CAS session management - Ticket Expiration Policies - CAS 6.5

132 views
Skip to first unread message

Niral Kunadia

unread,
May 30, 2023, 12:03:46 PM5/30/23
to CAS Community
Hello,

I would like to set, if server is idle/no activity for 30 mins, users should automatically logoutand session should expire.

If there is activity user stay login without logout.

I tried to set these two properties in .properties file but it still logout user even if there is activity.

management.endpoint.ticketExpirationPolicies.enabled=true
management.endpoints.web.exposure.include=ticketExpirationPolicies
cas.ticket.tgt.primary.max-time-to-live-in-seconds=120
cas.ticket.tgt.primary.time-to-kill-in-seconds=30

I also added decency - implementation"org.apereo.cas:cas-server-support-reports:${project.'cas.version'}" from CAS - Configuring Ticket Expiration Policy Components (apereo.github.io)

Please any advice.

Ray Bon

unread,
May 30, 2023, 2:08:49 PM5/30/23
to cas-...@apereo.org
Niral,

TGT is for life of cas login session, not application session. I am not sure if cas can send logouts to services when TGT expires - that would create strange issues in the client applications.

These settings will allow cas session length to increase beyond 30m only if user logs in to other services or visits cas to refresh a service, etc. (The values are in seconds. I seem to recall that the minimum value is 2m.)

cas.ticket.tgt.primary.max-time-to-live-in-seconds=some-value-greater-than-1800
cas.ticket.tgt.primary.time-to-kill-in-seconds=1800

For viewing the reports, some additional info can be found, https://apereo.github.io/cas/6.5.x/monitoring/Monitoring-Statistics.html

Ray

On Tue, 2023-05-30 at 08:30 -0700, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Niral Kunadia

unread,
May 31, 2023, 11:15:35 AM5/31/23
to cas-...@apereo.org

 

Hello Ray,

 

Thank you for reply. This is very useful.

 

cas.ticket.tgt.primary.max-time-to-live-in-seconds=240

cas.ticket.tgt.primary.time-to-kill-in-seconds=180

 

These are the setting and for testing I am following these steps.

 

I am login with cas credentials to web page, after login refresh page every 10second or so for about three mins, I am getting authenticate message and I am logged in in web page. That means cas server is not idle and in cas logs I can  see ‘Authentication event occurred ’ .So even after server is not idle and with activity , page is getting logout screen after three mins as we set cas.ticket.tgt.primary.time-to-kill-in-second=180.

 

These settings work as expected if server is idle, but not with if server is not idle.

 

Not able to find why this is happening.

 

Thank you,

Niral

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon
Sent: Tuesday, May 30, 2023 2:09 PM
To: cas-...@apereo.org
Subject: Re: [cas-user] CAS session management - Ticket Expiration Policies - CAS 6.5

 

WARNING: THIS IS AN EXTERNAL EMAIL THAT ORIGINATED OUTSIDE OF OUR EMAIL SYSTEM. DO NOT CLICK links / attachments unless you know that the content is safe! For suspicious emails, report using the Phish Alert Report button on the upper left of your email. For marketing/SPAM emails, delete.

 

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/45a68565c1a13c0295f8fbbbcd49ef99805ac6fa.camel%40uvic.ca.

Ray Bon

unread,
May 31, 2023, 12:31:24 PM5/31/23
to cas-...@apereo.org
Niral,

A refresh of the cas page may not be enough. You may have to get cas to issue a new ST [to a different application]. The service does not have to be real, just added to the service registry.
Use this type of url to get cas to go through the login process and issue a ST.

Ray

On Wed, 2023-05-31 at 13:39 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

 

Hello Ray,

Niral Kunadia

unread,
May 31, 2023, 1:58:22 PM5/31/23
to cas-...@apereo.org

Ray,

 

A you said you may have to get cas to issue a new ST[to a different application]. How can I add this for testing?

