Hi all, just installed JIRA606 and I need integrate the authentication with CAS 3.5.1. I followed the official documentation but without disabled the default JIRA authentication (JiraSeraphAuthenticator), if disable it the startup process failed (cas_error.txt).
A result of this error, I tried to maintain the Seraph enabled with the atlassianCasClient and the CAS authentication WORKS!!!, but when I logon the JiraSeraphAuthenticator authentication reorders.
This is my JIRA6 (jira_cas_foro.txt) .
Thanks for all
CAS INTEGRATION:
https://wiki.jasig.org/display/CASC/Configuring+Jira+with+JASIG+CAS+Client+for+Java+3.1
cp -pr cas-client-integration-atlassian-3.2.1.jar /usr/local/etc2/jira606/atlassian-jira/WEB-INF/lib/
cp -pr cas-client-core-3.2.1.jar /usr/local/etc2/jira606/atlassian-jira/WEB-INF/lib/
Habilitamos la configuración por CAS, comentando la configuración activa por default
$JIRA_HOME/WEB-INF/classes/seraph-config.xml
<!-- CROWD:START - The authenticator below here will need to be commented out for Crowd SSO integration -->
<authenticator class="com.atlassian.jira.security.login.JiraSeraphAuthenticator"/>
<!-- CROWD:END -->
<!-- CAS:START - Java Client Jira Authenticator -->
<authenticator class="org.jasig.cas.client.integration.atlassian.JiraCasAuthenticator"/>
<!-- CAS:END -->
Redirigimos el Sign Out de JIRA al Sign Out de CAS
$JIRA_HOME/WEB-INF/classes/seraph-config.xml
<init-param>
<!--
The login URL to redirect to when the user tries to access a protected resource (rather than clicking on
an explicit login link). Most of the time, this will be the same value as 'link.login.url'.
- if the URL is absolute (contains '://'), then redirect that URL (for SSO applications)
- else the context path will be prepended to this URL
If '${originalurl}' is present in the URL, it will be replaced with the URL that the user requested.
This gives SSO login pages the chance to redirect to the original page
-->
<param-name>login.url</param-name>
<!--<param-value>/login.jsp?permissionViolation=true&amp;os_destination=${originalurl}</param-value>-->
<param-value>https://mycassrv.domain.es/cas/login?service=${originalurl}</param-value>
</init-param>
<init-param>
<!--
the URL to redirect to when the user explicitly clicks on a login link (rather than being redirected after
trying to access a protected resource). Most of the time, this will be the same value as 'login.url'.
- same properties as login.url above
-->
<param-name>link.login.url</param-name>
<!--<param-value>/login.jsp?os_destination=${originalurl}</param-value>-->
<!--<param-value>/secure/Dashboard.jspa?os_destination=${originalurl}</param-value>-->
<!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
<param-value>https://mycassrv.domain.es/cas/login?service=${originalurl}</param-value>
</init-param>
<init-param>
<!-- URL for logging out.
- If relative, Seraph just redirects to this URL, which is responsible for calling Authenticator.logout().
- If absolute (eg. SSO applications), Seraph calls Authenticator.logout() and redirects to the URL
-->
<param-name>logout.url</param-name>
<!--<param-value>/secure/Logout!default.jspa</param-value>-->
<!--<param-value>http://sso.mycompany.com/logout</param-value>-->
<param-value>https://mycassrv.domain.es/cas/logout</param-value>
</init-param>
Add the Single Sign Out listener to the list of listener list too
$JIRA_HOME/WEB-INF/web.xml
<!-- CAS:START - Java Client Single Sign Out Listener -->
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>
<!-- CAS:END -->
$JIRA_HOME/WEB-INF/web.xml
Add before the filter-mapping entries:
<!-- CAS:START - Java Client Filter Mappings -->
<filter-mapping>
<filter-name>CasSingleSignOutFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CasAuthenticationFilter</filter-name>
<url-pattern>/login.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CasValidationFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- CAS:END -->
$JIRA_HOME/WEB-INF/web.xml
<!-- CAS:START - Java Client Filters -->
<filter>
<filter-name>CasSingleSignOutFilter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter>
<filter-name>CasAuthenticationFilter</filter-name>
<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
<init-param>
<param-name>casServerLoginUrl</param-name>
<param-value>https://mycassrv.domain.es/cas/login</param-value>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://mycassrv.domain.es/jira/</param-value>
</init-param>
</filter>
<filter>
<filter-name>CasValidationFilter</filter-name>
<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://mycassrv.domain.es/cas</param-value>
</init-param>
<init-param>
<param-name>serverName</param-name>
<param-value>https://mycassrv.domain.es/jira/</param-value>
</init-param>
<init-param>
<param-name>redirectAfterValidation</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<!--- CAS:END -->
<!-- =====================================================
FILTER MAPPINGS FOLLOW :
===================================================== -->
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.