Liferay 5 + CAS + some additional questions

[16年前 に Jin S Lee によって更新されました。]

Hello there!

Newbie to liferay (it rocks!). Thank you for this awesome product.

I have been playing around with all the liferay functions and now am gearing up to get it production ready for our company. We have JA-SIG CAS running with several webapps on Tomcat.

I tried to set up CAS + Liferay 5 integration and here are some things I've run into:

1. Are there updated docs for Liferay 5? I've checked out the wiki and liferay 4 documentation and I'm not sure how much of it applies to Liferay 5.

2. Here is what I did so far:
I uncommented web.xml for CAS integration, adjusted URLs as necessary.
Created portal-ext.properties under ROOT/WEB-INF/classes with the following entries:

cas.auth.enabled=true
cas.import.from.ldap=true
cas.login.url=https://server.com/cas/login
cas.logout.url=https://server.com/cas/logout
cas.service.url=http://server.com/c/portal/login
cas.validate.url=https://server.com/cas/proxyValidate

3. Here is the behavior I am seeing when starting liferay:
It doesn't immediately forward to /cas/login, instead it shows the liferay home login page.
When I click Sign In under the Welcome tab, it forwards me to cas/login
After I enter my credentials through CAS, it forwards me back to /web/guest/home (basically - not logged in)

I don't see any errors in the CAS log file so I am not sure what is going on.

Questions:

1. if cas.import.from.ldap is set to true, does that mean when an LDAP user signs in, a user entry is created in liferay (if none exists?)
2. How does one set CAS login page by default (instead of having to click Welcome > Sign In)
3. Is there a way to only allow CAS logins (no account creation via liferay)

Thank you very much for any answers!

Jin Lee

[15年前 に Mouna Masmoudi によって更新されました。]

Hi,

I would like to ask you if you have finished with CAS AND LIFERAY.
i don't succed to make SSO with liferay, can you help me please?

[15年前 に Jin S Lee によって更新されました。]

Hi guys -

Sorry about the extremely long delay. I totally forgot that I had asked these questions couple months ago.

Mouna, if you need help with anything feel free to ask. I have CAS + Liferay + LDAP + multiple virtualhosts all running smoothly now.

Brian, thanks for the information - it helped me through this process.

Thanks guys,
Jin

[15年前 に Boon Ong によって更新されました。]

Hi Jin,

I've seen your post.
I am having some problems with LifeRay + CAS.
Hope you could help - I'm very new to LifeRay.
I managed to get CAS to work -- I can get the login screen and I can use an AD account to login via CAS.
Now I'm trying to configure LifeRay to make use of CAS to login.
I've done the setup - using your first post instructions, ie, make a new portal-ext.properties, etc..

But when I put in the AD user id and password on the LifeRay login page, it says invalid user and password.
I could not login using the LifeRay "joebloggs" account either after setting up the CAS.What am I missing ?

Thanks in advance for any pointers.

Cheers.

[15年前 に 匿名 によって更新されました。]

Hello!! I'm new working in Liferay CAS, and I have to integrate Liferay 5.1.2 and CAS 3.
I have followed the steps on guides but i'm not sure is the result in right.
The file on tomcat webapps\ROOT\WEB-INF\classes\portal-ext.properties has:

cas.auth.enabled=true
cas.import.from.ldap=false
cas.login.url=https://localhost:8443/cas-web/login
cas.logout.url=https://localhost:8443/cas-web/logout
cas.service.url=http://localhost:8080/c/portal/login
cas.validate.url=https://localhost:8443/cas-web/proxyValidate
portal.release=professional
portal.ctx=/
auto.deploy.dest.dir=../webapps
auto.login.hooks=com.liferay.portal.security.auth.RememberMeAutoLogin,com.liferay.portal.security.auth.CASAutoLogin

And webapps\ROOT\WEB-INF\classes\system-ext.properties has:

com.liferay.filters.sso.cas.CASFilter=true

If I write the URL http://localhost:8080/ in a browser I access at home page of my portal but if I log in it, I don´t see that CAS work.

If in other browser I write http://localhost:8080/c/portal/login, I see the login page of CAS. If I write Liferay.com.1/Liferay.com.1 I access at sign-in page of Liferay.


My question is how is it possible to make transparent CAS at user? I must see the contents of my home page Liferay besides the sign-in box. When my application works with all the users I undestand that they don´t need to see CAS page, only the portal.

Please, anybody can help me? It’s very important for me to get that everything work soon.

I'm trying also connecting CAS with an openLDAP but not success.

Thanks

[14年前 に Dhandapani Shanmugam によって更新されました。]

Hi Jin,

I am trying the same Liferay+CAS+LDAP. Can you please help me to do this step by step. I am new to liferay. Thanks in advance

Regards

Dhandapani

[14年前 に jyotsna raveendran によって更新されました。]

Hi,

I am using Liferay 5.2.3 and CAS 2.0.11. I have integrated CAS with Liferay. But there seems to be a problem. When I try logging in Liferay, I am redirected to the CAS login page. But once I give the username and password, I get a connection error saying that the page cannot be displayed i.e. it is not performing any authentication. This error I am getting in IE and in Mozilla I am getting an error saying that data transfer interrupted. I am not able to authenticate through CAS. Can I know what could possibly be the problem?

