Share with mod_auth_cas not working

I have exactly the same problem.

Logging into CAS with the alfresco-share certificate as described in the wiki works. Also does the snoop.jsp example.

Furthermore WebDAV, which is not protected by CAS, doesn't work anymore. Do I need to put LDAP authentication back in alfresco-global.properties?

dward, can you help us here?

TIA,
Matthias.

I'm not even able to get Alfresco working with approach. What's happening is if I turn on the external authentication subsystem I can't even log in directly to the Alfrecso tomcat using admin/admin. If I comment out the authentication.chain, I can log in.
CAS logs in fine, but get to it from /alfresco I get redirected back to /alfresco/faces/…, as guest. At best I get the login screen on the /alfresco side.
There must be some configuration that I've got wrong, but I can't figure out what it is. This is using a fresh Alfresco 3.2r install. My logs don't show anything wrong - the state transitions in my CAS-server logs pretty much mimic what's in the login-webflow.xml. And my alfresco log pretty much has nothing in it past startup. Which I guess is not surprising since I don't have any debug entries for any authentication.

I finally sort-of got /alfresco working by adding the httpRequestAuthFilter per http://forums.alfresco.com/en/viewtopic.php?f=9&t=21080&p=70120&hilit=cas+share&sid=721b39e0903cf2a03f71ffb6e5df32e6#p70120. But now when CAS redirects me back to alfresco, I get "java.lang.StackOverflowError", with the following:

java.lang.StackOverflowError

Hide Details

java.lang.StackOverflowError
at java.util.concurrent.ConcurrentHashMap$Segment.get(ConcurrentHashMap.java:338)
at java.util.concurrent.ConcurrentHashMap.get(ConcurrentHashMap.java:769)
at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedBeanDefinition(AbstractBeanFactory.java:948)
at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedBeanDefinition(AbstractBeanFactory.java:928)
at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedBeanDefinition(AbstractBeanFactory.java:914)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:205)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:227)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:160)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:757)
at org.alfresco.repo.security.authentication.subsystems.SubsystemChainingAuthenticationComponent.getUsableAuthenticationComponents(SubsystemChainingAuthenticationComponent.java:84)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Also, when I go to localhost:8080/alfresco, and try to login with admin/admin I get:

"You have no access to Alfresco."‍

Hi. Sorry for my late arrival to this discussion.

jmwarfe: it looks like share is receiving an HTML response from the server, rather than the JSON response it is expecting. That would suggest that it is seeing a login page rather than the authenticated response. So it's probably that share isn't configured correctly to send the certificate.

Could you paste in the contents of

$CATALINA_HOME/shared/classes/alfresco/web-extension/webscript-framework-config-custom.xml

make sure it has exactly the path above.

?

Regarding the other questions, yes Web DAV authentication will require Alfresco's LDAP authentication subsystem to be included in your chain.

Rebuilding the Alfresco 3.2r source seems to have fixed a lot of stuff, at least making /alfresco work. I now have exactly the same condition as jmwarfe on /share:

javax.servlet.ServletException: org.alfresco.web.site.exception.RequestContextException: Exception running UserFactory in HttpRequestContextFactory
   org.alfresco.web.site.servlet.DispatcherServlet.service(DispatcherServlet.java:146)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

root cause

org.alfresco.web.site.exception.RequestContextException: Exception running UserFactory in HttpRequestContextFactory
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:117)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:202)
   org.alfresco.web.site.servlet.DispatcherServlet.service(DispatcherServlet.java:142)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

root cause

org.alfresco.web.site.exception.UserFactoryException: Unable to retrieve user from repository
   org.alfresco.web.site.AlfrescoUserFactory.loadUser(AlfrescoUserFactory.java:254)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:176)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:110)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:93)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:202)
   org.alfresco.web.site.servlet.DispatcherServlet.service(DispatcherServlet.java:142)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

root cause

org.json.JSONException: A JSONObject text must begin with '{' at character 9 of 







<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
   <head>
       <title>CAS &#8211; Central Authentication Service</title>
       <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
       <style type="text/css" media="screen">@import 'css/cas.css'/**/;</style>
       <!–[if gte IE 6]><style type="text/css" media="screen">@import 'css/ie_cas.css';</style><![endif]–>
       <script type="text/javascript" src="js/common_rosters.js"></script>
       <link rel="icon" href="/cas/favicon.ico" type="image/x-icon" />
   </head>

   <body id="cas" onload="init();">
       <div id="header">
           <h1 id="app-name">Central Authentication Service (CAS)</h1>
       </div>