 

I tested with two different browsers. Like login in chrome and did not touch it. I also login on edge and refreshing page every few mins, and I can see new service ticket open message in logs means server is active. I still got logged out from chrome after 3 mins as I set cas.ticket.tgt.primary.time-to-kill-in-seconds=180.

 

Thank you for your help!

Ray Bon

unread,
May 31, 2023, 3:19:48 PM5/31/23
to cas-...@apereo.org
Niral,

You will see in the logs that cas will issue a different TGT for each login; this means two different session == two different users (even if same username:password).
In the same browser, open a new tab and access / log in to a different service.

You can create fake services in your service registry, they do not have validate the ST, cas just has to issue the ST. Then access cas with a URL like:


Ray


On Wed, 2023-05-31 at 17:07 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Niral Kunadia

unread,
Jun 2, 2023, 1:54:16 PM6/2/23
to cas-...@apereo.org

Thank you Ray,

 

I notice even I issue new ticket and keep server busy/active, it is still killing session instead of expanding session. I am using CAS 6.5.9

What is best scenario to test this or some logs or setting I need to add.

 

Thank you,

Niral

Ray Bon

unread,
Jun 2, 2023, 4:35:35 PM6/2/23
to cas-...@apereo.org
Niral,

Perhaps I am misunderstanding what it is that you are doing. 
Post your cas.ticket.tgt.* config and the steps that you are performing.

I just tested with 6.5.9 and can confirm that these settings work:
cas.ticket.tgt.primary.max-time-to-live-in-seconds=301
cas.ticket.tgt.primary.time-to-kill-in-seconds=120

Ray

On Fri, 2023-06-02 at 17:30 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Niral Kunadia

unread,
Jun 5, 2023, 10:31:37 AM6/5/23
to cas-...@apereo.org

Ray,

 

You are correct, I am doing these steps

Post your cas.ticket.tgt.* config and the steps that you are performing.

 

I just tested with 6.5.9 and can confirm that these settings work:

cas.ticket.tgt.primary.max-time-to-live-in-seconds=301

cas.ticket.tgt.primary.time-to-kill-in-seconds=120

 

Are there any dependencies I have to add or extra properties. Or Do I need to enable any other ticketing properties in configs?

 

One more question:

cas.ticket.tgt.primary.time-to-kill-in-seconds=120, for this even server is active/issuing new tickets, does session expire after 120 sec?

I don’t want it to expire if I am on that page for few mins, it is just keep expiring session even there is activity. Can you please send me link for repo you are using?

Ray Bon

unread,
Jun 5, 2023, 12:51:20 PM6/5/23
to cas-...@apereo.org
Niral,

Ticket expiration is built in, nothing to include.

When you say 'on that page for a few mins', what page are you talking about?

Ray

On Mon, 2023-06-05 at 13:21 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Niral Kunadia

unread,
Jun 5, 2023, 10:38:01 PM6/5/23
to cas-...@apereo.org

Ray,

 

When you say 'on that page for a few mins', what page are you talking about? – webpage of our app which is integrated with CAS login.

 

If I login from this page or refresh this page, it is creating new ticket and I can see that on logs.

 

I am using this repo: GitHub - apereo/cas at 5.3.x

Ray Bon

unread,
Jun 6, 2023, 12:32:05 PM6/6/23
to cas-...@apereo.org
Niral,

That version is VERY old. I suggest you use or upgrade to the latest version. See https://apereo.github.io/cas/developer/Maintenance-Policy.html 

It is possible that the properties you have do not work with that old version.

You should be using the overlay instead of the main cas project https://github.com/apereo/cas-overlay-template 
The main cas project is for developers.


Your application should not be calling to cas on a page refresh (unless it has a proxy dependency - which I will assume it does not). Once logged in, your application should set its own session lifetime - independent of cas. Cas is not an application session manager; it is an SSO manager. The timeouts you have been asking about are SSO session timeouts.

Ray

On Mon, 2023-06-05 at 18:25 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

When you say 'on that page for a few mins', what page are you talking about? – webpage of our app which is integrated with CAS login.

