Versions Compared

Old Version 1

changes.mady.by.user Adam Rybicki (Deactivated)

Saved on

compared with

New Version Current

changes.mady.by.user Adam Rybicki (Deactivated)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 5.3

Overview

In installations using Jasig CAS for authentication WebProxy Portlet portlet can be configured to obtain its own proxy tickets. These tickets are not usable to authenticate to CAS-enabled Web sites. Instead, WebProxy Portlet portlet can validate its proxy ticket, ask for its own Proxy Granting Ticket, and then ask for a proxy ticket for a service to access. The rest of this document outlines how to configure WebProxy Portlet portlet to do this.

New Dependency

This implementation adds a dependency on Jasig Java CAS Client. This dependency was added to WebProxy portlet's pom.xml in SVN.

Enabling CAS authentication

To turn on WebProxy Portletportlet's support for authentication, set the value of "edu.wisc.my.webproxy.webproxy.httpclient.authEnable" portlet preference to "true." To select the authentication method, set the value of the "edu.wisc.my.webproxy.webproxy.httpclient.sAuthType" portlet preference to "CAS." Portlet preferences can be set using uPortal's Portlet Manager or using the .channel file import.

...

CAS authentication is implemented using the new handler in a Java class called edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler. This is a Spring bean , that is configured in WebProxy Portletportlet's applicationContext.xml. The updated distribution of this file contains a section near the top, which is commented-out by default. Enable that section to look like this:

Code Block
xml
xml
<!-- The following 4 beans are needed for proxy CAS authentication.  The first 3 are from the
     Jasig Java CAS Client.
     proxyStorage is a common storage that the ticket validator and filter use to keep a PGT for a Principal
     ticketValidator is used to validateWebProxy portlet's proxy ticket and request its own PGT.  In this
                     example, it is configured to accept any proxy.  Its constructor argument must
                     be set to the CAS URL.  proxyCallbackUrl must be set to the WebProxy Portletportlet's
                     proxy ticket receptor (configured in web.xml).
     proxyFilter is a filter that will receive the proxy tickets requested by ticketValidator.  Its
                 proxyReceptorUrl shown in this example should be sufficient and must be relative to
                 WebProxy Portletportlet's own "base" URL.  The service property is not used by this filter
                 as it does not perform ticket validation.
     casAuthenticationHandler is WebProxy Portletportlet's own bean that handles the CAS proxy authentication
                              as per the CAS protocol specification.  The myService property must be
                              set to the fully-qualified "base" URL of the portlet itself.  It is passed
                              to CAS for ticket validation, and it must match what uPortal used when it
                              obtained the proxy ticket for the portlet.
-->
<!-- 
<bean name="proxyStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />
  
<bean id="ticketValidator" class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
  <constructor-arg index="0" value="https://cas.university.edu/cas" />
  <property name="proxyCallbackUrl" value="https://portal.university.edu/WebProxyPortlet/CasProxyReceptor" />
  <property name="acceptAnyProxy" value="true" />
  <property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>

<bean name="proxyFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
  <property name="service" value="https://my.local.service.com/cas-client" />
  <property name="proxyReceptorUrl" value="/CasProxyReceptor" />
  <property name="ticketValidator" ref="ticketValidator" />
  <property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>

<bean name="casAuthenticationHandler" class="edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler">
  <property name="ticketValidator" ref="ticketValidator" />
  <property name="myService" value="http://portal.university.edu/WebProxyPortlet" />
</bean>
-->

Enabling the Proxy Granting Ticket Receptor

Jasig Java CAS Client contains a Web filter that can receive Proxy Granting Tickets. WebProxy portlet is configured to retrieve these at an endpoint "/CasProxyReceptor" in the above example. To configure that endpoint, please add the following section to WebProxy portlet's web.xml as illustrated below:

Code Block
xml
xml

<!-- The following section should be enabled to add support for proxy CAS authentication
     The servlet mapping is completely fake and uses the ProxyServlet definition.  The Jasig
     Java CAS client filter intercepts a call to this endpoint and grabs the proxy ticket
     received from CAS.
-->
<servlet-mapping>
  <servlet-name>ProxyServlet</servlet-name>
  <url-pattern>/CasProxyReceptor/*</url-pattern>
</servlet-mapping>

<filter>
  <filter-name>CAS Proxy Filter</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  <init-param>
    <param-name>targetBeanName</param-name>
    <param-value>proxyFilter</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>CAS Proxy Filter</filter-name>
  <url-pattern>/CasProxyReceptor/*</url-pattern>
</filter-mapping>

You will notice that the new endpoint, "/CasProxyReceptor" is mapped to an existing ProxyServlet. This is OK because the Jasig Java CAS Client will actually intercept the CAS callbacks with the PGT and the servlet will not be invoked.