       <div id="content">

         <form id="fm1" class="fm-v clearfix" action="/cas/login;jsessionid=DDDD7EDD6EC9AB9DA3DC58BACD6B0331?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin" method="post">
             
                <div class="box" id="login">
                <!– Congratulations on bringing CAS online!  The default authentication handler authenticates where usernames equal passwords: go ahead, try it out.  –>
                    <h2>Enter your NetID and Password</h2>
                    <div class="row">
                        <label for="username"><span class="accesskey">N</span>etID:</label>
                  
                  
                  
                  
                  <input id="username" name="username" class="required" tabindex="1" accesskey="n" type="text" value="" size="25" autocomplete="false"/>
                  
                    </div>
                    <div class="row">
                        <label for="password"><span class="accesskey">P</span>assword:</label>
                  
                  
                  <input id="password" name="password" class="required" tabindex="2" accesskey="p" type="password" value="" size="25" autocomplete="off"/>
                    </div>
                    <div class="row check">
                        <input id="warn" name="warn" value="true" tabindex="3" accesskey="w" type="checkbox" />
                        <label for="warn"><span class="accesskey">W</span>arn me before logging me into other sites.</label>
                    </div>
                    <div class="row btn-row">
                  <input type="hidden" name="lt" value="_cF5CF7323-9883-82D6-C026-FE85F627D357_kCD941794-A5E2-366C-0808-3AC0BADC4BB1" />
                  <input type="hidden" name="_eventId" value="submit" />

                        <input class="btn-submit" name="submit" accesskey="l" value="LOGIN" tabindex="4" type="submit" />
                        <input class="btn-reset" name="reset" accesskey="c" value="CLEAR" tabindex="5" type="reset" />
                    </div>
                </div>
               
               <div id="sidebar">
                   <p>For security reasons, please Log Out and Exit your web browser when you are done accessing services that require authentication!</p>
                   <div id="list-languages">
                   
                  
                  
                       <h3>Languages:</h3>
                  <ul
                     ><li class="first"><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=en">English</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=es">Spanish</a></li            
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=fr">French</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=ru">Russian</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=nl">Nederlands</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=sv">Svenskt</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=it">Italiano</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=ur">Urdu</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=zh_CN">Chinese (Simplified)</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=de">Deutsch</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=ja">Japanese</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=hr">Croatian</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=cs">Czech</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=sl">Slovenian</a></li
                     ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=pl">Polish</a></li
                            ><li><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=pt_BR">Portuguese (Brazil)</a></li
                     ><li class="last"><a href="login?service=http%3a%2f%2fsundar-desktop%2falfresco%2fwcs%2fwebframework%2fcontent%2fmetadata%3fuser%3dadmin&locale=tr">Turkish</a></li
                  ></ul>
                   </div>
               </div>
           </form>
      </div>
       <div id="footer">
           <div>
               <p>Copyright &copy; 2005-2007 JA-SIG. All rights reserved.</p>
               <p>Powered by <a href="http://www.ja-sig.org/products/cas/">JA-SIG Central Authentication Service 3.3.4</a></p>
           </div>
           <a href="http://www.ja-sig.org" title="go to JA-SIG home page"><img id="logo" src="images/ja-sig-logo.gif" width="118" height="31" alt="JA-SIG" title="go to JA-SIG home page" /></a>
       </div>
   </body>
</html>


   org.json.JSONTokener.syntaxError(Unknown Source)
   org.json.JSONObject.<init>(Unknown Source)
   org.json.JSONObject.<init>(Unknown Source)
   org.alfresco.web.site.AlfrescoUserFactory.loadUser(AlfrescoUserFactory.java:166)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:176)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:110)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:93)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:202)
   org.alfresco.web.site.servlet.DispatcherServlet.service(DispatcherServlet.java:142)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

My webscript-framework-config-custom.xml is:

  <config evaluator="string-compare" condition="Remote">
    <remote>
      <!– SSL client certificate + trusted CAs. Optionally used to authenticate share to an external SSO system such as CAS –>
      <keystore>
        <path>alfresco/web-extension/alfresco-system.p12</path>
        <type>pkcs12</type>
        <password>password</password>
      </keystore>
       
      <connector>
        <id>alfrescoCookie</id>
        <name>Alfresco Connector</name>
        <description>Connects to an Alfresco instance using cookie-based authentication</description>
        <class>org.alfresco.connector.AlfrescoConnector</class>
      </connector>

      <endpoint>
        <id>alfresco</id>
        <name>Alfresco - user access</name>
        <description>Access to Alfresco Repository WebScripts that require user authentication</description>
        <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://myhost/alfresco/wcs</endpoint-url>
        <identity>user</identity>
        <external-auth>true</external-auth>
      </endpoint>
            
