cas/login page not found
I have set up the CAS module in controller and the client site I have configured the CAS client properly looking at all the tutorials and the guidlines in CAS documentation. But I still dont get why am I getting this error:
"The requested URL /cas/login was not found on this server.
Apache/2.2.14 (Ubuntu) Server at federation.org Port 443"
About the server we dont have a CAS server but as the documentation says the CAS server component in the CAS module enabled in the controller site acts as CAS server but the error says it cant find cas/login page .I have googled and now I am in a confusion to have a single sign on working do we need to set up a CAS sever or does the drupal controller site(on which the CAS Server is enabled) acts as a CAS server?.
I also have another doubt if the CAS module can be used to set up single sign on on sites set up on multiple domains.
My doubts can be little foolish but I am working with the authentication modules for the first time
PLease help me give me any directions to set up the single sign on using CAS on sites set up on multiple domains.

CommentFileSizeAuthor
#29 caslog01.txt8.42 KBsstedman
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

metzlerd’s picture

It is difficult to help without more specifics of your configuration.

If you enable the CAS Server module on one drupal site (s) and enable the client module on another drupal site (c) then you can get CAS to enable single sign on for this site. Some steps to make sure you're ready for this:

1.) Cas requires SSL, which means site s must be accessible via an https url. For example https://myserver.example.com/mysite. make sure that you can access this before configuring cas client.

2.) If your cas server is configured correctly above, you can configure your cas settings on the client site c with the following settings
* server - myserver.example.com
* port - 443
* uri - mysite/cas

The servers need not be in the same domain. Hopefully this answers your question. If not, please respond with more specifics.

sri4u87’s picture

hey metzlerd
Thanks for th reply
Let me first give you some more specifications of my drupal client and server site set up.

I have this drupal server site named federation.org which I have configured such that it is accessed using both HTTP and HTTPS protocols.I have tested the https://federation.org before configuring the CAS client module in the client website(testog.org) is configured and it is accessible thru https protocol. Both the drupal sites are set up on the same server with same ip address but with different domain names and databases.
But when I tried to login using the CAS login on the client site I was redirected to the URL:
https://federation.org/cas/login?service=http%3A%2F%2Ftestog.org%2Fcas%3...

where testog.org is my client website.and resulted in 404 error

The requested URL /cas/login was not found on this server.
Apache/2.2.14 (Ubuntu) Server at federation.org Port 443

I have these questions :
can I have my client site (site c) simply on http and not on ssl i.e https?
or do the site client also requires the ssl to be set up?

I have my site server (sites s) accessible both the ways http and https does this create a problem ?
If so can I use any secure login module to make few of the pages of the site use ssl and some not(http) is this acceptable in case of CAS server (site s) ?

DO my organisation need a CAS server being set up some where for this module to work?

" The requested URL /cas/login was not found on this server.
Apache/2.2.14 (Ubuntu) Server at federation.org Port 443"

looking at the above error I still wonder if I have to set up some thing else on the cas server module or do i have to configure it in any other ways

PLease help me with this and please let me know if you need any details.

metzlerd’s picture

Some answers:
The cas client site can be http: only.

The fact that you are getting an Apache (Ubuntu) error message and not a Drupal 404 page leads me to believe that you still have an https configuration problem. Are all pages available via https: on your drupal site? What happens when you go to https://federation.org/user/login directly. Do you still get your sites s user login page?

You do not need to set up a JaSIG Cas Server for this to work. The drupal cas server module enabled on site (s) should work as a functional replacement for the JaSIG CAS server.

sri4u87’s picture

Sorry for the late reply.
The clean URLS were disabled on my https site and so the cas client couldnt find the URL /cas/login
but know since I have them enabled the client site(c) on using the CAS login is redirected to the controller site or CAS_server site(s).

But know I have 2 more issues
My client site is testog.org
My CAS_server site is https://federation.org

Now let me tell you little about by apache configuration I have configured federation.org such that it can be accesed by both http and https protocol and my client site testog.org is on http protocol.

1) Now the issue is when I try to login using the CAS login button on the client login page(testog.org) I am redirected to https://federation.org but when I login with credentials then there is a redirection to the client site where there is a WSOD the url is "http://testog.org/cas?destination=node&ticket=ST-JXHQUbdREz " .
When I hit the back button it redirects me to https:federation.org and give me this notice " Notice: Undefined index: service in cas_server_login() (line 89 of /var/www/drupal-sites/drupal7fed/sites/all/modules/cas/cas_server.module)."

2) the other issue is when there is some user (already registered in client site and server site) logged in the main site or the site(server) and if I open the client site and try to loginvia CAS the page redirects to "http://testog.org/cas?destination=node&ticket=ST-6mp4vxsgAV" which is again a WSOD

I still think that I am some where wrong with my apache config because the redirections were correct but since there are WSODS I am not able to predict any thing please help me with this concern.

DO you think the configuring of my server site to be accesible in both http and https might be the root cause for all this.I am little confused in this regard because there are lot of sites which use https and http for the same site or may be few pages of site using http and rest with https.I am not sure if it is the issue .I am trying to implement the SSO from several client to a drupal CAS server site in which I will have some http and some HTTPS pages do you think it will be a trouble for CAS SSO to work?.