Niral Kunadia

unread,
Jun 17, 2023, 12:38:24 AM6/17/23
to cas-...@apereo.org

Hello Ray,

 

As I am upgrading from 6.5.9 to 6.6.8 As we are using custom login page UI.  I have to do few changes in src folder. I have below code in src/main/resources/templates/layouts.html.

 
 
 <link rel="stylesheet" type="text/css" th:href="@{#{webjars.fontawesomemin.css}}"/>

 

I would like to add webjars dependency in build.gradle. I did not find any sample for this. Please help! As webjars not finding this it is displaying blank page instead of custom login page.

 

Thank you

Niral

You received this message because you are subscribed to a topic in the Google Groups "CAS Community" group.
To unsubscribe from this topic, visit https://groups.google.com/a/apereo.org/d/topic/cas-user/M-hrAO4jo3w/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/52ae00b8afd0b859887659f70094d323109a5710.camel%40uvic.ca.

Ray Bon

unread,
Jun 21, 2023, 10:27:22 AM6/21/23
to cas-...@apereo.org
Niral,


Ray

On Fri, 2023-06-16 at 12:08 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Hello Ray,

 

As I am upgrading from 6.5.9 to 6.6.8 As we are using custom login page UI.  I have to do few changes in src folder. I have below code in src/main/resources/templates/layouts.html.

Niral Kunadia

unread,
Jun 21, 2023, 4:12:53 PM6/21/23
to cas-...@apereo.org

Thank you so much Ray for quick reply.

 

I am able to fix custom theme issue and page loading with all css properly and I am able to login to CAS and able to see my credentials with other profile info. But when I refresh page it is automatically log me out. Any suggestions or idea?

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/20ca731a0cea05c993d5d002b8fb4ad4ab196448.camel%40uvic.ca.

Ray Bon

unread,
Jun 22, 2023, 10:20:02 AM6/22/23
to cas-...@apereo.org
Niral,

Is the page you are refreshing the cas default login page or is it a page in your client application?

Can you post the URL when you land on the cas login page after a refresh?

Ray

On Wed, 2023-06-21 at 19:34 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Message has been deleted

Ray Bon

unread,
Jun 22, 2023, 1:14:19 PM6/22/23
to cas-...@apereo.org
Niral,

I think that is OK. The default page is only to make sure cas is set up correctly. You can change the default https://apereo.github.io/cas/6.6.x/authentication/Configuring-SSO.html#default-service

Set up an application to use cas for authentication and the cas sso session will persist.

Ray

On Thu, 2023-06-22 at 14:34 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

It is cas default login page. https://stage.eclkc.info/cas/login. After refresh it is sending me again this login page.

Niral Kunadia

unread,
Jun 22, 2023, 11:38:24 PM6/22/23
to cas-...@apereo.org

Ray,

 

If I refresh page cas keep login information and it stayed on same page with profile info, but in browser at end of the url, I click and enter it is sending me to login page again and log me out.

 

This behavior is only with 6.6, our 6.5 version is working as expected and not sending me to logout even after refresh or click and enter in browser URL tab.

 

Are there any properties I need to set.

 

Thank you,

Niral

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d5a1e547a58789aed577887094af1decba143251.camel%40uvic.ca.

Petr Bodnár

unread,
Jun 23, 2023, 11:05:52 AM6/23/23
to CAS Community, nkun...@jbsinternational.com
Hi Niral,

from what you've written so far, it looks like the main SSO cookie, i.e. TGC, might be rejected by the browser - either because of its domain, secure flag (https vs. http)  or something else. Try to check the TGC cookie properties - they are listed at the filterable box at https://apereo.github.io/cas/6.6.x/authentication/Configuring-SSO.html#configuration.

You can also check your browser's console or CAS logs. Maybe you will see something which identifies the problem and guides you to the solution.

Petr

Niral Kunadia

unread,
Jun 23, 2023, 11:05:59 AM6/23/23
to Petr Bodnár, CAS Community

Ray,

 

You are correct. First login there is TGC cookie but after pressing enter in URL, somehow TGC cookies is not there.

