guacamole-auth-cas-0.9.13 Session not handled correctly after login

[santino83 <gs...@voiptech.it>]

Hello,

I need to use CAS for authentication, so I've used the new auth-cas
extension. It works, meaning, authentication against CAS is done
successfully and user got authenticated. However, web interface breaks, I
mean that some functionalities don't work. One step back:

Configuration:

guacamaole-client 0.9.13 + auth-jdbc-postgresql extension + auth-cas
extension

I need jdbc to manage connections via graphic interface and other stuff.
Well, following the manual I got the following scenario:

- user go to guacamole webpages
- auth-cas redirect user to Cas login page
- user does login using cas, cas redirect to guacamole endpoint
- guacamole validates user tickets against cas
- user is logged in in cas

after that, jdbc module looks in the database for a user matching the cas
user, searchs for availabel connections, and so on. All works, or seems so.
After login, if you try to open "Settings" menu (user personal setting),
nothing happen ( a gear loading 4ever): looking at the console, I could
read:

/api/session/data/cas/self/USER_ID_LOGGED?token=.... with status 404,
response: "no session associated with authentication provider cas". And so
on for other apis, like session/data/cas/users, session/ext/cas... etc

I don't know why it happens, I think that auth-cas ext is missing of
something useful, like UserContext or something like this, but I didn't
understand well how authentication and security framework work, so I wasn't
able to find a solution to my problem.

The only way I found as workaround was editing
CASAuthenticationProvider.java and changed the provider identifier from
"cas" to "postgresql". Everything now seems to work, but it is just an
horrible workaround

If someone could tell me how I could make a better solution, I'll be happy

Thanks




--
View this message in context: http://apache-guacamole-incubating-users.2363388.n4.nabble.com/guacamole-auth-cas-0-9-13-Session-not-handled-correctly-after-login-tp1060.html
Sent from the Apache Guacamole (incubating) - Users mailing list archive at Nabble.com.

Re: guacamole-auth-cas-0.9.13 Session not handled correctly after login

[Mike Jumper <mi...@guac-dev.org>]

On Tue, Jun 6, 2017 at 10:31 AM, santino83 <gs...@voiptech.it> wrote:
> Hello,
>
> I need to use CAS for authentication, so I've used the new auth-cas
> extension. It works, meaning, authentication against CAS is done
> successfully and user got authenticated. However, web interface breaks
> ...

Do you seen any errors in your Tomcat logs?

>
> /api/session/data/cas/self/USER_ID_LOGGED?token=.... with status 404,
> response: "no session associated with authentication provider cas". And so
> on for other apis, like session/data/cas/users, session/ext/cas... etc
>

This is to be expected, and is not a bug. Guacamole's REST service
will return HTTP 404 under normal circumstances to indicate that a
particular resource is not available. If the CAS extension doesn't
provide those resources, then 404 is the expected response, and the
interface should adjust itself accordingly.

If you see anything 500 or above, however - that would be a problem.

> The only way I found as workaround was editing
> CASAuthenticationProvider.java and changed the provider identifier from
> "cas" to "postgresql". Everything now seems to work, but it is just an
> horrible workaround

Please do not do this. Even if things seem to work, I can't imagine
the sort of horrible things must be happening inside the web
application when this is in place. It's important that these
identifiers are unique.

- Mike