topic Re: Alfresco Community and CAS - SSO in Alfresco Archive

Alfresco Community and CAS - SSO

frank_s — Tue, 13 May 2008 13:00:30 GMT

Hi,over the last few weeks, I've tried to configure Alfresco Community with CAS, and have failed to do so. I have posted a number of questions regarding this on the forums, yet these have been left unanswered. I noticed that other forum members posted questions about the same topic, but a lot of the

Re: Alfresco Community and CAS - SSO

mdaslam — Wed, 14 May 2008 01:08:23 GMT

Hi Frank,
It should be possible. We have configured Liferay + alfresco + CAS. You have to add CAS Filter entries to the the web.xml of alfresco.war.

Thanks,
Aslam

Re: Alfresco Community and CAS - SSO

shoshin — Wed, 14 May 2008 11:16:55 GMT

Hi Aslam,

It is good to hear that you have cracked the SSO part.
Could you please kindly share us the steps and entries to achieve the same.

Advance Thanks,
Shoshin

Re: Alfresco Community and CAS - SSO

frank_s — Wed, 14 May 2008 11:21:58 GMT

Please do - I'd be very interested in learning the details, as I've tried to make the changes to Alfresco's web.xml as they are described in various posts in the forums / wiki / Jira, but I didn't get anywhere.

Thanks in advance,

Frank.

Re: Alfresco Community and CAS - SSO

mdaslam — Wed, 14 May 2008 14:49:07 GMT

Hi Frank,
I wasn't involved in the integration of CAS with Alfresco as I joined the team later. But below are the configurations of CAS filter in web.xml of alfresco.war. Instead of localhost, change it to the respective URL and port of CAS. Also you need to add casclient-2.1.1.jar (WEB-INF\lib of cas-web.war) to the WEB-INF\lib folder of alfresco.war and cas-web.war should be deployed.

You can this, I know only this much of Integration part. Sorry about it.

<filter>

      <filter-name>CAS Filter</filter-name>
   <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>

<init-param>
      <param-name>logout_url</param-name>
      <param-value>https://localhost:8443/cas-web/logout</param-value>
   </init-param>

   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://localhost:8443/cas-web/login</param-value>
   </init-param>

<init-param>
        <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
        <param-value>https://localhost:8443/cas-web/serviceValidate</param-value>
    </init-param>

<init-param>
        <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
        <param-value>localhost:8080</param-value>
    </init-param>

</filter>

<filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
<filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>

Regards,
Aslam

Re: Alfresco Community and CAS - SSO

frank_s — Wed, 14 May 2008 15:05:03 GMT

Hi Aslam,

many thanks for that, I'll give that a try!

f.

Re: Alfresco Community and CAS - SSO

mdaslam — Wed, 14 May 2008 15:05:58 GMT

Hi,
There is also Cignex-war deployed in the lib of alfresco.war. It has
\com\cignex\cas
                     —\client
                    —-\proxy
                     —-\util
com\cignex\filters\sso\cas\CASFilter.class

and other like
\com\cignex\util
\com\cignex\web.

Regards,
Aslam

Re: Alfresco Community and CAS - SSO

frank_s — Wed, 14 May 2008 16:47:51 GMT

Aslam, thanks again for your post.

After making the changes to the web.xml, Alfresco throws exceptions and displays an error message as described here: http://forums.alfresco.com/viewtopic.php?f=3&t=10626&p=35576 when returning a ticket from the CAS server. Although I'm not using NTLM, the behaviour I experience is identical to the one described in the link above.

Since can't use the Enterprise version of Alfresco and have no need for Liferay, the Cignex solution is unfortunately of no use to me.

I'd be very happy to be corrected by someone from Alfresco, but I've had to come to the conclusion that Alfresco CE 2.9 on its own is not able to do SSO via CAS.

f.

Re: Alfresco Community and CAS - SSO

mikewaters — Wed, 21 May 2008 10:48:38 GMT

Hi Frank

We have done it at Keem Bay Research and you are right - Alfesco does not work with CAS out of the box - it needs a bit of extra java code.

We have been using 2.1 CE and 2.9B appears to be the same. (ie I looked at the code in the SVN head and its not changed much)

There are several bits of code in the wikis, forums and Jira but none have made it into Alfresco. (Keem Bay Research are working on a contribution right now

The extra code is a filter that takes the username populated by the CAS filter and passes it to the Alfresco API. Your error is a symptom of that not happening.

