cas ad sso集成问题记录

官方文档：https://wiki.jasig.org/display/CASUM/SPNEGO

 

The advantage of configuring SPNEGO is that users that are logged in to the AD domain will be logged in automatically at CAS, without any interaction asking for the password yet again. Note that this may not be desirable.

 

登录域后就可以直接登录cas了

 

参考  http://jcbay.iteye.com/blog/708020

 

 

 

apache集成  http://edu.codepub.com/2011/0225/29644.php

 

 

16 楼 zdx3578 刚刚   引用

C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass * /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT

--
这样的命令手动输入密码就24 错误

--
C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass 123qweGHJOII /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT
密码在命令里写好不手动输入后生产的keytab文件就ok，使用这样的文件就完成ok，一起顺利，域用户打开firefox后ie后cas server 自动登录完成。

zdx3578 写道

KRB Error: error code is 24 error Message is Pre-authentication information was invalid ？

问题原因应该是
Cause 2: If you are using the keytab to get the key (e.g., by setting the useKeyTab option to true in the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.

    Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.

    Cause 4: The Kerberos realm name is not all uppercase.

    Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. For details, refer to the Naming Conventions for the Realm Names and Hostnames section of this tutorial.

15 楼 zdx3578 刚刚   引用

http://www.xioxu.com/?p=325006
# javax.security.auth.login.LoginException: KrbException: Pre-authentication information was invalid (24) - Preauthentication failed

    Cause 1: The password entered is incorrect.

    Solution 1: Verify the password.

    Cause 2: If you are using the keytab to get the key (e.g., by setting the useKeyTab option to true in the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.

    Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.

    Cause 3: Clock skew - If the time on the KDC and on the client differ significanlty (typically 5 minutes), this error can be returned.

    Solution 3: Synchronize the clocks (or have a system administrator do so).
    Cause 4: The Kerberos realm name is not all uppercase.

    Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. For details, refer to the Naming Conventions for the Realm Names and Hostnames section of this tutorial.


还是没解决掉！
  

14 楼 zdx3578 刚刚   引用

KRB Error: error code is 24 error Message is Pre-authentication information was invalid ？

13 楼 zdx3578 刚刚   引用

官方例子：
https://wiki.jasig.org/display/CASC/Saml11TicketValidationFilter+Example
https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample

12 楼 zdx3578 昨天   引用

-rwxr-xr-x 1 zdx zdx 86635 2011-03-05 03:10 cas-client-core-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 12160 2011-03-05 03:10 cas-client-integration-tomcat-common-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 20191 2011-03-05 03:10 cas-client-integration-tomcat-v6-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 52915 2011-03-05 03:10 commons-logging-1.1.jar*

11 楼 zdx3578 前天   引用

http://192.168.245.139:8443/          第二次犯这个傻了

10 楼 zdx3578 前天   引用

http://192.168.245.139:8443/   

http://www.howtoforge.com/how-to-set-up-apache-tomcat-mod_jk-sso-cas-mod_auth_cas

评论

22 楼 张小宇 2011-10-27  

您好~ 有个问题希望能得到您的帮助 TT
在进入中心服务器准备验证之前，应该取到一串token，而这里取到的是一串乱码，导致后边无法正确认证，如下：
2011-10-27 18:37:02,484 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <SPNEGO Authorization header found with 1672 bytes>
2011-10-27 18:37:02,484 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <Obtained token: `??+
爞??袪$0"  *咹傳
      *咹嗺


+

?
????       *咹嗺




额。。。复制不上来，就是很长的一串乱码，不知道是从哪里取到的，求教求教，多谢多谢~

21 楼 zdx3578 2011-04-05  

zdx3578 写道

pc加入域 spnego 认证
pc未加入域 ldap ad认证（cas 表单验证）

但是如果
域对用户登录计算机有限制  用户又不能域帐号登录计算机后spnego认证，这时用户无法使用ldap ad认证，因为不允许用户访问cas server（域策略只允许用户访问自己的pc）

