<div dir="ltr">I forgot to mention also the logout URL in the following:<div><br></div><div><div> <beans:bean id="logoutHandler" class="com.evolveum.midpoint.web.security.AuditedLogoutHandler"></div><div> <beans:property name="defaultTargetUrl" value="<a href="https://SERVERURL/cas/logout">https://SERVERURL/cas/logout</a>"/></div><div> </beans:bean></div></div><div><br></div><div>JASON</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 3, 2015 at 11:11 AM, Jason Everling <span dir="ltr"><<a href="mailto:jeverling@bshp.edu" target="_blank">jeverling@bshp.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I have successfully got this working so I wanted to post it so that if you wanted to include it on your wiki, maybe clean it up so that the steps look nicer!<div><br></div><div>CAS Usernames must match midPoint user "name"<br><div><div><br></div><div>In this example I am using Apache with Tomcat 7, auth-cas and mod-jk</div><div><br></div><div>Assumed Configuration:</div><div><br></div><div>Apache installed and configured with SSL</div><div>Tomcat installed and configured working already with midPoint</div><div><br></div><div><b>Apache Configuration</b></div><div><br></div><div>sudo apt-get install libapache2-mod-jk libapache2-mod-auth-cas</div><div><br></div><div><br></div><div>1. Configure mod-jk</div><div><br></div><div>Create a workers.properties file in /etc/apache2</div><div><br></div><div>sudo vi /etc/apache2/workers.properties</div><div><br></div><div>Add the following</div><div><br></div><div>worker.list=worker1</div><div>worker.worker1.port=8009</div><div>worker.worker1.host=localhost</div><div>worker.worker1.type=ajp13</div><div><br></div><div>2. Configure apache2 sites</div><div><br></div><div>sudo vi /etc/apache2/sites-available/default-ssl.conf</div><div><br></div><div>Add the following below the first default DocumentRoot /var/www/html</div><div><br></div><div><span style="white-space:pre-wrap"> </span><Location ~ "/midpoint*"></div><div> <span style="white-space:pre-wrap"> </span>AuthType CAS</div><div> <span style="white-space:pre-wrap"> </span>AuthName "CAS"</div><div> <span style="white-space:pre-wrap"> </span>require valid-user</div><div> <span style="white-space:pre-wrap"> </span>CasAuthNHeader Cas-User</div><div><span style="white-space:pre-wrap"> </span></Location></div><div><br></div><div><span style="white-space:pre-wrap"> </span>JkMount /midpoint* worker1<span style="white-space:pre-wrap"> </span></div><div><br></div><div>3. Configure auth-cas</div><div><br></div><div>sudo vi /etc/apache2/mods-available/auth_cas.conf</div><div><br></div><div>Add the following</div><div><br></div><div>CASCookiePath /var/cache/apache2/mod_auth_cas/</div><div>CASLoginURL <a href="https://SERVERURL/cas/login" target="_blank">https://SERVERURL/cas/login</a></div><div>CASValidateURL <a href="https://SERVERURL/cas/serviceValidate" target="_blank">https://SERVERURL/cas/serviceValidate</a></div><div>CASDebug Off</div><div>CASValidateServer On</div><div>CASVersion 2</div><div>CASSSOEnabled On</div><div>#Below is needed, auth-cas will use the server hostname in the service URL redirect so we will override that, do not add a trailing / or add /midpoint!</div><div>CASRootProxiedAs <a href="https://MIDPOINTSERVERURL" target="_blank">https://MIDPOINTSERVERURL</a></div><div><br></div><div>Restart Apache2</div><div><br></div><div>sudo service apache2 restart</div><div><br></div><div><b>Tomcat Configuration</b></div><div><br></div><div>1. Confgure tomcat to use the AJP connector</div><div><br></div><div>sudo vi /var/lib/tomcat7/conf/server.xml</div><div><br></div><div>Uncomment the following so that it reads</div><div><br></div><div> <!-- Define an AJP 1.3 Connector on port 8009 --></div><div><br></div><div> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /></div><div><span style="white-space:pre-wrap"> </span></div><div><b>Midpoint Configuration</b></div><div><br></div><div>1. Edit ctx-web-security.xml</div><div><br></div><div>sudo vi /var/lib/tomcat7/webapps/ctx-web-security.xml</div><div><br></div><div>Uncomment the following so that reads</div><div><br></div><div><span style="white-space:pre-wrap"> </span><!-- For SSO integration use the following: --></div><div> <custom-filter position="PRE_AUTH_FILTER" ref="requestHeaderAuthenticationFilter" /></div><div><br></div><div>Edit the following value "principalRequestHeader" in the bean "requestHeaderAuthenticationFilter" so that it reads</div><div><br></div><div> <!-- Following bean is used with pre-authentication based on HTTP headers (e.g. for SSO integration) --></div><div> <beans:bean id="requestHeaderAuthenticationFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"></div><div><span style="white-space:pre-wrap"> </span> <beans:property name="principalRequestHeader" value="Cas-User"/></div><div><span style="white-space:pre-wrap"> </span> <beans:property name="authenticationManager" ref="authenticationManager" /></div><div><span style="white-space:pre-wrap"> </span></beans:bean></div><div><span style="white-space:pre-wrap"> </span></div><div>Finally restart tomcat7</div><div><br></div><div>sudo service tomcat7 restart</div><div><br></div><div>User can now login to midPoint using CAS</div></div></div><div><br></div><div>Thanks,</div><div>JASON</div></div>
</blockquote></div><br></div>
<br>
<font size="2"><br><br>CONFIDENTIALITY NOTICE:<br>This e-mail together with any attachments is proprietary and confidential; intended for only the recipient(s) named above and may contain information that is privileged. You should not retain, copy or use this e-mail or any attachments for any purpose, or disclose all or any part of the contents to any person. Any views or opinions expressed in this e-mail are those of the author and do not represent those of the Baptist School of Health Professions. If you have received this e-mail in error, or are not the named recipient(s), you are hereby notified that any review, dissemination, distribution or copying of this communication is prohibited by the sender and to do so might constitute a violation of the Electronic Communications Privacy Act, 18 U.S.C. section 2510-2521. Please immediately notify the sender and delete this e-mail and any attachments from your computer. </font><br>