Jasig CAS client for Jira - example of configuration

[Martin Stiborsky]

Hello,

I'm working on upgrade of our Jira 4.2.2 to Jira 4.4.3. We are using CAS for single sign on over all services.

Now is there Soulwing CAS client, but as is mentioned on soulwing.org, the client is no more being developed.

So, I moved to Jasig CAS client (https://wiki.jasig.org/display/CASC/Configuring+Jira+with+JASIG+CAS+Client+for+Java+3.1).

Basically, it works. But I'd like to ask you, if someone could send me example of web.xml and seraph-config.xml files, because, for example I have wrong "logout" URL and also I'm not 100% sure about few configuration variables.

My second question is about "bypass paths". Such feature was possible with Soulwing client. It was possible to configure paths, that are not "casified", that are not handled by cas.

Is it possible also with Jasig CAS client?

Thanks a lot for help.

[Ismael Guerra]

What URL-pattern do you have por CasAuthenticationFilter? That configuration worked for me using the Jasig CAS Client, even SOAP API requests.

[Martin Stiborsky]

Ouch, this seems to be exactly what I need. I was too much focused to "bypass" term so I was probably totally missed this one variable. Thanks for this hint, I will test it, then I will post here the result.

Thanks a lot again.

[Martin Stiborsky]

But anyway, CasValidationFilter is used for what path is under CAS authentication process.

I need exclude few paths…

Maybe I'm a little bit out of mind now, so sorry for possbile misunderstanding.

[Martin Stiborsky]

Now I get it (maybe :D).

Although I can't make "whitelist" of not-casified paths (=bypass in soulwing client), but with Jasig I can make "blacklist" (CasAuthenticationFilter) of all casified paths and rest (/sr*,/secure/applet/*, ...) will be not under CAS...

Hopefully I'm not totally wrong :)

I'll test it tommorow.

[Ismael Guerra]

Hi,

Which paths do you want to bypass exactly?

I think CasAuthenticationFilter only must handle login page requests but CasValidationFilter must handle all the requests.

My Web.xml

<filter>

<filter-name>CasSingleSignOutFilter</filter-name>

<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>

</filter>

<filter>

<filter-name>CasAuthenticationFilter</filter-name>

<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>

<init-param>

<param-name>casServerLoginUrl</param-name>

<param-value>https://cas.server.url/cas/login</param-value>

</init-param>

<init-param>

<param-name>serverName</param-name>

<param-value>http://jira.server.url</param-value>

</init-param>

</filter>

<filter>

<filter-name>CasValidationFilter</filter-name>

<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>

<init-param>

<param-name>casServerUrlPrefix</param-name>

<param-value>https://cas.server.url/cas</param-value>

</init-param>

<init-param>

<param-name>serverName</param-name>

<param-value>http://jira.server.url</param-value>

</init-param>

<init-param>

<param-name>redirectAfterValidation</param-name>

<param-value>true</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>CasSingleSignOutFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasAuthenticationFilter</filter-name>

<url-pattern>/login.jsp</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasAuthenticationFilter</filter-name>

<url-pattern>/secure/Dashboard.jspa</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CasValidationFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

My Seraph-config.xml

<param-name>login.url</param-name>

<param-value>https://cas.server.url/cas/login?service=${originalurl}</param-value>

<param-name>link.login.url</param-name>

<param-value>https://cas.server.url/cas/login?service=${originalurl}</param-value>

<param-name>logout.url</param-name>

<param-value>https://cas.server.url/cas/logout?service=${originalurl}</param-value>

[Martin Stiborsky]

Here is configuration of bypass in Soulwing client: <filter>

<filter> 
  <filter-name>CAS-Simple-Bypass</filter-name> 
  <filter-class>org.soulwing.cas.filter.SimpleBypassFilter</filter-class> 
  <init-param> 
    <param-name>bypassPaths</param-name> 
    <param-value>
	/rpc/*, /images/*, /styles/*,/sr*,/rest*, /secure/RunPortlet.jspa ,/secure/Logout!default.jspa, /secure/applet/* 
    </param-value> 
  </init-param> 
</filter>

We need it becuase of for example SOAP API access, connection with Confluence and so on…

[Martin Stiborsky]

About bypass feature - it seems to be bad :( https://issues.jasig.org/browse/CASC-162