JBoss Portal: enabling SSO with CAS – Central Authentication Service (taken from this guide)

This Single Sign On plugin enables seamless integration between JBoss Portal and the CAS Single Sign On Framework.

Details about CAS can be found here

1. Install CAS server (v 3.2.1). This should be as simple as deploying single cas-server-webapp-3.2.1.war file.

2. Copy portal-identity-lib.jar and portal-identity-sso-lib.jar files from
   $JBOSS_HOME/server/default/deploy/jboss-portal.sar/lib to
   $JBOSS_HOME/server/default/deploy/cas-server-webapp-3.2.1.war/
   WEB-INF/lib.

3. Edit $JBOSS_HOME/server/default/deploy/jboss-portal.sar/portal-server.war/
   WEB-INF/context.xml file and enable proper tomcat valve
   by uncommenting following lines:

   <Valve className=”org.jboss.portal.identity.sso.cas.CASAuthenticationValve”
   casLogin=”https://localhost:port/cas-server-webapp-3.2.1/login”
   casLogout=”https://localhost:port/cas-server-webapp-3.2.1/logout”
   casValidate=”https://localhost:port/cas-server-webapp-3.2.1/serviceValidate”
   casServerName=”localhost:port”
   authType=”FORM”
   />

4. Update valve options as follow:

   • casLogin: URL of your CAS Authentication Server

   • casLogout: URL of your CAS Authentication Server

   • casValidate: URL of your CAS Authentication Server validation service

   • casServerName: the hostname:port combination of your CAS Authentication Server

5. Copy casclient.jar into $JBOSS_HOME/server/default/deploy/jboss-portal.sar/lib.
   You can download this file from CAS homepage or from JBoss repository under http://repository.jboss.com/cas/3.0.7/lib/

6. Edit $JBOSS_HOME/server/default/deploy/jboss-portal.sar/META-INF/jboss-service.xml file and uncomment following lines:

   <mbean
   code=”org.jboss.portal.identity.sso.cas.CASAuthenticationService”
   name=”portal:service=Module,type=CASAuthenticationService”
   xmbean-dd=”"
   xmbean-code=”org.jboss.portal.jems.as.system.JBossServiceModelMBean”>
   <xmbean/>
   <depends>portal:service=Module,type=IdentityServiceController</depends>
   <attribute name=”HavingRole”></attribute>
   </mbean>

   This will expose special service in JBoss Portal that can be leveraged by CAS AuthenticationHandler if the server is deployed on the same
   application server instance. This AuthenticationHandler will be enabled in next 2 steps.

7. Edit $JBOSS_HOME/server/default/deploy/cas-server-webapp-3.2.1.war/
   WEB-INF/deployerConfigContext.xml and add following line in the
   authenticationManagers’s authenticationHandler property’s section:

   <bean class=”org.jboss.portal.identity.sso.cas.CASAuthenticationHandler”/>

   This can replace default SimpleTestUsernamePasswordAuthenticationHandler so whole part of this config file can look as follows:

   <property name=”authenticationHandlers”>

   <list>

   <bean
   class=”org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler”>
   <property
   name=”httpClient”
   ref=”httpClient” />
   </bean>

   <bean class=”org.jboss.portal.identity.sso.cas.CASAuthenticationHandler”/>

   </list>

   </property>

To test the integration:

• Go to your portal. Typically, https://localhost:8443(or 443)/portal

• Click on the “Login” link on the main portal page

• This should bring up the CAS Authentication Server’s login screen instead of the default JBoss Portal login screen

• Input your portal username and password. For built-in portal login try user:user or admin:admin

• If login is successful, you should be redirected back to the portal with the appropriate user logged in.

• MOST IMPORTANT: if you want to make working logout action from portal, and portals inside it, you have to change the href link in header.jsp located in $JBOSS_HOME/server/default/deploy/jboss-portal.sar/portal-core.war/WEB-INF/jsp/header/ like here: <a href=”https://your-server-name:8443/cas-server-webapp-3.2.1/logout?service= https://your-server-name:8443/signout?location=portal“>Logout</a>

Last step is available here