Tomcat CAS Client Filter Only Working at / (Root)

183 views
Skip to first unread message

Colin Ryan

unread,
Nov 22, 2024, 10:50:35 PM11/22/24
to cas-...@apereo.org
Folks,

CAS Client 3.6.4

Filter is starting in the logs, but I only want CAS to be in play for 1
specific WebApp installed on this Tomcat 9 instance.

If I change the url-patterns in the web.xml file to "/*" everything
works, but if I try to scope CAS down to the specific App the filter's
appear to never be "invoked". I have a simple .jsp file in
/ldapconn/casverify.jsp for confirming CAS. If I in a freshly started
browser go to

/ldapconn/casverify.jsp I do not get redirected to CAS for
authentication and get errors obviously in my JSP.

Even if I go to CAS directly and login and then go to
/ldapconn/casverify.jsp I get the same error.

If I change the url-patterns to just "/*" it all works as expected.


Here is my web.xml


<!-- CAS Validation Filter -->
<filter>
  <filter-name>CAS Validation Filter</filter-name>
<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
   <init-param>
    <param-name>casServerUrlPrefix</param-name>
<param-value>https://ssoservice.mydomain.net/cas</param-value>
  </init-param>
<init-param>
    <param-name>serverName</param-name>
<param-value>http://ldapconn.mydomain.net:8080</param-value>
  </init-param>
</filter>

<!-- Cas Filter/Wrapper -->

 <filter>
  <filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
  <init-param>
    <param-name>casServerUrlPrefix</param-name>
<param-value>https://ssoservice.mydomain.net/cas</param-value>
  </init-param>
<init-param>
    <param-name>serverName</param-name>
<param-value>http://ldapconn.mydomain.net:8080</param-value>
  </init-param>
</filter>

<!-- CAS Wrapper -->

<filter>
  <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>CAS Authentication Filter</filter-name>
    <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


<filter-mapping>
    <filter-name>CAS Validation Filter</filter-name>
    <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>



<filter-mapping>
  <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
  <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


Ray Bon

unread,
Nov 25, 2024, 1:57:19 PM11/25/24
to cas-...@apereo.org
Colin,

The filters are ordered. Authentication filter must be listed before validation filter.

Ray

On Fri, 2024-11-22 at 13:40 -0500, Colin Ryan wrote:
[You don't often get email from col...@caveo.ca. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

Folks,

CAS Client 3.6.4

Filter is starting in the logs, but I only want CAS to be in play for 1
specific WebApp installed on this Tomcat 9 instance.

If I change the url-patterns in the web.xml file to "/*" everything
works, but if I try to scope CAS down to the specific App the filter's
appear to never be "invoked". I have a simple .jsp file in
/ldapconn/casverify.jsp for confirming CAS. If I in a freshly started
browser go to

/ldapconn/casverify.jsp I do not get redirected to CAS for
authentication and get errors obviously in my JSP.

Even if I go to CAS directly and login and then go to
/ldapconn/casverify.jsp I get the same error.

If I change the url-patterns to just "/*" it all works as expected.


Here is my web.xml


<!-- CAS Validation Filter -->
<filter>
   <filter-name>CAS Validation Filter</filter-name>
<filter-class>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</filter-class>
    <init-param>
     <param-name>casServerUrlPrefix</param-name>
   </init-param>
<init-param>
     <param-name>serverName</param-name>
   </init-param>
</filter>

<!-- Cas Filter/Wrapper -->

  <filter>
   <filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
   <init-param>
     <param-name>casServerUrlPrefix</param-name>
   </init-param>
<init-param>
     <param-name>serverName</param-name>
   </init-param>
</filter>

<!-- CAS Wrapper -->

<filter>
   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
</filter>

<filter-mapping>
     <filter-name>CAS Authentication Filter</filter-name>
     <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


<filter-mapping>
     <filter-name>CAS Validation Filter</filter-name>
     <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>



<filter-mapping>
   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
   <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


--
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

Ray Bon

unread,
Nov 25, 2024, 10:19:18 PM11/25/24
to col...@caveo.ca, cas-...@apereo.org
Colin,

I have this filter order (I should have included this earlier):

Authentication
Validation
Wrapper

Filters are applied in the order they are listed in web.xml. There is no mechanism to skip nor go backwards.
One must authenticate before validate. 

Note: if you want to use a logout filter, it would precede authenticate.

Ray

On Mon, 2024-11-25 at 14:38 -0500, Colin Ryan wrote:
You don't often get email from col...@caveo.ca. Learn why this is important

Ray,

Changed to the following:


<filter-mapping>
  <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<filter-mapping>
    <filter-name>CAS Validation Filter</filter-name>
    <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>

<filter-mapping>
    <filter-name>CAS Authentication Filter</filter-name>
    <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


Same issue

Thanks
   </init-param>
<init-param>
     <param-name>serverName</param-name>
   </init-param>
</filter>

<!-- Cas Filter/Wrapper -->

  <filter>
   <filter-name>CAS Authentication Filter</filter-name>
<filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
   <init-param>
     <param-name>casServerUrlPrefix</param-name>
   </init-param>
<init-param>
     <param-name>serverName</param-name>
   </init-param>
</filter>

<!-- CAS Wrapper -->

<filter>
   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
</filter>

<filter-mapping>
     <filter-name>CAS Authentication Filter</filter-name>
     <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


<filter-mapping>
     <filter-name>CAS Validation Filter</filter-name>
     <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>



<filter-mapping>
   <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
   <url-pattern>/ldapconn/*</url-pattern>
</filter-mapping>


--
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email tocas-user+u...@apereo.org.

Colin Ryan

unread,
Nov 26, 2024, 12:07:32 PM11/26/24
to cas-...@apereo.org

Ray,

That's what I had originally. It all works if my filter is applied to "/*" but if I use subpath for the webapp installed in tomcat "/ldapconn/*"

it appears to not get invoked/triggered etc.

I will sanity check my eyes again today.

C

--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG

---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

Colin Ryan

unread,
Nov 27, 2024, 2:08:17 AM11/27/24
to cas-...@apereo.org

Appears I "solved" this. I had this in the tomcat "root" web.xml.  I put these directives in the <webapps>/WEB-INF/web.xml with root path "/*"

and gave me what I wanted.

C

Dmitriy Kopylenko

unread,
Nov 27, 2024, 2:08:22 AM11/27/24
to cas-...@apereo.org
You might want to set debug or trace level logging on cas client to get some insights on what it’s doing. 

D. 

Reply all
Reply to author
Forward
0 new messages