nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

SSO/External Authentication still broken in 201611EA?

davidd2go

I tried to get SSO (with CAS) working on version 201611EA. According to the release notes earlier problems as reported by in this bug should have been solved in the 201611EA release.

However I still see problems for which I filed a new bug-report here.

Since the details are described there I won't repeat them in this post.

Did anyone succeed in getting this to work on 201611EA or any other release after 5.1.f?

Regards,

David

Find more posts tagged with

Comments

idwright

I have CAS authentication working with repo/share version 5.1.g and can confirm that I'm seeing the same thing with 5.2.b-EA/5.2.c-EA

with the same code GitHub - wrighting/alfresco-cas: A project designed to show how to integrate Alfresco with CAS single sign on

I haven't yet made any effort to diagnose this.(I recently changed my approach to this problem so may try the old approach to see what happens)

(Something seems to change in this area with every release....)

pinux

Hi Ian,

also I planned to run Alfresco with CAS auth; after a lot of work trying to follow the official Alfresco approach here Using Alfresco with CAS authentication through Apache mod_auth_cas | Alfresco Documentation I decied to change my way and I found your github project GitHub - wrighting/alfresco-cas: A project designed to show how to integrate Alfresco with CAS single sign on . So I installed fresh version of Alfresco Community version 5.0.d, integrated the amp file alfresco-cas-share-amp-1.2.2.amp produced; my java-cas-client-properties is:

casServerLoginUrl=https://my-server-hostname:8444/cas-webapp/login
serverName=https://my-server-hostname:8443
ticketValidatorClass=org.jasig.cas.client.validation.Cas30ServiceTicketValidator
casServerUrlPrefix=https://my-server-hostname:8444/cas-webapp

The x509 certificate of alfresco is the default one provided with Alfresco fresh installation (under $ALFRESCO_HOME/alf_data/keystore) while the x509 certificate of CAS Server was self made with the keytool -utility (keytool -genkey -alias tomcat -keyalg RSA) and when asked the common nome i used my-server-hostname.

When I try to login in Alfresco Share I'm redirect to CAS login, successfully login on CAS but whe I'm redirect to Alfresco Share I received an error. In catalina.out the error is:

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

What I'm wrong?

Could you help me to solve the problem?

Thanks in advance.

Pino

idwright

Hi Pino,

This is almost certainly down to using self signed certificates for the CAS server.

Note this is different from the Alfresco x509 certificates.

If you can, it is much the easiest to use a full certificate e.g. using Lets Encrypt - this might help Configuring Alfresco SSL by using Let's Encrypt - keensoft

Otherwise it's a case of getting hold of the client certificate and adding it to the cacerts file used by the java that is running tomcat - which is relatively painful to do. See SSL Troubleshooting and Reference Guide - CAS User Manual - Apereo Wiki

pinux

Hi Ian,

thanks for your reply; added the certificate to cacerts file used by tomcat JVM; now I'm receiving a new error:

ERROR [alfresco.web.site] [http-bio-8443-exec-19] javax.servlet.ServletException: org.jasig.cas.client.validation.TicketValidationException: No principal was found in the response from the CAS server.
org.jasig.cas.client.validation.TicketValidationException: No principal was found in the response from the CAS server.
at org.jasig.cas.client.validation.Cas20ServiceTicketValidator.parseResponseFromServer(Cas20ServiceTicketValidator.java:98)

Could you help me to solve the problem?

Thanks in advance,
Pino