Best bet would be to add “org.apache.http” at DEBUG to your log4j. Expect a 
lot of noise.



From: Jonathan Labin [mailto:[email protected]]
Sent: Friday, February 5, 2016 9:10 AM
To: CAS Community <[email protected]>
Cc: [email protected]
Subject: Re: [cas-user] SLO require trusted certificates



I have another web application that I know is not reachable at all from the 
cas server due to network firewall rules.  I don't see any error messages in 
the log due to that logout callback failing either.

Is there something I should add to my log4j to make sure these failures are 
being logged?





On Friday, February 5, 2016 at 10:35:16 AM UTC-5, Misagh Moayyed wrote:

No, it should be in the logs. Judging by your logs, SLO messages are sent 
correctly. So if SLO isn’t working, it’s something else.



From: Jonathan Labin [mailto:[email protected] <javascript:> ]
Sent: Friday, February 5, 2016 8:29 AM
To: CAS Community <[email protected] <javascript:> >
Cc: [email protected] <javascript:>
Subject: Re: [cas-user] SLO require trusted certificates



And this failure of SLO due to untrusted certificates would not be reflected 
in the log at all?



2016-02-05T10:19:42.010-0500|Info: 2016-02-05 10:19:42,010 DEBUG 
[org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: 
[https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient]>

2016-02-05T10:19:42.016-0500|Info: 2016-02-05 10:19:42,016 DEBUG 
[org.jasig.cas.logout.LogoutManagerImpl] - <Prepared logout message to send 
is 
[org.jasig.cas.logout.LogoutManagerImpl$LogoutHttpMessage@65b0876b[url=https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient,message=<samlp:LogoutRequest
 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
ID="LR-1-f1ySNTcbr7QBhC6wVDqW7fV4T4xOmWwb14j" Version="2.0" 
IssueInstant="2016-02-05T10:19:42Z"><saml:NameID 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-2-Pdly50eqxXp1JLC2zFSK-server</samlp:SessionIndex></samlp:LogoutRequest>,asynchronous=true,contentType=application/x-www-form-urlencoded]]>

2016-02-05T10:19:42.035-0500|Info: 2016-02-05 10:19:42,035 DEBUG 
[org.jasig.cas.logout.LogoutManagerImpl] - <Captured logout request 
[org.jasig.cas.logout.DefaultLogoutRequest@6a570a2d[ticketId=ST-2-Pdly50eqxXp1JLC2zFSK-server,service=https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient,status=SUCCESS]
 
<https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient,status=SUCCESS%5d>
 
 ]>



I see status=SUCCESS in there but i'm not sure if that is saying that the 
logout request callback was a success or something else.


On Thursday, February 4, 2016 at 3:05:32 PM UTC-5, Misagh Moayyed wrote:

Very likely, yes.



From: [email protected] <mailto:[email protected]> 
[mailto:[email protected]] On Behalf Of Jonathan Labin
Sent: Thursday, February 4, 2016 8:52 AM
To: CAS Community <[email protected] <mailto:[email protected]> >
Subject: [cas-user] SLO require trusted certificates



In my development environment I am using self-signed certificates.  I have 
successfully configured the client web application container (glassfish) to 
trust the self-signed certificate of the CAS server host.  But I have not 
done the reverse.



Authentication and Single sign-on appears to be working as expected but 
Single log-out does not.  Is this because of a certificate failure?  I 
haven't seen any indication of a problem in the log files.



I had previously had these same applications working with a local cas server 
but have been trying to deploy the cas server to it's own host and began 
running into the certificate issues.

-- 
You received this message because you are subscribed to the Google Groups 
"CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an 
email to [email protected] <mailto:[email protected]> .
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.

-- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.

Reply via email to