Logout requests are handled by clients.
.=> CAS_Client::handleLogoutRequests(true, array ( 0 => '
cas-1.server.test.pl',)) [CAS.php:1276]
D0EE .| Not a logout request [Client.php:1739]
See phpcas
El lunes, 23 de abril de 2018, Viacheslav Babanin <babanin.vb...@gmail.com>
escribió:
> Hello, I have encountered issue with SSO for SAML 1.1 clients with CAS 5.2
>
> I am rather new cas user and probably i am missing something obvious.
>
> I am using folowing phpCAS client:
>
> <?php
> require_once 'phpcas/source/CAS.php';
> // Enable debugging
> phpCAS::setDebug('phpCAS.log');
> // Enable verbose error messages. Disable in production!
> phpCAS::setVerbose(true);
> // Initialize phpCAS
> $cas_host = 'cas-1.uek.krakow.pl';
> // Context of the CAS Server
> $cas_context = '/cas';
> // Port of your CAS server. Normally for a https server it's 443
> $cas_port = 443;
> phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);
> // For production use set the CA certificate that is the issuer of the cert
> // on the CAS server and uncomment the line below
> // phpCAS::setCasServerCACert($cas_server_ca_cert_path);
> // For quick testing you can disable SSL validation of the CAS server.
> // THIS SETTING IS NOT RECOMMENDED FOR PRODUCTION.
> // VALIDATING THE CAS SERVER IS CRUCIAL TO THE SECURITY OF THE CAS
> PROTOCOL!
> phpCAS::setNoCasServerValidation();
> // force CAS authentication
>
> $cas_real_hosts = array('cas-1.uek.krakow.pl');
>
>
> phpCAS::handleLogoutRequests(true, $cas_real_hosts);
>
> phpCAS::forceAuthentication();
> // at this step, the user has been authenticated by the CAS server
> // and the user's login name can be read with phpCAS::getUser().
> // logout if desired
> // logout if desired
> if (isset($_REQUEST['logout'])) {
> phpCAS::logout();
> }
> ?>
> <html>
> <head>
> <title>Advanced SAML 1.1 example</title>
> <meta http-equiv="Content-Type" content="text/html;
> charset=utf-8"/>
> </head>
> <body>
> <h2>Advanced SAML 1.1 example</h2>
> <?php require 'script_info.php' ?>
>
> Authentication succeeded for user
> <strong><?php echo phpCAS::getUser(); ?></strong>.
> User has attributes
> <strong><?php if(phpCAS::hasAttributes()){
> echo 'true';
> }
> else {
> echo 'false';
> }
>
> ?></strong>.
> <h3>User Attributes</h3>
> <ul>
> <?php
> foreach (phpCAS::getAttributes() as $key => $value) {
> if (is_array($value)) {
> echo '<li>', $key, ':<ol>';
> foreach ($value as $item) {
> echo '<li><strong>', $item, '</strong></li>';
> }
> echo '</ol></li>';
> } else {
> echo '<li>', $key, ': <strong>', $value, '</strong></li>' .
> PHP_EOL;
> }
> }
> ?>
> </ul>
> <p><a href="?logout=">Logout</a></p>
> </body>
> </html>
>
>
> Single sign in works like expected. If I have several CAS clients, when I
> log in to one of them, I am authenticated in all, like expected.
>
> But Single Logout completely doesn't work for me. When I log out using CAS
> logout endpoint "{cas-server}/cas/logout" i receive message that I am
> logged out from CAS and I can see in SSO manager that CAS Session is
> terminated.
> But all application sessions are still alive, I am allowed not only to
> navigate client pages but also close\open tabs and I am still logged in.
>
> I have tried to configure service with client application with both
> "BACK_CHANNEL" and "FRONT_CHANNEL" logoutType with no luck.
>
> 1. If I use BACK_CHANNEL.
>
> Thats how service definition looks like:
>
> {
> "@class" : "org.jasig.cas.services.RegexRegisteredService",
> "serviceId" : "https://cas-client.ssl.stub/";,
> "name" : "example_simple_citest",
> "id" : 7,
> "logoutType" : "BACK_CHANNEL",
>
> "attributeReleasePolicy" : {
> "@class" : "org.apereo.cas.services.ReturnMappedAttributeReleasePo
> licy",
> "allowedAttributes" : {
> "@class" : "java.util.TreeMap",
> "uid" : "user_id",
> "sn" : "surname"
> }
> }
> }
>
>
> When I log out using "{cas-server}/cas/logout" endpoint CAS server log
> looks like this: back.txt (see attachment)
>
> phpCAS.log doesn't log anything in this case. And application session
> still lives untill I close browser.
