topic Re: trouble with alfresco + cas in Alfresco Archive

trouble with alfresco + cas

sean — Tue, 15 Aug 2006 09:45:50 GMT

hi folks,i've been tasked with evaluating alfresco for my company. it seems like a really cool product. after playing around with the default install for a bit and r'ing tfm's, i've attempted unsuccessfully to get SSO via CAS working.first i tried to use the acegi hooks in the authentication conte

Re: trouble with alfresco + cas

sean — Tue, 15 Aug 2006 10:08:52 GMT

here are the relevant parts of my web.xml, in case it's helpful:


   <filter>
      <filter-name>Authentication Filter</filter-name>
<!– LOCAL CHANGES
<filter-class>org.alfresco.web.app.servlet.AuthenticationFilter</filter-class>
–>
<!– BEGIN LOCAL CHANGES –>
    <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
    <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://myserver:8443/cas/login</param-value>
    </init-param>
    <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
      <param-value>https://myserver:8443/cas/serviceValidate</param-value>
    </init-param>
    <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.serviceUrl</param-name>
      <param-value>http://myserver:8090/alfresco</param-value>
    </init-param>
<!– END LOCAL CHANGES –>
</filter>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: trouble with alfresco + cas

alarocca — Thu, 25 Jan 2007 16:34:49 GMT

Ciao Sean,

I'm having the same problem you described. Have you find the solution? Best regards, Alessandro

hi folks,

i've been tasked with evaluating alfresco for my company. it seems like a really cool product. after playing around with the default install for a bit and r'ing tfm's, i've attempted unsuccessfully to get SSO via CAS working.

first i tried to use the acegi hooks in the authentication context file but couldn't seem to get things working via that route. things were further complicated by the bundled version of acegi being outdated wrt the latest upstream version (and hence the documentation i had was not fully accurate). furthermore, the latest version has a different namespace (org.acegisecurity instead of under net.sf), with some subtle yet non-backwards-compatible API changes.

i'm now trying to authenticate via CAS directly, by replacing the authentication filter in web.xml. i've had more success with this route, though not much. now when i request /alfresco, i'm sent to the cas login page, and after authenticating i'm sent back to alfresco (so far so good), but then alfresco sends me a 302 header sending me back to cas, which thinks there's nothing wrong and 302's me back to alfresco, etc etc.

i saw a similar problem in the forums that was solved by recompiling alfresco with a different name for ARG_TICKET in baseServlet.java, which i've tried without success.

does anyone have an idea of what else could be a problem? any help would be greatly appreciated!

sean

Re: trouble with alfresco + cas

sean — Mon, 29 Jan 2007 08:00:14 GMT

hi alessandro,

no luck, sorry we've currently given up looking further into it and have had to compromise with ldap authentication/synchronization instead.

but i'm not incredibly familiar with the acegi internals, so it's possible there is a way. all i know is that the method currently documented in the latest version of acegi won't work with code from 0.8 (namespace and other incompatibilities). maybe someone with more experience could comment? any chance some alfresco people are reading this?

sean

Re: trouble with alfresco + cas

andy — Mon, 29 Jan 2007 14:53:10 GMT

Hi

Yes, it is read ….

Moving to acegi 1.0 is one of those tasks that keeps getting put off, but it is on the list. So is getting round to learning about CAS and setting it all up.

It sounds like you are doing the right thing. You probably need to implement your own AuthenticationFilter - see NovellIChainsHTTPRequestAuthenticationFilter for an example. You will not be able to get away with using an out of the box CAS filter as there is some alfresco specific stuff to set up.

Regards

Andy

Re: trouble with alfresco + cas

alarocca — Mon, 29 Jan 2007 15:16:39 GMT

Finally I have alfresco 1.4 and liferay 4.2.1 smoothly authenticating with CAS. To get it, you have to change just a row of the NovellIChainsHTTPRequestAuthenticationFilter class (and rename it if you like as CASAuthenticationFilter):

String authHdr = (String) req.getSession().getAttribute(CASFilter.CAS_FILTER_USER);

Then you have to properly configure the filter within web.xml as the following:

   <filter>
      <filter-name>CAS Filter</filter-name>
   <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://myserver:8443/cas/login</param-value>
   </init-param>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
      <param-value>https://myserver:8443/cas/serviceValidate</param-value>
   </init-param>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.serviceUrl</param-name>
      <param-value>http://myserver/alfresco/faces/jsp/login.jsp</param-value>
   </init-param>
   </filter>

   <filter>
      <filter-name>Authentication Filter</filter-name>      <filter-class>org.alfresco.web.app.servlet.CASAuthenticationFilter</filter-class>
   </filter>

   <filter>
      <filter-name>WebDAV Authentication Filter</filter-name>      <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class>      
   </filter>
   
   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
      
   <filter-mapping>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <url-pattern>/webdav/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/admin/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/categories/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/groups/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/delete-user.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/users.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/dialog/system-info.jsp</url-pattern>
   </filter-mapping>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Best regards, Alessandro

Re: trouble with alfresco + cas

andy — Mon, 29 Jan 2007 15:45:01 GMT

Hi Alessandro

Thanks for reporting back your solution!

The intention is make NovellIChainsHTTPRequestAuthenticationFilter more configurable. One option will be to specify the session attribute in which to find the user id. Does this make CAS integration purely configuration?

Cheers

Andy

Re: trouble with alfresco + cas

alarocca — Mon, 29 Jan 2007 15:58:37 GMT

Yes. It does.

Greetings from Italy

Hi Alessandro

Thanks for reporting back your solution!

The intention is make NovellIChainsHTTPRequestAuthenticationFilter more configurable. One option will be to specify the session attribute in which to find the user id. Does this make CAS integration purely configuration?