    </remote>
  </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Hi dward, The CASServer has this in its log:

2009-11-02 18:19:01,300 DEBUG [org.jasig.cas.web.support.CasArgumentExtractor] - <Extractor generated service for: http://sundar-desktop/alfresco/wcs/webframework/content/metadata?user=admin>
2009-11-02 18:19:01,300 DEBUG [org.jasig.cas.web.flow.InitialFlowSetupAction] - <Placing service in FlowScope: http://sundar-desktop/alfresco/wcs/webframework/content/metadata?user=admin>
2009-11-02 18:19:01,300 DEBUG [org.jasig.cas.web.flow.InitialFlowSetupAction] - <Action 'InitialFlowSetupAction' completed execution; result is 'success'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Action 'X509CertificateCredentialsNonInteractiveAction' beginning execution>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Certificates not found in request.>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Action 'X509CertificateCredentialsNonInteractiveAction' completed execution; result is 'error'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Action 'AuthenticationViaFormAction' beginning execution>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Executing setupForm>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Creating new form object with name 'credentials'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Creating new instance of form object class [class org.jasig.cas.authentication.principal.UsernamePasswordCredentials]>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Putting form object of type [class org.jasig.cas.authentication.principal.UsernamePasswordCredentials] in scope Flow with name 'credentials'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Creating new form errors for object with name 'credentials'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <No property editor registrar set, no custom editors to register>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Putting form errors instance in scope Flash>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Action 'AuthenticationViaFormAction' completed execution; result is 'success'>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Action 'AuthenticationViaFormAction' beginning execution>
2009-11-02 18:19:01,301 DEBUG [org.jasig.cas.web.flow.AuthenticationViaFormAction] - <Action 'AuthenticationViaFormAction' completed execution; result is 'success'>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Does the "[org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Certificates not found in request.>" indicate that there's a problem in certificates being handled properly? Or is this safe to ignore?

Ok, what I have now:

- Share is authenticating properly with the certificate. I got these lines in cas.log:

2009-11-02 20:57:34,769 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - certificate was issued by t
rusted issuer
2009-11-02 20:57:34,769 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - this is an end-user certifi
cate
2009-11-02 20:57:34,769 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - Pattern Match: true [EMAILA
DDRESS=noc@company.de, CN=alfresco-system, OU=Network Operations, O=company UG, ST=somestate, C=DE] against [.*].
2009-11-02 20:57:34,770 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - cert[2] ok, setting as cred
entials candidate
2009-11-02 20:57:34,770 INFO [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - authentication OK; SSL clien
t authentication data meets criteria for cert[2]
2009-11-02 20:57:34,770 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - AuthenticationHandler: org.jasig.cas.adaptors.x509.authentication.han
dler.support.X509CredentialsAuthenticationHandler successfully authenticated the user which provided the following credentials: org.jasig.cas.adaptors.x509.a
uthentication.principal.X509CertificateCredentials@454a8c
2009-11-02 20:57:34,770 INFO [org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentialsToIdentifierPrincipalResolver] - Creating princi
pal for: EMAILADDRESS=noc@company.de, CN=alfresco-system, OU=Network Operations, O=company, ST=somestate, C=DE
2009-11-02 20:57:34,840 INFO [org.jasig.cas.CentralAuthenticationServiceImpl] - Granted service ticket [ST-1-fljp791QoR4132GIrhfC-app01.company.de] for serv
ice [https://app01.company.de/alfresco/wcs/webframework/content/metadata?user=matthias.name%40company.de] for user [alfresco-system]

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

…but I still received the same error as jmwarfe when I try to access Share. Is it a problem with the '@' sign in my username? We use multitenancy, so the sign is mandatory.

- WebDAV is working again, thanks.

Matthias

Matthias, I wonder how you got your Share to send out the certificate. It seems (based on my logs) that I'm actually failing the X509CredentialsAuthenticationHandler in login-webflow and going on to the viewLoginForm action. But can't understand why. Do you have any suggestions? Did you have this problem before and solve the certificate handling somehow? Thanks much for any help.

Matthias. It may well be that multi tenancy is stopping the feature from working. Although I still don't know why, if share is sending the certificate, it still claims to be getting HTML back from the user metadata call.

All I can suggest is that we instrument share's client with further debug logging so we can work out what sequence of redirects are happening.

Do you feel up to adding some additional logging to

org.alfresco.connector.RemoteClient.service(URL, InputStream, OutputStream, HttpServletRequest, HttpServletResponse, ResponseStatus)

?

