topic (Alfresco 5.1.2) CAS authentication through Apache mod_auth_cas returning Unauthorized in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31038#M13145 <HTML><HEAD></HEAD><BODY><P><SPAN>I am attempting to integrate into our development environment mod_auth_cas (version 1.1 from </SPAN><A class="jive-link-external-small" href="https://github.com/Jasig/mod_auth_cas" rel="nofollow noopener noreferrer" target="_blank">https://github.com/Jasig/mod_auth_cas</A><SPAN>) for use in our existing Apache server 2.4 in order to authenticate share and alfresco.</SPAN></P><P></P><P>Our CAS Server is compiled via MAVEN from JASIG CAS version 3.5.2., and our Alfresco version is 5.1.2</P><P></P><P>I am (loosely) following the documentation provided for community 5.0 at <A class="link-titled" href="http://docs.alfresco.com/community5.0/concepts/alf-modauthcas-home.html" title="http://docs.alfresco.com/community5.0/concepts/alf-modauthcas-home.html" rel="nofollow noopener noreferrer">Using Alfresco with CAS authentication through Apache mod_auth_cas | Alfresco Documentation</A>, with liberties initially taken to use the latest version of mod_auth_cas itself (a necessary step as it supports Apache 2.4).</P><P></P><P>Additionally, while our server configuration involves two virtual machines, our CAS server is located in the same tomcat instance that alfresco&amp; share reside in, and not in the same machine hat mod_auth_cas resides in.</P><P></P><P>Having adapted the steps to the best of my knowledge, I am encountering the following error:<BR />-After posting login information to /cas/login attempting to access /share or /alfresco, I am redirected to the following screen:<BR /><IMG alt="Unauthorized" class="image-1 jive-image j-img-original" src="https://connect.hyland.com/legacyfs/online/alfresco/13157_Unauthorized.PNG" /></P><P></P><P>The ssl_error_log provides the following during this process:</P><PRE>[Fri Mar 31 02:57:07.659313 2017] [ssl:info] [pid 1456] [client 172.17.0.1:60166] AH01964: Connection to child 12 established (server localhost:443)<BR />[Fri Mar 31 02:57:07.659448 2017] [ssl:debug] [pid 1456] ssl_engine_kernel.c(2115): [client 172.17.0.1:60166] AH02043: SSL virtual host for servername localhost found<BR />[Fri Mar 31 02:57:07.661136 2017] [ssl:debug] [pid 1456] ssl_engine_kernel.c(2042): [client 172.17.0.1:60166] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)<BR />[Fri Mar 31 02:57:07.661172 2017] [ssl:info] [pid 1456] (70014)End of file found: [client 172.17.0.1:60166] AH01991: SSL input filter read failed.<BR />[Fri Mar 31 02:57:07.661225 2017] [ssl:debug] [pid 1456] ssl_engine_io.c(1043): [client 172.17.0.1:60166] AH02001: Connection closed to child 12 with standard shutdown (server localhost:443)<BR />[Fri Mar 31 02:57:07.672373 2017] [ssl:info] [pid 1403] [client 172.17.0.1:60168] AH01964: Connection to child 11 established (server localhost:443)<BR />[Fri Mar 31 02:57:07.672489 2017] [ssl:debug] [pid 1403] ssl_engine_kernel.c(2115): [client 172.17.0.1:60168] AH02043: SSL virtual host for servername localhost found<BR />[Fri Mar 31 02:57:07.673149 2017] [ssl:debug] [pid 1403] ssl_engine_kernel.c(2042): [client 172.17.0.1:60168] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)<BR />[Fri Mar 31 02:57:07.673317 2017] [ssl:debug] [pid 1403] ssl_engine_kernel.c(366): [client 172.17.0.1:60168] AH02034: Initial (No.1) HTTPS request received for child 11 (server localhost:443), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.673382 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(835): [client 172.17.0.1:60168] AH01628: authorization result: granted (no directives), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932297 2017] [ssl:debug] [pid 1403] ssl_engine_kernel.c(366): [client 172.17.0.1:60168] AH02034: Subsequent (No.2) HTTPS request received forchild 11 (server localhost:443), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932365 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932371 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of &lt;RequireAny&gt;: denied (no authenticated user yet), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932394 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(2076): [client 172.17.0.1:60168] Entering cas_authenticate(), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932399 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(656): [client 172.17.0.1:60168] Modified r-&gt;args (now ''), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.932468 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(1779): [client 172.17.0.1:60168] entering getResponseFromServer(), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:07.947072 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(584): [client 172.17.0.1:60168] CAS Service 'https%3a%2f%2flocalhost%2fshare%2f', referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:08.595629 2017] [ssl:info] [pid 1434] [client ::1:35280] AH01964: Connection to child 2 established (server localhost:443)<BR />[Fri Mar 31 02:57:08.595830 2017] [ssl:debug] [pid 1434] ssl_engine_kernel.c(2115): [client ::1:35280] AH02043: SSL virtual host for servername localhost found<BR />[Fri Mar 31 02:57:08.599817 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(1848): [client 172.17.0.1:60168] MOD_AUTH_CAS: curl_easy_perform() failed (Peer's Certificate issuer is not recognized.), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:08.599840 2017] [auth_cas:debug] [pid 1403] mod_auth_cas.c(1440): [client 172.17.0.1:60168] entering