Niral Kunadia

unread,
Jul 5, 2023, 2:07:58 PM7/5/23
to cas-...@apereo.org

Also,

 

I am using tomcat server 9.0.30 on our test environment, does it can be issue?

 

Thankyou,

Niral

 

From: Niral Kunadia
Sent: Wednesday, July 5, 2023 11:28 AM
To: cas-...@apereo.org
Subject: RE: [cas-user] CAS session management - Ticket Expiration Policies - CAS 6.5

 

Ray,

 

I am upgraded CAS to 6.6.9 from 6.5.8, I am able to login to cas with authentication and on refresh somehow TGC is expiring and asking for login credentials again.

 

Is there any setting I have to add in cas.properties?

 

I did these steps:

  1. Copy cas.war to test environment. Restarted tomcat services.
  2. Open URL in browser cas/login
  3. Able to login and getting profile info.
  4. On refresh still able to see profile page.
  5. Then I logout cas/logout
  6. Again open login screen and entered credentials. Able to login and on refresh it is displaying profile.

 

If don’t do cas/logout, somehow tgc ticket is expiring.

 

But after few second somehow TGC is expiring. How can I add expiration time in 6.6.9. I don’t have any setting related to tgc in my 6.5.8 version.

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7ba33e3f3c3c3a1fce173922592919095bfc4136.camel%40uvic.ca.

Niral Kunadia

unread,
Jul 5, 2023, 2:07:58 PM7/5/23
to cas-...@apereo.org

Ray,

 

I am upgraded CAS to 6.6.9 from 6.5.8, I am able to login to cas with authentication and on refresh somehow TGC is expiring and asking for login credentials again.

 

Is there any setting I have to add in cas.properties?

 

I did these steps:

  1. Copy cas.war to test environment. Restarted tomcat services.
  2. Open URL in browser cas/login
  3. Able to login and getting profile info.
  4. On refresh still able to see profile page.
  5. Then I logout cas/logout
  6. Again open login screen and entered credentials. Able to login and on refresh it is displaying profile.

 

If don’t do cas/logout, somehow tgc ticket is expiring.

 

But after few second somehow TGC is expiring. How can I add expiration time in 6.6.9. I don’t have any setting related to tgc in my 6.5.8 version.

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/7ba33e3f3c3c3a1fce173922592919095bfc4136.camel%40uvic.ca.

Ray Bon

unread,
Jul 5, 2023, 4:36:55 PM7/5/23
to cas-...@apereo.org
Niral,

To see a list of all cas properties:
$ ./gradlew exportConfigMetadata

Which will create a file called config-metadata.properties
You can search for 'tgt' or 'tgc' 
The default value will be shown beside the property.
TicketGgrantingTicket is the server side session and TGC is the client side cookie used to find the TGT.

To see other gradlew commands:
$ ./gradlew tasks

There are some management endpoints that can provide some info, https://apereo.github.io/cas/6.6.x/monitoring/Monitoring-Statistics.html

Here are some related blog posts:

Some URLs that I use:

I do not think this is an issue with tomcat.
Your steps 3. and 4. suggest that it is working correctly.


You say 'Restarted tomcat services'. 
Are you deploying the war to more than one tomcat?
Is the tomcat on your local dev computer or some hosted environment?


On my local I have a sym link from tomcat/webapps/cas.war to devdir/build/lib/cas.war (this will save a step if tomcat is local).
You can also use the docker build and deploy or embedded tomcat run approach. These options are described at the bottom of https://fawnoos.com/2022/08/06/cas66-gettingstarted-overlay/

Ray

On Wed, 2023-07-05 at 15:27 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

I am upgraded CAS to 6.6.9 from 6.5.8, I am able to login to cas with authentication and on refresh somehow TGC is expiring and asking for login credentials again.

