You are welcome! Regards, Yauheni
On Friday, January 20, 2017 at 1:25:44 AM UTC+3, maxwell_g wrote: > > Thanks again Yauheni > > > > -Gary > > > > *From:* [email protected] <javascript:> [mailto:[email protected] > <javascript:>] *On Behalf Of *Yauheni Sidarenka > *Sent:* Thursday, January 19, 2017 2:55 AM > *To:* CAS Community <[email protected] <javascript:>> > *Subject:* Re: [cas-user] Cas 5 and implementing ehcache replication > > > > Hello, > > I may guess this happens because you use different cookie encryption on > both CAS servers (nearly the same that sesharaju sv said). > You know, when you start CAS 5.0.0 without any configuration it produces > WARN messages like these: > > WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - > <Secret key for signing is not defined. CAS will attempt to auto-generate > the signing key> > WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - > <Generated signing key > rShUuOJuPwpIAvzo-eJLQttzyP_61e5Q1rwlnzExJBdfmubp_7Z2ABqhDk0nnwn7Lo4U4p3Uni2FncBSR6sk8Q > > of size 512. The generated key MUST be added to CAS settings.> > WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - > <No encryption key is defined. CAS will attempt to auto-generate keys> > WARN [org.apereo.cas.util.cipher.WebflowConversationStateCipherExecutor] - > <Generated encryption key HuCQqOznZTCchApj of size 16. The generated key > MUST be added to CAS settings.> > WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - < > Secret key for encryption is not defined. CAS will attempt to auto-generate > the encryption key> > WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - < > Generated encryption key bmMKn_wh5PQYHaIN6c-8XnNt40Cpbz1PI0-1GTbvzMs of > size 256. The generated key MUST be added to CAS settings.> > WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - < > Secret key for signing is not defined. CAS will attempt to auto-generate > the signing key> > WARN [org.apereo.cas.util.cipher.TicketGrantingCookieCipherExecutor] - < > Generated signing key > Tfz8OkZze_xYsO_9pNeeDj3htHa7uz2lJApUQ7VkwgorC3VYHP0C6z1LrXugRKqtBxfM2ixVLOMnj_BAWUfF2Q > > of size 512. The generated key MUST be added to CAS settings.> > > > So I just added these settings to my cas.properties (as stated in > messages) and I hope it is easy to guess what to place for each line: > > cas.tgc.encryptionKey= > cas.tgc.signingKey= > cas.webflow.encryption.key= > cas.webflow.signing.key= > > > Then I just copied these exact values to properties for second server and > since that HA has started working fine. > > CAS 5.0.0 encrypts ticket granting cookie (TGC) and therefore, in my > opinion, each CAS server in HA cluster should have equal cas.tgc.* keys to > read and understand cookies produced by other members of cluster. > > I am not convinced about the necessity of cas.webflow.* settings but if > CAS says they must be added - I must add them :) > > Regards, > Yauheni > > On Thursday, January 19, 2017 at 8:42:35 AM UTC+3, maxwell_g wrote: > > Thank you! Yauheni > > > > That fixed TGT from being destroyed and I am able to bring up multiple SSO > applications after logging in one time. > > This however leads me to another issue. I am running two cas servers with > ehcache replication. After logging into one application, > > I can see the ticket is replicated to both servers however when I stop the > server that I initially logged into, > > the load balancer sends me to the replicated server however it doesn’t > recognize the replicated ticket and asks for me to login again. > > > > Any clues how I can troubleshoot this issue? > > > > -Gary > > > > > > *From:* [email protected] [mailto:[email protected]] *On Behalf Of *Yauheni > Sidarenka > *Sent:* Tuesday, January 17, 2017 6:22 AM > *To:* CAS Community <[email protected]> > *Subject:* Re: [cas-user] Cas 5 and implementing ehcache replication > > > > Hello, > > We had similar issue and we solved it using > > *cas**.**ticket**.**registry**.**ehcache**.**persistence*=*LOCALTEMPSWAP* > > property instead of > > *cas**.**ticket**.**registry**.**ehcache**.