...
In installations using Jasig CAS for authentication WebProxy Portlet portlet can be configured to obtain its own proxy tickets. These tickets are not usable to authenticate to CAS-enabled Web sites. Instead, WebProxy Portlet portlet can validate its proxy ticket, ask for its own Proxy Granting Ticket, and then ask for a proxy ticket for a service to access. The rest of this document outlines how to configure WebProxy Portlet portlet to do this.
New Dependency
This implementation adds a dependency on Jasig Java CAS Client. This dependency was added to WebProxy Portletportlet's pom.xml in SVN.
Enabling CAS authentication
To turn on WebProxy Portletportlet's support for authentication, set the value of "edu.wisc.my.webproxy.webproxy.httpclient.authEnable" portlet preference to "true." To select the authentication method, set the value of the "edu.wisc.my.webproxy.webproxy.httpclient.sAuthType" portlet preference to "CAS." Portlet preferences can be set using uPortal's Portlet Manager or using the .channel file import.
...
CAS authentication is implemented using the new handler in a Java class called edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler. This is a Spring bean , that is configured in WebProxy Portletportlet's applicationContext.xml. The updated distribution of this file contains a section near the top, which is commented-out by default. Enable that section to look like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<!-- The following 4 beans are needed for proxy CAS authentication. The first 3 are from the
Jasig Java CAS Client.
proxyStorage is a common storage that the ticket validator and filter use to keep a PGT for a Principal
ticketValidator is used to validateWebProxy portlet's proxy ticket and request its own PGT. In this
example, it is configured to accept any proxy. Its constructor argument must
be set to the CAS URL. proxyCallbackUrl must be set to the WebProxy Portletportlet's
proxy ticket receptor (configured in web.xml).
proxyFilter is a filter that will receive the proxy tickets requested by ticketValidator. Its
proxyReceptorUrl shown in this example should be sufficient and must be relative to
WebProxy Portletportlet's own "base" URL. The service property is not used by this filter
as it does not perform ticket validation.
casAuthenticationHandler is WebProxy Portletportlet's own bean that handles the CAS proxy authentication
as per the CAS protocol specification. The myService property must be
set to the fully-qualified "base" URL of the portlet itself. It is passed
to CAS for ticket validation, and it must match what uPortal used when it
obtained the proxy ticket for the portlet.
-->
<!--
<bean name="proxyStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />
<bean id="ticketValidator" class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
<constructor-arg index="0" value="https://cas.university.edu/cas" />
<property name="proxyCallbackUrl" value="https://portal.university.edu/WebProxyPortlet/CasProxyReceptor" />
<property name="acceptAnyProxy" value="true" />
<property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>
<bean name="proxyFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
<property name="service" value="https://my.local.service.com/cas-client" />
<property name="proxyReceptorUrl" value="/CasProxyReceptor" />
<property name="ticketValidator" ref="ticketValidator" />
<property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>
<bean name="casAuthenticationHandler" class="edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler">
<property name="ticketValidator" ref="ticketValidator" />
<property name="myService" value="http://portal.university.edu/WebProxyPortlet" />
</bean>
-->
|
...
Jasig Java CAS Client contains a Web filter that can receive Proxy Granting Tickets. WebProxy Portlet portlet is configured to retrieve these at an endpoint "/CasProxyReceptor" in the above example. To configure that endpoint, please add the following section to WebProxy Portletportlet's web.xml as illustrated below:
...