If we could see what URLs are being called, what redirects are happening, what cookies are being returned and what status codes are being received, we might be able to work out what's going wrong!

Matthias, I wonder how you got your Share to send out the certificate. It seems (based on my logs) that I'm actually failing the X509CredentialsAuthenticationHandler in login-webflow and going on to the viewLoginForm action. But can't understand why. Do you have any suggestions? Did you have this problem before and solve the certificate handling somehow? Thanks much for any help.

cybertoast: I configured everything as described in http://wiki.alfresco.com/wiki/Alfresco_With_mod_auth_cas (without Maven).

Except one thing: I added the following to /etc/apache2/httpd.conf:

SSLVerifyClient optional
SSLCACertificateFile /etc/ssl/certs/cacert.pem
SSLOptions +StdEnvVars +ExportCertData

This was the only way to make it work. Otherwise Apache seems not to send the incoming certificate properly.
I got the same error as you before I made these changes, so maybe that solves your problem.

Try at first if you can login to the snoop.jsp example (bottom of wiki article) via the certificate. If this works, you're on a good way.

Matthias.

Do you feel up to adding some additional logging to

org.alfresco.connector.RemoteClient.service(URL, InputStream, OutputStream, HttpServletRequest, HttpServletResponse, ResponseStatus)

?

If we could see what URLs are being called, what redirects are happening, what cookies are being returned and what status codes are being received, we might be able to work out what's going wrong!

Ok, I tried to set the logging but I only get results if I use org.alfresco.connector.RemoteClient=debug - going further like

org.alfresco.connector.RemoteClient.service gives no result. Am I doing something wrong?

The result with RemoteClient=debug

16:25:37,223 DEBUG [org.alfresco.connector.RemoteClient] Executing (GET) https://app01.company.de/alfresco/wcs/webframework/content/metadata?user=matthias.name%40company.de
16:25:37,225 DEBUG [org.alfresco.connector.RemoteClient]  - OutputStream supplied - will stream response…
16:25:37,305 DEBUG [org.alfresco.connector.RemoteClient] Setting cookie header: MOD_AUTH_CAS_S=b5d6a2524928d27bd5ade0bed30742e6;CASTGC=TGT-25-7CNalUs5KSroXN3zXgWPcN0DchY0CSttWwqx3Wk4uniP05ZVsE-app01.company.de
16:25:37,502 DEBUG [org.alfresco.connector.RemoteClient] Response status code: 401
16:25:37,502 DEBUG [org.alfresco.connector.RemoteClient] Response encoding: Content-Type: text/html; charset=iso-8859-1‍‍‍‍‍

That's it. Not very helpful. 😕

Matthias, Thanks very much for your response. I've actually tried that, but still have no success on the client authentication part.
This is what I had to do to just get things sort of working:

1. Apache default-ssl file (I'm using Ubuntu, so this may just be the httpd.conf file's :443 virtualhost on other systems):

SSLCertificateFile /etc/ssl/certs/localhost.crt
SSLCertificateKeyFile /etc/ssl/private/localhost.pem
‍‍‍‍

In mod-enabled/ssl.conf, I added the JkMount /cas .. stuff, but also had to add JkMountCopy On:

JkMountCopy On
JkMount /cas casnode
JkMount /cas/* casnode
JkMount /examples casnode
JkMount /examples/* casnode
SSLVerifyClient optional
SSLCACertificateFile /etc/ssl/certs/cacert.pem
SSLOptions +StdEnvVars + ExportCertData
‍‍‍‍‍‍‍‍‍‍

2. In my tomcat/conf/server.xml I had to add the keystore (otherwise casserver fails to start up, with errors about jsse.invalid_ssl_conf):

&nbsp;&nbsp; <Connector port="8444" protocol="HTTP/1.1" SSLEnabled="true"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; maxHttpHeaderSize="8192" minSpareThreads="25" maxSpareThreads="75"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; maxThreads="150" scheme="https" secure="true"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sslProtocol="TLS" connectionTimeout="20000"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; clientauth="true" 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; keystoreFile="/etc/ssl/alfresco-system.p12"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; keystoreType="PKCS12" keystorePass="password"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; truststoreFile="/etc/ssl/alfresco-system.p12" 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; truststorePass="password" truststoreType="PKCS12"
&nbsp;&nbsp; />
‍‍‍‍‍‍‍‍‍‍‍‍

When I try to connect to the tomcat server directly (http://myhost:8444/cas/login) I get a "SSL peer cannot verify your certificate. (Error code: ssl_error_bad_cert_alert)" from firefox. This is because I've set clientauth="true". If I set clientauth="want", then I get the CAS login form.

