Not sure exactly what it was, but I replaced my JDK11 cacerts with original the that was shipped with JDK. I then imported my cas.cer that was generated from running CAS 6.3 "gradlew createKeystore" and I'm able to login with my SAML app now.
On Saturday, August 21, 2021 at 10:34:29 AM UTC-5 Pablo Vidaurri wrote: > I have CAS 6.3, ran the createKeystore and get a "thekeystore" file > created in /etc/cas. I also imported the /etc/cas/cas.cer to my JDK cacert > file. Great! I can login via auth/login and logging in with a CAS Client > also works. I see user attributes also returned. > > Next, I enabled shibboleth with the following cas.properties: > cas.authn.saml-idp.entity-id=https://localhost/idp/shibboleth > cas.authn.saml-idp.metadata.location=file:/etc/cas/saml > I do not see an explanation on what the other config options are for so > left them out for now. > > On startup, I see the idp metadata file and key/cer files created in > /etc/cas/saml. > > Now using a SAML Client that works with standalone Shibboleth 4.x, I have > imported the idp metadata file into the client app and setup the sp > metadata file in CAS. > > In my service file: > { > "@class" : "org.apereo.cas.support.saml.services.SamlRegisteredService", > "serviceId" : "http://mysamlclient.com/sample/samlclient";, > "name" : "SAML Localhost", > "id" : 20210729178235, > "evaluationOrder" : 30, > "metadataLocation" : "file:/etc/cas/metadata/local_saml_client.xml" > } > > and I have the sp metadata file in /etc/cas/metadata/local_saml_client.xml. > > Now when trying to access my saml client, I do get redirected to CAS sign > in page but then on redirect back to the client I get an error: > > - <SSL error getting response from host: localhost : Error Message: PKIX > path validation failed: java.security.cert.CertPathValidatorException: > signature check failed> > javax.net.ssl.SSLHandshakeException: PKIX path validation failed: > java.security.cert.CertPathValidatorException: signature check failed > > CAS client and logging in via cas/login page still works, just not with > SAML client. > > Not sure which keystore Shib is using at this point. Is it different than > the /etc/cas/keystore and the JDK cacert file? > > Any pointers would be appreciated. > Thanks. > -psv > > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d302e4e0-4b7a-4ba8-b950-fb0c551f5b89n%40apereo.org.
