Grouper Users - Open Discussion List

["Singley, Norman" <>]

Hi Chris.

 

Thanks for checking in.  Yes, I have not resolved the issue yet, but have not been able to work on it lately since we’re working on upgrading our MIM software and several other projects right now. I hope to reset in the next day or two and revisit -  maybe trying these steps instead:

 

https://spaces.internet2.edu/display/Grouper/Newcastle+University+-+Protecting+UI+With+Shib

 

 

I will keep you posted. 

 

Thanks.

 

 

Norman Singley

Directory Services

406 243 6799

 

 

 

From: Hyzer, Chris [mailto:]
Sent: Wednesday, October 19, 2016 6:33 AM
To: Singley, Norman; Travis Schmidt; Jeff McCullough
Cc: Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

Norman are you still having a problem here?

 

---

From: Singley, Norman <>
Sent: Wednesday, September 28, 2016 5:38 PM
To: Singley, Norman; Travis Schmidt; Hyzer, Chris; Jeff McCullough
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

My apologies… What I meant was I had REMOVED basic auth from those two files, and just now I put it back – I reverted the web.core.xml files back to what came with the original install, and am still experiencing the error. 

 

Thanks!

 

Norman Singley

Directory Services

406 243 6799

 

 

 

From: [] On Behalf Of Singley, Norman
Sent: Wednesday, September 28, 2016 3:08 PM
To: Travis Schmidt; Hyzer, Chris; Jeff McCullough
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

Thanks Travis.  I did have BASIC still in there, so I removed it from:

 

./grouper/grouper.ui-2.3.0/webapp/WEB-INF/web.core.xml

./grouper/grouper.ui-2.3.0/dist/grouper/WEB-INF/web.core.xml

 

Attached is the web.core.xml file that is in place. 

 

I still get the access to the requested resource has been denied error.   

 

message Access to the requested resource has been denied

description Access to the specified resource (Access to the requested resource has been denied) has been forbidden.

 

Norman Singley

Directory Services

406 243 6799

 

 

 

From: Travis Schmidt []
Sent: Wednesday, September 28, 2016 1:48 PM
To: Singley, Norman; Hyzer, Chris; Jeff McCullough
Cc: Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

If you still have the BASIC auth removed from the web.core.xml, try putting it back in.  I have that set still in my app and that might be the link that sets the REMOTE_USER to a place Grouper is looking for it.

 

On Wed, Sep 28, 2016 at 10:46 AM Singley, Norman <> wrote:

Thanks, Travis.  I gave this a shot, and changed the Realm as noted.  I am getting redirected to our Shib, and I can authenticate, but when I get back to Grouper, I get this error:

 

 

 

 

 

The UI grouper error log looks like this:

 

 

2016-09-28 11:20:04,257: [http-8080-1] INFO  EventLog.info(156) -  - [a467035d6da1430995433101f095f25a,'GrouperSystem','application'] session: start (4ms)

2016-09-28 11:20:04,359: [http-8080-1] INFO  EventLog.info(156) -  - [a96848a889d547d9926af45c68cb2e87,'GrouperSystem','application'] session: start (1ms)

2016-09-28 11:20:04,403: [http-8080-1] DEBUG GrouperUiFilter.remoteUser(638) -  - httpServletRequest.getRemoteUser(): null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null

2016-09-28 11:20:04,404: [http-8080-1] DEBUG GrouperUiFilter.remoteUser(638) -  - httpServletRequest.getRemoteUser(): null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null

 

Thanks!

 

 

Norman Singley

Directory Services

406 243 6799

 

 

 

 

 

From: [mailto:] On Behalf Of Travis Schmidt
Sent: Friday, September 23, 2016 2:42 PM
To: Singley, Norman; Hyzer, Chris; Jeff McCullough
Cc: Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

Hi Norman, 

 

  I think this note previously from Jeff is what you need:

 

Since we allow anyone to login to grouper, I changed the Realm to:

 

<Realm

      className="org.jasig.cas.client.tomcat.v7.AssertionCasRealm"

   />

 

 

I think the fact that you deployed an empty group-user.properties, it is saying that you didn't login as an authorized user.

 

Travis

 

On Fri, Sep 23, 2016 at 1:37 PM Singley, Norman <> wrote:

Hmm, making progress, but now it’s kind of acting like it’s not sending me over to CAS (shib) to authenticate, perhaps?  It did not redirect to our cas login, just loaded this page.  I rebooted tomcat, cleared my browser cache ( and tried on a separate machine I have not navigated to grouper on before – and get the same error)

 

 

 

 

 

Norman Singley

Directory Services

406 243 6799

 

 

 

From: Hyzer, Chris [mailto:]
Sent: Friday, September 23, 2016 2:29 PM

To: Singley, Norman; Jeff McCullough; Travis Schmidt
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

Take out the other security constraints in web.xml and bounce tomcat, should work

 

 

 