So basically I'm unable to get the client authentication using the pkcs12 alfresco-system.p12 keystore.

I thought maybe this was because the alfesco-system cert has a CN of alfresco-system, and so changed this to my DNS. But did not make any difference.

I also tried to import the /etc/ssl/certs/cacert.pem into my keystore using keytool:

keytool –import -alias alfresco-system -keystore /etc/ssl/keystore -file /etc/ssl/certs/cacert.pem
‍‍‍

But this caused jsse.invalid_ssl_conf and "no available certifice or key corresponds to the ssl cipher suites which are enabled" during startup of casserver.

I'm sure there's something relatively simple that I'm missing, but just can't figure out what. The fact that I've been staring at this for several days is probably not helping either

Thanks for your help, anyway!

mathias

That at least tells us that it's getting a status 401 response from alfresco, even for an authenticated request with a CAS cookie in place.

We believe this may mean that the external authentication subsystem has become broken, ironically due to recent changes made to support multi tennancy.

I have logged

https://issues.alfresco.com/jira/browse/ETHREEOH-3265

cybertoast. You are deviating away from the supported instructions and I can't help you. You shouldn't be using the keystore at all with tomcat - this should be configured in apache and you should switch tomcat authentication off as it says in the instructions. I also hope you started with a virgin tomcat zip as the installation requires and not some Ubuntu packaged version. And we don't need JkMountCopy On.

dward, thanks for the response. My tomcat is the zip file from apache (apache-tomcat-6.0.20.tar.gz), not the ubuntu packaged one.
When using the standard server.xml (without keystore definitions), but with tomcatAuthentication="false", I get:

SEVERE: Failed to load keystore type JKS with path /root/.keystore due to /root/.keystore (No such file or directory)java.io.FileNotFoundException: /root/.keystore (No such file or directory)
&nbsp; at java.io.FileInputStream.open(Native Method)
&nbsp; at java.io.FileInputStream.<init>(FileInputStream.java:106)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:341)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:263)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:473)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:413)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:129)
&nbsp; at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:503)
&nbsp; at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:526)
&nbsp; at org.apache.coyote.http11.Http11Protocol.start(Http11Protocol.java:203)
&nbsp; at org.apache.catalina.connector.Connector.start(Connector.java:1131)
&nbsp; at org.apache.catalina.core.StandardService.start(StandardService.java:531)
&nbsp; at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
&nbsp; at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
&nbsp; at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
&nbsp; at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
&nbsp; at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
&nbsp; at java.lang.reflect.Method.invoke(Method.java:597)
&nbsp; at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
&nbsp; at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Nov 4, 2009 12:28:14 PM org.apache.coyote.http11.Http11Protocol start
SEVERE: Error starting endpoint
java.io.FileNotFoundException: /root/.keystore (No such file or directory)
&nbsp; at java.io.FileInputStream.open(Native Method)
&nbsp; at java.io.FileInputStream.<init>(FileInputStream.java:106)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:341)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:263)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:473)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:413)
&nbsp; at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:129)
&nbsp; at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:503)
&nbsp; at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:526)
&nbsp; at org.apache.coyote.http11.Http11Protocol.start(Http11Protocol.java:203)
&nbsp; at org.apache.catalina.connector.Connector.start(Connector.java:1131)
&nbsp; at org.apache.catalina.core.StandardService.start(StandardService.java:531)
&nbsp; at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
&nbsp; at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
&nbsp; at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
&nbsp; at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
&nbsp; at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
&nbsp; at java.lang.reflect.Method.invoke(Method.java:597)
&nbsp; at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
&nbsp; at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This is the ONLY reason I deviated from the wiki - I could not figure out any other way to make this work (and basically followed the tomcat instructions on the CAS site, the one where you explicitly say "don't worry about tomcat configuration steps").

Anyway, I don't have a keystore file by default (the /root/.keystore), so how to proceed?

Again, thanks. I'm completely flummoxed and have had no luck getting this to work, so any help is hugely appreciated!

****, I'm an ****! Sorry, I had uncommented the SSL portion of the original tomcat server.xml file. SO SO SORRY! Ok, I'm trying it all out from scratch again and let's see if it's all just because of my stupidity!

Ok, starting from scratch, this is what happens:

1. If I try to navigate to http://myhost/cas/login, I get login screen. https://myhost/cas/login gives me

Not Found
the requested URL /cas/login was not found on this server
‍‍‍‍

The only way to get this to work is to add JkMountCopy On in my default-ssl virtualhost. Adding this to my ssl.conf also does not work.
I had to change the SSLCACertificatePath /etc/ssl/certs/ to SSLCACertificateFile /etc/ssl/certs/cacert.pem (like matthias suggested as well), since otherwise Firefox and Safari both just hang on "loading…" connecting to the URL.

