topic Problem Share Cas Logout in Alfresco Archive

Problem Share Cas Logout

carlosjl — Fri, 10 Jul 2015 11:25:51 GMT

Hello, I'm new with alfresco.My environment consists of:- Cas Server 3.5.2- Alfresco Community 5.0.cI configured share to validate with cas (cas-client-core-3.3.3) and all work fine. But I have the logout problem.In share (web.xml): <filter> <filter-name>CAS Single Sign Out Filter

Re: Problem Share Cas Logout

idwright — Tue, 28 Jul 2015 13:54:17 GMT

Firstly I'll admit I haven't even tried to get this working but I've some experience in this area so hopefully can provide some pointers.

A key thing to remember is that you are logged in to CAS <em>and</em> Alfresco so you need to log out of both.

The filter you've listed is for Single Sign Out so Alfresco gets a logout message from CAS (a POST) i.e. when the user has logged out of CAS, probably via another app, so what you would need to do is provide another bit of code to do the logout from Alfresco as well when the POST is received.(I've never bothered with this)

The logout controller is called when you log out of Alfresco - the logout menu option is disabled when you have configured SSO but it's not too difficult to reenable it but you do need to tell the controller to log out of CAS as well otherwise you just get logged straight back in again as your CAS credentials are still active.

Unfortunately the way the logout menu/controller works keeps changing and I haven't worked out what to do in 5.0.x (just to make things even better SSO changes within the 5.0 versions)
(for earlier versions see http://tech.wrighting.org/2011/11/share-cas-logout/)

Re: Problem Share Cas Logout

danifbconil — Wed, 05 Aug 2015 12:28:33 GMT

Hi, did you find the solution for the Share Cas Logout?

Re: Problem Share Cas Logout

pablog_ — Thu, 22 Oct 2015 09:34:54 GMT

Hi, I had overrided logoutController following the link "http://tech.wrighting.org/2011/11/share-cas-logout/".

The problem is the line

<java>final String ticket = connector.getConnectorSession().getParameter(AlfrescoAuthenticator.CS_PARAM_ALF_TICKET);</java>

This param is NULL!!.

Anybody knows what's the problem?

Best regards for your help!

Re: Problem Share Cas Logout

idwright — Mon, 02 Nov 2015 15:11:13 GMT

I've created a github project that contains an all-in-one project with just the CAS configuration for 5.0.d including logout

https://github.com/wrighting/alfresco-cas

There's (slightly) more detail in the wiki attached to that project but a brief description here:

As well as creating a new logout menu item (well putting back the original which won't show with SSO configured) you need to create a patched version of Aikau in order to allow the LogoutService to post appropriate redirect parameters to the dologout url.

<blockcode>
doLogout: function alfresco_services_LogoutService__doLogout() {
         this.serviceXhr({
            url: AlfConstants.URL_PAGECONTEXT + "dologout",
            method: "POST",
            data: {
               redirectURL: "${cas.server.prefix}/logout",
               redirectURLQueryKey: "service",
               redirectURLQueryValue: "${cas.logout.dest.url}"
            },
            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
            successCallback: this.reloadPage,
            callbackScope: this
         });
         //?
      },
</blockcode>

Re: Problem Share Cas Logout

pablog_ — Tue, 15 Dec 2015 15:14:29 GMT

Thank your for your great response 'idwright'!, your cas project was very helpfull. But I have a last (I hope) issue.
When I click in Logout link, the rest call is a POST method to 'dologout':

POST http://localhost:8081/share/page/dologout –> "401 unauthorized".

Best regards!

Re: Problem Share Cas Logout

idwright — Wed, 02 Mar 2016 13:11:02 GMT

I do see the 401 but as you are immediately forwarded on to the CAS logout page, and thence to the URL defined in the service parameter then you do get logged out and it behaves as expected despite the 401 response.

