Hey, everyone, I'm trying to get SAML2 authentication working against my CAS server. I've got CAS protocol authentications working just fine, but am struggling getting the SAML IdP configured correctly. I have the following items configured in my main CAS configuration:
## SAML Provider cas.authn.samlIdp.entityId=https://server.domain.com/cas/idp cas.authn.samlIdp.hostName=server.domain.com cas.authn.samlIdp.scope=domain.com cas.authn.samlIdp.metadata.cacheExpirationMinutes=30 cas.authn.samlIdp.metadata.failFast=true cas.authn.samlIdp.metadata.location=file:///etc/cas/saml cas.authn.samlIdp.metadata.privateKeyAlgName=RSA cas.authn.samlIdp.metadata.requireValidMetadata=true cas.authn.samlIdp.logout.forceSignedLogoutRequests=true cas.authn.samlIdp.logout.singleLogoutCallbacksDisabled=false cas.authn.samlIdp.response.skewAllowance=0 cas.authn.samlIdp.response.signError=false cas.authn.samlIdp.response.useAttributeFriendlyName=true I also have a JSON-based service registry configured, and have the following entry for the SP that I'm trying to authenticate with: { "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId": "https://1.2.3.4/guacamole/api/tokens";, "name": "GuacamoleSAML", "id": 1002, "evaluationsOrder": 1002, "metadataLocation": "file:///etc/cas/saml/sp-guacamole.xml" } and, finally, I used the web site mentioned in the CAS SAML IdP documentation to generate the metadata: <?xml version="1.0"?> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2018-02-17T03:16:28Z" cacheDuration="PT604800S" entityID="https://1.2.3.4/guacamole/api/tokens";> <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://1.2.3.4/guacamole/api/ext/saml/callback"; index="1" /> </md:SPSSODescriptor> </md:EntityDescriptor> However, every time I try to authenticate with this app, I receive the following error: 2018-02-15 12:12:52,559 INFO [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController] - <Received SAML profile request [/cas/idp/profile/SAML2/Redirect/SSO]> 2018-02-15 12:12:52,581 ERROR [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlProfileHandlerController] - <CAS has found a match for service [https://1.2.3.4/guacamole/api/tokens] in registry but the match is not defined as a SAML service> I can't seem to get much more detail - I think something must be wrong with my logging configuration, because I can't get any debugging. Also, most of the parameters in the cas configuration file for SAML (cas.authn.samlIdp.*) seem to lack documentation - for example, I feel like this could be related to the "cas.authn.samlIdp.scope=domain.com", but there's no documentation on what's expected or acceptable for the scope, and whether this would generate the error message I'm seeing above? Other than that, as far as I can tell, my JSON service entry matches the documentation, is valid JSON, and defines the mentioned service as a SAML service, so its unclear to me what's leading to this error. Any pointers would be appreciated! -Nick -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/abc5ef3d-26d5-4070-a08f-aa40db37a7fc%40apereo.org.
