grouper-users - Re: [grouper-users] SSO integration - grouper 2.3.0
Please Wait...
grouper-users@internet2.edu
Subject: Grouper Users - Open Discussion List
List archive
- From: Travis Schmidt <travis.schmidt@gmail.com>
- To: "Singley, Norman" <Norman.Singley@mso.umt.edu>, "Hyzer, Chris" <mchyzer@isc.upenn.edu>, Jeff McCullough <jeffmc@berkeley.edu>
- Cc: Gouper Users List <grouper-users@internet2.edu>
- Subject: Re: [grouper-users] SSO integration - grouper 2.3.0
- Date: Wed, 28 Sep 2016 19:48:00 +0000
- Ironport-phdr: 9a23:vQMKJRX2ptkVqKu9sPqBu4HrCYzV8LGtZVwlr6E/grcLSJyIuqrYZh2Ct8tkgFKBZ4jH8fUM07OQ6P+wHzFbqs/c+Fk5M7VyFDY9wf0MmAIhBMPXQWbaF9XNKxIAIcJZSVV+9Gu6O0UGUOz3ZlnVv2HgpWVKQka3HUNPK+/0Ao/fidisn6D3osWLIlYAuD3oK4hzKhqyoBSV/u8Rm45rLOx5nj3OuH5BfaJtxGVnIV+CtxPn4YGt+YIl/ihN7bZpve5RQ6jgO+wTTaZZF35uZ2U+5Nz5uAPrTBCEoGYEX2MQ1BdEHl6BpDP3UJm5lyDRq+553zSVPYWiT706VzGpx61mUhzljCoWcTM17TeEpNZ3ifdnuhu/pgc3+IXUZYCZKLIqYrnUY9IBA3FKXsNQWzBpDYa1bo9JBO0Ea7UL57LhrkcD+EPtTTKnA/nin3oR3if7
Thanks, Travis. I gave this a shot, and changed the Realm as noted. I am getting redirected to our Shib, and I can authenticate, but when I get back to Grouper, I get this error:
The UI grouper error log looks like this:
2016-09-28 11:20:04,257: [http-8080-1] INFO EventLog.info(156) - - [a467035d6da1430995433101f095f25a,'GrouperSystem','application'] session: start (4ms)
2016-09-28 11:20:04,359: [http-8080-1] INFO EventLog.info(156) - - [a96848a889d547d9926af45c68cb2e87,'GrouperSystem','application'] session: start (1ms)
2016-09-28 11:20:04,403: [http-8080-1] DEBUG GrouperUiFilter.remoteUser(638) - - httpServletRequest.getRemoteUser(): null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null
2016-09-28 11:20:04,404: [http-8080-1] DEBUG GrouperUiFilter.remoteUser(638) - - httpServletRequest.getRemoteUser(): null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null
Thanks!
From: grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu] On Behalf Of Travis Schmidt
Sent: Friday, September 23, 2016 2:42 PM
To: Singley, Norman; Hyzer, Chris; Jeff McCullough
Cc: Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0
Hi Norman,
I think this note previously from Jeff is what you need:
Since we allow anyone to login to grouper, I changed the Realm to:
<Realm
className="org.jasig.cas.client.tomcat.v7.AssertionCasRealm"
/>
I think the fact that you deployed an empty group-user.properties, it is saying that you didn't login as an authorized user.
Travis
On Fri, Sep 23, 2016 at 1:37 PM Singley, Norman <Norman.Singley@mso.umt.edu> wrote:
Hmm, making progress, but now it’s kind of acting like it’s not sending me over to CAS (shib) to authenticate, perhaps? It did not redirect to our cas login, just loaded this page. I rebooted tomcat, cleared my browser cache ( and tried on a separate machine I have not navigated to grouper on before – and get the same error)
From: Hyzer, Chris [mailto:mchyzer@isc.upenn.edu]
Sent: Friday, September 23, 2016 2:29 PM
To: Singley, Norman; Jeff McCullough; Travis Schmidt
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
Take out the other security constraints in web.xml and bounce tomcat, should work
<security-constraint>
<web-resource-collection>
<web-resource-name>UI</web-resource-name>
<url-pattern>/grouperUi/app/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->
<security-constraint>
<web-resource-collection>
<web-resource-name>UI</web-resource-name>
<url-pattern>/grouperUi/appHtml/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->
<security-constraint>
<web-resource-collection>
<web-resource-name>UI</web-resource-name>
<url-pattern>/grouperExternal/app/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->
<security-constraint>
<web-resource-collection>
<web-resource-name>UI</web-resource-name>
<url-pattern>/grouperExternal/appHtml/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint> Thanks
Chris
From: Hyzer, Chris
Sent: Friday, September 23, 2016 3:22 PM
To: 'Singley, Norman' <Norman.Singley@mso.umt.edu>; Jeff McCullough <jeffmc@berkeley.edu>; Travis Schmidt <travis.schmidt@gmail.com>
Cc: Gouper Users List <grouper-users@internet2.edu>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
Send me your server.xml and path of server.xml to start out… send me your web.xml and the full path of that. And confirm that you bounced tomcat after making changes and maybe clear cache in your browser and try again… finally, are you using apache or just tomcat? you can reply off list if you like…
Thanks
Chris
From: Singley, Norman [mailto:Norman.Singley@mso.umt.edu]
Sent: Friday, September 23, 2016 2:54 PM
To: Hyzer, Chris <mchyzer@isc.upenn.edu>; Jeff McCullough <jeffmc@berkeley.edu>; Travis Schmidt <travis.schmidt@gmail.com>
Cc: Gouper Users List <grouper-users@internet2.edu>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
Thanks, Chris.