I set the SSLCertificateFile to /etc/ssl/certs/localhost.crt and SSLCertificateKeyFile to /etc/ssl/private/localhost.key. These are the cert/key generated in Step 3 of the wiki instructions.

2. I have steps 2, 3 and 4 completed, and have Apache, CASServer and all certificates in place. mod-jk redirects my requests to /cas/login. Trying the snoop.jsp example redirects me to /cas/login and my ldap auth works.

3. Trying out client authentication by importing the alfresco-system.p12 keystore into Firefox, cleaning out cookies and going back to http://myhost/examples/jsp/snp/snoop.jsp takes me to https://myhost/cas/login?service=…
So importing the alfresco-system.p12 keystore into Firefox does not seem to have any effect

Any ideas?

Hmm, seems you should get CAS-Server working at first.

- You don't need JkMountCopy at all. (btw: I'm using Ubuntu as well)
- Use "JkMount /cas* worker1" in your SSL VHost.
- Create /etc/apache/workers.properties with the following:

worker.list=worker1
worker.default.port=8009
worker.default.host=localhost
worker.default.type=ajp13
worker.default.lbfactor=1‍‍‍‍‍

Put the following in /etc/apache/httpd.conf

JkWorkersFile /etc/apache2/workers.properties

# Where to put jk logs
JkLogFile /var/log/apache2/mod_jk.log

# Set the jk log level [debug/error/info]
JkLogLevel info

# Select the log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

# JkOptions indicate to send SSL KEY SIZE,
JkOptions +ForwardKeySize -ForwardDirectories

# JkRequestLogFormat set the request format
JkRequestLogFormat "%w %V %T"

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

That is enough to make Apache work with CAS.

After that you can protect some dirs with mod_auth_cas.
Try that with the /examples directory of Tomcat. Check, if you can see your username there.

dward,
* Removed all JkMountCopy On
* Removed my JkMount /cas* casnode from /etc/apache2/mods-enabled/ssl.conf and moved JkMount /cas* casnode to /etc/apache2/sites-enabled/default-ssl
* Left JkMount /examples* casnode in /etc/apache2/mods-enabled/ssl.conf
* Added your suggestions to httpd.conf (basically it was an empty file, and now it only has the stuff you suggested)
* Removed JkWorkersFile and JkLogFile from /etc/apache2/mods-enabled/jk.conf (since they're now in httpd.conf)

My /etc/apache2/workers.properties file:

worker.list=ajp12, ajp13, casnode, alfnode  # I know I only need casnode and alfnode
worker.casnode.port=8009
worker.casnode.host=myhost
worker.casnode.type=ajp13
worker.casnode.lbfactor=1
worker.alfnode.port=8010
worker.alfnode.host=myhost
worker.alfnode.type=ajp13
worker.inprocess.type=jni
worker.inprocess.class_path=$(workers.tomcat_home)$(ps)lib$(ps)tomcat.jar
worker.inprocess.cmd_line=start
worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)jvm.dll
worker.inprocess.stdout=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stdout
worker.inprocess.stderr=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stderr
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This makes CAS work with apache. I believe the addition of the JkMount /cas* casnode into the default.ssl file is what made the difference. (Maybe because sites-enabled is what's included last in apache2.conf?).

* Ensured that there is nothing in Your Certificates in Firefox's Certificate Manager.
* Go to http://myhost/examples/jsp/snp/snoop.jsp -> Get CAS login form
* Clear all cookies, import alfresco-system.p12 into Firefox's Your Certificates, and I get the CAS login form, same as before. And in my CAS log is:

2009-11-04 18:06:19,472 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Certificates not found in request.>
‍‍‍

Thanks VERY VERY much for helping with this!

* Ensured that there is nothing in Your Certificates in Firefox's Certificate Manager.
* Go to http://myhost/examples/jsp/snp/snoop.jsp -> Get CAS login form
* Clear all cookies, import alfresco-system.p12 into Firefox's Your Certificates, and I get the CAS login form, same as before. And in my CAS log is:
2009-11-04 18:06:19,472 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Certificates not found in request.>
‍‍‍
Thanks VERY VERY much for helping with this!

cybertoast, what you didn't tell me:
- Can you login via CAS to snoop.jsp (without certificate, only with username+pass!)?
- If yes, do you see your username there?