Petr Bodnár

unread,
Jul 5, 2023, 7:31:49 PM7/5/23
to CAS Community, nkun...@jbsinternational.com
Niral,

I still kinda thing the same as before, i.e. that the TGC cookie is simply rejected by your browser. Because when you do the refresh of the login page (e.g. pressing F5 instead of hitting Enter in the address line) , you're re-sending the login credentials and that's why you see "you are still logged in". But the browser should clearly tell you that you are re-sending the data, so I'm not 100% sure from your description whether you really experience this, or not.

Some further resources which could probably help you find the issue with your TGC cookie _directly from your browser_ (both Firefox's and Chrome's consoles are pretty similar nowadays - press F12 in your browser and see for yourself):


Also, it could help if you write how exactly you access your new CAS instance and how you've got it deployed - do you access it directly (e.g. https://localhost:8433/cas), or is it hidden behind a proxy, for example?

Niral Kunadia

unread,
Jul 6, 2023, 2:30:23 PM7/6/23
to cas-...@apereo.org

Thank you Ray,

 

Are you deploying the war to more than one tomcat? : I created .war file with gradle on local and deploying to test environment which is some hosted environment.

Is the tomcat on your local dev computer or some hosted environment? : some hosted environment

 

Thank you for reply.

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/e1847d18154f067cd0cf948c349cca4b723228bc.camel%40uvic.ca.

Ray Bon

unread,
Jul 6, 2023, 3:42:45 PM7/6/23
to cas-...@apereo.org
Niral,

Is it possible the hosted environment has more than one tomcat server?
If TGTs are not shared between cas instances, then, when switching tomcat servers (controlled by the hosting service / load balancer), the second cas will not know about the login session and force the login screen.

Alternatively, start with a single cas server, then add more cas servers and the ticket registry when other config is more or less complete.

Ray


On Thu, 2023-07-06 at 14:04 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Thank you Ray,

 

Are you deploying the war to more than one tomcat? : I created .war file with gradle on local and deploying to test environment which is some hosted environment.

Niral Kunadia

unread,
Jul 7, 2023, 12:53:22 AM7/7/23
to cas-...@apereo.org

Ray,

 

I can double check if hosted environment have more than one tomcat server. FYI, this was working perfectly fine with 6.5.9 , TGC ticket expiring only with 6.6.9 version.

 

Is there any public repo you are aware of with CAS 6.6.9 available for test with login and logout form.

 

Thank you for reply!

 

Niral

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/e2392cb3c117ae6cb9a3b9a000eb7bdf54533f15.camel%40uvic.ca.

Ray Bon

unread,
Jul 7, 2023, 2:06:49 PM7/7/23
to cas-...@apereo.org
Niral,

I would be surprised if there were any changes in the way tickets are handled by cas in the upgrade (it is fundamental in the way cas operates).
Spring is good at logging when there is a mismatch between your config and class properties. Is there anything in the logs that would suggest values are not being set?

Petr suggested using your browser's dev tools. If you step through the network traffic, you can see cookies and values being sent and you will see if a TGC is being resent [with a different value].

You do not need a real service to check cas's management of TGCs. I added a fake service to my service registry; I literally have this bookmark:

after login your browser will display a message about not finding https://blah (firefox displays: Hmm. We’re having trouble finding that site.), and in the address bar will be:

If you open a new tab and try to log in with the bookmark, you will not see the log in page but get redirected to https://blah with a new ST

Ray

On Thu, 2023-07-06 at 19:56 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

I can double check if hosted environment have more than one tomcat server. FYI, this was working perfectly fine with 6.5.9 , TGC ticket expiring only with 6.6.9 version.

Niral Kunadia

unread,
Jul 8, 2023, 1:17:48 AM7/8/23
to cas-...@apereo.org

Ray,

 

I will do more debug with this. I also notice we are using custom JavaScript for handling two factor authentication. Is that can be issue?

 

Niral

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/6f5e1d879fffcc4f50a0b84d7c1fb88750368f02.camel%40uvic.ca.

Niral Kunadia

unread,
Jul 13, 2023, 11:37:49 AM7/13/23
to cas-...@apereo.org

Ray,

 

We are using one tomcat only. I found we added code in  “cas-overlay-template\src\main\java\org\apereo\cas\authentication\handler\support\AbstractUsernamePasswordAuthenticationHandler.java

” Which is calling CAS Rest API for two factor authentication.