Well, I removed the code mentioned in this page:
https://spaces.internet2.edu/display/Grouper/Grouper+UI+custom+authentication+example
from the two web.core.xml files I could find. I even removed it from grouper.ws-2.3.0/grouper-ws/build/dist/grouper-ws/WEB-INF/web.xml
with no change, so I’m a little confused. I am not sure where else basic authentication could be getting applied from.
Thanks.
Norman Singley
Directory Services
406 243 6799
From: Hyzer, Chris [mailto:mchyzer@isc.upenn.edu]
Sent: Friday, September 23, 2016 4:51 AM
To: Singley, Norman; Jeff McCullough; Travis Schmidt
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
Does your apache config or web.xml require basic? If so remove those config things
thanks
Chris
From: Singley, Norman [mailto:Norman.Singley@mso.umt.edu]
Sent: Thursday, September 22, 2016 5:03 PM
To: Jeff McCullough <jeffmc@berkeley.edu>; Travis Schmidt <travis.schmidt@gmail.com>
Cc: Hyzer, Chris <mchyzer@isc.upenn.edu>; Gouper Users List <grouper-users@internet2.edu>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
HI folks.
We’re working on implementing this as well, and I ran into a problem. It does re-direct to our CAS (shibboleth) SSO, and I authenticate and get redirected back to grouper, but at that point, I get an http status 401 error “This request requires http authentication”.
It’s a fresh install of grouper2.3.0. I’m using servername:8080/grouper in the "GROUPER_SERVER" field.
I did keep this line in, because without it, Tomcat would not start, but it is pointing to a blank file.
propertiesFilePath="/etc/tomcat/grouper-users.properties"
Thanks for any help anyone can offer.
Norman Singley
Directory Services
406 243 6799
From: grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu] On Behalf Of Jeff McCullough
Sent: Thursday, August 25, 2016 4:33 PM
To: Travis Schmidt
Cc: Hyzer, Chris; Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0
Thank you. I tried this out, and found it to work. Since we allow anyone to login to grouper, I changed the Realm to:
<Realm
className="org.jasig.cas.client.tomcat.v7.AssertionCasRealm"
/>
One can also add the SAML authenticator if they want to have more info returned and used to setup up roles.
Cheers,
Jeff
On Aug 24, 2016, at 11:28 AM, Travis Schmidt <travis.schmidt@gmail.com> wrote:
I was able to get this to work by using the Tomcat integration on the Java CAS Client:
The context definition for Tomcat looks like this:
<Context docBase="/ucd/opt/grouper-ui/dist/grouper" path="/grouper"
reloadable="false"
mapperContextRootRedirectEnabled="true"
mapperDirectoryRedirectEnabled="true">
<Realm
className="org.jasig.cas.client.tomcat.v7.PropertiesCasRealm"
propertiesFilePath="/etc/tomcat/grouper-users.properties"
/>
<Valve
className="org.jasig.cas.client.tomcat.v7.Cas20CasAuthenticator"
encoding="UTF-8"
casServerLoginUrl="https://CAS_SERVER/cas/login"
casServerUrlPrefix="https://CAS_SERVER/cas/"
serverName="GROUPER_SERVER"
/>
<!-- Single sign-out support -->
<Valve
className="org.jasig.cas.client.tomcat.v7.SingleSignOutValve"
artifactParameterName="SAMLart"
/>
</Context>
I didn't need to alter anything in the Grouper UI itself, just need to make sure that the logged in user was searchable by a source.
On Wed, Aug 24, 2016 at 11:12 AM Hyzer, Chris <mchyzer@isc.upenn.edu> wrote:
Is anyone using CAS with Grouper 2.3? How was it configured?