解决思路
pc加入域 spnego 认证，其他用户使用表单验证，

不允许用户访问cas server（域策略只允许用户访问自己的pc），这类用户域帐号登录自己pc呀，但是如果不用域帐号登录自己的pc或登录域后spnego认证有问题，    那么cas使用sql查询之前应用的数据库（之前使用数据库存放用户验证信息）进行验证，待测试！

我靠，太复杂了！！

20 楼 zdx3578 2011-04-05  

zdx3578 写道

zdx3578 写道

windwos的pfx证书 在tomcat可以直接使用， pfx导入ie导出cer格式后可导入java keystore里

            keystoreFile="/home/zdx/castest.cer.pfx"
            keystorePass="1"
            keystoreType="PKCS12"

windows的证书设置为tomcat server的证书
            keystoreFile="/home/zdx/castest.cer.pfx"
            keystorePass="1"
            keystoreType="PKCS12"

tocmat的客户端访问时：
pfx导入ie导出cer格式后可导入java keystore里 ，这样客户端就有服务器端的证书信息了。

19 楼 zdx3578 2011-03-18  

server
install cas server
https 证书
dns hostname 解析

cilent
信任证书jdk
jar包  web.xml

apache mod_cas_auth
spnego ie信任网站添加


应用接入
应用获取登录名

登录名多套系统整合到一起（单点）后的整理一致

认证数据源是否要一致或可以多个？？

18 楼 zdx3578 2011-03-18  

sudo apt-get install libapache2-mod-auth-cas apache2

cas客户端是apache+其他应用

17 楼 zdx3578 2011-03-17  

pc加入域 spnego 认证
pc未加入域 ldap ad认证（cas 表单验证）
域对用户登录计算机有限制  只能域帐号登录计算机后spnego认证，无法使用ldap ad认证

解决思路
pc加入域 spnego 认证，其他用户使用表单验证，cas使用sql查询之前的数据库进行验证，待测试！

16 楼 zdx3578 2011-03-16  

zdx3578 写道

zdx3578 写道

zdx3578 写道

如何消除cas认证弹出框 直接表单
因为
deployerConfigContext.xml 里的authhandler里启用了

<bean
                                        class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />

好像不对！

启用 spngeo 认证后 浏览器没加cas 地址到本地信任站点，所以弹窗，启用spnego后浏览器本地信任加入cas地址 后不弹窗

弹窗  跟是否启用 spngeo 认证无关 ，只跟浏览器是否加cas 地址到本地信任站点有关 

15 楼 zdx3578 2011-03-16  

zdx3578 写道

zdx3578 写道

如何消除cas认证弹出框 直接表单
因为
deployerConfigContext.xml 里的authhandler里启用了

<bean
                                        class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />

好像不对！

启用 spngeo 认证后 浏览器没加cas 地址到本地信任站点，所以弹窗，启用spnego后浏览器本地信任加入cas地址 后不弹窗

14 楼 zdx3578 2011-03-12  

ldap 49  ldap context 绑定错误，ldap环境的域信息错误  ldap绑定信息dn信息 ou or cn 等错误

13 楼 zdx3578 2011-03-11  

zdx3578 写道

windwos的pfx证书 在tomcat可以直接使用， pfx导入ie导出cer格式后可导入java keystore里

            keystoreFile="/home/zdx/castest.cer.pfx"
            keystorePass="1"
            keystoreType="PKCS12"

12 楼 zdx3578 2011-03-11  

windwos的pfx证书 在tomcat可以直接使用， pfx导入ie导出cer格式后可导入java keystore里

11 楼 zdx3578 2011-03-11  

zdx3578 写道

如何消除cas认证弹出框 直接表单
因为
deployerConfigContext.xml 里的authhandler里启用了

<bean
                                        class="org.jasig.cas.authentication.handler.support.SimpleTestUsernamePasswordAuthenticationHandler" />

好像不对！

10 楼 zdx3578 2011-03-11  

域用户cas认证：如果同时支持ldap和集成kerberos
页面认证是ldap方式  弹出对话框是kerberos认证

以上2008r2 客户端测试结果

9 楼 zdx3578 2011-03-10  

域用户使用SPNEGO方式登录sso，用户登录域pc即可直接在cas中验证通过，如果pc未加入域 使用域方式的ldap方式验证也可以，而且ldap方式配置cas比jaas方式配置cas简单多了

