Thanks I'm seeing a bit more now. Still no error messages but I at least see a difference between the two cases.
The logout to my unreachable client web app shows: ... 2016-02-05T12:00:03.483-0500|Info: 2016-02-05 12:00:03,483 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] - <Connecting socket to unreachable-host/192.168.1.4:8181 with timeout 5000> 2016-02-05T12:00:03.484-0500|Info: 2016-02-05 12:00:03,484 DEBUG [org.apache.http.impl.conn.DefaultManagedHttpClientConnection] - <http-outgoing-15: Shutdown connection> 2016-02-05T12:00:03.484-0500|Info: 2016-02-05 12:00:03,484 DEBUG [org.apache.http.impl.execchain.MainClientExec] - <Connection discarded> 2016-02-05T12:00:03.484-0500|Info: 2016-02-05 12:00:03,484 DEBUG [org.apache.http.impl.conn.DefaultManagedHttpClientConnection] - <http-outgoing-15: Close connection> ... While the reachable one with a non-trusted cert shows: ... 2016-02-05T12:04:50.713-0500|Info: 2016-02-05 12:04:50,713 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] - <Connecting socket to client-host/192.168.2.5:8181 with timeout 5000> 2016-02-05T12:04:50.714-0500|Info: 2016-02-05 12:04:50,714 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] - <Enabled protocols: [TLSv1, ..]> 2016-02-05T12:04:50.714-0500|Info: 2016-02-05 12:04:50,714 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] - <Enabled cipher suites:[...]> 2016-02-05T12:04:50.714-0500|Info: 2016-02-05 12:04:50,714 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] - <Starting handshake> 2016-02-05T12:04:50.737-0500|Info: 2016-02-05 12:04:50,737 DEBUG [org.apache.http.impl.conn.DefaultManagedHttpClientConnection] - <http-outgoing-16: Shutdown connection> 2016-02-05T12:04:50.737-0500|Info: 2016-02-05 12:04:50,737 DEBUG [org.apache.http.impl.execchain.MainClientExec] - <Connection discarded> 2016-02-05T12:04:50.738-0500|Info: 2016-02-05 12:04:50,738 DEBUG [org.apache.http.impl.conn.DefaultManagedHttpClientConnection] - <http-outgoing-16: Close connection> ... According to the apache http source the next thing that should be in the logs is: Secure session established negotiated protocol: ... negotiated cipher suite: ... and I'm not currently seeing that so I assume that the handshake is failing even though it's not being stated as the reason for the connection being shutdown. On Friday, February 5, 2016 at 11:29:35 AM UTC-5, Misagh Moayyed wrote: > > Best bet would be to add “org.apache.http” at DEBUG to your log4j. Expect > a lot of noise. > > > > *From:* Jonathan Labin [mailto:[email protected] <javascript:>] > *Sent:* Friday, February 5, 2016 9:10 AM > *To:* CAS Community <[email protected] <javascript:>> > *Cc:* [email protected] <javascript:> > *Subject:* Re: [cas-user] SLO require trusted certificates > > > > I have another web application that I know is not reachable at all from > the cas server due to network firewall rules. I don't see any error > messages in the log due to that logout callback failing either. > > Is there something I should add to my log4j to make sure these failures > are being logged? > > > > > > On Friday, February 5, 2016 at 10:35:16 AM UTC-5, Misagh Moayyed wrote: > > No, it should be in the logs. Judging by your logs, SLO messages are sent > correctly. So if SLO isn’t working, it’s something else. > > > > *From:* Jonathan Labin [mailto:[email protected]] > *Sent:* Friday, February 5, 2016 8:29 AM > *To:* CAS Community <[email protected]> > *Cc:* [email protected] > *Subject:* Re: [cas-user] SLO require trusted certificates > > > > And this failure of SLO due to untrusted certificates would not be > reflected in the log at all? > > > > 2016-02-05T10:19:42.010-0500|Info: 2016-02-05 10:19:42,010 DEBUG > [org.jasig.cas.logout.LogoutManagerImpl] - <Sending logout request for: [ > https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient > ]> > > 2016-02-05T10:19:42.016-0500|Info: 2016-02-05 10:19:42,016 DEBUG > [org.jasig.cas.logout.LogoutManagerImpl] - <Prepared logout message to send > is [org.jasig.cas.logout.LogoutManagerImpl$LogoutHttpMessage@65b0876b[url= > https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient,message=<samlp:LogoutRequest > > xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" > ID="LR-1-f1ySNTcbr7QBhC6wVDqW7fV4T4xOmWwb14j" Version="2.0" > IssueInstant="2016-02-05T10:19:42Z"><saml:NameID > xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-2-Pdly50eqxXp1JLC2zFSK-server</samlp:SessionIndex></samlp:LogoutRequest>,asynchronous=true,contentType=application/x-www-form-urlencoded]]> > > 2016-02-05T10:19:42.035-0500|Info: 2016-02-05 10:19:42,035 DEBUG > [org.jasig.cas.logout.LogoutManagerImpl] - <Captured logout request > [org.jasig.cas.logout.DefaultLogoutRequest@6a570a2d[ticketId=ST-2-Pdly50eqxXp1JLC2zFSK-server,service= > https://client-host:8181/cas-sample-java-webapp/callback?client_name=CasClient,status=SUCCESS] > ]> > > > > I see status=SUCCESS in there but i'm not sure if that is saying that the > logout request callback was a success or something else. > > > On Thursday, February 4, 2016 at 3:05:32 PM UTC-5, Misagh Moayyed wrote: > > Very likely, yes. > > > > *From:* [email protected] [mailto:[email protected]] *On Behalf Of > *Jonathan > Labin > *Sent:* Thursday, February 4, 2016 8:52 AM > *To:* CAS Community <[email protected]> > *Subject:* [cas-user] SLO require trusted certificates > > > > In my development environment I am using self-signed certificates. I have > successfully configured the client web application container (glassfish) to > trust the self-signed certificate of the CAS server host. But I have not > done the reverse. > > > > Authentication and Single *sign-on* appears to be working as expected but > Single *log-out* does not. Is this because of a certificate failure? I > haven't seen any indication of a problem in the log files. > > > > I had previously had these same applications working with a local cas > server but have been trying to deploy the cas server to it's own host and > began running into the certificate issues. > > -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/ > . > > -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
