[cas-user] CAS with SSL and Apache reverse proxy and tomcat backend gives 'SAXParseException: White spaces are required between publicId and systemId'

2010-04-07 Thread Venn Hardy
I am trying to get CAS working on my organisation's intranet over SSL. I have installed the certificate on the apache HTTPD server, and am rewriting any incoming http://logon.company.org.au/cas/login url as https://logon.company.org.au/cas/login. The CAS authentication part is working, however, the

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enfor

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: [cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

[cas-user] Re: Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread hajo . passon
Hallo, ich bin zurzeit im Urlaub und deshalb nicht via Mail erreichbar. Wenden Sie sich in dringenden Fällen bitte per Mail (i...@form4.de) oder telefonisch (030/27 87 84-0) an meine Kollegen. Ab dem 12.04.2010 können Sie mich wieder im Büro erreichen. Viele Grüße Hajo Passon -- You are curr

Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread Ahsan Imam
Hi Jeff, I am not sure if this will help but you can start tomcat in debug mode and then attach a debugger (I used eclipse) to see what is happening. When I was having issues I set my debug statement (LdapPasswordWarningCheck.java) in the method getPasswordWarning. Some other keys files to look

Re: [cas-user] CAS crashing

2010-04-07 Thread Jeff Chapin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Well, the crashes are still occuring. I have set up a workaround for our other SSL issues, and this bug is still around. Any other suggestions on what to check? Jeff Jeff Chapin wrote: > We are still deploying and moving towards launch. At the mome

Re: [cas-user] Enabling LDAP Password Policy Enforcement

2010-04-07 Thread Jeff Chapin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 To make things even more fun, the instance I have with LdapBind and an attempt at the ldap-pwd module is letting locked users log in, but an instance with FastBind is not. I most definitely have something broken. Jeff Jeff Chapin wrote: > I know I

Re: [cas-user] javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?

2010-04-07 Thread Curtis Garman
Hmm...it actually looks like my problem was a server issue. Pinging my server on the server resolved to the localhost IP and pinging it from another machine resulted in the actual IP address...so apache was then unable to find a https virtual host and thus the error message I was dealing with. On

Re: [cas-user] SSO "exit your browser" tags, pamphlets, documentation?

2010-04-07 Thread John King
All our public machines are auto-login to an unprivileged account (on the computer and the domain) By auto-login, do you mean that the user begins in a (hopefully new) desktop session? I was proposing that the user begin at the login screen, having to first select the "Guest" account. I presu

Re: [cas-user] SSO "exit your browser" tags, pamphlets, documentation?

2010-04-07 Thread Cary, Kim
Right. All our public machines are auto-login to an unprivileged account (on the computer and the domain). The idea of using a desktop background is a good one, and most of our labs/public computers will also do that. Most public systems dump any file changes on reboot; we also like that since w

Re: [cas-user] 3.4.2 audit logging to a data source causing tomcat issues

2010-04-07 Thread Patrick Berry
On Wed, Apr 7, 2010 at 8:01 AM, Marvin Addison wrote: > > What version of Tomcat are you running? > > I'm running 6.0.20 at present, but have run a similar setup against > 5.5.x and never seen this. > > M > > Yeah, just tried 6.0.20 on a whim and virtually the same thing: log4j:ERROR Attempted to

Re: [cas-user] SSO "exit your browser" tags, pamphlets, documentation?

2010-04-07 Thread John King
I'm certainly not an expert when it comes to labs, but I'm of the opinion that users shouldn't share a system login session. Would enforcing LDAP/AD authentication for lab machines and providing "Guest" account access on public kiosks be a viable alternative? Any changes made to the file system

Re: [cas-user] 3.4.2 audit logging to a data source causing tomcat issues

2010-04-07 Thread Marvin Addison
> What version of Tomcat are you running? I'm running 6.0.20 at present, but have run a similar setup against 5.5.x and never seen this. M -- You are currently subscribed to cas-user@lists.jasig.org as: arch...@mail-archive.com To unsubscribe, change settings or access archives, see http://ww

Re: [cas-user] 3.4.2 audit logging to a data source causing tomcat issues

2010-04-07 Thread Patrick Berry
On Wed, Apr 7, 2010 at 7:22 AM, Marvin Addison wrote: > I'd agree with Scott's assessment that this appears to be a > classloader problem. What's really interesting is that we're doing > exactly the same thing, and have never seen this afaik. In > particular, we put the JDBC driver in $TOMCAT_HO

Re: [cas-user] Certificate with difference host problem!