Do this first. After that, we can check the certificate stuff.

matthias, yes, I've always been able to log in with CAS and see my Remote User as the user I signed in with. Sorry, I guess I was unclear about that. I've had this working with both simpleTestUsernamePassword handler (where username matches password), and with LDAP (using active directory).

FYI I've just tried the latest code on HEAD with my mod_auth_cas VM and it still seems to work for me. I did spot some errors in the Wiki instructions (you need to point VIRTUAL_TOMCAT_HOME to somewhere other than your tomcat home or "ant incremental-tomcat" will mess up your tomcat installation with virtualization stuff). I've updated the Wiki.

cybertoast. It looks like the main differences are due to the way the SSL virtual host is configured differently in Ubuntu. It looks like apache isn't sending through the certificate data to tomcat. To get this to work on Red Hat it was VERY important to add this directive to ssl.conf.

SSLOptions +StdEnvVars +ExportCertData

and the ordering of directives is very important too. In tomcat, /etc/httpd/conf.d is processed in alphabetical order so the ordering would be mod_auth_cas.conf, mod_jk.conf, ssl.conf.

So good luck! It sounds like it's just a matter of getting the httpd config right for Ubuntu.

By the way, I'm closing the bug, since you are both working on a different platform, and it still appears to work on Red Hat with HEAD.

I can barely believe it, but it seems that something in the certificate creation instructions (which I followed blindly) is incorrect for Ubuntu (or I did something wrong - I'll check on this and update the wiki as necessary). I went back to basics and created the CA, certs and pkcs12 using CA.pl and things are in much better shape than they were.

Now when I load alfresco-system.p12 into the browser and go to snoop.jsp I get a prompt to select the certificate. Better yet, my cas.log says that it found a certificate to load:

2009-11-05 17:23:07,779 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Action 'X509CertificateCredentialsNonInteractiveAction' beginning execution>
2009-11-05 17:23:07,781 DEBUG [org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction] - <Certificate found in request.>
2009-11-05 17:23:07,781 DEBUG [org.jasig.cas.CentralAuthenticationServiceImpl] - <Attempting to create TicketGrantingTicket for org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentials@4a2dd4>
2009-11-05 17:23:07,781 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <–examining cert[14653026945918949920] CN=alfresco-system, O="Vitech Systems Group, Inc.", L=Manhattan, ST=New York, C=US" from issuer "EMAILADDRESS=foo@bar.com, CN=Sundar CA, O="Vitech Systems Group, Inc.", ST=New York, C=US">
2009-11-05 17:23:07,781 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <certificate is valid>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <Pattern Match: true [EMAILADDRESS=foo@bar.com, CN=Sundar CA, O="Vitech Systems Group, Inc.", ST=New York, C=US] against [^.*CN=Sundar CA.*$].>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <certificate was issued by trusted issuer>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <this is an end-user certificate>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <Pattern Match: true [CN=alfresco-system, O="Vitech Systems Group, Inc.", L=Manhattan, ST=New York, C=US] against [.*].>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <cert[14653026945918949920] ok, setting as credentials candidate>
2009-11-05 17:23:07,782 INFO [org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler] - <authentication OK; SSL client authentication data meets criteria for cert[14653026945918949920]>
2009-11-05 17:23:07,782 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - <AuthenticationHandler: org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler successfully authenticated the user which provided the following credentials: org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentials@4a2dd4>
2009-11-05 17:23:07,782 DEBUG [org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentialsToIdentifierPrincipalResolver] - <Attempting to resolve a principal…>
2009-11-05 17:23:07,782 INFO [org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentialsToIdentifierPrincipalResolver] - <Creating principal for: CN=alfresco-system, O="Vitech Systems Group, Inc.", L=Manhattan, ST=New York, C=US>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

But the X509CertificateCredentialsToIdentifierPrincipalResolver is not happy and throws a rather ugly error (sorry for the long dump here, but it may be helpful):

HTTP Status 500 -

type Exception report

message

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.webflow.engine.ActionExecutionException: Exception thrown executing [AnnotatedAction@b4b0a4 targetAction = org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction@b90a6e, attributes = map[[empty]]] in state 'startAuthenticate' of flow 'login-webflow' – action execution attributes were 'map[[empty]]'; nested exception is java.lang.ArrayIndexOutOfBoundsException: 1
   org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:583)
   org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
   org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
   org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)

