Hi Suelane,

I’d suggest you try these 2 minor changes to the web.xml file:

1. Change the serverName section - from:

<param-name>serverName</param-name>

<param-value>http://143.107.102.247:8080/hubs-webapp/</param-value>

</context-param>

to:

<param-name>serverName</param-name>

<param-value>http://143.107.102.247:8080http://143.107.102.247:8080/hubs-webapp/</param-value>

</context-param>

<param-name>contextpath</param-name>

<param-value>/hubs-webapp</param-value>

</context-param>

2. Change the server uriFilterPattern to:

<context-param>

<param-name>uriFilterPattern</param-name>

<param-value>/*</param-value>

</context-param>

I also note you are missing a few filter settings that we use in our version of hub-webapp. I’ve attached a sample “web.xml” file that you should look at, to check against, if the above changes do not work.

Regards

Nick -- Nick dos Remedios Atlas of Living Australia http://www.ala.org.au/

From: "Suelane G. Fontes" <suelane@uol.com.brmailto:suelane@uol.com.br> Date: Thursday, 17 April 2014 5:22 am To: "ala-portal@lists.gbif.orgmailto:ala-portal@lists.gbif.org" <ala-portal@lists.gbif.orgmailto:ala-portal@lists.gbif.org>, "support@ala.org.aumailto:support@ala.org.au" <support@ala.org.aumailto:support@ala.org.au> Subject: Cas Authentication - Hubs-Webapp

Hi all,

We need to enforce the users to authenticate before have access to ALA-PORTAL..

We found a authentication enforcement in ala-collectory module, when the user tries to access the “admin” page, using JASIG Cas server.

We performed the following steps to test the authentication:

We deployed an instance of JASIG Cas server (http://www.jasig.org/cas) in server: http://143.107.102.247:65002/cas-server-webapp-3.4.12.1http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogin&sa=D&sntz=1&usg=AFQjCNH3vG0Ka4sLQzPoHwActqlfWHpv0g.

We configured the ala-collectoy to enforce authentication in file: ala-collectory-0.1.0/ala-collectory/grails-app/conf/config.groovy , using the following code:

/******************************************************************************\

* SECURITY ******************************************************************************/ if (!security.cas.uriFilterPattern) { security.cas.uriFilterPattern = "/admin.*,/collection.*,/institution.*,/contact.*,/reports.*," + "/providerCode.*,/providerMap.*,/dataProvider.*,/dataResource.*,/dataHub.*,/manage/.*" } if (!security.cas.loginUrl) { security.cas.loginUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/loginhttp://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogin&sa=D&sntz=1&usg=AFQjCNH3vG0Ka4sLQzPoHwActqlfWHpv0g" } if (!security.cas.logoutUrl) { security.cas.logoutUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/logouthttp://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Flogout&sa=D&sntz=1&usg=AFQjCNHehugoZZSv8DVSUX-3YHdqFzEY6A" } if (!security.apikey.serviceUrl) { security.apikey.serviceUrl = "http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/apikey/ws/check?apik...http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2Fapikey%2Fws%2Fcheck%3Fapikey%3D&sa=D&sntz=1&usg=AFQjCNGqC95eT2XCTZg-6Vh_63edJG7VyA" } if(!security.cas.appServerName){ security.cas.appServerName = "http://143.107.102.247:65002http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002&sa=D&sntz=1&usg=AFQjCNH5k83H3rCfxq9G6357RoRk2vu4yA" } if(!security.cas.casServerName){ security.cas.casServerName = "http://143.107.102.247:8080http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A8080&sa=D&sntz=1&usg=AFQjCNHNS4B3AfRd4bnMHSoxOVwzDisprw" } if(!security.cas.uriExclusionFilterPattern){ security.cas.uriExclusionFilterPattern = '/images.*,/css.*,/js.*,/less.*' } if(!security.cas.authenticateOnlyIfLoggedInPattern){ security.cas.authenticateOnlyIfLoggedInPattern = "" // pattern for pages that can optionally display info about the logged-in user } if(!security.cas.casServerUrlPrefix){ security.cas.casServerUrlPrefix = 'http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/'http://www.google.com/url?q=http%3A%2F%2F143.107.102.247%3A65002%2Fcas-server-webapp-3.4.12.1%2F%27&sa=D&sntz=1&usg=AFQjCNGRqmrqERZlp6oeLUpeJlC8LhUNqA } if(!security.cas.bypass){ security.cas.bypass = true } if(!disableAlertLinks){ disableAlertLinks = false }