8 楼 zdx3578 2011-03-10  

我所有这些测试的环境是2008r2 ubuntu10 tomcat 6032 jdk6u21  cas3.46

7 楼 zdx3578 2011-03-10  

zdx3578 写道

https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample  官方这个例子非常完整

https://wiki.jasig.org/display/CASC/Saml11TicketValidationFilter+Example 这个例子的web。xml 不完整

6 楼 zdx3578 2011-03-10  

https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample  官方这个例子非常完整

5 楼 zdx3578 2011-03-09  

zdx3578 写道

和现有应用的集成 https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample  

Authentication In Legacy Application

For this given scenario, you can add this method to you sources, verify the proxy ticket and get the user name from the response.
TicketValidator.java

import org.jasig.cas.client.authentication.AttributePrincipal;
import org.jasig.cas.client.validation.Assertion;
import org.jasig.cas.client.validation.Cas20ProxyTicketValidator;
import org.jasig.cas.client.validation.TicketValidationException;

public class TicketValidator {
public final boolean validateTicket(String ticket) {
AttributePrincipal principal = null;
String casServerUrl = "https://localhost/cas";
Cas20ProxyTicketValidator sv = new Cas20ProxyTicketValidator(casServerUrl);
sv.setAcceptAnyProxy(true);
try {
// there is no need, that the legacy application is accessible
// through this URL. But for validation purpose, even a non-web-app
// needs a valid looking URL as identifier.
String legacyServerServiceUrl = "http://otherserver/legacy/service";
Assertion a = sv.validate(ticket, legacyServerServiceUrl);
principal = a.getPrincipal();
System.out.println("user name:" + principal.getName());
} catch (TicketValidationException e) {
e.printStackTrace(); // bad style, but only for demonstration purpose.
}
return principal != null;
}
}



String ticket = request.getParameter("ticket");
legacyServerServiceUrl 也通过request动态获取  就可以获取到域登录的用户名了。

String casServerUrl = "https://localhost/cas";  如果这一句写成
String casServerUrl = "https://localhost/cas/login";会是什么结果吗？？？
timeout  那是什么ip呢？
watch 'netstat -nap|grep -i syn'


tcp6       0      1 192.168.245.140:56094   128.30.52.37:80         SYN_SENT
10606/java


128.30.52.37:80 cas里怎么出来这个东西呀！！！！

4 楼 zdx3578 2011-03-09  

client : jar filter  dns  ssl  应用修改

3 楼 zdx3578 2011-03-08  

和现有应用的集成 https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample  

Authentication In Legacy Application

For this given scenario, you can add this method to you sources, verify the proxy ticket and get the user name from the response.
TicketValidator.java

import org.jasig.cas.client.authentication.AttributePrincipal;
import org.jasig.cas.client.validation.Assertion;
import org.jasig.cas.client.validation.Cas20ProxyTicketValidator;
import org.jasig.cas.client.validation.TicketValidationException;

public class TicketValidator {
public final boolean validateTicket(String ticket) {
AttributePrincipal principal = null;
String casServerUrl = "https://localhost/cas";
Cas20ProxyTicketValidator sv = new Cas20ProxyTicketValidator(casServerUrl);
sv.setAcceptAnyProxy(true);
try {
// there is no need, that the legacy application is accessible
// through this URL. But for validation purpose, even a non-web-app
// needs a valid looking URL as identifier.
String legacyServerServiceUrl = "http://otherserver/legacy/service";
Assertion a = sv.validate(ticket, legacyServerServiceUrl);
principal = a.getPrincipal();
System.out.println("user name:" + principal.getName());
} catch (TicketValidationException e) {
e.printStackTrace(); // bad style, but only for demonstration purpose.
}
return principal != null;
}
}



String ticket = request.getParameter("ticket");
legacyServerServiceUrl 也通过request动态获取  就可以获取到域登录的用户名了。