How to fix Error in uPortal CAS Authentication after configuring SSL

Eduardo Fonseca

unread,

Dec 28, 2016, 11:33:47 AM12/28/16

to uPortal Community

Hello,

I am configuring uPortal and we are researching about integrating it's built-in CAS authentication with a client app running on php.

I have had good progress but got to a point where I am able to authenticate with the phpCAS but the uPortal authentication ends up broken.

I am using Tomcat 7, and followed the steps to configure SSL on port 8443

so enabled this connector:

<Connector

protocol="org.apache.coyote.http11.Http11NioProtocol"

port="8443" maxThreads="200"

scheme="https" secure="true" SSLEnabled="true"

keystoreFile="${user.home}/.keystore" keystorePass="uportal"

clientAuth="false" sslProtocol="TLS"/>

also made sure that the uPortal configuration is correctly setup for CAS authentication on port 8443 with localhost as hostname, in cas.properties and local.properties.

uportal runs, I can navigate to the Sign In page, I can input the username and password, however, once I click Login, I get the following result

We're sorry, but an error has occurred.

Please contact your uPortal administrator and provide the following information:

Your name and user id

What content were you trying to view when this error occurred

Any other useful information to help reproduce the error

This is the url on the Login page:

https://localhost:8443/cas/login?service=https://localhost:8443/uPortal/Login

This the the url where is redirecting:

https://localhost:8443/uPortal/Login?ticket=ST-6-epyfNTUobxy1U4mvrjqg-localhost

I'm using a self signed certificate as specified in the SSL configuration for Tomcat 7

https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

However when using the php application I can authenticate

Successfull Authentication!

Current script

index.php

session_name():

PHPSESSID

session_id():

ST-7-mla0RUWx4GX1mSsdPJd9-localhost

the user's login is admin.

phpCAS version is 1.3.4+.

Logout

Also, if I set tomcat and uportal to go back to use http, and port 8080, uPortal login works again.

Any ideas what I need to do so the uPortal authentication does not break when using https, SSL, and port 8443?

I'm using Tomcat 7, uPortal 4.3.1 and it's built-in CAS server

Benito J. Gonzalez

unread,

Dec 28, 2016, 12:16:28 PM12/28/16

to Eduardo Fonseca, uPortal Community

Hi Eduardo,

Did you update the server/port and protocol for uPortal in the filters
file you are using? The default one is filters/local.properties.

-bjagg

On 12/28/2016 08:33 AM, Eduardo Fonseca wrote:
> Hello,
> I am configuring uPortal and we are researching about integrating it's
> built-in CAS authentication with a client app running on php.
> I have had good progress but got to a point where I am able to
> authenticate with the phpCAS but the uPortal authentication ends up broken.
>
> I am using Tomcat 7, and followed the steps to configure SSL on port 8443
> so enabled this connector:

> *
> *
> * *
> * <Connector*
> * protocol="org.apache.coyote.http11.Http11NioProtocol"*
> * port="8443" maxThreads="200"*
> * scheme="https" secure="true" SSLEnabled="true"*
> * keystoreFile="${user.home}/.keystore"
> keystorePass="uportal"*
> * clientAuth="false" sslProtocol="TLS"/>*

>
> also made sure that the uPortal configuration is correctly setup for CAS
> authentication on port 8443 with localhost as hostname, in
> cas.properties and local.properties.
>
> uportal runs, I can navigate to the Sign In page, I can input the
> username and password, however, once I click Login, I get the following
> result
>

> *We're sorry, but an error has occurred.*
> *
> *
> *Please contact your uPortal administrator and provide the following
> information:*
> *
> *
> *Your name and user id*
> *What content were you trying to view when this error occurred*
> *Any other useful information to help reproduce the error*

>
> This is the url on the Login page:
> https://localhost:8443/cas/login?service=https://localhost:8443/uPortal/Login
> <https://localhost:8443/cas/login?service=https://localhost:8443/uPortal/Login>
>
> This the the url where is redirecting:
> https://localhost:8443/uPortal/Login?ticket=ST-6-epyfNTUobxy1U4mvrjqg-localhost
> <https://localhost:8443/uPortal/Login?ticket=ST-6-epyfNTUobxy1U4mvrjqg-localhost>
>
> I'm using a self signed certificate as specified in the SSL
> configuration for Tomcat 7
> https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
> <https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html>
>
> However when using the php application I can authenticate

> *Successfull Authentication!*
> *
> *
> *Current script*
> *index.php*
> *session_name():*
> *PHPSESSID*
> *session_id():*
> *ST-7-mla0RUWx4GX1mSsdPJd9-localhost*
> *the user's login is admin.*
> *
> *
> *phpCAS version is 1.3.4+.*
> *
> *
> *Logout*
> *
> *

> Also, if I set tomcat and uportal to go back to use http, and port 8080,
> uPortal login works again.
>
> Any ideas what I need to do so the uPortal authentication does not break
> when using https, SSL, and port 8443?
>
> I'm using Tomcat 7, uPortal 4.3.1 and it's built-in CAS server
>

> --
> You received this message because you are subscribed to the Google
> Groups "uPortal Community" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to uportal-user...@apereo.org
> <mailto:uportal-user...@apereo.org>.
> Visit this group at
> https://groups.google.com/a/apereo.org/group/uportal-user/.

--
Benito J. Gonzalez
Software Developer
Unicon, Inc.
Voice: 480.558.2360
Text: 209.777.2754
Email: bgon...@unicon.net
GitHub: bjagg
GitLab: bjagg
BitBucket: bjagg

Eduardo Fonseca

unread,

Dec 28, 2016, 12:25:01 PM12/28/16

to uPortal Community, efon...@gmail.com

Hello, yes I did, I was looking at the logs and I found an error building the path to the certificate, not sure if this may be the cause of the issue.

I did run the command to create the keystore and set the correct password in server.xml for Tomcat.

BTW, I'm using Windows.

Dec 28, 2016 9:22:30 AM org.apache.catalina.core.StandardWrapperValve invoke

SEVERE: Servlet.service() for servlet [AuthenticationDispatcherServlet] in context with path [/uPortal] threw exception

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:341)

at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:305)

at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:50)

at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:208)

at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:169)