**persistence*=*NONE* > > which is default one for CAS 5.0.0 (and to be clear, for Ehcache as well). > > Hope this will help you. > > Regards, > Yauheni. > > > On Tuesday, January 17, 2017 at 8:49:55 AM UTC+3, maxwell_g wrote: > > In summary, the behavior I see is the following: > > 1. I login to the first SSO application > 2. CAS creates the TGT ticket on the first server and then replicates it > to the second. > 3. I bring up the login for the second SSO application. > 4. CAS performs a TICKET_GRANTING_TICKET_DESTROYED on the TGT ticket > 5. Because the TGT is gone, CAS proceeds to login into the second SSO > application. > > Why causes CAS to delete the TGT ticket? > > -Gary > > > -----Original Message----- > From: Maxwell, Gary > Sent: Monday, January 16, 2017 3:28 PM > To: [email protected] > Subject: RE: [cas-user] Cas 5 and implementing ehcache replication > > Hi Seshu, > > I turned on Debug and It shows me where it creates the TGT: > > DEBUG [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Adding > ticket TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXX.edu to the cache > org.apereo.cas.ticket.TicketCache to live 7200 seconds and stay idle for > 7200 seconds> > > However latter on (in abbreviated log) it says it can't find it: > > DEBUG [org.apereo.cas.web.support.DefaultCasCookieValueManager] - <Decoded > cookie value is > [TGT-**********************************************[email protected]@Mozilla/5.0 > > (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0]> TRACE > [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket encryption > is not enabled. Falling back to default behavior> DEBUG > [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id > [TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXX.fortlewis.edu] is found in the registry> > TRACE [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket > encryption is not enabled. Falling back to default behavior> DEBUG > [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id > [TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXX.edu] is found in the registry> TRACE > [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <Ticket encryption > is not enabled. Falling back to default behavior> DEBUG > [org.apereo.cas.ticket.registry.EhCacheTicketRegistry] - <No ticket by id > [TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXXX.edu] is found in the registry> DEBUG > [org.apereo.cas.CentralAuthenticationServiceImpl] - <Ticket > [TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXX.edu] by type [Ticket] cannot be found in > the ticket registry.> DEBUG > [org.apereo.cas.CentralAuthenticationServiceImpl] - <Removing ticket > [TGT-********************************************** > 5B0wydvh6k-login-test1.XXXXXXXX.edu] from registry...> > > Any Ideas why???? > > -Gary > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of > sesharaju sv > Sent: Monday, January 16, 2017 11:34 AM > To: [email protected] > Subject: Re: [cas-user] Cas 5 and implementing ehcache replication > > This would be few reasons behind this issue. Please enable your ehcache > logging to debug and you should be able to see what exactly the issues is. > > Thanks > Seshu > > On 16 January 2017 at 23:42, Maxwell, Gary <[email protected]> wrote: > > .We have installed cas 5 along with ehcache replication. When we login > > to a SSO application the replication works great however when we log > > into the next SSO application, CAS deletes the existing TGT. CAS then > > requires the user to re-authenticate. Does anyone know why this would be > happening? > > > > > > > > Thanks for any insight on this! > > > > > > > > -Gary > > > > -- > > - CAS gitter chatroom: https://gitter.im/apereo/cas > > - CAS mailing list guidelines: > > https://apereo.github.io/cas/Mailing-Lists.html > > - CAS documentation website: https://apereo.github.io/cas > > - CAS project website: https://github.com/apereo/cas > > --- > > You received this message because you are subscribed to the Google > > Groups "CAS Community" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [email protected]. > > To view this discussion on the web visit > > > https://groups.google.com/a/apereo.org/d/msgid/cas-user/016e99eee450407ca0bb6a035d5032fb%40mbx2.fortlewis.edu. > > > > > > -- > Venkata S Sadhu > India (Mobile) : +91 7032638062 > INDIA > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAABZGc2v3cFumnBDu%2B7%3DVu0XzJC%2B7cvOGMpzY6OYa7zgtagPvQ%40mail.gmail.com. > > > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/c69c367c-0bee-44c4-8224-936af7d2f0fc%40apereo.org > > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/c69c367c-0bee-44c4-8224-936af7d2f0fc%40apereo.org?utm_medium=email&utm_source=footer> > . > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/b5b0ab8d-28cb-451e-b2f5-bce66fbb77e6%40apereo.org > > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/b5b0ab8d-28cb-451e-b2f5-bce66fbb77e6%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/5a3507d8-1724-4a32-9f99-f87725413e2b%40apereo.org.
