You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@shiro.apache.org by jleleu <le...@gmail.com> on 2013/10/14 15:59:43 UTC

Re: Cant Integrate Shiro with CAS

Hi,

I don't understand why you use the *authc* filter (you don't have any form
in your application right ?).
The login page is on the CAS server.
I'm pretty sure that it's the root cause of your problem : generating a
UsernamePasswordToken whereas the CasRealm expects a CasToken.

To use properly the CAS server, it should retrieve the attributes of the
authenticated user, not your application and push them to your app during
the service ticket validation.

Best regards,
Jérôme




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579235.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Cant Integrate Shiro with CAS

Posted by jleleu <le...@gmail.com>.

Hi,

I must admit I'm often asked for support. Would you mind refreshing my
memories about the problem?
Better to do it directly on the Shiro mailing list.
Best,
Jérôme



2014-01-27 skybird [via Shiro User] <
ml-node+s582556n7579568h76@n2.nabble.com>

> Was this problem solved/fixed? I also have an application with a custom
> login page. Please post the solution/fix if available.
>
> ------------------------------
>  If you reply to this email, your message will be added to the discussion
> below:
>
> http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579568.html
>  To start a new topic under Shiro User, email
> ml-node+s582556n582556h4@n2.nabble.com
> To unsubscribe from Shiro User, click here<http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=582556&code=bGVsZXVqQGdtYWlsLmNvbXw1ODI1NTZ8LTExNzY2MzcxMTY=>
> .
> NAML<http://shiro-user.582556.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579570.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Cant Integrate Shiro with CAS

Posted by jleleu <le...@gmail.com>.

Hi,

Eduardo is completely right: the login form is part of the CAS server.
Though, you can brand it in your way using Spring themes:
https://wiki.jasig.org/display/CASUM/Theme+Control.
Best regards,
Jérôme




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579581.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Cant Integrate Shiro with CAS

Posted by "Eduardo J. Ortega U" <ed...@zurich.co>.

Hi:

I had a similar situation before. Bottom line, this is not a Shiro 
question but a CAS question. And while it can be done, it is not very 
good or clean to achieve. CAS is designed to work with its own form, so 
you'll have to hack it around to get it to work non-interactively by 
automating the under the hood interaction between it and your app. See 
https://wiki.jasig.org/display/CAS/Using+CAS+without+the+CAS+login+screen

--
Eduardo J. Ortega
Tel: 57+1+2553580
Cel: 57+317+4415156
Zürich
CL 72 5 83 Piso 11, Bogotá, CO.

On 27/01/14 07:19, skybird wrote:
> A bit more in detail... if it helps
> I have a shiro web application that has its own login page
> (http://app-server:8080/myapp/login.jsp). I would like to enter the
> credentials on my login page, under the hood it should authenticate against
> CAS and redirect me to my secured page. This thread has pretty much
> described most of the shiro.ini config that I need, except that it is
> missing a few things, heres my config, I used the github project mentioned
> above and highlighted the line I added.
>
> ----------------- START CONFIG ------------------
> [main]
> casFilter = org.apache.shiro.cas.CasFilter
> casFilter.failureUrl = /error.jsp
>
> casRealm = org.apache.shiro.cas.CasRealm
> casRealm.defaultRoles = ROLE_USER
> casRealm.casServerUrlPrefix = http://cas-server/           (no port or /cas,
> login is available at http://cas-server/login and it works fine)
> casRealm.casService = http://app-server:8080/myapp
> #casRealm.validationProtocol = SAML
>
> casSubjectFactory = org.apache.shiro.cas.CasSubjectFactory
> securityManager.subjectFactory = $casSubjectFactory
>
> user.loginUrl =
> http://cas-server/login?service=http://app-server:8080/myapp/home.jsp
> shiro.loginUrl = /login.jsp               (i added this)
> authc.successUrl = /home.jsp        (i added this)
>
> [urls]
> /myapp = casFilter
> /login.jsp = authc
> /logout = logout
>
>
> ----------------- END CONFIG ------------------
>
> Also what would my login form look like? An examples?
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579574.html
> Sent from the Shiro User mailing list archive at Nabble.com.

Re: Cant Integrate Shiro with CAS

Posted by skybird <sn...@gmail.com>.

A bit more in detail... if it helps
I have a shiro web application that has its own login page
(http://app-server:8080/myapp/login.jsp). I would like to enter the
credentials on my login page, under the hood it should authenticate against
CAS and redirect me to my secured page. This thread has pretty much
described most of the shiro.ini config that I need, except that it is
missing a few things, heres my config, I used the github project mentioned
above and highlighted the line I added.

----------------- START CONFIG ------------------
[main]
casFilter = org.apache.shiro.cas.CasFilter
casFilter.failureUrl = /error.jsp

casRealm = org.apache.shiro.cas.CasRealm
casRealm.defaultRoles = ROLE_USER
casRealm.casServerUrlPrefix = http://cas-server/           (no port or /cas,
login is available at http://cas-server/login and it works fine)
casRealm.casService = http://app-server:8080/myapp
#casRealm.validationProtocol = SAML

casSubjectFactory = org.apache.shiro.cas.CasSubjectFactory
securityManager.subjectFactory = $casSubjectFactory

user.loginUrl =
http://cas-server/login?service=http://app-server:8080/myapp/home.jsp
shiro.loginUrl = /login.jsp               (i added this)
authc.successUrl = /home.jsp        (i added this)

[urls]
/myapp = casFilter
/login.jsp = authc
/logout = logout


----------------- END CONFIG ------------------

Also what would my login form look like? An examples?



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Cant-Integrate-Shiro-with-CAS-tp7579234p7579574.html
Sent from the Shiro User mailing list archive at Nabble.com.