Cheers

Andy

Re: trouble with alfresco + cas

mdbhokie — Mon, 05 Feb 2007 21:29:10 GMT

What version of the CAS client are you using? Are you using cas-web.war from the Liferay site? Where did you put the casclient.jar?

How do you relate alfresco's user with the CAS user? I'm using liferay.com.1 from the liferay-CAS installation and when I access the Alfresco portlet I still need to login.

Re: trouble with alfresco + cas

alarocca — Wed, 07 Feb 2007 08:36:54 GMT

Exactly I don't know the version of the CAS client. I'm using for Alfresco the same library bundled with Liferay 4.2.1.

Yes. I'm using the war available from Liferay site even if this should not be different from the one available from CAS site. Probably, only the war name (then the context) changes and liferay is already configured for use that name. Anyway, I changed the filename to cas.war before deploying and the settings within web.xml to reflect that change.

In my setup casclient.jar is in tomcat\common\lib\ext.

CAS is configured to authenticate users against LDAP (MS Active Directory). I created an application that retrieves all the users from LDAP and creates an account on Alfresco and Liferay if they haven't.

I don't use alfresco portlet (IMHO, useless). Anyway, liferay.com.1 is not a valid LDAP users then should not be successfully authenticated.

BR, Alessandro

What version of the CAS client are you using? Are you using cas-web.war from the Liferay site? Where did you put the casclient.jar?

How do you relate alfresco's user with the CAS user? I'm using liferay.com.1 from the liferay-CAS installation and when I access the Alfresco portlet I still need to login.

Re: trouble with alfresco + cas

sebastien_marin — Tue, 13 Mar 2007 15:42:11 GMT

   <filter>
      <filter-name>CAS Filter</filter-name>
   <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://myserver:8443/cas/login</param-value>
   </init-param>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
      <param-value>https://myserver:8443/cas/serviceValidate</param-value>
   </init-param>
   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.serviceUrl</param-name>
      <param-value>http://myserver/alfresco/faces/jsp/login.jsp</param-value>
   </init-param>
   </filter>

   <filter>
      <filter-name>Authentication Filter</filter-name>      <filter-class>org.alfresco.web.app.servlet.CASAuthenticationFilter</filter-class>
   </filter>

   <filter>
      <filter-name>WebDAV Authentication Filter</filter-name>      <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class>      
   </filter>
   
   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
      
   <filter-mapping>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <url-pattern>/webdav/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/admin/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/categories/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/groups/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/delete-user.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/users.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/dialog/system-info.jsp</url-pattern>
   </filter-mapping>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Best regards, Alessandro

Hello, i am trying to have a CAS authen,tification on Alfresco in Liferay portal as you. So i am agree with your configuration but i have a problem with the web.xml.

So if i change "/faces/*" to "/*", the picture of alfresco are not displayed (JSP problem). So the login form never go to the CAS auth class…

Can you give me the good way or what could be the problem ?

Thank you.

Re: trouble with alfresco + cas

sebastien_marin — Wed, 14 Mar 2007 08:51:17 GMT

Hello,

i don't really understand but now, the filter CAS is use.

So the problem with the url pattern "<url-pattern>/*</url-pattern>" is that the filter is active with pictures, and other elements.

So all is ok but i enter in the filter about 20 times per request and the log user is always the guest…

Can you help me ?

Re: trouble with alfresco + cas

sebastien_marin — Thu, 29 Mar 2007 17:45:11 GMT

Hi,
is there anyone can help me?

Re: trouble with alfresco + cas

alarocca — Fri, 30 Mar 2007 06:49:41 GMT

Try using the following url-pattern:

/faces/jsp/*

Best regards, Alessandro

Hello,

i don't really understand but now, the filter CAS is use.

So the problem with the url pattern "<url-pattern>/*</url-pattern>" is that the filter is active with pictures, and other elements.

So all is ok but i enter in the filter about 20 times per request and the log user is always the guest…

Can you help me ?

Re: trouble with alfresco + cas

tegyat — Mon, 16 Apr 2007 11:13:16 GMT

Hi alarocca,
can you tell us if you use alfresco portlet in liferay?
if yes please tell us how you do it clearly (i did the same things as you but i haven't sso in liferay and alfresco)
thanks.

Re: trouble with alfresco + cas

tegyat — Mon, 16 Apr 2007 11:14:38 GMT

hello
please sebastien.marin do you have solution for this problem
sso for alfresco portlet in liferay?
thanks

Re: trouble with alfresco + cas

alarocca — Wed, 18 Apr 2007 07:18:32 GMT

Hi, I use a Liferay IFrame portlet to include Alfresco.

Hi alarocca,
can you tell us if you use alfresco portlet in liferay?
if yes please tell us how you do it clearly (i did the same things as you but i haven't sso in liferay and alfresco)
thanks.

Re: trouble with alfresco + cas

fthamura — Tue, 01 May 2007 07:25:08 GMT

hi all

what do you think if CAS config is bundled in Alfresco binary distribution

so we just click, and integrate

Frans

Re: trouble with alfresco + cas

sebastien_marin — Wed, 02 May 2007 07:25:01 GMT

Yes, it could be fine but the problem of everybody is not to add CAS authentication to Alfresco but implement the autologin and CAS filter on alfresco portlet with portletContext…

You just have to implement the method that allowed to authenticate a user object or just a userid to the alfresco api with a portlet context. So, in the portlet, you've done this for guest acces but not for an other userID…

It is a little bit too simple. Community need that metho because it is a problem to integrate Alfresco in portal container…

Thank.

Re: trouble with alfresco + cas

fthamura — Wed, 02 May 2007 16:29:40 GMT

make it a bundle as optional

that is the power of community, we have more choice.