nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco Community and CAS - SSO

frank_s

Hi,

over the last few weeks, I've tried to configure Alfresco Community with CAS, and have failed to do so. I have posted a number of questions regarding this on the forums, yet these have been left unanswered. I noticed that other forum members posted questions about the same topic, but a lot of these threads seem to have been abandoned.

This makes me wonder:
1. Has anybody been successful in setting up Alfresco CE using CAS authentication without using the Cignex war?
2. Is it possible to do so with the currently available distributable (Alfresco CE 2.9B), or am I trying to do the impossible?

Any feedback and/or personal experiences would be extremely welcome.

Thanks for your time,

Frank.

Find more posts tagged with

Comments

mdaslam

Hi Frank,
It should be possible. We have configured Liferay + alfresco + CAS. You have to add CAS Filter entries to the the web.xml of alfresco.war.

Thanks,
Aslam

shoshin

Hi Aslam,

It is good to hear that you have cracked the SSO part.
Could you please kindly share us the steps and entries to achieve the same.

Advance Thanks,
Shoshin

frank_s

Please do - I'd be very interested in learning the details, as I've tried to make the changes to Alfresco's web.xml as they are described in various posts in the forums / wiki / Jira, but I didn't get anywhere.

Thanks in advance,

Frank.

mdaslam

Hi Frank,
I wasn't involved in the integration of CAS with Alfresco as I joined the team later. But below are the configurations of CAS filter in web.xml of alfresco.war. Instead of localhost, change it to the respective URL and port of CAS. Also you need to add casclient-2.1.1.jar (WEB-INF\lib of cas-web.war) to the WEB-INF\lib folder of alfresco.war and cas-web.war should be deployed.

You can this, I know only this much of Integration part. Sorry about it.

<filter>

      <filter-name>CAS Filter</filter-name>
   <filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>

<init-param>
      <param-name>logout_url</param-name>
      <param-value>https://localhost:8443/cas-web/logout</param-value>
   </init-param>

   <init-param>
      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
      <param-value>https://localhost:8443/cas-web/login</param-value>
   </init-param>

<init-param>
        <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
        <param-value>https://localhost:8443/cas-web/serviceValidate</param-value>
    </init-param>

<init-param>
        <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
        <param-value>localhost:8080</param-value>
    </init-param>

</filter>

<filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
<filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>

Regards,
Aslam

frank_s

Hi Aslam,

many thanks for that, I'll give that a try!

f.

mdaslam

Hi,
There is also Cignex-war deployed in the lib of alfresco.war. It has
\com\cignex\cas
                     —\client
                    —-\proxy
                     —-\util
com\cignex\filters\sso\cas\CASFilter.class

and other like
\com\cignex\util
\com\cignex\web.

Regards,
Aslam

frank_s

Aslam, thanks again for your post.

After making the changes to the web.xml, Alfresco throws exceptions and displays an error message as described here: http://forums.alfresco.com/viewtopic.php?f=3&t=10626&p=35576 when returning a ticket from the CAS server. Although I'm not using NTLM, the behaviour I experience is identical to the one described in the link above.

Since can't use the Enterprise version of Alfresco and have no need for Liferay, the Cignex solution is unfortunately of no use to me.

I'd be very happy to be corrected by someone from Alfresco, but I've had to come to the conclusion that Alfresco CE 2.9 on its own is not able to do SSO via CAS.

mikewaters

Hi Frank

We have done it at Keem Bay Research and you are right - Alfesco does not work with CAS out of the box - it needs a bit of extra java code.

We have been using 2.1 CE and 2.9B appears to be the same. (ie I looked at the code in the SVN head and its not changed much)

There are several bits of code in the wikis, forums and Jira but none have made it into Alfresco. (Keem Bay Research are working on a contribution right now

The extra code is a filter that takes the username populated by the CAS filter and passes it to the Alfresco API. Your error is a symptom of that not happening.