More info in another post - http://forums.alfresco.com/viewtopic.php?f=7&t=12372#p41366 but this should really get into the wiki (and into 3.0!)

cheers

-Mike
Keem Bay Research
http://keembay.com

Re: Alfresco Community and CAS - SSO

frank_s — Wed, 21 May 2008 11:04:26 GMT

Hi Mike,

thank you very much for this. Let's hope that it makes it into 3.0CE - I'm sure it would be of use to many people, if only because it would make the upgrade process easier. I just hope somebody from Alfresco reads this…

Thanks again,

f.

Re: Alfresco Community and CAS - SSO

mikewaters — Wed, 21 May 2008 16:55:34 GMT

Hi again - I have created that wiki page with instructions to integrate Alfresco with CAS

http://wiki.alfresco.com/wiki/Central_Authentication_Service_Configuration

Let us know how you get on!

-Mike
Keem Bay Research
http://keembay.com

Re: Alfresco Community and CAS - SSO

frank_s — Wed, 21 May 2008 17:01:47 GMT

Wow! You totally rock - that's an absolutely spectacular effort! Thank you so much - I'll give it a whirl first thing tomorrow.

Thanks again,

f.

Re: Alfresco Community and CAS - SSO

frank_s — Thu, 22 May 2008 14:35:22 GMT

Mike,

thank you again for the sterling effort - I followed your instructions on the wiki and I'm now running a fully CASified Alfresco, thanks to you! Here's what I learned:

I didn't get any joy using cas-client-core-3.1.1.jar. When starting up Tomcat in step "Testing CAS Protection", Tomcat threw an exception ("ClassNotFound exception: edu.yale.its.tp.cas.client.filter.CASFilter").

casclient.jar

cas-client-core-3.1.1.jar

The class structure is no longer 'edu.yale.its.tp.cas.client…', but 'org.jasig.cas.client…'

There doesn't seem to be a CASFilter.class in cas-client-core.3.1.1.jar.

casclient.jar

cas-client-2.0.11

There seems to be a typo in your web.xml snippet. In the filter-mapping, the url-pattern is

<url-pattern>/faces*</url-pattern>‍

<url-pattern>/faces/*</url-pattern>‍

A really weird thing happened when I tried to make the redirect work (step "Testing CAS Protection"). Alfresco displayed a "System error" screen every time when it returned from CAS, despite closing all browser windows religiously and restarting Tomcat. I only figured out after some time that this was due to me just using the


         <filter-mapping>
            <filter-name>Authentication Filter</filter-name>
            <url-pattern>/faces/*</url-pattern>
         </filter-mapping>
‍‍‍‍‍‍

Authentication

CAS

The last point is probably not worth mentioning on the wiki page - I just included it so that plonkers like myself :? can find it here and know that Bad Things will happen if they do this, because there's really no clue (at least none that would be obvious to me) in the error messages what causes them…

For reference, here's the setup I'm using: JA-SIG CAS Server 3.2 is authenticating against ApacheDS 1.0.2, both are running on the same Windows XP box.
Alfresco 2.1 CE (using JA-SIG CAS Client 2.0.11) is running on a separate machine (Windows Server 2003 under VMWare); I'm using Java SDK 1.6.0-05 on both machines.

The only things that remain for me to do is to set up LDAP synch to the Alfresco user accounts (a whole new world of pain all on its own, by the sound of it…), and CASifying the PHP application that I'm also using (I'm almost looking forward to that one, 'cos it'll be the first time for a long time that I'm going to be in a situation where I know what I'm doing… ).

Again, I can't thank you enough - I'd already given up on getting this to work…

All the best,

Frank.

Re: Alfresco Community and CAS - SSO

mikewaters — Fri, 23 May 2008 18:08:14 GMT

Hi Frank

Congratulations! and thanks for the feedback - and sorry for the typos.

About the client jar file I double checked my cas-client jar version, the one I used was in fact casclient-2.1.1.jar

It actually comes with the server release, inside the war file. (ie in cas-server-3.2.1-release.tar.gz at path cas-server-3.2.1/modules/cas-server-webapp-3.2.1.war. The path inside the war is WEB-INF/lib) so there is no need for the cas-client release at least for what we are doing.

I'll update the wiki

cheers

-Mike

Re: Alfresco Community and CAS - SSO

mmontecchi — Fri, 01 Aug 2008 10:24:10 GMT

Hi,
thanks all for the very usefull info to integrate CAS and Alfresco.
I have only a more question: what's about the CAS/ALfresco logout ? Someone was able to configure?

Thanks
Massimo Montecchi
EC Company