 

Code is look like this in our 6.5.8:

 

protected void transformPassword(final UsernamePasswordCredential userPass) throws FailedLoginException, AccountNotFoundException {
    if (StringUtils.isBlank(userPass.toPassword())) {
        throw new FailedLoginException("Password is null.");
    }

    LOGGER.debug("Attempting to encode credential password via [{}] for [{}]", this.passwordEncoder.getClass().getName(), userPass.getUsername());
    /* REST api */
    LOGGER.debug("Get token [{}]", userPass.getCustomFields().get("tokenid").toString());

    String password = new String(userPass.getPassword());

    if (!StringUtils.isBlank(userPass.getCustomFields().get("tokenid").toString())) {
        try {
            String passToken = password + "<tokenid>" + userPass.getCustomFields().get("tokenid").toString();
            password = "Token_" + URLEncoder.encode(passToken, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            System.out.println("Issue for encoding" + e.getMessage());
        }
    }

 

As 6.9.8 was complaining some deprecated code I changed code for 

String password = new String(userPass.getPassword()); 
 
to 
 
String password = userPass.toPassword();

 

So new code look like this:

protected void transformPassword(final UsernamePasswordCredential userPass) throws FailedLoginException, AccountNotFoundException {
    if (StringUtils.isBlank(userPass.toPassword())) {
        throw new FailedLoginException("Password is null.");
    }

    LOGGER.debug("Attempting to encode credential password via [{}] for [{}]", this.passwordEncoder.getClass().getName(), userPass.getUsername());
    /* REST api */
    LOGGER.debug("Get token [{}]", userPass.getCustomFields().get("tokenid").toString());

    String password = userPass.toPassword();



    if (!StringUtils.isBlank(userPass.getCustomFields().get("tokenid").toString())) {
        try {
            String passToken = password + "<tokenid>" + userPass.getCustomFields().get("tokenid").toString();
            password = "Token_" + URLEncoder.encode(passToken, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            System.out.println("Issue for encoding" + e.getMessage());
        }
    }

 

Do you think that is issue for expiring TGC ?

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/6f5e1d879fffcc4f50a0b84d7c1fb88750368f02.camel%40uvic.ca.

Ray Bon

unread,
Jul 13, 2023, 12:33:19 PM7/13/23
to cas-...@apereo.org
Niral,

It is possible that you can access the user session. If so, you can check the state of the TGT.

Ray

On Thu, 2023-07-13 at 14:08 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

We are using one tomcat only. I found we added code in  “cas-overlay-template\src\main\java\org\apereo\cas\authentication\handler\support\AbstractUsernamePasswordAuthenticationHandler.java

” Which is calling CAS Rest API for two factor authentication.

 

Code is look like this in our 6.5.8:

 

protected voidtransformPassword(finalUsernamePasswordCredential userPass)throws FailedLoginException,AccountNotFoundException{
    if(StringUtils.isBlank(userPass.toPassword

())) {
        throw newFailedLoginException("Password is null.");
    }

    LOGGER.debug("Attempting to encode credential password via [{}] for [{}]", this.passwordEncoder.getClass().getName(), userPass.getUsername());
    /* REST api */
    LOGGER.debug("Get token [{}]", userPass.getCustomFields().get("tokenid").toString());

    String password = newString(userPass.getPassword());

    if(!StringUtils.isBlank(userPass.getCustomFields().get("tokenid").toString())) {
        try{
            String passToken = password+ "<tokenid>"+ userPass.getCustomFields().get("tokenid").toString();
            password ="Token_"+ URLEncoder.encode(passToken,"UTF-8");
        } catch(UnsupportedEncodingExceptione) {
            System.out.println("Issue for encoding" +e.getMessage());
        }
    }

 

As 6.9.8 was complaining some deprecated code I changed code for

String password = new String(userPass.getPassword()); 
 
to 
 
String password = userPass.toPassword();

