Still having issues with this. We've narrowed it down to the EncryptedMapDecorator. If we implement it without the encryption it works, but then the ClearPass credentials are stored in clear text, which isn't an acceptable solution. If anyone who has deployed ClearPass in a load-balanced CAS environment could just post your clearpass-configuration.xml that would be most helpful.
Thanks, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> From: St Laurent, Mark Sent: Tuesday, November 12, 2013 7:51 AM To: cas-user@lists.jasig.org Subject: RE:[cas-user] ClearPass with Load-Balanced CAS Really having problems with this. If anyone out there has ever made ClearPass work in a load-balanced environment I'd really appreciate it if I could get some help from you. Thanks, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> From: St Laurent, Mark Sent: Friday, November 08, 2013 4:36 PM To: cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> Subject: RE:[cas-user] ClearPass with Load-Balanced CAS So, I have made some progress. I've discovered that if I change the key prefix from clearPass_ to something unique for each server (such as "cas0_clearPass_") then the error below goes away. However, it appears that the servers cannot read each other's credential cache, successful proxy tickets don't get a password in the returned information. Still looking for help on this, anything would be appreciated. Thanks, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> From: St Laurent, Mark Sent: Friday, November 08, 2013 8:16 AM To: cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> Subject: RE:[cas-user] ClearPass with Load-Balanced CAS After more testing last night, I discovered that it is leaving an error message in the CAS log: 2013-11-07 19:40:55,307 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler successfully authenticated [username: anaylor] 2013-11-07 19:40:55,307 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - Resolved principal anaylor 2013-11-07 19:40:55,307 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler@41589833<mailto:org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler@41589833> authenticated anaylor with credential [username: anaylor]. 2013-11-07 19:40:55,322 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN ============================================================= WHO: [username: anaylor] WHAT: supplied credentials: [username: anaylor] ACTION: AUTHENTICATION_FAILED APPLICATION: CAS WHEN: Thu Nov 07 19:40:55 MST 2013 CLIENT IP ADDRESS: 198.60.125.12 SERVER IP ADDRESS: 198.60.125.94 ============================================================= 2013-11-07 19:40:55,322 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - Audit trail record BEGIN ============================================================= WHO: [username: anaylor] WHAT: javax.crypto.BadPaddingException: Given final block not properly padded ACTION: TICKET_GRANTING_TICKET_NOT_CREATED APPLICATION: CAS WHEN: Thu Nov 07 19:40:55 MST 2013 CLIENT IP ADDRESS: 198.60.125.12 SERVER IP ADDRESS: 198.60.125.94 ============================================================= If anyone could provide any assistance on this, I'd really appreciate it. Thanks, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> From: St Laurent, Mark Sent: Thursday, November 07, 2013 3:11 PM To: cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> Subject: [cas-user] ClearPass with Load-Balanced CAS So, I'm trying to get ClearPass working in a load-balanced CAS environment with a memcache ticket registry. I discovered this Wiki entry: https://wiki.jasig.org/display/CASUM/ClearPass+and+Multiple+Server+Configurations But I can't seem to get it working. My clearpass-configuration.xml is as follows: <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to Jasig under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. Jasig licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at the following location: http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <beans xmlns="http://www.springframework.org/schema/beans"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xmlns:p="http://www.springframework.org/schema/p"; xmlns:sec="http://www.springframework.org/schema/security"; xmlns:util="http://www.springframework.org/schema/util"; xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd";> <bean id="CPserialTranscoder" class="net.spy.memcached.transcoders.SerializingTranscoder" p:compressionThreshold="2048" /> <bean id="memcachedMap" class="net.spy.memcached.CacheMap"> <constructor-arg index="0"> <bean class="net.spy.memcached.spring.MemcachedClientFactoryBean" p:servers="${memcached.servers}" p:protocol="${memcached.protocol}" p:locatorType="${memcached.locatorType}" p:failureMode="${memcached.failureMode}" p:transcoder-ref="CPserialTranscoder"> <property name="hashAlg"> <util:constant static-field="net.spy.memcached.DefaultHashAlgorithm.