Any direction or help in this regard is appreciated .

Thanks and sorry for the long description.

sri4u87’s picture

I am sorry but I just realized that the php curl module was not installed.I just installed it and now it redirects to
the cas login page i.e "https://federation.org/user?destination=cas/login" and now I am getting another
error :

" CAS Authentication failed!

You were not authenticated.

You may submit your request again by clicking here.

If the problem persists, you may contact the administrator of this site.
phpCAS 1.3.1 using server https://federation.org/cas/ (CAS 2.0)
Skip to main content
drupal7
Error
The website encountered an unexpected error. Please try again later.
Error message:
CAS_AuthenticationException: in CAS_Client->validateCAS20() (line 2753 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/CAS/CAS/Client.php). "

from this page now when I access the login page where I logged in (server site login page ) server site I see I am logged in but I get this notice again
" Notice: Undefined index: service in cas_server_login() (line 89 of /var/www/drupal-sites/drupal7fed/sites/all/modules/cas/cas_server.module)."
plaese help me with this.

metzlerd’s picture

Making progress.

Just to be clear, make sure that CAS module is not enabled on the CAS server site.

On the CAS client site under cas settings enable debugging and attach the log file. We should be able to figure out the problem from there.

sri4u87’s picture

Thanks for the reply metzlerd
same error as above and in addition it also says

Warning: touch(): Unable to create file casbugg because Permission denied in phpCAS::log() (line 472 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/CAS/CAS.php).

Warning: error_log(casbugg): failed to open stream: Permission denied in phpCAS::log() (line 482 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/CAS/CAS.php).

and also I found the field
CAS debugging output filename in
"Miscellaneous & Experimental Settings "
but there is no check box to enable. all I did is put a file name(I named it "casbugg") in the input field and saved the form I think that should do ?

and also I have checked and make sure that the only CAS server in enabled on site (Server)
and CAS module is enabled in site (Client).

Also do you have a authentication server drupal site that I may use to see if my client is configured properly

That way we can figure out with which part of the module I have my problem right now like is it site (C, module CAS client) or Site (S, module CAS Server).

sri4u87’s picture

some more progress but still there is an error

"A new account could not be created for testloginfed. The username is already in use on this site."

where testloginfed is a user in both the sites and when I tried to login via CAS from the client site it took me to server site logged there with the credentials and I am redirected back to client site with the following error:
"A new account could not be created for testloginfed. The username is already in use on this site."

and also seen the sites become slow because I think there is some internal looping to check for the user in mysql database.do you think it is just another looping issue if so is it some thing similar to http://drupal.org/node/1086748

i.e "having some trouble with session initialization in your PHP environment? "

please help me with this.

metzlerd’s picture

The error regarding testloginfed already existing means that you need to configure the cas user name on your client site. Edit the user account and specify the cas user name to be the same as the user name on the server side. If you're going to precreate useraccounts, you want to make sure to fill in the cas user name field.

sri4u87’s picture

Wonderful module
no doubt it worked
but now I have 2 more issues to be solved

ONE-> how can I get my users in the client site have a CAS username similar to their username so that it becomes easy for them to login.

TWO -> Single sign out issue I have found this patch metzlerd at this issue http://drupal.org/node/1043640

http://drupal.org/files/issues/1043640-cas7_0.patch
just wanted to know where is it applied it says on cas.module where in cas server enabled site or cas module enabled site (I know this que is silly but a little confused)
and also u mentioned it to be applicable to 7.1 is it for recom versions or dev version?

bfroehle’s picture

Regarding your second point, you can upgrade to version 7.x-1.2.

metzlerd’s picture

Assuming that all your users on site c have a cas user name that is the same as their drupal user name then running the following mysql query would do the trick:

insert into cas_user (uid,cas_name)
(SELECT uid,name from users u where not exists(
select 1 from cas_user c WHERE c.uid=u.uid)
AND uid<>0)

sri4u87’s picture

Hi bfroehle
Thanks for the reply. I have just installed the 7x-1.2 version and it didn't worked instead it has an additional issue when I was using 7x-1.1 if I logged out it main site it worked and logged me out from the other sites too but it was not doing the same when I was trying to log out in a client site. Where as in 7x1.2 it became more of an individual log out totally ie even if iam logged out in main site it doesnt logs me out from client sites instead I have to log out manually from all the client sites.I cleared the caches and tried it again but it didnt change. I have also read thru the readme file but it seems that both versions have similar settings. I still wonder if I am missing anything.

metzlerd’s picture

The cas server module must be at 7.x-1.x-dev for single sign out to work. CAS clients can be at 7.x-1.2.

sri4u87’s picture

Hi metzlerd
Thanks for the reply but I am wondering If I can use the dev version on a site which has to be published and go into production.Is it stable to use the dev version on the production site.

metzlerd’s picture

It is pretty stable, and is not undergoing many changes. There is one issue about cas tickets that prevented this feature from going into stable release, but it should work for your purposes.

sri4u87’s picture

Hi metzlerd

error PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'valid' in 'field list': SELECT service, ticket, valid FROM {cas_server_tickets} WHERE uid= :uid; Array ( [:uid] => 1 ) in cas_server_logout_clients() (line 254 of /var/www/drupal-sites/drupal7fed/sites/all/modules/cas/cas_server.module).