More info in another post - http://forums.alfresco.com/viewtopic.php?f=7&t=12372#p41366 but this should really get into the wiki (and into 3.0!)

cheers

-Mike
Keem Bay Research
http://keembay.com

frank_s

Hi Mike,

thank you very much for this. Let's hope that it makes it into 3.0CE - I'm sure it would be of use to many people, if only because it would make the upgrade process easier. I just hope somebody from Alfresco reads this…

Thanks again,

f.

mikewaters

Hi again - I have created that wiki page with instructions to integrate Alfresco with CAS

http://wiki.alfresco.com/wiki/Central_Authentication_Service_Configuration

Let us know how you get on!

-Mike
Keem Bay Research
http://keembay.com

frank_s

Wow! You totally rock - that's an absolutely spectacular effort! Thank you so much - I'll give it a whirl first thing tomorrow.

Thanks again,

f.

frank_s

Mike,

thank you again for the sterling effort - I followed your instructions on the wiki and I'm now running a fully CASified Alfresco, thanks to you! Here's what I learned:

I didn't get any joy using cas-client-core-3.1.1.jar. When starting up Tomcat in step "Testing CAS Protection", Tomcat threw an exception ("ClassNotFound exception: edu.yale.its.tp.cas.client.filter.CASFilter").

The class structure is no longer 'edu.yale.its.tp.cas.client…', but 'org.jasig.cas.client…'
There doesn't seem to be a CASFilter.class in cas-client-core.3.1.1.jar.

There seems to be a typo in your web.xml snippet. In the filter-mapping, the url-pattern is

<url-pattern>/faces*</url-pattern>‍

but I believe it should be

<url-pattern>/faces/*</url-pattern>‍

A really weird thing happened when I tried to make the redirect work (step "Testing CAS Protection"). Alfresco displayed a "System error" screen every time when it returned from CAS, despite closing all browser windows religiously and restarting Tomcat. I only figured out after some time that this was due to me just using the

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<filter-mapping>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<filter-name>Authentication Filter</filter-name>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<url-pattern>/faces/*</url-pattern>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</filter-mapping>
‍‍‍‍‍‍

and changing Authentication to CAS in the filter-name.The last point is probably not worth mentioning on the wiki page - I just included it so that plonkers like myself :? can find it here and know that Bad Things will happen if they do this, because there's really no clue (at least none that would be obvious to me) in the error messages what causes them…

For reference, here's the setup I'm using: JA-SIG CAS Server 3.2 is authenticating against ApacheDS 1.0.2, both are running on the same Windows XP box.
Alfresco 2.1 CE (using JA-SIG CAS Client 2.0.11) is running on a separate machine (Windows Server 2003 under VMWare); I'm using Java SDK 1.6.0-05 on both machines.

The only things that remain for me to do is to set up LDAP synch to the Alfresco user accounts (a whole new world of pain all on its own, by the sound of it…), and CASifying the PHP application that I'm also using (I'm almost looking forward to that one, 'cos it'll be the first time for a long time that I'm going to be in a situation where I know what I'm doing…

).

Again, I can't thank you enough - I'd already given up on getting this to work…

All the best,

Frank.

mikewaters

Hi Frank

Congratulations! and thanks for the feedback - and sorry for the typos.

About the client jar file I double checked my cas-client jar version, the one I used was in fact casclient-2.1.1.jar

It actually comes with the server release, inside the war file. (ie in cas-server-3.2.1-release.tar.gz at path cas-server-3.2.1/modules/cas-server-webapp-3.2.1.war. The path inside the war is WEB-INF/lib) so there is no need for the cas-client release at least for what we are doing.

I'll update the wiki

cheers

-Mike

mmontecchi

Hi,
thanks all for the very usefull info to integrate CAS and Alfresco.
I have only a more question: what's about the CAS/ALfresco logout ? Someone was able to configure?

Thanks
Massimo Montecchi
EC Company