Re: Problem Share Cas Logout

davidd2go — Fri, 04 Nov 2016 12:16:39 GMT

Hi Ian
Thanks for your work on CAS-Alfresco integration. This is complicated stuff and your github project really helped me to configure single sign out with mod_auth_cas.
I would prefer to use the approach on the application level with the cas client library so I started working with the amps from your project on GitHub.

The build succeeds and I applied the amps to Alfresco and Share.
I adapted web.xml and share-config-custom.xml
I am able to login to CAS but then I hit the standard Share login-page.

I think there is 1 piece of the puzzel I am missing:
How do I tell CAS to insert the alfresco header (e.g. "X-Alfresco-Remote-User") tot the calls to Share after succesfull login in CAS?

Hope you can help.

Best regards,

David

Re: Problem Share Cas Logout

idwright — Mon, 07 Nov 2016 07:58:40 GMT

Hi David,

This might depend on the version you're using - if you're using 5.0.d to 5.1.f inclusive then you need to replace the SlingshotAlfrescoConnector in share-config-custom.xml with org.wrighting.web.site.servlet.SlingshotAlfrescoConnector instead of the Alfresco class (there's a bug...) or upgrade.

Alfresco inserts the header - CAS sets the value returned by getRemoteUser which is then used to set the header.

Regards,

Ian

(I am hoping to update the github project before the end of the year with installable amps)

Re: Problem Share Cas Logout

davidd2go — Wed, 09 Nov 2016 13:26:02 GMT

Hi Ian

Thanks for your reply.

I work with version 5.1.g (a.k.a. 201605).

I now succeeded in using your amps (based on the master branch) for CAS login.

The problems I encountered before were due to interference between my own share-config-custom.xml and the one packed in the share-amp.

I removed the second one from the project and added the references to org.wrighting.web.site.servlet.SlingshotAlfrescoConnector in my own share-config-custom.xml.

Some further observations:

- Deploying the repo-amp does not seem to be necessary

- Could not get it working without your SlingshotAlfrescoConnector, so this servlet also seems to be necessary for 5.1.g as well

Hope this info helps other people.

Regards,

David

Re: Problem Share Cas Logout

pinux — Sun, 11 Dec 2016 22:20:43 GMT

Hi David,

could you briefly explain the steps you followed to successfully integrate CAS and Alfresco? I'm working with alfresco 5.0d and CAS 5.0 and also I am receiving share login page after CAS login.

Thanks in advance.

Pino

Re: Problem Share Cas Logout

idwright — Mon, 12 Dec 2016 08:11:21 GMT

Hi Pino,

My guess is that your share-config-custom.xml is not pointing at the correct backend.

If you are using GitHub - wrighting/alfresco-cas: A project designed to show how to integrate Alfresco with CAS single sign on it defaults to http://localhost:8080/alfresco/...

I've just updated the README.md to give more instructions

Re: Problem Share Cas Logout

idwright — Mon, 12 Dec 2016 08:23:50 GMT

Hi David,

I have updated the project now.

You are correct that you don't need the repo amp although it will now include the admin pages.

share-config-custom.xml is now not included by default and there are other changes to make it easier to deploy - see project for details.

I have managed to use the default SlingshotAlfrescoConnector for 5.1.g

Re: Problem Share Cas Logout

pinux — Mon, 12 Dec 2016 11:09:31 GMT

Hi Ian,

thanks for your reply; anyway my share-config-custom.xml is pointing to correct backend (http://localhost:8080/alfresco/)
My software stack version is: Alfresco 5.1f (just updated), CAS 5.0 and your cas-client-core-3.4.1.jar (from the latest build of your project and deployed both in alfresco and share lib).

Edited the file /etc/java-cas-client.properties with the following value:

casServerLoginUrl=https://myhostname:8444/cas/login
serverName=https://myhostname:8443

ticketValidatorClass=org.jasig.cas.client.validation.Cas30ServiceTicketValidator
casServerUrlPrefix=https://myhostname:8444/cas

Thanks in advance!

Pino