root cause

org.springframework.webflow.engine.ActionExecutionException: Exception thrown executing [AnnotatedAction@b4b0a4 targetAction = org.jasig.cas.adaptors.x509.web.flow.X509CertificateCredentialsNonInteractiveAction@b90a6e, attributes = map[[empty]]] in state 'startAuthenticate' of flow 'login-webflow' – action execution attributes were 'map[[empty]]'; nested exception is java.lang.ArrayIndexOutOfBoundsException: 1
   org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.java:64)
   org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:156)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
   org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
   org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
   org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Flow.start(Flow.java:521)
   org.springframework.webflow.engine.impl.RequestControlContextImpl.start(RequestControlContextImpl.java:193)
   org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:177)
   org.springframework.webflow.executor.FlowExecutorImpl.launch(FlowExecutorImpl.java:187)
   org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRequest(FlowRequestHandler.java:125)
   org.springframework.webflow.executor.mvc.FlowController.handleRequestInternal(FlowController.java:165)
   org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
   org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
   org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
   org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:807)
   org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:571)
   org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
   org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
   org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)

root cause

java.lang.ArrayIndexOutOfBoundsException: 1
   org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentialsToIdentifierPrincipalResolver.resolvePrincipalInternal(X509CertificateCredentialsToIdentifierPrincipalResolver.java:56)
   org.jasig.cas.adaptors.x509.authentication.principal.AbstractX509CertificateCredentialsToPrincipalResolver.extractPrincipalId(AbstractX509CertificateCredentialsToPrincipalResolver.java:24)
   org.jasig.cas.authentication.principal.AbstractPersonDirectoryCredentialsToPrincipalResolver.resolvePrincipal(AbstractPersonDirectoryCredentialsToPrincipalResolver.java:42)
   org.jasig.cas.authentication.AuthenticationManagerImpl.authenticate(AuthenticationManagerImpl.java:124)
   org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTicket(CentralAuthenticationServiceImpl.java:417)
   org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExecute(AbstractNonInteractiveCredentialsAction.java:80)
   org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:192)
   org.springframework.webflow.engine.AnnotatedAction.execute(AnnotatedAction.java:146)
   org.springframework.webflow.engine.ActionExecutor.execute(ActionExecutor.java:59)
   org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:156)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:54)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Transition.execute(Transition.java:212)
   org.springframework.webflow.engine.TransitionableState.onEvent(TransitionableState.java:107)
   org.springframework.webflow.engine.Flow.onEvent(Flow.java:534)
   org.springframework.webflow.engine.impl.RequestControlContextImpl.signalEvent(RequestControlContextImpl.java:205)
   org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:161)
   org.springframework.webflow.engine.State.enter(State.java:191)
   org.springframework.webflow.engine.Flow.start(Flow.java:521)
   org.springframework.webflow.engine.impl.RequestControlContextImpl.start(RequestControlContextImpl.java:193)
   org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:177)
   org.springframework.webflow.executor.FlowExecutorImpl.launch(FlowExecutorImpl.java:187)
   org.springframework.webflow.executor.support.FlowRequestHandler.handleFlowRequest(FlowRequestHandler.java:125)
   org.springframework.webflow.executor.mvc.FlowController.handleRequestInternal(FlowController.java:165)
   org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
   org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
   org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
   org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:807)
   org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:571)
   org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:501)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
   org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
   org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I decided to see what /share might do with the certificate, and basically I get "org.alfresco.web.site.exception.UserFactoryException: Unable to retrieve user from repository". So I suspect the X509 Principal is not being resolved into a LDAP principal.

So a couple of questions:
1. In the wiki there's a line that says:

For the subject name, use alfresco-system. We will later configure Alfresco to trust that this subject is the Share application.

. I did not see anything that explicitly trusts the CN of alfresco-system in the instructions. Did I miss something?
2. The wiki instructions for the deployerConfixContext.xml says

<bean
               class="org.jasig.cas.adaptors.x509.authentication.principal.X509CertificateCredentialsToIdentifierPrincipalResolver">
               <property name="identifier" value="$CN" />
            </bean>

Is this still correct even for Active Directory's LDAP?

Thanks much.

1. The external subsystem is preconfigured to trust alfresco-system.
2. Yes. This part doesn't have anything to do with LDAP and is just the configuration for how it extracts a user ID from the certificate.

Looking at the stack trace, I think the problem is now in the CAS server. It seems the way that it parses the DN in a certificate can be broken if one of the components contains a comma. Can you please try certificates without the comma in "Vitech Systems Group, Inc."?

dward, i owe you a few beers (wonder if Bolaji can make that happen)! Removing the comma from the DN did the trick. Thanks so much for your help. I'm pretty sure I would not have found this problem.

In any case, I'm going to spend some time today adding Ubuntu instructions to the wiki so that the next poor soul has a better chance