 

So new code look like this:

protected void transformPassword(final UsernamePasswordCredential userPass) throws FailedLoginException, AccountNotFoundException {
    if (StringUtils.isBlank(userPass.toPassword())) {
        throw new FailedLoginException("Password is null.");
    }

    LOGGER.debug("Attempting to encode credential password via [{}] for [{}]", this.passwordEncoder.getClass().getName(), userPass.getUsername());
    /* REST api */
    LOGGER.debug("Get token [{}]", userPass.getCustomFields().get("tokenid").toString());

    String password = userPass.toPassword();



    if(!StringUtils.isBlank(userPass.getCustomFields().get("tokenid").toString())) {
        try{
            String passToken = password+ "<tokenid>"+ userPass.getCustomFields().get("tokenid").toString();
            password ="Token_"+ URLEncoder.encode(passToken,"UTF-8");
        } catch(UnsupportedEncodingExceptione) {
            System.out.println("Issue for encoding" +e.getMessage());
        }
    }

 

Do you think that is issue for expiring TGC ?

 

 

 

 

 

 

 

 

From: cas-...@apereo.orgcas-...@apereo.org On Behalf Of Ray Bon
Sent: Friday, July 7, 2023 2:07 PM
To: cas-...@apereo.org
Subject: Re: [cas-user] CAS session management - Ticket Expiration Policies - CAS 6.5

 

WARNING: THIS IS AN EXTERNAL EMAIL THAT ORIGINATED OUTSIDE OF OUR EMAIL SYSTEM. DO NOT CLICK links / attachments unless you know that the content is safe! For suspicious emails, report using the Phish Alert Report button on the upper left of your email. For marketing/SPAM emails, delete.

 

Niral,

 

I would be surprised if there were any changes in the way tickets are handled by cas in the upgrade (it is fundamental in the way cas operates).

Spring is good at logging when there is a mismatch between your config and class properties. Is there anything in the logs that would suggest values are not being set?

 

Petr suggested using your browser's dev tools. If you step through the network traffic, you can see cookies and values being sent and you will see if a TGC is being resent [with a different value].

 

You do not need a real service to check cas's management of TGCs. I added a fake service to my service registry; I literally have this bookmark:

 

after login your browser will display a message about not findinghttps://blah (firefox displays: Hmm. We’re having trouble finding that site.), and in the address bar will be:

 

If you open a new tab and try to log in with the bookmark, you will not see the log in page but get redirected tohttps://blah with a new ST

Message has been deleted

Ray Bon

unread,
Jul 19, 2023, 9:38:27 PM7/19/23
to cas-...@apereo.org
Niral,


'Too many redirects' can happen when the client (stage.eclkc.info ?) does not process the login from cas correctly (the service ticket: ST...). 

Ray

P.S. This a different issue from expiration policies, you should create a new thread

On Wed, 2023-07-19 at 16:34 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

I am able to deploy cas.war file on server and it is working. Some how I am not able to access management endpoints. Do I have to add anything in cas.properties or as dependencies. I am getting this and also cas-managemnt displaying same error.

 

Niral Kunadia

unread,
Jul 20, 2023, 9:11:33 PM7/20/23
to cas-...@apereo.org

Thank you Ray,

 

I am able to access info, health and metrics endpoint after adding them in cas.properties. I would like to add ssoSession.

 

I am following this doc (CAS - Configuring SSO Sessions (apereo.github.io)). When I try to add dependencies in buil.gradle (CAS 6.6.9). I am getting this error.

 

How can I fix this?

 

Niral

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c6f3fa3c77f488c3b9e5e789e21928b927063856.camel%40uvic.ca.

Ray Bon

unread,
Jul 20, 2023, 9:44:35 PM7/20/23
to cas-...@apereo.org
Niral,

You can browse the repositories at https://oss.sonatype.org
The files are there. It could have been a network glitch. You can also download the file and install it yourself.

You can also paste the search url from the error output in your browser to see the file. 
Usually this kind of error is from a typo; though I do not see anything wrong.

