Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

Overview

In installations using Jasig CAS for authentication WebProxy portlet can be configured to obtain its own proxy tickets. These tickets are not usable to authenticate to CAS-enabled Web sites. Instead, WebProxy portlet can validate its proxy ticket, ask for its own Proxy Granting Ticket, and then ask for a proxy ticket for a service to access. The rest of this document outlines how to configure WebProxy portlet to do this.

New Dependency

This implementation adds a dependency on Jasig Java CAS Client. This dependency was added to WebProxy portlet's pom.xml in SVN.

Enabling CAS authentication

To turn on WebProxy portlet's support for authentication, set the value of "edu.wisc.my.webproxy.webproxy.httpclient.authEnable" portlet preference to "true." To select the authentication method, set the value of the "edu.wisc.my.webproxy.webproxy.httpclient.sAuthType" portlet preference to "CAS." Portlet preferences can be set using uPortal's Portlet Manager or using the .channel file import.

Obtaining a CAS proxy ticket.

uPortal passes CAS proxy tickets to portlets when a portlet is configured to request a user attribute "casProxyTicket." This is configured in portlet.xml by adding a user attribute like in the following example:

<user-attribute>
  <description>CAS Proxy Ticket</description>
  <name>casProxyTicket</name>
</user-attribute>

Enabling the CAS Authentication Handler

CAS authentication is implemented using the new handler in a Java class called edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler. This is a Spring bean that is configured in WebProxy portlet's applicationContext.xml. The updated distribution of this file contains a section near the top, which is commented-out by default. Enable that section to look like this:

<!-- The following 4 beans are needed for proxy CAS authentication.  The first 3 are from the
     Jasig Java CAS Client.
     proxyStorage is a common storage that the ticket validator and filter use to keep a PGT for a Principal
     ticketValidator is used to validateWebProxy portlet's proxy ticket and request its own PGT.  In this
                     example, it is configured to accept any proxy.  Its constructor argument must
                     be set to the CAS URL.  proxyCallbackUrl must be set to the WebProxy portlet's
                     proxy ticket receptor (configured in web.xml).
     proxyFilter is a filter that will receive the proxy tickets requested by ticketValidator.  Its
                 proxyReceptorUrl shown in this example should be sufficient and must be relative to
                 WebProxy portlet's own "base" URL.  The service property is not used by this filter
                 as it does not perform ticket validation.
     casAuthenticationHandler is WebProxy portlet's own bean that handles the CAS proxy authentication
                              as per the CAS protocol specification.  The myService property must be
                              set to the fully-qualified "base" URL of the portlet itself.  It is passed
                              to CAS for ticket validation, and it must match what uPortal used when it
                              obtained the proxy ticket for the portlet.
-->
<!-- 
<bean name="proxyStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />
  
<bean id="ticketValidator" class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
  <constructor-arg index="0" value="https://cas.university.edu/cas" />
  <property name="proxyCallbackUrl" value="https://portal.university.edu/WebProxyPortlet/CasProxyReceptor" />
  <property name="acceptAnyProxy" value="true" />
  <property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>

<bean name="proxyFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
  <property name="service" value="https://my.local.service.com/cas-client" />
  <property name="proxyReceptorUrl" value="/CasProxyReceptor" />
  <property name="ticketValidator" ref="ticketValidator" />
  <property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>

<bean name="casAuthenticationHandler" class="edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler">
  <property name="ticketValidator" ref="ticketValidator" />
  <property name="myService" value="http://portal.university.edu/WebProxyPortlet" />
</bean>
-->

Enabling the Proxy Granting Ticket Receptor

Jasig Java CAS Client contains a Web filter that can receive Proxy Granting Tickets. WebProxy portlet is configured to retrieve these at an endpoint "/CasProxyReceptor" in the above example. To configure that endpoint, please add the following section to WebProxy portlet's web.xml as illustrated below:

<!-- The following section should be enabled to add support for proxy CAS authentication
     The servlet mapping is completely fake and uses the ProxyServlet definition.  The Jasig
     Java CAS client filter intercepts a call to this endpoint and grabs the proxy ticket
     received from CAS.
-->
<servlet-mapping>
  <servlet-name>ProxyServlet</servlet-name>
  <url-pattern>/CasProxyReceptor/*</url-pattern>
</servlet-mapping>

<filter>
  <filter-name>CAS Proxy Filter</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  <init-param>
    <param-name>targetBeanName</param-name>
    <param-value>proxyFilter</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>CAS Proxy Filter</filter-name>
  <url-pattern>/CasProxyReceptor/*</url-pattern>
</filter-mapping>

You will notice that the new endpoint, "/CasProxyReceptor" is mapped to an existing ProxyServlet. This is OK because the Jasig Java CAS Client will actually intercept the CAS callbacks with the PGT and the servlet will not be invoked.

  • No labels