nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Problem Share Cas Logout

carlosjl

Hello, I'm new with alfresco.

My environment consists of:

- Cas Server 3.5.2
- Alfresco Community 5.0.c

I configured share to validate with cas (cas-client-core-3.3.3) and all work fine. But I have the logout problem.
In share (web.xml):

   <filter>
      <filter-name>CAS Single Sign Out Filter</filter-name>
      <filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
   </filter>
   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
   <listener>
      <listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
   </listener>

But this does not work… or I need some settings.

I read about the possibility of extending logoutController in custom-slingshot-application-context.xml

Any ideas!!

Thank's for all.

Find more posts tagged with

Comments

idwright

Firstly I'll admit I haven't even tried to get this working but I've some experience in this area so hopefully can provide some pointers.

A key thing to remember is that you are logged in to CAS <em>and</em> Alfresco so you need to log out of both.

The filter you've listed is for Single Sign Out so Alfresco gets a logout message from CAS (a POST) i.e. when the user has logged out of CAS, probably via another app, so what you would need to do is provide another bit of code to do the logout from Alfresco as well when the POST is received.(I've never bothered with this)

The logout controller is called when you log out of Alfresco - the logout menu option is disabled when you have configured SSO but it's not too difficult to reenable it but you do need to tell the controller to log out of CAS as well otherwise you just get logged straight back in again as your CAS credentials are still active.

Unfortunately the way the logout menu/controller works keeps changing and I haven't worked out what to do in 5.0.x (just to make things even better SSO changes within the 5.0 versions)
(for earlier versions see http://tech.wrighting.org/2011/11/share-cas-logout/)

danifbconil

Hi, did you find the solution for the Share Cas Logout?

pablog_

Hi, I had overrided logoutController following the link "http://tech.wrighting.org/2011/11/share-cas-logout/".

The problem is the line

<java>final String ticket = connector.getConnectorSession().getParameter(AlfrescoAuthenticator.CS_PARAM_ALF_TICKET);</java>

This param is NULL!!.

Anybody knows what's the problem?

Best regards for your help!

idwright

I've created a github project that contains an all-in-one project with just the CAS configuration for 5.0.d including logout

https://github.com/wrighting/alfresco-cas

There's (slightly) more detail in the wiki attached to that project but a brief description here:

As well as creating a new logout menu item (well putting back the original which won't show with SSO configured) you need to create a patched version of Aikau in order to allow the LogoutService to post appropriate redirect parameters to the dologout url.

<blockcode>
doLogout: function alfresco_services_LogoutService__doLogout() {
         this.serviceXhr({
            url: AlfConstants.URL_PAGECONTEXT + "dologout",
            method: "POST",
            data: {
               redirectURL: "${cas.server.prefix}/logout",
               redirectURLQueryKey: "service",
               redirectURLQueryValue: "${cas.logout.dest.url}"
            },
            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
            successCallback: this.reloadPage,
            callbackScope: this
         });
         //?
      },
</blockcode>

pablog_

Thank your for your great response 'idwright'!, your cas project was very helpfull. But I have a last (I hope) issue.
When I click in Logout link, the rest call is a POST method to 'dologout':

POST http://localhost:8081/share/page/dologout –> "401 unauthorized".

Best regards!

idwright

I do see the 401 but as you are immediately forwarded on to the CAS logout page, and thence to the URL defined in the service parameter then you do get logged out and it behaves as expected despite the 401 response.

davidd2go

Hi Ian
Thanks for your work on CAS-Alfresco integration. This is complicated stuff and your github project really helped me to configure single sign out with mod_auth_cas.
I would prefer to use the approach on the application level with the cas client library so I started working with the amps from your project on GitHub.

The build succeeds and I applied the amps to Alfresco and Share.
I adapted web.xml and share-config-custom.xml
I am able to login to CAS but then I hit the standard Share login-page.

I think there is 1 piece of the puzzel I am missing:
How do I tell CAS to insert the alfresco header (e.g. "X-Alfresco-Remote-User") tot the calls to Share after succesfull login in CAS?

Hope you can help.

Best regards,

David