177bet login Philippines.Claim Your Free 999 Pesos Bonus Today

Resolved sparadrus
(@sparadrus)

9 years, 3 months ago

Hello,
I just discover WP and Authorizer and it’s wonderful extension ! Bravo ??

But i have a problem, when i want login to Jasig 3.53 (connect on AD),I have correctly redirected on sso server, i try to log with my sAMAccountName, and the ticket is just created, not validated.

On my SSO Server, hen i logout from https://mycasserver/cas/logout directly, i have this error :

2015-11-11 22:18:59,293 WARN [org.jasig.cas.util.HttpClient] – <Error Sending message to url endpoint [https://myexamplesite.fr/wp-login.php?external=cas]. Error is [sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]>

and on WP:

CAS Authentication failed!
You were not authenticated.
You may submit your request again by clicking here.
If the problem persists, you may contact the administrator of this site.

So, i have self-signed certificate on WP site and SSO server. I think is not a problem; but I have imported (on DER format) the certificate on my Webserver CA to my SSO server.. but it work with GLPI and oWncloud on the same webserver with phpCAS 1.3.3…

Have you a idea? Thanks ??
Regards

https://www.ads-software.com/plugins/authorizer/

Viewing 6 replies - 1 through 6 (of 6 total)

Plugin Author Paul Ryan
(@figureone)

9 years, 3 months ago

Hm, it sounds like you need to add the self-signed certificate for the WordPress server to the Java truststore on the SSO server, but you said you already did that…

Here’s the CAS authentication code in Authorizer:
https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L759-L823

You’ll notice that it updates its own copy of cacert from the cURL website every 3 months. Can you also try adding your self-signed certificate to this truststore? It should be in the Authorizer plugin directory (/wp-content/plugins/authorizer/inc/cacert.pem).

Thread Starter sparadrus
(@sparadrus)

9 years, 1 month ago

Hello, thanks for your reply.
I’v reinstalled my cas server with a trust certificate from GlobalSign.
I’ve the same error.
Also, I havent compiled JAsig for SAML feature.
Regards

Plugin Author Paul Ryan
(@figureone)

9 years, 1 month ago

SAML might be the issue–the plugin is configured to use SAML 1.1 when connecting to the CAS server.
https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L821
https://developer.jasig.org/cas-clients/php/current/docs/api/group__publicInit.html#ga15e9a325862a20edfbd9e862b49738a5
https://developer.jasig.org/cas-clients/php/1.1.0RC4/docs/api/group__public.html

Can you try changing the server version in line 821 of authorizer.php and see if that resolves the issue? your options are:
SAML_VERSION_1_1
CAS_VERSION_2_0
CAS_VERSION_1_0

If that works, I can make that a configurable option so you can choose your server version. However, I’m not sure it will work without SAML, since the plugin relies on the release of SAML attributes (like email address) to authenticate.

autredr
(@autredr)

9 years, 1 month ago

Hello

For our case such an option in the configuration page would have helped as well. Anyway I solved it exactly the way you mentioned it and I confirm it works.

—
Regards
Dries

Plugin Author Paul Ryan
(@figureone)

9 years ago

I’ve added this option and will include it in the next version (2.4.0). Thanks again!
https://github.com/uhm-coe/authorizer/commit/87babfa84cba98bd127813415619e40a0281f296

Plugin Author Paul Ryan
(@figureone)

9 years ago

New version (2.4.0) is now out with this feature. Please let me know if you discover any problems!
https://www.ads-software.com/plugins/authorizer/changelog/

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Ticket not validated’ is closed to new replies.