<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Hi David, thanks for asking this question – we are also pursuing the same strategy.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Currently we have our Shib IDP v2 delegate authentication to our external CAS 3.5 server. This makes for a very seamless SSO experience between on-premise and off-campus applications.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">AFAIK, this is possible with a Shib IDP v3 deployment that handles both SSO for CAS clients, and remote Shib SPs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Corey S.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Corey Scholefield | <a href="mailto:coreys@uvic.ca">
<span style="color:#0563C1">coreys@uvic.ca</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sr. Identity Systems Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">University of Victoria | Victoria, B.C. Canada<o:p></o:p></span></p>
<p class="MsoNormal"><b><i><span style="font-size:12.0pt;color:#1F497D"><o:p> </o:p></span></i></b></p>
<p class="MsoNormal"><span style="color:#1F497D">University Systems<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><img border="0" width="436" height="54" style="width:4.5416in;height:.5625in" id="Picture_x0020_1" src="cid:image001.jpg@01D30AB8.6A24C050" alt="Description: cid:503A0399-005C-4190-8638-3C32C44A5C8B"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>David C Fuhs<br>
<b>Sent:</b> August 1, 2017 10:58 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> CAS And Shibboleth SSO<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Hello all:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Our production and development IdP specifics:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Red Hat Enterprise Linux Server release 6.9 (Santiago)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Oracle Java JDK 1.8.0_131<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Jetty 9.3.9<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Shibboleth IdP 3.3.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We are currently running Shibboleth IdP version 3.3.1 in production. We are also running an old version of CAS (3.5.2.1) in production. Our goals are to use the CAS protocol implementation in IdP V3 to eliminate CAS
entirely, and to have just one single sign-on session across both CAS and Shibboleth clients.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Having followed the instructions under CASProtocolConfiguration on the wiki, we have two CAS clients successfully authenticating using IdP V3. They share a session as expected: if one successfully logs in to CAS Client
A, then no login dialog box is displayed when the user goes to access CAS Client B, he is simply granted access to the application. The same situation exists with Shibboleth clients and applications: successfully log in to one and the user’s credentials are
not required again to access a second Shibboleth-protected application.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">What isn’t working: CAS and Shibboleth do not recognize each other’s sessions: after a successful login to a Shibboleth-protected application, the user is required to enter his credentials again to access a CAS-protected
application, or vice versa: the user successfully logs in to a CAS-protected application, but has to enter his credentials again if he wants to use a Shibboleth-protected application.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It appears we have addressed the four main requirements as listed under “CAS Quickstart”:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Configure suitable storage service:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">From idp.properties:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">idp.session.StorageService = shibboleth.StorageService<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">idp.cas.StorageService = shibboleth.StorageService<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Add CAS protocol profiles to the default relying party:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">From relying-party.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><bean id=”shibboleth.DefaultRelyingParty” parent=”RelyingParty”><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <property name=”profileConfigurations”><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> ….multiple lines omitted…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <ref bean=”CAS.LoginConfiguration” /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <ref bean=”CAS.ProxyConfiguration” /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <ref bean=”CAS.ValidateConfiguration” /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Add verified CAS relying parties:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">From cas-protocol.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><bean class=”net.shibboleth.idp.cas.service.ServiceDefinition”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> c:regex=https://([A-Za-z0-9_-]+\.)*csuchico\.edu(:\d+)?/.*<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> p:group=”csuchico-cas-clients”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> p:authorizedToProxy=”true”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> p:singleLogoutParticipant=”true” /><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We intend to restrict this further, but for now any on-campus clients are okay.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We will need to do CAS proxying, but have not got that far yet.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Configure SSL/TLS trust:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Not implemented yet. Need to get basic SSO functioning before we address CAS proxies.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The IdP logs (idp-warn.log, idp-process.log) don’t indicate anything obvious, other than Shibboleth or CAS not recognizing the existing session that the other protocol created.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Historically, we have made only the minimum changes from the defaults that are required. The only heavily-customized part of our IdP installation is login.vm, which is a modified version of login.jsp from our IdP V2
installation. To eliminate that as a variable, I am testing using the default copy of login.vm that came with IdP V3.3.1.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">With a properly configured IdP V3, will a CAS client wanting access to an application honor an existing Shibboleth session (user logged into a federated application earlier) and not display a login form asking for credentials
again?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Same question going the other way: will a user who has already successfully authenticated to a CAS-protected application via IdP V3 avoid seeing the login page a second time when accessing a federated application via
Shibboleth? <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">What am I missing?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks in advance for any help.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">David Fuhs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Enterprise Applications<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">California State University, Chico<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>