...
| Tip | ||
|---|---|---|
| ||
Hint: filter declarations come before servlet declarations in the web.xml. Personally, I find XMLBuddy's support for validating application descriptors XML against its declared DTD / schema quite helpful in catching element ordering and XML validity problems... |
...
The YaleCasFilteredContext is part of the Yale uPortal CAS security provider package, available here.
Proxying authentication
The above instructions should get you to the point where users can authenticate to your uPortal itself using CAS. A killer feature for portals that CAS offers beyond this initial authentication is proxy authentication. In this section we describe the additional configuration you need to make to turn on proxy authentication. We highly recommend that you first verify that you are able to CAS authenticate to your uPortal istself before tackling the additional complexities of proxy authentication.
Receiving proxy tickets
You'll need to map the ProxyTicketReceptor servlet in your web.xml. This servlet must be available via https:
| Code Block | ||
|---|---|---|
| ||
<servlet>
<servlet-name>CasProxyServlet</servlet-name>
<servlet-class>edu.yale.its.tp.cas.proxy.ProxyTicketReceptor</servlet-class>
<load-on-startup>4</load-on-startup>
</servlet>
...
<servlet-mapping>
<servlet-name>CasProxyServlet</servlet-name>
<url-pattern>/CasProxyServlet</url-pattern>
</servlet-mapping>
|
Asking for proxy tickets
Having mapped ProxyTicketReceptor, you're prepared to receive proxy tickets if the CAS server would send them to you. But you also need to configure the CASValidateFilter to ask for them.
You need to add the filter init-param "edu.yale.its.tp.cas.client.filter.proxyCallbackUrl" to your CASValidateFilter configuration.
| Code Block | ||
|---|---|---|
| ||
<filter>
<filter-name>CAS Validate Filter</filter-name>
<filter-class>edu.yale.its.tp.cas.client.filter.CASValidateFilter</filter-class>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
<param-value>https://secure.its.yale.edu/cas/serviceValidate</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
<param-value>hkg2.cis.yale.edu:8080</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.filter.proxyCallbackUrl</param-name>
<param-value>https://hkg2.cis.yale.edu/uPortal/CasProxyServlet</param-value>
</init-param>
</filter>
|
| Warning | ||
|---|---|---|
| ||
The proxy callback URL MUST be an https: URL. |
Obtaining and using ProxyTickets in your IChannel implementations
Your IChannels obtain and use proxy tickets through the LocalConnectionContext abstraction, as implemented by a CasConnectionContext instance.