2010-04-07 Thread Pablo Mosquera Saenz
If I have right understanding, can any one tell me how to change CN in certificate from "localhost" to "xxx.yyy.com"? If you want to change this, try to generate a new certificate with the new CN. There is a lot of documentation about how to generate certificates. Pablo Mosquera 2010/4/7 Marvin

Re: [cas-user] CAS with Active Directory

2010-04-07 Thread Marvin Addison
I'm not sure I'm clear on your use of the terms "high" and "low." I don't think this is a search scope problem since the default for BindLdapAuthenticationHandler is subtree scope. Maybe you could sketch out your AD schema and give some specific examples of what users can and cannot authenticate.

Re: [cas-user] SSL Error

2010-04-07 Thread Jeff Chapin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 In catalina.out2, the line the error starts on is immediately following the SQL error. The line starts with "2010-04-06 15:23:41,306" Jeff Scott Battaglia wrote: > I don't see any SSL errors in the catalina.out > > Did I miss it? > > > On Tue, Apr

Re: [cas-user] Certificate with difference host problem!

2010-04-07 Thread Marvin Addison
> javax.net.ssl.SSLHandshakeException: > sun.security.validator.ValidatorException: PKIX path building failed: > sun.security.provider.certpath.SunCertPathBuilderException: unable to find > valid certification path to requested target Please see http://www.ja-sig.org/wiki/display/CASUM/SSL+Troubl

Re: [cas-user] 3.4.2 audit logging to a data source causing tomcat issues

2010-04-07 Thread Marvin Addison
I'd agree with Scott's assessment that this appears to be a classloader problem. What's really interesting is that we're doing exactly the same thing, and have never seen this afaik. In particular, we put the JDBC driver in $TOMCAT_HOME/lib and the pooling library in the application, which would

Re: [cas-user] SSL Error

2010-04-07 Thread Marvin Addison
Found the needle in the haystack: chain [0] = [ [ Version: V3 Subject: CN=*.uni.edu, OU=Information Technology Services - Information Systems, O=University of Northern Iowa, L=Cedar Falls, ST=Iowa, C=US Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: SunPKCS11-Solaris RSA p

Re: [cas-user] Changing the location of log4j.properties

2010-04-07 Thread Marvin Addison
> INFO: Deploying web application archive cas.war > log4j:WARN No appenders could be found for logger > (org.apache.commons.digester.Digester.sax). > log4j:WARN Please initialize the log4j system properly. That doesn't have anything to do with finding the log4j config, per se. It could also happe

Re: [cas-user] Fail to pass non-English custom attribute

2010-04-07 Thread Marvin Addison
> My CAS and app encoding were both set to utf-8. I understand that this is > something related to encoding, but don't know how to solve it. I believe http://www.ja-sig.org/wiki/display/CASUM/Internationalization should help. M -- You are currently subscribed to cas-user@lists.jasig.org as: ar

[cas-user] cas-server-3.4.2 and nagios plugin / Login page displacement

2010-04-07 Thread Kapetanakis Giannis
Hi all, I've upgraded yesterday to cas-server-3.4.2. This broke the nagios plugin I've been using http://www.ja-sig.org/wiki/display/CASUM/Nagios+plugins I get an exception. If I remove the custom.css definitions in WEB-INF/view/jsp/default/ui/includes/top.jsp the plugin works but then the css

[cas-user] CAS with Active Directory

2010-04-07 Thread Steve Graziotto
Hello, I succeeded in setting up the authentification on Active Directory with CAS, it authenticates only the “high” users, i.e., that only the users with the “root” can authenticate themselves, (the user of test creates with the root works), but the others (low) are excluded. It would seem that it