Do we need a servlet filter?
https://wiki.jasig.org/display/casc/configuring+the+jasig+cas+client+for+java+in+the+web.xml
Thanks
chris
From: Jeff McCullough [mailto:jeffmc@berkeley.edu]
Sent: Tuesday, August 23, 2016 3:23 PM
To: Hyzer, Chris <mchyzer@isc.upenn.edu>
Cc: Gouper Users List <grouper-users@internet2.edu>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0
Yes, it doesn’t look like it doesn’t have an effect.
Remote_user in index.jsp. This is the part that displays the username from REMOTE_USER.
<body.
<dl>
<dt>Your user name:</dt>
<dd><%= request.getRemoteUser()== null ? "null" : request.getRemoteUser() %></dd>
</dl>
</body>
It is the same call in the index.jsp in the grouper UI root directory.
if(request.getRemoteUser()==null || "y".equals(request.getParameter("badRole"))) {
location="populateIndex.do";
}else{
location="home.do";
}%>
Jeff
On Aug 22, 2016, at 8:29 PM, Hyzer, Chris <mchyzer@isc.upenn.edu> wrote:
Ok, I need that setting when I do authn with apache, maybe you don’t need it.
How do you display REMOTE_USER in jsp exactly?
Thanks,
Chris
From: Jeff McCullough [mailto:jeffmc@berkeley.edu]
Sent: Monday, August 22, 2016 8:47 PM
To: Hyzer, Chris <mchyzer@isc.upenn.edu>
Cc: Gouper Users List <grouper-users@internet2.edu>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0
Hi Chris,
For the grouper.ui.authentication.http.header parameter, I tried no value, $REMOTE_USER and REMOTE_USER. None of these changed the error behavior.
Tomcat server.xml doesn’t have that or any similar setting.
For diagnostics of tomcat/CAS, I installed a small cas-client app that reads/displays REMOTE_USER via a request.getRemoteUser() call. It works as expected.
Do you have any other ideas?
Thanks,
Jeff
On Aug 20, 2016, at 7:33 AM, Hyzer, Chris <mchyzer@isc.upenn.edu> wrote:
Is it $REMOTE_USER or just REMOTE_USER? I don’t think you need to change that setting as you said… but try editing it.
Do you have tomcat server.xml setting:
<Connector port="8552" protocol="AJP/1.3" connectionTimeout="600000" request.tomcatAuthentication="false"
URIEncoding="UTF-8" />
Or whatever the tomcat authn setting for your version is…
Thanks
Chris
From: grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu] On Behalf Of Jeff McCullough
Sent: Friday, August 19, 2016 10:35 PM
To: Gouper Users List <grouper-users@internet2.edu>
Subject: [grouper-users] SSO integration - grouper 2.3.0
Hi all,
I’ve run into a snag with SSO integration this time around. I’ve actually done the procedure multiple times on other versions, and it was very easy to setup, no problems. This time with grouper 2.3.0, no workie. Here’s what I’ve done:
I have the CAS 3.4.2 java client integrated with tomcat version 7 running on java 1.8.
I removed the security-constraints, login-config, and security-role from the web.xml file.
I modified the struts-config.xml with callLogin set to home.do, though the previous step is where I start seeing the below error.
This seemed redundant (because REMOTE_USER is the default), but found it in a email thread where someone else was having the same issue.
I modified grouper.ui.authentication.http.header = $REMOTE_USER
Lastly I added the debug statement (log4j.logger.edu.internet2.middleware.grouper.ui.GrouperUiFilter = DEBUG) in log4j with the result of:
2016-08-19 19:24:55,632: [http-bio-8443-exec-2] DEBUG GrouperUiFilter.remoteUser(636) - - httpServletRequest.getRemoteUser(): null, $REMOTE_USER header: null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null
I’ve confirmed that the CAS client is in fact returning REMOTE_USER with correct user id. I modified the index.jsp within the grouper UI to display it, so I know grouper is seeing it. Yet, I get the error message:
You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.
Thanks in advance for any insights you may have.
Cheers,
Jeff
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/22/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Hyzer, Chris, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Hyzer, Chris, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Hyzer, Chris, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/23/2016
- Re: [grouper-users] SSO integration - grouper 2.3.0, Travis Schmidt, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/28/2016
- Re: [grouper-users] SSO integration - grouper 2.3.0, Travis Schmidt, 09/28/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/28/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/28/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/28/2016
- Re: [grouper-users] SSO integration - grouper 2.3.0, Travis Schmidt, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Singley, Norman, 09/23/2016
- RE: [grouper-users] SSO integration - grouper 2.3.0, Hyzer, Chris, 09/23/2016
Archive powered by MHonArc 2.6.19.