${memcached.hashAlgorithm}" /> </property> </bean> </constructor-arg> <constructor-arg index="1" value="7200" /> <!-- this is the timeout for the cache in seconds --> <constructor-arg index="2" value="clearPass_" /> <!-- this is the prefix for the keys stored in the map --> </bean> <bean id="credentialsCache" class="org.jasig.cas.extension.clearpass.EncryptedMapDecorator"> <constructor-arg index="0" ref="memcachedMap" /> <constructor-arg index="1" value="********" /> <!-- Replace the salt and secret key with one of your choosing --> <constructor-arg index="2" value="********" /> </bean> <!-- NOTE: Name of delegated ticket registry bean in ticketRegistry.xml must be "ticketRegistryValue." --> <bean id="ticketRegistry" class="org.jasig.cas.extension.clearpass.TicketRegistryDecorator"> <constructor-arg index="0" ref="ticketRegistryValue"/> <constructor-arg index="1" ref="credentialsCache"/> </bean> <!-- implementation of the clear pass vending service --> <bean id="clearPassController" class="org.jasig.cas.extension.clearpass.ClearPassController"> <constructor-arg index="0" ref="credentialsCache"/> </bean> <bean id="handlerMappingClearPass" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping" p:alwaysUseFullPath="true"> <property name="mappings"> <props> <prop key="/clearPass"> clearPassController </prop> </props> </property> </bean> <!-- Security configuration --> <bean id="clearPassFilterChainProxy" class="org.springframework.security.web.FilterChainProxy"> <sec:filter-chain-map request-matcher="ant"> <sec:filter-chain pattern="/clearPass" filters="casValidationFilter,httpServletRequestWrappingFilter"/> </sec:filter-chain-map> </bean> <!-- NOTE: It is dangerous to include a non-proxied CAS Filter for protecting /clearPass. Non-proxied CAS Filters like AuthenticationFilter don't honor the Filter chain proxy protection mechanism and, worse yet, allow access to the logged on user's cleartext password. It could be useful to enable this bean for easy testing of clearPass functionality however.--> <!-- <bean id="casAuthenticationFilter" class="org.jasig.cas.client.authentication.AuthenticationFilter"> <property name="casServerLoginUrl" value="${cas.securityContext.casProcessingFilterEntryPoint.loginUrl}"/> <property name="serverName" value="${server.name}"/> </bean> --> <!-- NOTE: A bean named clearPassProxyList must define the list of proxying services authorized to obtain clearpass credentials. --> <bean id="casValidationFilter" class="org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter"> <property name="serverName" value="${server.name}"/> <property name="exceptionOnValidationFailure" value="false"/> <property name="useSession" value="true"/> <property name="ticketValidator"> <bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"> <constructor-arg index="0" value="${server.prefix}" /> <property name="allowedProxyChains" ref="clearPassProxyList" /> </bean> </property> </bean> <bean id="httpServletRequestWrappingFilter" class="org.jasig.cas.client.util.HttpServletRequestWrapperFilter"/> </beans> Here are the properties from the cas.properties file: # MemCached properties memcached.servers=hera.yc.edu:11212,liam.yc.edu:11212,nicholas.yc.edu:11212,saul.yc.edu:11212 memcached.protocol=BINARY memcached.locatorType=CONSISTENT memcached.failureMode=Redistribute memcached.hashAlgorithm=FNV1_64_HASH expiration.policy.tgt.validity_period=${tgt.maxTimeToLiveInSeconds} expiration.policy.st.validity_period=${st.timeToKillInSeconds} The logs don't show any errors on startup, but when you try to authenticate with the CAS server it comes back and says the CAS server is unavailable. Thanks in advance, ---------------------------------- Mark St. Laurent Web Systems Administrator Yavapai College (928) 717-7654 http://www.yc.edu<http://www.yc.edu/> -- You are currently subscribed to cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> as: mark.stlaur...@yc.edu<mailto:mark.stlaur...@yc.edu> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> as: mark.stlaur...@yc.edu<mailto:mark.stlaur...@yc.edu> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> as: mark.stlaur...@yc.edu<mailto:mark.stlaur...@yc.edu> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to cas-user@lists.jasig.org<mailto:cas-user@lists.jasig.org> as: mark.stlaur...@yc.edu<mailto:mark.stlaur...@yc.edu> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user -- You are currently subscribed to cas-user@lists.jasig.org as: arch...@mail-archive.com To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user
