a modified version of login.jsp from our IdP V2 installation. To eliminate
that as a variable, I am testing using the default copy of login.vm that came with IdP V3.3.1.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">With a properly configured IdP V3, will a CAS client wanting access to an application honor an existing Shibboleth session (user logged into a federated application earlier) and not display a login form asking for credentials again?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Same question going the other way: will a user who has already successfully authenticated to a CAS-protected application via IdP V3 avoid seeing the login page a second time when accessing a federated application via Shibboleth?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What am I missing?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance for any help.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">David Fuhs<o:p></o:p></p>
<p class="MsoNormal">Enterprise Applications<o:p></o:p></p>
<p class="MsoNormal">California State University, Chico<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>