This error comes up when I used 7.1x DEV version of drupal cas module for cas server (drupal site server) is it the same issue you were talking about?

bfroehle’s picture

I suspect you need to run your update.php script.

sri4u87’s picture

Just ran the update.php and resulted in this exception.

cas_server module
Update #7000

Failed: DatabaseSchemaObjectExistsException: Table cas_server_tickets already exists. in DatabaseSchema->createTable() (line 657 of /var/www/drupal-sites/drupal7fed/includes/database/schema.inc).

sri4u87’s picture

Sorry for the trouble but the module was not uninstalled properly.Now it works fine.

sri4u87’s picture

Issues with single sign out

I have set up the cas module in two sites(client a and client b) and CAS server on another site(server site).
When I tried to single sign out on site 'client a' I was logged out of the 'client a' and main site (server site) but I was not logged out of site client b.Now when I try to logout from site client b using CASLOGOUT Iogout I get this following notice and warning.

Notice: Undefined property: stdClass::$name in cas_server_logout() (line 233 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/cas_server.module).
Warning: session_destroy(): Trying to destroy uninitialized session in cas_server_logout() (line 238 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/cas_server.module).

from the above warning it is clear that the main site(server site) cas session is already terminated due to the first CAS logout I was wondering how to make the other client sites to log the user out once he is logged out of main site.
Please help me in this regard any pointers are appreciated.

metzlerd’s picture

Can you tell us the Client and server versions you are using?

sri4u87’s picture

Hi David

Thanks for the immediate reply.

oh oops sorry
yeah sure both the clients are on 7.X-1.2
and the server is on 7.x-1.x-dev

as I said the CAS sign out happens in the client site where you clicked the button (Lets say client A ) now I am logged out of server site and client A(same user in all three sites client A client B and server site) but when I go to client B I see that I am still logged in and when again I do a CAS logout in client B I get the warning and notice

Notice: Undefined property: stdClass::$name in cas_server_logout() (line 233 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/cas_server.module).
Warning: session_destroy(): Trying to destroy uninitialized session in cas_server_logout() (line 238 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/cas_server.module)

Upto my knowledge I think since the first CAS logout actually destroys the CAS session with main site it is giving a warning when I am trying to do it with the client B site but then how to achieve CAS single sign out then?
is there any thing I am missing here I have enabled CAS login and CAS logout menu links in navigation for both the client sites(client A client B).Am I suppose to set up some thing in the CAS server site too?

bfroehle’s picture

As an un-authenticated user, if you visit https://your_cas_server/cas/logout, do you get the same error message?

Dave, it looks like we need to do one of two things:
(1) Protect against users not being logged in in cas_server_logout; or
(2) Switch the access callback for 'cas/logout' to 'user_is_logged_in'.

sri4u87’s picture

Hi Bfreohle

Yes even if I go to https://your_cas_server/cas/logout
as an un authenticated user I get the same notice and warning.

Notice: Undefined property: stdClass::$name in cas_server_logout() (line 233 of /var/www/drupal-s1ites/drupal7organic/sites/all/modules/cas/cas_server.module).
Warning: session_destroy(): Trying to destroy uninitialized session in cas_server_logout() (line 238 of /var/www/drupal-sites/drupal7organic/sites/all/modules/cas/cas_server.module).

sri4u87’s picture

Hey I am cheking back to see if the single sign out issue was dealt with I think I can help in this scenario.
I also have few questions about how to add already existing users once the CAS is installed is it possible if so how?

sstedman’s picture

Metz, first of all thanks for your work on this project.

After much testing, this is the only reference that I've found that the link from the client site cannot be on an https page. On my client site, using Secure Pages and linking to the CAS Server from every page is a requirement. Is there any way to login to CAS Server from an https page on the CAS Client? Perhaps a patch or hook that could allow this to happen?

metzlerd’s picture

It doesn't matter wether the page is secure or not on the client side. It will work equally well both ways. The cas server module MUST be https, but the client can be http or https. If you have secure pages on the client it should take care of it. I actually generally just set the base url in settings.php so that every page gets https: rather then secure pages when I need a whole site https. But I have many sites where the cas clients are https only pages without any issues. Are you having a specific problem with this configuration?

sstedman’s picture

FileSize
8.42 KB

Thanks for your fast response. Your comment in #3 led me to believe that the client could not be http.

I can log into the CAS server from the client site just fine in http.

When I try to log into the CAS server from an https page by clicking the CAS Login invitation button, I receive a warning in firefox "Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party." I click OK, the page attempts to reach the CAS Server and reloads with no change and no log in.

I have attached the CAS log. Thanks again.

bkosborne’s picture

Issue summary: View changes
Status: Active » Closed (outdated)

Please re-open this issue if you still are having issues. This issue is quite old and I'm trying to clean up the issue queue, but I imagine you've moved on from these problems.