How CAS authentication works
- The client requests access to a protected resource (e.g. BlueMind). This client is not authenticated on the CAS server.
- The server redirects the client to the CAS server for authentication.
- Once authenticated, a CAS cookie is placed in the client's web browser and the client is redirected to the protected resource with a ticket for validation.
- The BlueMind server sees this ticket and checks its authenticity with the CAS server. If authentication is successful, the server allows the client in and connects it as login_cas and places a BlueMind cookie in the client's web browser.
- The client requests access to the BlueMind server again. As it has the BlueMind cookie, it is authenticated automatically as long as the cookie is valid.
Installation
Install the needed package :
aptitude install bm-plugin-hps-cas
yum install bm-plugin-hps-cas
Restart BlueMind :
bmctl restart
Configuration
- You need to be connected as admin0 and go to System Management > System Configuration > Authentication tab.
- Select CAS as authentication mode from the drop-down menu and complete the related authentication settings:
- Save changes.
- Restart the bm-hps service.
Once CAS authentication is enabled, you will be automatically redirected to the CAS server when you access the authentication page. If you want to connect as admin0 or to another domain, go to the page: https://bm.domain.tld/native
This access always remains reachable in case of configuration problem to be able to access to the administration console to correct it.
Known errors
Error 403: Your user account does not exist in this BlueMind.
This error message means that the username entered to authenticate on the CAS does not exist in the domain domain.tld. You have two options:
- Create the user bound to the CAS username that does not pass through to the domain domain.tld
- Ignore the error. You can do this if some users from your CAS database do not have access to your BlueMind.
Error 500: Internal Server Error
This error message can have several causes. The easiest way to find out is to look at your server's HPS logs, using the command below, for instance:
cat /var/log/bm-hps/hps.log | grep CAS
Using a self-signed certificate or an unknown certification authority
If you use a self-signed certificate for your CAS server, or your CAS server's certification authority is not indexed, you will probably get an error message when you connect to the CAS server via https.
The easiest way to resolve this error is to import the certificate into the jvm keystore BlueMind uses.
keytool -import -trustcacerts -alias cas -file cert_racine.crt -keystore /usr/lib/jvm/bm-jdk/jre/lib/security/cacerts Enter keystore password: changeit