>
> 2. If I use FRONT_CHANNEL.
>
> Thats how service definition looks like:
>
> {
> "@class" : "org.jasig.cas.services.RegexRegisteredService",
> "serviceId" : "https://cas-client.ssl.stub/";,
> "name" : "example_simple_citest",
> "id" : 7,
> "logoutType" : "FRONT_CHANNEL",
>
> "attributeReleasePolicy" : {
> "@class" : "org.apereo.cas.services.ReturnMappedAttributeReleasePo
> licy",
> "allowedAttributes" : {
> "@class" : "java.util.TreeMap",
> "uid" : "user_id",
> "sn" : "surname"
> }
> }
> }
>
> When I log out using "{cas-server}/cas/logout" endpoint CAS server log
> looks like this: front.txt (see attachment)
>
> And I see following message upon logout on endpoint page:
>
>
> <https://lh3.googleusercontent.com/-UTWr5C0Ljuw/Wt3mgxz_NeI/AAAAAAAAAKM/PPlxChw1Gwk--HOokjLhoOO5DUzk7zV2gCLcBGAs/s1600/fronLogout.png>
>
>
>
>
> W
> Which tells me that logout notification has been sent.
>
> At the same time, when endpoint logout happens, phpCAS.log logs following
> message.
>
> D0EE .START (2018-04-23 15:37:16) phpCAS-1.3.5 ******************
> [CAS.php:468]
> D0EE .=> phpCAS::client('S1', 'cas-1.server.test.pl', 443, '/cas')
> [index.php:13]
> D0EE .| => CAS_Client::__construct('S1', false, 'cas-1.server.test.pl',
> 443, '/cas', true) [CAS.php:360]
> D0EE .| | Starting a new session
> ST-26-6Ad0C8OCIF5n-1zWgmiE8HZdw-E-v-cas-1
> [Client.php:932]
> D0EE .| | Session is authenticated as: babanin [Client.php:936]
> D0EE .| <= ''
> D0EE .<= ''
> D0EE .=> phpCAS::setNoCasServerValidation() [index.php:20]
> D0EE .| You have configured no validation of the legitimacy of the cas
> server. This is not recommended for production use. [CAS.php:1644]
> D0EE .<= ''
> D0EE .=> CAS_Client::handleLogoutRequests(true, array ( 0 => '
> cas-1.server.test.pl',)) [CAS.php:1276]
> D0EE .| Not a logout request [Client.php:1739]
> D0EE .<= ''
> D0EE .=> phpCAS::forceAuthentication() [index.php:27]
> D0EE .| => CAS_Client::forceAuthentication() [CAS.php:1098]
> D0EE .| | => CAS_Client::isAuthenticated() [Client.php:1280]
> D0EE .| | | => CAS_Client::_wasPreviouslyAuthenticated()
> [Client.php:1393]
> D0EE .| | | | user = `babanin' [Client.php:1622]
> D0EE .| | | <= true
> D0EE .| | | user was already authenticated, no need to look for
> tickets [Client.php:1417]
> D0EE .| | <= true
> D0EE .| | no need to authenticate [Client.php:1282]
> D0EE .| <= true
> D0EE .<= ''
>
> This message looks exactly like regular login message, but it appers when
> tab with application is closed and at the exact time when CAS sends logout
> notification.
> It seems like client receives FRONT_CHANNEL connection from server but
> fails to recognise it as logout request.
>
>
> So, summarising:
>
> Logging out from cas using both endpoint and casified applications causes
> CAS to terminate SSO session but fails to terminate application sessions.
> As a client I am using example code from phpCAS documentation.
> Please help me to solve this issue, or, atlease get understanding of it.
>
> Thank you very much for attention,
>
> Viacheslav Babanin
>
> --
> - Website: https://apereo.github.io/cas
> - Gitter Chatroom: https://gitter.im/apereo/cas
> - List Guidelines: https://goo.gl/1VRrw7
> - Contributions: https://goo.gl/mh7qDG
> ---
> You received this message because you are subscribed to the Google Groups
> "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to cas-user+unsubscr...@apereo.org.
> To view this discussion on the web visit https://groups.google.com/a/
> apereo.org/d/msgid/cas-user/33b216d7-1947-4ffd-8bc7-
> 51f307b6bd3a%40apereo.org
> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/33b216d7-1947-4ffd-8bc7-51f307b6bd3a%40apereo.org?utm_medium=email&utm_source=footer>
> .
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to cas-user+unsubscr...@apereo.org.
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAMY5mie8swV3ZGQFAq3P-qA4SfN5tiNugYHxknXsX0pPNz3ZTw%40mail.gmail.com.