if(!disableOverviewMap){ disableOverviewMap = false }

then, we tried to access the admin section of ala-collectory browser. Which worked perfectly: the ala-collectory redirected the call to CAS server login page, and after the user provides correct username and password the user is redirected again to admin-section of ala-collectory.

We would like to enforce the same authentication in ala-hubs, as shown in the figure adapted from wiki (attached).

We followed the steps in wiki:

https://code.google.com/p/ala-bie/wiki/Authentication#Example_web.xml_config... .

In pom.xml of hubs-webapp directory we included the following code:

<dependency>

<groupId>org.jasig.cas</groupId>

<artifactId>cas-client-core</artifactId>

<version>3.1.10</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>au.org.ala</groupId>

<artifactId>ala-cas-client</artifactId>

<version>2.0-SNAPSHOT</version>

<type>jar</type>

<scope>compile</scope>

<exclusions>

<exclusion>

<groupId>javax.servlet</groupId>

<artifactId>servlet-api</artifactId>

</exclusion>

</exclusions>

</dependency>

In web.xml file we included the following code:

<!-- CAS Authentication related properties -->

<context-param>

<!-- Parameter used by CAS filters -->

<param-name>serverName</param-name>

<param-value>http://143.107.102.247:8080/hubs-webapp/</param-value>

</context-param>

<context-param>

<param-name>casServerName</param-name>

<param-value>http://143.107.102.247:8080http://143.107.102.247:8080/</param-value>

</context-param>

<context-param>

<param-name>uriFilterPattern</param-name>

<param-value>/, /occurrences/\d+, /occurrences/search, /explore/your-area</param-value>

</context-param>

<!-- CAS Authentication Service filters -->

<filter>

<filter-name>CAS Authentication Filter</filter-name>

<filter-class>au.org.ala.cas.client.UriFilter</filter-class>

<init-param>

<param-name>filterClass</param-name>

<param-value>org.jasig.cas.client.authentication.AuthenticationFilter</param-value>

</init-param>

<init-param>

<param-name>casServerLoginUrl</param-name>

<param-value>http://143.107.102.247:65002/cas-server-webapp-3.4.12.1/login</param-value>

</init-param>

<init-param>

<param-name>gateway</param-name>

<param-value>true</param-value>

</init-param>

</filter>

<filter>

<filter-name>CAS Validation Filter</filter-name>

<filter-class>au.org.ala.cas.client.UriFilter</filter-class>

<init-param>

<param-name>filterClass</param-name>

<param-value>org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</param-value>

</init-param>

<init-param>

<param-name>casServerUrlPrefix</param-name>

<param-value>http://143.107.102.247:65002/cas-server-webapp-3.4.12.1</param-value>

</init-param>

</filter>

<filter>

<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>

<filter-class>au.org.ala.cas.client.UriFilter</filter-class>

<init-param>

<param-name>filterClass</param-name>

<param-value>au.org.ala.cas.client.AlaHttpServletRequestWrapperFilter</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>CAS Authentication Filter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CAS Validation Filter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<filter-mapping>

<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

then we deployed the hubs-webapp.war in tomcat server. Unfornatelly, when the user access ala-webapp no autentication is asked by ala-portal.

What we need to do in order to enforce all the users to autenticate in jasig cas before have access to hubs-webapp?

Regards,

Suelane/Silvio