<security-constraint>

    <web-resource-collection>

      <web-resource-name>UI</web-resource-name>

      <url-pattern>/grouperUi/app/*</url-pattern>

    </web-resource-collection>

    <auth-constraint>

      <role-name>*</role-name>

    </auth-constraint>

  </security-constraint>

<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->

<security-constraint>

    <web-resource-collection>

      <web-resource-name>UI</web-resource-name>

      <url-pattern>/grouperUi/appHtml/*</url-pattern>

    </web-resource-collection>

    <auth-constraint>

      <role-name>*</role-name>

    </auth-constraint>

  </security-constraint>

<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->

<security-constraint>

    <web-resource-collection>

      <web-resource-name>UI</web-resource-name>

      <url-pattern>/grouperExternal/app/*</url-pattern>

    </web-resource-collection>

    <auth-constraint>

      <role-name>*</role-name>

    </auth-constraint>

  </security-constraint>

<!--Inserting tag from base file. Merge file was file:/grouper/grouper.ui-2.3.0/temp/99.web.core-filters.xml-->

<security-constraint>

    <web-resource-collection>

      <web-resource-name>UI</web-resource-name>

      <url-pattern>/grouperExternal/appHtml/*</url-pattern>

    </web-resource-collection>

    <auth-constraint>

      <role-name>*</role-name>

    </auth-constraint>

  </security-constraint> Thanks

Chris

 

From: Hyzer, Chris
Sent: Friday, September 23, 2016 3:22 PM
To: 'Singley, Norman' <>; Jeff McCullough <>; Travis Schmidt <>
Cc: Gouper Users List <>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

Send me your server.xml and path of server.xml to start out…  send me your web.xml and the full path of that.  And confirm that you bounced tomcat after making changes and maybe clear cache in your browser and try again…  finally, are you using apache or just tomcat?  you can reply off list if you like…

 

Thanks

Chris

 

From: Singley, Norman []
Sent: Friday, September 23, 2016 2:54 PM
To: Hyzer, Chris <>; Jeff McCullough <>; Travis Schmidt <>
Cc: Gouper Users List <>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

 

Thanks, Chris. 

 

Well, I removed the code mentioned in this page:

https://spaces.internet2.edu/display/Grouper/Grouper+UI+custom+authentication+example

 

from the two web.core.xml files I could find.  I even removed it from  grouper.ws-2.3.0/grouper-ws/build/dist/grouper-ws/WEB-INF/web.xml

with no change, so I’m a little confused. I am not sure where else basic authentication could be getting applied from. 

 

Thanks.

 

 

Norman Singley

Directory Services

406 243 6799

 

 

 

From: Hyzer, Chris []
Sent: Friday, September 23, 2016 4:51 AM
To: Singley, Norman; Jeff McCullough; Travis Schmidt
Cc: Gouper Users List
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

Does your apache config or web.xml require basic?  If so remove those config things

 

thanks

Chris

 

From: Singley, Norman []
Sent: Thursday, September 22, 2016 5:03 PM
To: Jeff McCullough <>; Travis Schmidt <>
Cc: Hyzer, Chris <>; Gouper Users List <>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0

 

HI folks.

 

We’re working on implementing this as well, and I ran into a problem.  It does re-direct to our CAS (shibboleth) SSO, and I authenticate and get redirected back to grouper, but at that point, I get an http status 401 error “This request requires http authentication”. 

 

It’s a fresh install of grouper2.3.0.  I’m using servername:8080/grouper in the "GROUPER_SERVER" field. 

 

I did keep this line in, because without it, Tomcat would not start, but it is pointing to a blank file. 

propertiesFilePath="/etc/tomcat/grouper-users.properties"

 

Thanks for any help anyone can offer. 

 

 

Norman Singley

Directory Services

406 243 6799

 

 

 

 

From: [] On Behalf Of Jeff McCullough
Sent: Thursday, August 25, 2016 4:33 PM
To: Travis Schmidt
Cc: Hyzer, Chris; Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

Thank you. I tried this out, and found it to work. Since we allow anyone to login to grouper, I changed the Realm to:

 

<Realm

      className="org.jasig.cas.client.tomcat.v7.AssertionCasRealm"

   />

 

One can also add the SAML authenticator if they want to have more info returned and used to setup up roles. 