isValidCASTicket(), referer: https://localhost/cas/login?service=https%3a%2f%2flocalhost%2fshare%2f<BR />[Fri Mar 31 02:57:08.621355 2017] [ssl:info] [pid 1434] [client ::1:35280] AH02008: SSL library error 1 in handshake (server localhost:443)<BR />[Fri Mar 31 02:57:08.621418 2017] [ssl:info] [pid 1434] SSL Library Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (SSL alert number 48)<BR />[Fri Mar 31 02:57:08.621426 2017] [ssl:info] [pid 1434] [client ::1:35280] AH01998: Connection closed to child 2 with abortive shutdown (server localhost:443)<BR />[Fri Mar 31 02:57:08.634433 2017] [ssl:debug] [pid 1403] ssl_engine_kernel.c(366): [client 172.17.0.1:60168] AH02034: Subsequent (No.3) HTTPS request received forchild 11 (server localhost:443), referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:08.689285 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of Require all granted: granted, referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:08.689314 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of &lt;RequireAny&gt;: granted, referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:08.695774 2017] [core:info] [pid 1403] [client 172.17.0.1:60168] AH00128: File does not exist: /var/www/html/drupal/favicon.ico, referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:08.695872 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of Require all granted: granted, referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:08.695878 2017] [authz_core:debug] [pid 1403] mod_authz_core.c(809): [client 172.17.0.1:60168] AH01626: authorization result of &lt;RequireAny&gt;: granted, referer: https://localhost/share/?ticket=ST-8-gViyrekgof2baWD1XNee-cas<BR />[Fri Mar 31 02:57:14.627107 2017] [ssl:debug] [pid 1403] ssl_engine_io.c(1043): [client 172.17.0.1:60168] AH02001: Connection closed to child 11 with standard shutdown (server localhost:443)</PRE><P>When debugging the issue further with openssl s_client -connect localhost:443 -verify_return_error, the Verify return code is 20 (unable to get local issuer certificate).</P><P></P><P>We are using mod_jk curently to connect to a tomcat instance containing alfresco, share, solr &amp; cas in another virtual instance.<BR />There are other applications on the server that use other CAS clients that can currently successfully logon.</P><P></P><P>This related to another issue I have posted on (<A href="https://migration33.stage.lithium.com/thread/229575">(Alfresco 5.1.1 -&amp;gt; 5.1.2 Upgrade) Continuous 'Authentication Required' popup in Share</A> ), Where our existing CAS client for alfresco &amp; share has stopped working for 5.1.2.</P></BODY></HTML> Fri, 31 Mar 2017 03:48:47 GMT mwatkins 2017-03-31T03:48:47Z (Alfresco 5.1.2) CAS authentication through Apache mod_auth_cas returning Unauthorized https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31038#M13145 I am attempting to integrate into our development environment mod_auth_cas (version 1.1 from https://github.com/Jasig/mod_auth_cas) for use in our existing Apache server 2.4 in order to authenticate share and alfresco.Our CAS Server is compiled via MAVEN from JASIG CAS version 3.5.2., and our Alfres Fri, 31 Mar 2017 03:48:47 GMT https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31038#M13145 mwatkins 2017-03-31T03:48:47Z Re: (Alfresco 5.1.2) CAS authentication through Apache mod_auth_cas returning Unauthorized https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31039#M13146 <HTML><HEAD></HEAD><BODY><P>Hi Michael,</P><P></P><P>It seems you have a SSL certificate validation problem between mod_auth_cas and your CAS server.</P><PRE style="color: #727174; background-color: #ffffff; border: 0px;">[Fri Mar 31 02:57:08.621355 2017] [ssl:info] [pid 1434] [client ::1:35280] AH02008: SSL library error 1 in handshake (server localhost:443)</PRE><P>The mod_auth_cas client must trust the CAS server in order to validate the serviceTicket during a callback request and thus retrieve the identified user login.</P><P></P><P>You have two solutions :</P><UL><LI>Register the CAS server certificate <A href="https://github.com/Jasig/mod_auth_cas/blob/master/README#L186" rel="nofollow noopener noreferrer">as trusted&nbsp;for mod_auth_cas</A></LI><LI>Disable certificate validation in&nbsp;the mod_auth_cas configuration with CASValidateServer Off. Be careful, this directive <A href="https://github.com/Jasig/mod_auth_cas/commit/1b1032c230a3ddf9db9004326bd4d075ab602c0e" rel="nofollow noopener noreferrer">has been removed </A>since the v1.1 version of the module</LI></UL><P></P><P>Regards,</P><P></P><P>Charles</P></BODY></HTML> Mon, 03 Apr 2017 07:43:33 GMT https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31039#M13146 amoae 2017-04-03T07:43:33Z Re: (Alfresco 5.1.2) CAS authentication through Apache mod_auth_cas returning Unauthorized https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31040#M13147 <HTML><HEAD></HEAD><BODY><P>If you would like to use an amp based approach instead of mod_auth_cas then&nbsp;<A class="link-titled" href="https://github.com/wrighting/alfresco-cas" title="https://github.com/wrighting/alfresco-cas" rel="nofollow noopener noreferrer">GitHub - wrighting/alfresco-cas: A project designed to show how to integrate Alfresco with CAS single sign on</A>&nbsp;&nbsp;should work with your version.</P><P>(You should probably upgrade your CAS...)</P></BODY></HTML> Mon, 03 Apr 2017 12:55:56 GMT https://connect.hyland.com/t5/alfresco-forum/alfresco-5-1-2-cas-authentication-through-apache-mod-auth-cas/m-p/31040#M13147 idwright 2017-04-03T12:55:56Z