Could someone please share the steps that are required to integrate CAS with liferay. The links I had followed for integrating are

http://www.liferay.com/web/guest/community/wiki/-/wiki/Main/Single+SignOn+-+Integrating+Liferay+With+CAS+Server

http://wiki.pentaho.com/display/ServerDoc1x/Integrating+Liferay+with+CAS

Thanks in advance.

[14年前 に jyotsna raveendran によって更新されました。]

Hi,

I am facing the same issue as you had mentioned in your previous post.(given below)

3. Here is the behavior I am seeing when starting liferay:
It doesn't immediately forward to /cas/login, instead it shows the liferay home login page.
When I click Sign In under the Welcome tab, it forwards me to cas/login
After I enter my credentials through CAS, it forwards me back to /web/guest/home (basically - not logged in)

I don't see any errors in the CAS log file so I am not sure what is going on.

Also tomcat shows that authentication is successful and that ticket has been generated.
You had mentioned in next post that you have solved this problem. Could you please share the steps you had followed in solving this.

Thanks,
Jyotsna

[14年前 に Ashok Aggarwal によって更新されました。]

Hi Jyostna and/or others,

Do you still have an issue? I recently configured LifeRay with CAS successfully and can probably help you troubleshoot. What specific error(s), if any, are you facing at this time?

I am going to guess that you have a problem with your SSL handshake.


Ashok Aggarwal
[e-mail]
http://www.mandsconsulting.com

[14年前 に Nagendra Kumar Busam によって更新されました。]

Hi Ashok,

I am getting handshake related error, can you let me know how to troubleshoot this error

17:14:28,484 ERROR [CASFilter:125] java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path bu
ilding failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provide
r.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:295)
        at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator
.java:33)
        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:178)
        at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132)
        at com.liferay.portal.servlet.filters.sso.cas.CASFilter.processFilter(CASFilter.java:180)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:112)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:110)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:185)
        at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:191)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:112)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:185)
        at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:191)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:112)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:185)
        at com.liferay.portal.servlet.filters.threadlocalcache.ThreadLocalCacheFilter.processFilter(ThreadLocalCacheFilter.java:51)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:112)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:185)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:115)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:185)
        at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:115)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:738)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:433)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:379)
        at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
        at java.lang.Thread.run(Thread.java:619)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCer
tPathBuilderException: unable to find valid certification path to requested target
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1611)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1035)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:124)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1139)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1041)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:281)
        ... 49 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find
 valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
        at sun.security.validator.Validator.validate(Validator.java:218)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014)
        ... 61 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
        ... 67 more

Thanks,
- Nagendra Kumar

[13年前 に chandra sekhar によって更新されました。]

Hi Ashok,

I am Integrating CAS with liferay using MYSQL database as authentication. When i click on sign-in option from welcome button I am successfully able to view the CAS login page and I provide the authentication details. when click on submit it showes white page. I gone through the logs file of tomcat I am able to see the user authentication Successfully and it created one service ticket but I am facing the SSL handshaking problem.

Please help me to clear the SSL Handshake problem. And I attached the log file,please go through it.

Thanks in advance........

Regards,
Chandrasekhar

[13年前 に chandra sekhar によって更新されました。]

Hi All,

Finally I resolved the issue. Please go through the following steps to resolve the SSL Handshake Issue.

Step:1
---------
Just created the SSL certificate using keytool command and applied this certificate in server.xml of tomcat.

Step:2
---------
Import the above certificate into cacerts certificate which will be avilable in the java directory.

Regards,
Chandrasekhar

[14年前 に Mayank Awasthi によって更新されました。]

Guys,

If you are still facing issues:

I captured the steps that I performed to make it work:

They are here: http://liferayintegrator.blogspot.com/

Thanks
Mayank

[15年前 に Brian Kim によって更新されました。]

1. Yes
2. Extend or create a new filter that checks all requests to see if the user is logged in, and then forwards to the CAS login if not
3. Account creation needs to happen within Liferay. Reason being, that user record is used to associate the user to all other tables.

[15年前 に Mykola Hutta によって更新されました。]

Hello Jin,
did you fix this problem? I have the same. Please give me answer.

[15年前 に James Min によって更新されました。]

Also, if you want to make a contribution to the wiki from your experience please do so:

http://www.liferay.com/web/guest/community/wiki/-/wiki/Main/Single+SignOn+-+Integrating+Liferay+With+CAS+Server

[15年前 に Mykola Hutta によって更新されました。]

thanks for link
I made before the same as in wiki. But after cas login I'm redirected to liferay login page and i'm not logged in!!!
I need to logged in.

[14年前 に Nagendra Kumar Busam によって更新されました。]

Hi Jin,

Can you tell us how you managed to resolve those issues

In my case, i need to login twice - one time using CAS & second time using liferay login

I have liferay 5.2 EE SP3 & CAS server 3.3.5 running on different instances (ports)

Thanks & Regards,
- Nagendra Kumar