 

Cheers,

Jeff

 

On Aug 24, 2016, at 11:28 AM, Travis Schmidt <> wrote:

 

I was able to get this to work by using the Tomcat integration on the Java CAS Client:

 

https://github.com/apereo/java-cas-client

 

The context definition for Tomcat looks like this:

 

        <Context docBase="/ucd/opt/grouper-ui/dist/grouper" path="/grouper"

                  reloadable="false"

                  mapperContextRootRedirectEnabled="true"

                  mapperDirectoryRedirectEnabled="true">

          <Realm

             className="org.jasig.cas.client.tomcat.v7.PropertiesCasRealm"

             propertiesFilePath="/etc/tomcat/grouper-users.properties"

          />

          <Valve

            className="org.jasig.cas.client.tomcat.v7.Cas20CasAuthenticator"

            encoding="UTF-8"

            casServerLoginUrl="https://CAS_SERVER/cas/login"

            casServerUrlPrefix="https://CAS_SERVER/cas/"

            serverName="GROUPER_SERVER"

          />

 

          <!-- Single sign-out support -->

          <Valve

            className="org.jasig.cas.client.tomcat.v7.SingleSignOutValve"

            artifactParameterName="SAMLart"

          />

 

       </Context>

 

I didn't need to alter anything in the Grouper UI itself, just need to make sure that the logged in user was searchable by a source.

 

 

 

On Wed, Aug 24, 2016 at 11:12 AM Hyzer, Chris <> wrote:

Is anyone using CAS with Grouper 2.3?  How was it configured?

 

Do we need a servlet filter?

 

https://wiki.jasig.org/display/casc/configuring+the+jasig+cas+client+for+java+in+the+web.xml

 

Thanks

chris

 

 

 

From: Jeff McCullough [mailto:]
Sent: Tuesday, August 23, 2016 3:23 PM

To: Hyzer, Chris <>
Cc: Gouper Users List <>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

Yes, it doesn’t look like it doesn’t have an effect. 

 

Remote_user in index.jsp. This is the part that displays the username from REMOTE_USER. 

 

<body.

<dl>

        <dt>Your user name:</dt>

        <dd><%= request.getRemoteUser()== null ? "null" : request.getRemoteUser() %></dd>

</dl>

</body>

 

 

 

It is the same call in the index.jsp in the grouper UI root directory.

 

if(request.getRemoteUser()==null || "y".equals(request.getParameter("badRole"))) {

        location="populateIndex.do";

}else{

        location="home.do";

}%>

 

Jeff

 

On Aug 22, 2016, at 8:29 PM, Hyzer, Chris <> wrote:

 

Ok, I need that setting when I do authn with apache, maybe you don’t need it.

 

How do you display REMOTE_USER in jsp exactly?

 

Thanks,

Chris

 

From: Jeff McCullough [] 
Sent: Monday, August 22, 2016 8:47 PM
To: Hyzer, Chris <>
Cc: Gouper Users List <>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0

 

Hi Chris,

 

For the grouper.ui.authentication.http.header parameter, I tried no value, $REMOTE_USER and REMOTE_USER. None of these changed the error behavior.

 

Tomcat server.xml doesn’t have that or any similar setting. 

 

For diagnostics of tomcat/CAS, I installed a small cas-client app that reads/displays REMOTE_USER via a request.getRemoteUser() call. It works as expected. 

 

Do you have any other ideas?

 

Thanks,

Jeff

 

On Aug 20, 2016, at 7:33 AM, Hyzer, Chris <> wrote:

 

Is it $REMOTE_USER or just REMOTE_USER?   I don’t think you need to change that setting as you said…  but try editing it. 

 

Do you have tomcat server.xml setting:

 

<Connector port="8552" protocol="AJP/1.3" connectionTimeout="600000" request.tomcatAuthentication="false"

      URIEncoding="UTF-8" />

 

Or whatever the tomcat authn setting for your version is…

 

Thanks

Chris

 

From:  [] On Behalf Of Jeff McCullough
Sent: Friday, August 19, 2016 10:35 PM
To: Gouper Users List <>
Subject: [grouper-users] SSO integration - grouper 2.3.0

 

Hi all,

 

I’ve run into a snag with SSO integration this time around. I’ve actually done the procedure multiple times on other versions, and it was very easy to setup, no problems. This time with grouper 2.3.0, no workie.  Here’s what I’ve done:

 

I have the CAS 3.4.2 java client integrated with tomcat version 7 running on java 1.8. 

 

I removed the security-constraints, login-config, and security-role from the web.xml file. 

 

I modified the struts-config.xml with callLogin set to home.do, though the previous step is where I start seeing the below error.

 

This seemed redundant (because REMOTE_USER is the default), but found it in a email thread where someone else was having the same issue.

I modified grouper.ui.authentication.http.header = $REMOTE_USER

 

Lastly I added the debug statement (log4j.logger.edu.internet2.middleware.grouper.ui.GrouperUiFilter = DEBUG) in log4j with the result of:

 

2016-08-19 19:24:55,632: [http-bio-8443-exec-2] DEBUG GrouperUiFilter.remoteUser(636) -  - httpServletRequest.getRemoteUser(): null, $REMOTE_USER header: null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null

 

I’ve confirmed that the CAS client is in fact returning REMOTE_USER with correct user id. I modified the index.jsp within the grouper UI to display it, so I know grouper is seeing it. Yet, I get the error message:

 

You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.

 

Thanks in advance for any insights you may have.

 

Cheers,

Jeff