Ray

On Thu, 2023-07-20 at 15:39 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Thank you Ray,

 

I am able to access info, health and metrics endpoint after adding them in cas.properties. I would like to add ssoSession.

 

I am following this doc (CAS - Configuring SSO Sessions (apereo.github.io)). When I try to add dependencies in buil.gradle (CAS 6.6.9). I am getting this error.

 

How can I fix this?

 

Niral

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf OfRay Bon

Niral Kunadia

unread,
Jul 21, 2023, 2:33:36 PM7/21/23
to cas-...@apereo.org

Ray,

 

I am using this for management app (cas-management-overlay/gradle.properties at 6.6 · apereo/cas-management-overlay · GitHub) and this as cas overlay for cas(GitHub - apereo/cas-overlay-template at 6.6).

 

I am able to create cas.war file and cas-management.war file. I deploy it to server http://*.com/ in /tomcat9/webapps/ folder. Both webapplication and cas are on same directory.  I have cas.properites and management.properties there.

 

Do I need to put all configs in cas.properies and don’t need management.properties as both are on same directory?

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf Of Ray Bon

Ray Bon

unread,
Jul 21, 2023, 2:41:28 PM7/21/23
to cas-...@apereo.org
Niral,

I have not tried to get sso session reports in cas management, just cas.
Did you try it in cas-overlay?

Ray

On Fri, 2023-07-21 at 17:49 +0000, 'Niral Kunadia' via CAS Community wrote:
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Ray,

 

I am using this for management app (cas-management-overlay/gradle.properties at 6.6 · apereo/cas-management-overlay · GitHub) and this as cas overlay for cas(GitHub - apereo/cas-overlay-template at 6.6).

 

I am able to create cas.war file and cas-management.war file. I deploy it to serverhttp://*.com/ in /tomcat9/webapps/ folder. Both webapplication and cas are on same directory.  I have cas.properites and management.properties there.

 

Do I need to put all configs in cas.properies and don’t need management.properties as both are on same directory?

 

 

 

From: cas-...@apereo.org <cas-...@apereo.org> On Behalf OfRay Bon

Niral Kunadia

unread,
Jul 22, 2023, 12:34:51 AM7/22/23
to cas-...@apereo.org

Ray,

 

Currently I am trying in cas. But we used to have it working for cas management and cas for older version which is not working with 6.6.9

 

Niral

Petr Bodnár

unread,
Jul 22, 2023, 4:41:12 AM7/22/23
to CAS Community, nkuna...@gmail.com
Hi Niral,

as Ray kind of suggested, I believe you really should start a new Conversation on the problem of getting CAS and/or cas-management's Dashboard sessions monitoring working. While it might help with the investigation (of which I'm not quite sure though), it seems to be big enough on its own.

Regarding the original topic of "expiring sessions", which I understand is still not resolved for you, I think we could help you more effectively if you provided at least a short wrap up of answers to questions from above. I think the crucial step that only you yourself can apparently do and evaluate (I suppose you cannot provide us with access to your testing CAS instance) is checking what happens with the TGC cookie in your browser console as described above. Also, it would help to make the situation more clear if you could answer the question about the expected re-posting of the login data on page refresh in your testing scenario. Believe me that these are the very basic questions that need to be answered, no matter if we are talking about CAS, or about any other web-based application which uses cookies. No clear repro, no clear answer.

Regarding your question of "influence of 2FA login customization", I think it is highly improbable that it could affect the way how CAS handles sessions - because a CAS session (i.e. also the TGC cookie) is created after the login process and it shouldn't be dependent on how the user logged in.

All that said, you can also try with a clean CAS with no customizations in order to make sure you are really investigating how to setup CAS correctly and not a side-effect of a customization.

Niral Kunadia

unread,
Jul 24, 2023, 9:56:40 AM7/24/23
to CAS Community, p.bo...@centrum.cz, Niral Kunadia
Thank you so much Both of you for replying. I will start new conversation. 
Reply all
Reply to author
Forward
0 new messages