Overview
In installations using Jasig CAS for authentication WebProxy Portlet can be configured to obtain its own proxy tickets. These tickets are not usable to authenticate to CAS-enabled Web sites. Instead, WebProxy Portlet can validate its proxy ticket, ask for its own Proxy Granting Ticket, and then ask for a proxy ticket for a service to access. The rest of this document outlines how to configure WebProxy Portlet to do this.
Enabling CAS authentication
To turn on WebProxy Portlet's support for authentication, set the value of "edu.wisc.my.webproxy.webproxy.httpclient.authEnable" portlet preference to "true." To select the authentication method, set the value of the "edu.wisc.my.webproxy.webproxy.httpclient.sAuthType" portlet preference to "CAS." Portlet preferences can be set using uPortal's Portlet Manager or using the .channel file import.
Obtaining a CAS proxy ticket.
uPortal passes CAS proxy tickets to portlets when a portlet is configured to request a user attribute "casProxyTicket." This is configured in portlet.xml by adding a user attribute like in the following example:
<user-attribute> <description>CAS Proxy Ticket</description> <name>casProxyTicket</name> </user-attribute>
Enabling the CAS Authentication Handler
CAS authentication is implemented using the new handler in a Java class called edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler. This is a Spring bean, that is configured in WebProxy Portlet's applicationContext.xml. The updated distribution of this file contains a section near the top, which is commented-out by default. Enable that section to look like this:
<!-- The following 4 beans are needed for proxy CAS authentication. The first 3 are from the
Jasig Java CAS Client.
proxyStorage is a common storage that the ticket validator and filter use to keep a PGT for a Principal
ticketValidator is used to validateWebProxy portlet's proxy ticket and request its own PGT. In this
example, it is configured to accept any proxy. Its constructor argument must
be set to the CAS URL. proxyCallbackUrl must be set to the WebProxy Portlet's
proxy ticket receptor (configured in web.xml).
proxyFilter is a filter that will receive the proxy tickets requested by ticketValidator. Its
proxyReceptorUrl shown in this example should be sufficient and must be relative to
WebProxy Portlet's own "base" URL. The service property is not used by this filter
as it does not perform ticket validation.
casAuthenticationHandler is WebProxy Portlet's own bean that handles the CAS proxy authentication
as per the CAS protocol specification. The myService property must be
set to the fully-qualified "base" URL of the portlet itself. It is passed
to CAS for ticket validation, and it must match what uPortal used when it
obtained the proxy ticket for the portlet.
-->
<!--
<bean name="proxyStorage" class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" />
<bean id="ticketValidator" class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
<constructor-arg index="0" value="https://cas.university.edu/cas" />
<property name="proxyCallbackUrl" value="https://portal.university.edu/WebProxyPortlet/CasProxyReceptor" />
<property name="acceptAnyProxy" value="true" />
<property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>
<bean name="proxyFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter">
<property name="service" value="https://my.local.service.com/cas-client" />
<property name="proxyReceptorUrl" value="/CasProxyReceptor" />
<property name="ticketValidator" ref="ticketValidator" />
<property name="proxyGrantingTicketStorage" ref="proxyStorage" />
</bean>
<bean name="casAuthenticationHandler" class="edu.wisc.my.webproxy.beans.security.CasAuthenticationHandler">
<property name="ticketValidator" ref="ticketValidator" />
<property name="myService" value="http://portal.university.edu/WebProxyPortlet" />
</bean>
-->